8 ms·

The problem is that no one really knows what constitutes "safe" use of GPL code. Even in a highly-technical OSS-friendly community like HN, there are many diffe

The problem is that no one really knows what constitutes "safe" use of GPL code. Even in a highly-technical OSS-friendly community like HN, there are many different interpretations of what the GPL's restrictions actually mean. You can see this in action in these VMware threads, where there are strong arguments on both sides about whether VMware is violating the GPL. That uncertainty plus the viral nature of the GPL means that there's no way to know for sure that you won't be forced to open your whole codebase at some point in the future. That's more risk than a proprietary software company is willing to take. The only way to resolve this problem is to get legal decisions like this one. One way or the other, this decision will clarify the picture slightly. If we add enough other decisions, maybe someday we'll have clarity. Until then, my company is solidly in the "Absolutely no GPL" camp.

kuschku 12y ago
LGPL might be the best solution then (I personally would say LGPL should be used for everything, but that’s a personal opionion), because LGPL only goes viral through actual forking, but does not consider linking.
- vezzy-fnord 12y ago
  I'd actually recommend MPL instead, because it enforces copyleft on the source file level rather than the library level. This makes it unambiguously applicable to just about anything other than Smalltalk, whereas the LGPL's terminology is slanted towards C/++ semantics.
- halostatue 12y ago
  This is not quite correct. The “link wall” matters mostly in compiled languages, but consider a proprietary program Quux that links to the GNU LGPLed libhoge. When the owner of Quux distributes it, they must also (on request) provide recipients the source to libhoge and the ability for Quux to be relinked against a modified version of libhoge. They either have to be using libhoge.so or provide the object files and tools to link against a modified libhoge.a. Simply providing the source of libhoge is not sufficient, and most people do not understand that about the GNU LGPL.
  - jallmann 12y ago
    Linking is really not big a deal with LGPL, provided you're comfortable with the GPL. You might have to think a little harder if you're distributing statically, but given the goals of the LGPL and the technicalities of linking, its provisions are reasonable. Yes, you have to provide the source and a build process for the (L)GPL'd software in question. That's standard for both the GPL and LGPL; no difference. From there, linking is just another step in the build with ld, or at runtime with LD_PRELOAD. The LGPL is incredibly under-appreciated. Developers love to complain about GPL'd software, but who actually takes raw chunks of code, or entire applications, and re-packages it as their own? Most developers don't have a reason to do this -- the majority of our work with third-party code consists of interfacing with libraries and that is where the LGPL comes in handy. If you're uncomfortable committing completely to the GPL but still want to support its basic tenets, try the LGPL.
    - halostatue 12y ago
      This doesn’t really change the fundamental problem—most people think that all they have to do in order to be compliant with the GNU LGPL is release the (modified) source of the library under the GNU LGPL. The licence is (reasonably) clear that this is not the case, but this confusion is one of the reasons why it was renamed from the GNU Library GPL to the GNU Lesser GPL. I personally recommend against using the GNU LGPL because of this confusion. If you want something that does what most people think the GNU LGPL does, use the MPL with a GNU GPL exception. (IMO, the MPL is a superior licence to anything in the GNU GPL family, but it is also not my licence of choice—that is the MIT-style licence.)
      - jallmann 12y ago
        That's a problem with people, not with the LGPL. Would you sign a contract without reading it through? The same goes for software licenses. Suggesting an alternative license doesn't absolve people of the responsibility of reading the suggested text in the first place. The language of most of common software licenses is straightforward; blindly using any license without being aware with their implications, especially in a commercial capacity, is... stupid. Beyond that, we'll have to agree to disagree. If you're familiar with the four freedoms of the GNU free software definition [1], then licenses that are nonfree and non-copyleft do not ensure the four freedoms for users of the software. The (L)GPL has been carefully crafted to ensure those those freedoms. Although that might not matter to you personally, preserving those freedoms is important for many people. [1] https://www.gnu.org/philosophy/free-sw.html https://www.gnu.org/philosophy/free-sw.html
- deleted 12y ago
  [deleted]
27182818284 12y ago
>The problem is that no one really knows what constitutes "safe" use of GPL Outside of a business that can hire lawyers, it would be helpful for the FSF and sites like http://opensource.org/licenses/BSD-3-Clause http://opensource.org/licenses/BSD-3-Clause to have examples right beneath the licenses. Something like: "Here is a JS plugin with BSD-3 here is another plugin based on it. Note how the license did/didn't change." "Here is an MIT license and an example of a company adding that code to their app with license intact on the app's about screen". Stuff like that. http://choosealicense.com/ http://choosealicense.com/ is helpful, and part of the way there.
- jordigh 12y ago
  > Outside of a business that can hire lawyers, it would be helpful for the FSF and sites like http://opensource.org/licenses/BSD-3-Clause http://opensource.org/licenses/BSD-3-Clause to have examples right beneath the licenses They can't do that. The law doesn't work like that. The GPL FAQ[1] has to be deliberately vague about some things, because judges and juries themselves are vague, as are the laws they work to interpret. You can't have cut-and-dry examples of what can be done and what can't, because there can be many other externalities that could make a different case work in a different way, despite similarities to your proposed list of examples. There are can be broad strokes, but the law is not a programming language. Recent xkcd comes to mind.[2] [1] https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html [2] http://xkcd.com/1494/ http://xkcd.com/1494/
- nymisunderrated 12y ago
  The organizations with lawyers behind them won't, and quite can't, do it. They're not supposed to give legal advice in general terms, no one is. Now, if individuals would be willing to work together to put up such a site, as a collection of information and opinions, with necessary disclaimers so that its limits are well-understood, and add examples, thoughts about them, critique and disagreements about them too, that would be different.
jordigh 12y ago
It's risky, but it's not that risky. I'm sure freedom-hating, source-code-hoarding Apple has made the analysis that making Xcode work with copylefted git isn't going to make them reveal their source code. Back when Jobs got pwned by the GPL during his NeXT days, he probably vowed "never again", but that doesn't mean Apple has stopped shipping GPL'ed code. If Apple can afford to use the GPL, i.e. they think the GPL risk is low enough for them and won't make them free their entire codebase, then anyone can also make this assessment.
- angersock 12y ago
  Jobs got pwned by the GPL during his NeXT day That sounds like a fun story. What happened?
  - jordigh 12y ago
    Consider GNU Objective C. NeXT initially wanted to make this front end proprietary; they proposed to release it as .o files, and let users link them with the rest of GCC, thinking this might be a way around the GPL's requirements. But our lawyer said that this would not evade the requirements, that it was not allowed. And so they made the Objective C front end free software. https://www.gnu.org/philosophy/pragmatic.html https://www.gnu.org/philosophy/pragmatic.html Specifically, as I've spoken about in my many talks on GPL compliance, the earliest publicly discussed major GPL violation was by NeXT computing when Steve Jobs attempted and failed (thanks to RMS' GPL enforcement work) to make the Objective C front-end to GCC proprietary. Everything for everyone involved would have gone quite differently if that enforcement effort had failed. http://ebb.org/bkuhn/blog/2014/01/26/llvm.html http://ebb.org/bkuhn/blog/2014/01/26/llvm.html
    - legulere 12y ago
      And yet apple is basically responsible for creating the non-copyleft free objective c fronted for llvm. They could have just kept it closed source.
      - 12y ago
foobarqux 12y ago
> That uncertainty plus the viral nature of the GPL means that there's no way to know for sure that you won't be forced to open your whole codebase at some point in the future. That doesn't happen. A violator would be ordered to pay compensation and remove the offending code, though they could reach a settlement to do something else.
- venomsnake 12y ago
  Is the GPL that toothless?
  - foobarqux 12y ago
    That's the law, not GPL.
  - kazinator 12y ago
    What would constitute having "teeth" for you? Mandatory jail terms even when parties are willing to settle? Execution by firing squad?
    - venomsnake 12y ago
      Well C levels executives are the only persons I support unconditional death penalty for. But mandatory opening of all source code will be more valuable than money.
- joshyeager 12y ago
  Ok, good point. But for a small- to mid-sized software company, a big fine or a big reengineering effort is pretty dangerous too.
  - foobarqux 12y ago
    Sure, but the vast majority of GPL violations are no more surprising than "shared source" proprietary code: Using each imposes certain obligations and no one is confused about the latter, I don't know why so many people think GPL is some kind of trick designed to trap you, it's not.
derf_ 12y ago
I don't think that's true at all. Anyone who's spent any time at all in open source has a pretty good idea what their obligations under the GPL are. There may be corner cases debated on the internet by geeks who ANAL, but if those actually matter to your business, simply asking someone at the SFC or SFLC will quickly clear them up [0]. I'll quote LWN's summary [1] from the talk Bob Young of Red Hat gave at LCA this January: He has long been a staunch advocate of the GPL, he said, but not because he has detailed opinions of the differences between it and other, similar licenses. Rather, he said, he learned early on that customers do not care about the details of free-software licenses, and that diving into an explanation of them was the fastest way to send a potential customer running toward the competition. ... With the GPL, everyone knows what the rules are, more or less, so the debate is over quickly. They might not actually know the rules, he added, but they think they do, which amounts to the same thing. As a "business guy," he said, he is always trying to simplify the "pitch" - the GPL tells everyone "what we're about," so it has the greatest impact. [0] We did this when we wanted to publish a royalty-free patent license tied to certain code, and wanted to be sure it would not keep people from using that code in GPLv3 projects. We were reasonably sure of our interpretation of the terms, but it's always nice to double-check. [1] https://lwn.net/Articles/629413/ https://lwn.net/Articles/629413/
lambda 12y ago
There is a pretty clearly defined set of safe behaviors under the GPL. If you do not link to a program, run it in the same address space as your proprietary code, or use any internal data structures of that program, that is safe. No one can force you to open your whole code base. They can only make you choose between opening the parts that do the unsafe things listed above (linking, running in the same address space, utilizing private data structures via some kind of shim that is supposed to work around the GPL), or they can force you to stop distributing the GPLed software. Until then, my company is solidly in the "Absolutely no GPL" camp. It's so stunningly easy to use GPLed software properly, and there are thousands of companies doing it. Just don't link it to your code, or try to do some kind of hack that avoids linking it while giving you all of the same benefits of doing so. The problem with VMware is that they have been pushing all of the boundaries; rather than just taking the easy road and doing known safe things like ensuring that there's a clear separation between GPLed code and their code, or just releasing their code that is linking to the GPLed code.
- joshyeager 12y ago
  How does that help if the code we want to use is a library? A recent example was an image manipulation need. We found a great library that met all our requirements, but was GPL. Our other options were an inferior MIT-licensed library, an inferior commercial library, or spending the time to write our own. If the thing you want to use is a DLL, how do you use it without linking to it? Writing some sort of external process and using IPC to talk to it might fulfill the letter of the license, but it's more work and less robust, and still violates the spirit of the GPL. In the end, we picked the MIT licensed component and worked around the issues.
  - foobarqux 12y ago
    Your real complaint is that you can't use the GPL without the conditions imposed by it, not that those conditions are confusing or surprising.
  - johnny22 12y ago
    that was the right thing to do in that case.
deleted 12y ago
[deleted]

kuschku 12y ago

LGPL might be the best solution then (I personally would say LGPL should be used for everything, but that’s a personal opionion), because LGPL only goes viral through actual forking, but does not consider linking.

vezzy-fnord 12y ago
I'd actually recommend MPL instead, because it enforces copyleft on the source file level rather than the library level. This makes it unambiguously applicable to just about anything other than Smalltalk, whereas the LGPL's terminology is slanted towards C/++ semantics.
halostatue 12y ago
This is not quite correct. The “link wall” matters mostly in compiled languages, but consider a proprietary program Quux that links to the GNU LGPLed libhoge. When the owner of Quux distributes it, they must also (on request) provide recipients the source to libhoge and the ability for Quux to be relinked against a modified version of libhoge. They either have to be using libhoge.so or provide the object files and tools to link against a modified libhoge.a. Simply providing the source of libhoge is not sufficient, and most people do not understand that about the GNU LGPL.
- jallmann 12y ago
  Linking is really not big a deal with LGPL, provided you're comfortable with the GPL. You might have to think a little harder if you're distributing statically, but given the goals of the LGPL and the technicalities of linking, its provisions are reasonable. Yes, you have to provide the source and a build process for the (L)GPL'd software in question. That's standard for both the GPL and LGPL; no difference. From there, linking is just another step in the build with ld, or at runtime with LD_PRELOAD. The LGPL is incredibly under-appreciated. Developers love to complain about GPL'd software, but who actually takes raw chunks of code, or entire applications, and re-packages it as their own? Most developers don't have a reason to do this -- the majority of our work with third-party code consists of interfacing with libraries and that is where the LGPL comes in handy. If you're uncomfortable committing completely to the GPL but still want to support its basic tenets, try the LGPL.
  - halostatue 12y ago
    This doesn’t really change the fundamental problem—most people think that all they have to do in order to be compliant with the GNU LGPL is release the (modified) source of the library under the GNU LGPL. The licence is (reasonably) clear that this is not the case, but this confusion is one of the reasons why it was renamed from the GNU Library GPL to the GNU Lesser GPL. I personally recommend against using the GNU LGPL because of this confusion. If you want something that does what most people think the GNU LGPL does, use the MPL with a GNU GPL exception. (IMO, the MPL is a superior licence to anything in the GNU GPL family, but it is also not my licence of choice—that is the MIT-style licence.)
    - jallmann 12y ago
      That's a problem with people, not with the LGPL. Would you sign a contract without reading it through? The same goes for software licenses. Suggesting an alternative license doesn't absolve people of the responsibility of reading the suggested text in the first place. The language of most of common software licenses is straightforward; blindly using any license without being aware with their implications, especially in a commercial capacity, is... stupid. Beyond that, we'll have to agree to disagree. If you're familiar with the four freedoms of the GNU free software definition [1], then licenses that are nonfree and non-copyleft do not ensure the four freedoms for users of the software. The (L)GPL has been carefully crafted to ensure those those freedoms. Although that might not matter to you personally, preserving those freedoms is important for many people. [1] https://www.gnu.org/philosophy/free-sw.html https://www.gnu.org/philosophy/free-sw.html
deleted 12y ago
[deleted]

27182818284 12y ago

>The problem is that no one really knows what constitutes "safe" use of GPL Outside of a business that can hire lawyers, it would be helpful for the FSF and sites like http://opensource.org/licenses/BSD-3-Clause http://opensource.org/licenses/BSD-3-Clause to have examples right beneath the licenses. Something like: "Here is a JS plugin with BSD-3 here is another plugin based on it. Note how the license did/didn't change." "Here is an MIT license and an example of a company adding that code to their app with license intact on the app's about screen". Stuff like that. http://choosealicense.com/ http://choosealicense.com/ is helpful, and part of the way there.

jordigh 12y ago
> Outside of a business that can hire lawyers, it would be helpful for the FSF and sites like http://opensource.org/licenses/BSD-3-Clause http://opensource.org/licenses/BSD-3-Clause to have examples right beneath the licenses They can't do that. The law doesn't work like that. The GPL FAQ[1] has to be deliberately vague about some things, because judges and juries themselves are vague, as are the laws they work to interpret. You can't have cut-and-dry examples of what can be done and what can't, because there can be many other externalities that could make a different case work in a different way, despite similarities to your proposed list of examples. There are can be broad strokes, but the law is not a programming language. Recent xkcd comes to mind.[2] [1] https://www.gnu.org/licenses/gpl-faq.html https://www.gnu.org/licenses/gpl-faq.html [2] http://xkcd.com/1494/ http://xkcd.com/1494/
nymisunderrated 12y ago
The organizations with lawyers behind them won't, and quite can't, do it. They're not supposed to give legal advice in general terms, no one is. Now, if individuals would be willing to work together to put up such a site, as a collection of information and opinions, with necessary disclaimers so that its limits are well-understood, and add examples, thoughts about them, critique and disagreements about them too, that would be different.

jordigh 12y ago

It's risky, but it's not that risky. I'm sure freedom-hating, source-code-hoarding Apple has made the analysis that making Xcode work with copylefted git isn't going to make them reveal their source code. Back when Jobs got pwned by the GPL during his NeXT days, he probably vowed "never again", but that doesn't mean Apple has stopped shipping GPL'ed code. If Apple can afford to use the GPL, i.e. they think the GPL risk is low enough for them and won't make them free their entire codebase, then anyone can also make this assessment.

angersock 12y ago
Jobs got pwned by the GPL during his NeXT day That sounds like a fun story. What happened?
- jordigh 12y ago
  Consider GNU Objective C. NeXT initially wanted to make this front end proprietary; they proposed to release it as .o files, and let users link them with the rest of GCC, thinking this might be a way around the GPL's requirements. But our lawyer said that this would not evade the requirements, that it was not allowed. And so they made the Objective C front end free software. https://www.gnu.org/philosophy/pragmatic.html https://www.gnu.org/philosophy/pragmatic.html Specifically, as I've spoken about in my many talks on GPL compliance, the earliest publicly discussed major GPL violation was by NeXT computing when Steve Jobs attempted and failed (thanks to RMS' GPL enforcement work) to make the Objective C front-end to GCC proprietary. Everything for everyone involved would have gone quite differently if that enforcement effort had failed. http://ebb.org/bkuhn/blog/2014/01/26/llvm.html http://ebb.org/bkuhn/blog/2014/01/26/llvm.html
  - legulere 12y ago
    And yet apple is basically responsible for creating the non-copyleft free objective c fronted for llvm. They could have just kept it closed source.
    - 12y ago

foobarqux 12y ago

> That uncertainty plus the viral nature of the GPL means that there's no way to know for sure that you won't be forced to open your whole codebase at some point in the future. That doesn't happen. A violator would be ordered to pay compensation and remove the offending code, though they could reach a settlement to do something else.

venomsnake 12y ago
Is the GPL that toothless?
- foobarqux 12y ago
  That's the law, not GPL.
- kazinator 12y ago
  What would constitute having "teeth" for you? Mandatory jail terms even when parties are willing to settle? Execution by firing squad?
  - venomsnake 12y ago
    Well C levels executives are the only persons I support unconditional death penalty for. But mandatory opening of all source code will be more valuable than money.
joshyeager 12y ago
Ok, good point. But for a small- to mid-sized software company, a big fine or a big reengineering effort is pretty dangerous too.
- foobarqux 12y ago
  Sure, but the vast majority of GPL violations are no more surprising than "shared source" proprietary code: Using each imposes certain obligations and no one is confused about the latter, I don't know why so many people think GPL is some kind of trick designed to trap you, it's not.

derf_ 12y ago

I don't think that's true at all. Anyone who's spent any time at all in open source has a pretty good idea what their obligations under the GPL are. There may be corner cases debated on the internet by geeks who ANAL, but if those actually matter to your business, simply asking someone at the SFC or SFLC will quickly clear them up [0]. I'll quote LWN's summary [1] from the talk Bob Young of Red Hat gave at LCA this January: He has long been a staunch advocate of the GPL, he said, but not because he has detailed opinions of the differences between it and other, similar licenses. Rather, he said, he learned early on that customers do not care about the details of free-software licenses, and that diving into an explanation of them was the fastest way to send a potential customer running toward the competition. ... With the GPL, everyone knows what the rules are, more or less, so the debate is over quickly. They might not actually know the rules, he added, but they think they do, which amounts to the same thing. As a "business guy," he said, he is always trying to simplify the "pitch" - the GPL tells everyone "what we're about," so it has the greatest impact. [0] We did this when we wanted to publish a royalty-free patent license tied to certain code, and wanted to be sure it would not keep people from using that code in GPLv3 projects. We were reasonably sure of our interpretation of the terms, but it's always nice to double-check. [1] https://lwn.net/Articles/629413/ https://lwn.net/Articles/629413/

lambda 12y ago

There is a pretty clearly defined set of safe behaviors under the GPL. If you do not link to a program, run it in the same address space as your proprietary code, or use any internal data structures of that program, that is safe. No one can force you to open your whole code base. They can only make you choose between opening the parts that do the unsafe things listed above (linking, running in the same address space, utilizing private data structures via some kind of shim that is supposed to work around the GPL), or they can force you to stop distributing the GPLed software. Until then, my company is solidly in the "Absolutely no GPL" camp. It's so stunningly easy to use GPLed software properly, and there are thousands of companies doing it. Just don't link it to your code, or try to do some kind of hack that avoids linking it while giving you all of the same benefits of doing so. The problem with VMware is that they have been pushing all of the boundaries; rather than just taking the easy road and doing known safe things like ensuring that there's a clear separation between GPLed code and their code, or just releasing their code that is linking to the GPLed code.

joshyeager 12y ago
How does that help if the code we want to use is a library? A recent example was an image manipulation need. We found a great library that met all our requirements, but was GPL. Our other options were an inferior MIT-licensed library, an inferior commercial library, or spending the time to write our own. If the thing you want to use is a DLL, how do you use it without linking to it? Writing some sort of external process and using IPC to talk to it might fulfill the letter of the license, but it's more work and less robust, and still violates the spirit of the GPL. In the end, we picked the MIT licensed component and worked around the issues.
- foobarqux 12y ago
  Your real complaint is that you can't use the GPL without the conditions imposed by it, not that those conditions are confusing or surprising.
- johnny22 12y ago
  that was the right thing to do in that case.

deleted 12y ago

[deleted]