Page 1 of 2

Licensing

Posted: Thu Jan 19, 2006 8:08 am
by Moocat
I'm wondering if someone could bring the terminology and licensing stuff about the new GPL draft and CCL down to a more newbie level. A few of this forum's members blogs I follow mentioned something about the GPL draft not being secure for web based projects (specifically games). Something about how a loophole allows people to make modifications to software under that license and then sell/use it without having to release the source code (something I thought was totally against the whole point of open-source projects). They've also been saying that the CCL covers this, but it's somehow not meant for web based projects.

One of them used to work on LOTGD (Legend of the Green Dragon) but says he can no longer work on it due to some type of licensing switching he's going to do (GPL to Creative Commons License (Attribution-ShareAlike) ). Also, the current project he's working on is open-source under the GPL, but he wants to switch to the CCL and he said this will cause him to have to restart the whole project. Doesn't open source allow for modifications to licensing agreements with changes to the codebase without having to rewrite from scratch?

Whew, if any of you get what I was trying to get across perhaps you can answer one (or some) of my many confusing questions. I'm just trying to get a feel for how open source works before I delve into such a thing :)

Posted: Thu Jan 19, 2006 11:30 am
by Maugrim_The_Reaper
Its because the GPL was never designed to deal with a situation where the code would be remotely hosted on a network, and not directly distributed to a user. As a result the GPL cannot be used to guarantee that modified source code will be made available to users - because users are not "receiving" the program but are "using it across a network". i.e. if someone modified the GIMP, and you downloaded a modified version under the GPL license, you would also be entitled to the source code - that is the modifier is distributing the program to you.

But with PHP, its all used across a network - there no user distribution (as defined in the GPL).

The net result is that if you license a PHP application under the GPL, there is no legal means by which you can force modifications to be shared, or made publicly available. This essentially allows any user to modify the application, and utilise it in much the same way as a proprietary application - so long as they host it, and not distribute it (which is impossible in any case since PHP is never compiled to binary executables like other languages, e.g. C). They can just sit there and use your hard work, and never share a single modification.

Its basically a breach in the spirit of the GPL, but legally they can do it. As such its a loophole that should be closed in the GPL v3. The ruckus is because the recent GPL v3 draft does nothing to close that loophole besides a lot of publicity of that move beforehand...

Of course, this was only a draft - a lot could change between now and the final useable license text...;)

On the topic of the CCL - Creative Commons Licenses were not originally intended to cover source code. However most copyright laws treat source code as written text, and as a written text work code can indeed be licensed under one of the CC licenses. Its difficult to call such open source, since the license was never intended for that purpose - but if the shoe fits...

At least one CCL does impose a share-alike clause for public performance of an original work - i.e. this can be interpreted that if you distribute or utilise a CCL licensed application written in PHP, then you are legally required to publicly release any modifications to the original work.

See, the shoe does fit...mostly.

Personally I've been using the Affero GPL ( a modification of the GPL ) where I feel like outwitting the GPL loophole. I'd much prefer to move to a fixed GPL however...

Posted: Thu Jan 19, 2006 11:54 am
by jwalsh
Can't put it better than that. Thanks Maugrim.

Posted: Thu Jan 19, 2006 12:03 pm
by Moocat
I believe this is the area in the GPL which you are refering to?:
2. Basic Permissions.

All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the Program. The output from running it is covered by
this License only if the output, given its content, constitutes a work
based on the Program. This License acknowledges your rights of "fair use"
or other equivalent, as provided by copyright law.

This License gives unlimited permission to privately modify and run the
Program, provided you do not bring suit for patent infringement against
anyone for making, using or distributing their own works based on the
Program.

Propagation of covered works is permitted without limitation provided it
does not enable parties other than you to make or receive copies.
Propagation which does enable them to do so is permitted, as
"distribution", under the conditions of sections 4-6 below.
This would mean users can create works which are not subject to basically the entire license as long as they don't give them away and they're web based. Other than that, there really doesn't seem to be a whole lot in the license that says you have to share anything as long as you don't distribute the program. But isn't distributing the program via it's output the same thing? The user interface is accessible only through a web browser therby making the web browser a distribution of content provider.

Am I wrong or missing something here?

Posted: Thu Jan 19, 2006 12:05 pm
by Moocat
Oh, I gotcha, I went through and read the FAQ and such, that plus your comments above clears things up.

Edit: I'll have to take that back (again) I read over the clause added in affero and it stated basically if someone had a method for distribution, you must be able to gain access to distribution. However, would this really close another loophole such as hiding the link? You could keep the page up, but hide the page amoungst a mess of other links, or in an area not normally visible to the user, or perhaps not in the same area (most likely the front page, but they would move the link to a page that the user can "access" yet not know where it is). Here is an example:

User A puts a link for download on their frontpage of the program.

User B moves the link to hidethedownload.html which, while techinically being part of the program and has no restrictions on a user accessing the page, he does not link to at all within his modifications of said program.

...once again circumventing the process.

Posted: Thu Jan 19, 2006 1:14 pm
by Roja
Moocat wrote:This would mean users can create works which are not subject to basically the entire license as long as they don't give them away and they're web based.
That is the exact definition of the web services loophole. You nailed it exactly.
Moocat wrote:But isn't distributing the program via it's output the same thing?
No. Case law (and now, the public comments by the FSF) maintain that executing a program is not distribution. Neither is "distributing" that output. If true, that would mean that a GPL wordprocessor would only produce documents under the GPL. It would mean that a GPL'd compiler would only produce GPL'd code. It just doesn't hold up.

In languages like C, it makes perfect sense. In PHP, not as much. Thats why the GPL is non-ideal for PHP, generally.
Moocat wrote:User B moves the link to hidethedownload.html which, while techinically being part of the program and has no restrictions on a user accessing the page, he does not link to at all within his modifications of said program.
Under the GPLv2, thats entirely okay, as long as the page wasn't linked from the copyright notice - a trick a few programs used. Since the copyright notice must be as prominant as it was, it makes it legally challenging for derivitive works to change the copyright notice. If that notice is linked to the download source page, it makes it tough to change.

Thats not to say they can't. There is no reason why a copyright notice needs to link to a "download source" button. Nothing is stopping the modifier from doing so, as you say.

The GPLv3 *does* try to fix THAT issue. They add a provision saying that you can add one of four additional terms - one of which can be that the modifier must not remove the link allowing download of the code.

However, those provisions - those requirements - are *still* only triggered upon distribution, NOT execution. So again, for a web-based game, I can take your GPL code, modify it to my hearts content, put it online, and never share the changes.

The Affero does essentially the same as the GPLv3 - if the programmer thinks ahead, and includes a "view source" link, the downstream can't remove it. But that requirement still is only triggered by distribution. ie, it doesn't prevent the webservices loophole from being abused.

It all comes down to a boogeyman question - Do you feel there is a boogeyman that will run your game, with more mods and more improvements than you, and not share the code?

If the answer is yes, you want the CCL. If the answer is no, the Affero GPL or the GPLv3 is probably secure enough for most issues, if you include a view source link.

Unfortunately, we ran into not one, not two, but three different boogeymen that wanted to do that *exact* thing, and would have crippled the userbase we had. I won't help them strangle the project they are building from.

So I'm switching. :)

On a side note, it is a certified opensource license. The tricky question is whether it is considered "Freedom" software under the terms of the FSF, or Debian, for example. Personally, it protects my interests, and ensures that people will share and share alike. Whether it is legally compatible with their definition of "Freedom" I cannot answer. It is definitely in the same spirit as the freedom software movement.

Posted: Thu Jan 19, 2006 3:51 pm
by AKA Panama Jack
Maugrim_The_Reaper wrote:The net result is that if you license a PHP application under the GPL, there is no legal means by which you can force modifications to be shared, or made publicly available. This essentially allows any user to modify the application, and utilise it in much the same way as a proprietary application - so long as they host it, and not distribute it (which is impossible in any case since PHP is never compiled to binary executables like other languages, e.g. C). They can just sit there and use your hard work, and never share a single modification.
Actually it is not a breach of anything. Even with a program that was written in C++ and available under GPL that when compiled, created a helper program that is used on a web site to help create certain output. Anyone can download the source code and modify it for their specific needs to create output tailored to their site. There is nothing in the GPL that requires them to release their modifications to the code.

You are not distributing the compiled program so you are not required to release your modifications. When a person modifies any PHP program the resulting output sent to a browser is not distribution of the program just like the output of a modified source for a compiled C executable is not distributing the actual program.

Modifications of ANY GPL program source code no matter the medium are NOT forced to be shared. The only time it would be forced to be shared is if you are distributing a COMPILED version then you are forced to distribute the source code.

In otherwords if you compiled a GPL C++ program and distributed the compiled executable you are required to distribute the modified source code as well. It can be a seperate download. If the modified binary is only used on your sites or computers and not downloadable then the source C++ source code is not required to be distributable.

This is the same for PHP programs. If someone was releasing modifying PHP code under GPL in a compiled form using something like RoadSend then they are required to also make the modified PHP source available for downloading. But if they are only using that Compiled/Uncompiled, Modified PHP code on their own web sites then they are not required to distribute it.
Maugrim_The_Reaper wrote:They can just sit there and use your hard work, and never share a single modification.
Anyone can modify GPL released code for their own use and not be required to distribute it. This is absolutely no different from any compiled language where the compiled code is used by someone in their business or on their website for their own purposes. Nothing requires them to release the modified source code under GPL. They are not distributing the compiled code even tough they are using it, so they are not required to distribute the modified uncompiled source.

To require what you are asking would make a complete mess out of things. It would require every little change someone made to any GPL released program (PHP, C++, Perl, whatever) to be released for download even if it was site/person specific. This would create a freaking nightmare of versions that most people would never need or want because in most cases the modifications are specific to that persons/sites needs.

Quite frankly I would rather anything I wrote and distributed under GPL/LPGL and modified by someone for their own use NEVER be released. Forcing the release of modifications others made to something you created only delutes and possibly corrupts what you have worked upon. I wouldn't want something I released that was modified in a BAD way by some idiot for their site to be fored to be released. It could impact unfavorably on my initial work. I would rather they kept it to themselves. There is nothing I would hate more than having to field querstions about problems created by someone else who was forced to release their modified version of my code. I have had to reply with "Sorry I didn't write that modification contact the person who did." many times on open source projects before and it is annoying as hell. I would rather they kept their changes to themself instead of inflicting them upon me and everyone else.

So forcing changes to be released when they are site/user specific would be a very bad thing overall.

Posted: Thu Jan 19, 2006 3:54 pm
by AKA Panama Jack
Moocat wrote:But isn't distributing the program via it's output the same thing? The user interface is accessible only through a web browser therby making the web browser a distribution of content provider.

Am I wrong or missing something here?
Nope not even close. Because alot of PHP code can be in the background and not distribute ANY ourput to a browser. Take for example my ADOdb Lite package written with PHP. There isn't any output being sent to any browser when used unless you enable debugging. Output does not fall under the GPL as distribution of anything.

Posted: Thu Jan 19, 2006 4:55 pm
by Maugrim_The_Reaper
And hence we hit the mysterious brick wall of why the majority of PHP projects are licensed under the GPL at all...;) Since simply outputing HTML does not trigger distribution, you can't enforce a shared source environment. Without that people will simply have far less incentive to see bugs reported, and the overall application improved unless out of the goodness of their own hearts - now not to be sarcastic a *lot* of people will make that effort - but there's a class of individuals out there who'll do anything but...

Worst case scenario it will cause an eruption of what you could honestly call forks - and we know what too many forks do to any project...

The more I think about this, the less attractive a view-source link becomes. It might work, but I think maybe Roja is hitting a nail with the right sort of hammer...and maybe those of us looking to the GPL/AGPL are not.

Since in essence we're attempting to protect the source code, regardless of the network distribution of output loophole, maybe a CCL is far more appropriate and powerful in that respect.

Posted: Thu Jan 19, 2006 5:10 pm
by Moocat
AKA Panama Jack wrote:To require what you are asking would make a complete mess out of things. It would require every little change someone made to any GPL released program (PHP, C++, Perl, whatever) to be released for download even if it was site/person specific. This would create a freaking nightmare of versions that most people would never need or want because in most cases the modifications are specific to that persons/sites needs.

Quite frankly I would rather anything I wrote and distributed under GPL/LPGL and modified by someone for their own use NEVER be released. Forcing the release of modifications others made to something you created only delutes and possibly corrupts what you have worked upon. I wouldn't want something I released that was modified in a BAD way by some idiot for their site to be fored to be released. It could impact unfavorably on my initial work. I would rather they kept it to themselves. There is nothing I would hate more than having to field querstions about problems created by someone else who was forced to release their modified version of my code. I have had to reply with "Sorry I didn't write that modification contact the person who did." many times on open source projects before and it is annoying as hell. I would rather they kept their changes to themself instead of inflicting them upon me and everyone else.

So forcing changes to be released when they are site/user specific would be a very bad thing overall.
First off, thanks for explaining things again :)

While agreeing with many of your points, I disagree with not being able to download the source code from "mods". Yes, it's true, many mods of projects don't go anywhere at all, but you must admit many base projects also do just that as well, cluttering up quite a bit of Sourceforge.net. In fact, I would dare to say a good 95+% never get past the "alpha" stage (even though many claim to be in beta). I see more success in the number of projects that are mods of successful projects.

With just your release I imagine you have many users clamoring for attention about your project, and even more that want to build off it. Having people come to you about mods they've made may be just as frustrating when they get angry that you won't help them, but could also alert you to projects and mods that you hadn't thought of yet and hadn't found on the every increasing net. Even if they do clutter up areas of the net with their half-finished code, I'd rather have the choice of downloading that hodge-podge code, than no choice at all.

Posted: Thu Jan 19, 2006 8:00 pm
by Roja
AKA Panama Jack wrote:You are not distributing the compiled program so you are not required to release your modifications.
The compiling/not-compiling isn't directly related to the need to release the modifications. Its the distribution. The rest of your post is dead on, so I think this was just a minor mistype.. just making sure.
AKA Panama Jack wrote:Quite frankly I would rather anything I wrote and distributed under GPL/LPGL and modified by someone for their own use NEVER be released.
To be clear, I do respect that position. Personally, I prefer them sharing it. Worst case scenario, I can at least get an understanding of how something was done, and I can do it as well, in a different way. Best case, I can drop it in.

Until the GPLv3, I assumed that the GPLv3 would solve the webservices loophole. With the stance they've taken, its clear that they value the freedom of users executing the software over the need to grow the community of software. My values are different. I won't help someone that is going to not only disrespect the work I've done, but also not share back to the community that helped them in the first place.

On the bright side, after over 4 years of legacy code, starting with a blank slate is incredibly freeing. Its a very refreshing change.

And frightening. :)

Posted: Thu Jan 19, 2006 8:59 pm
by Roja
It appears in a previous post I was dead wrong.

The CCL is considered by the OSI to NOT be Opensource software. Debian considers it not free software. The Creative Commons suggests not using the license for software.

Sounds like I have more research to do. Sigh.

Posted: Fri Jan 20, 2006 9:29 am
by Maugrim_The_Reaper
As the rumbling of distant thunder continues towards Draft 2...

Re-reading the GPL draft with more attention - I'm not entirely certain that the additional license conditions that can validaly be added are restricted by whether the program is executable/or just remotely hosted.

The text of the section (7) simply states
When you release a work based on the Program, you may include your own terms covering added parts for which you have, or can give, appropriate copyright permission, as long as those terms clearly permit all the activities that this License permits, or permit usage or relicensing under this License.
They don't seem to place a limit on when those terms come into effect - unless I'm missing something obvious (we're reading a complex license!) the terms are literally YOU'RE personal terms, in your wording, with your conditions - to the extent the meet the allowed purposes, i.e. for a web application the more useful would be:
d) They may require that the work contain functioning facilities that allow users to immediately obtain copies of its Complete Corresponding Source Code.
In this case one could easily add an own term matching the example of the Affero GPL - a reference to a facility (a simple link to an archive of the source seems reasonable) which must be preserved in all modifications of or programs derived from the original licensed application.

Assuming this is the case, you could simply extend the license with an own term based liberally on the AGPL (can't be the same for copyright safety).
If the Program as you received it is intended to interact with users through a computer network and if, in the version you received, any user interacting with the Program was given the opportunity to request transmission to that user of the Program's complete source code, you must not remove that facility from your modified version of the Program or work based on the Program, and must offer an equivalent opportunity for all users interacting with your Program through a computer network to request immediate transmission of the complete source code of your modified version or other derivative work.
Now if you assume a link to an archive is such a facility (can't think of many other reasonable facilities - even a view source link has limited usefulness) then with the additional term, meeting the requirements of the GPL v3 section 7d, you would have a program licensed under GPL v3 without the loophole.

Presumably....;)

Personally I don't see how any other License terminology can interfere with this - its not stating any dependency on a trigger event (distribution or otherwise). Its simply stating that if the facility exists, it must be preserved with any changes necessary to apply to the modified source.

Am I missing something?

Posted: Fri Jan 20, 2006 10:11 am
by Maugrim_The_Reaper
Reading through the GPL v3 rationale document
To illustrate what this principle implies, consider the treatment of software
designed for public use on network servers. Given the variety of
needs and concerns in this area, in which different parties have disparate
and strongly-held positions, we have chosen not to add requirements about
public use of modified versions in the GPL itself. Instead we have made a
variety of possible license requirements compatible with the GPL, through
an enhanced compatibility provision; thus we leave individual developers
scope for choosing among requirements to apply for public use of their
code. We have intentionally done nothing that might threaten to divide free
software developers from free software users.
Further down the text, the rationale for section 4 (verbatim copying):
Section 4 has been revised from its corresponding section in GPLv2 in
light of the new section 7 on license compatibility. A distributor of verbatim
copies of the program’s source code must obey any existing additional
terms that apply to parts of the program. In addition, the distributor is required
to keep intact all license notices, including notices of such additional
terms.
To further the move against the web application loophole, section 7 makes it pretty clear that (mentioning no names) certain additional license terms are compatible with the GPL v3. One of these of course covers the current Affero GPL - i.e. the requirement to maintain a facility within an application for downloading the then current source code (modified or not).
Under subsection 7d, the added part may require the program to contain
functioning facilities that allow users to obtain copies of the program’s
Complete Corresponding Source Code. This is intended to enable compatibility
with licensing terms that, for example, require modified versions
of a program that interacts with users through a network to preserve an
opportunity for users to request network transmission of the source code.

Posted: Sun Jan 22, 2006 8:37 am
by Roja
Maugrim_The_Reaper wrote:They don't seem to place a limit on when those terms come into effect - unless I'm missing something obvious (we're reading a complex license!)
Quote: "To 'propagate' a work means doing anything with it that requires permission under applicable copyright law, other than executing it on a computer or making private modifications."

Copyright law doesn't restrict end-user use, generally, except in very specific, limited scenarios that would reduce the value to the copyright holder. As a result, it can't effectively plug the webservices loophole.
Maugrim_The_Reaper wrote:the terms are literally YOU'RE personal terms, in your wording, with your conditions
Not really. They spell out the only four categories you can restrict, and in very limited terms. Then they specifically disallow any other restrictions beyond those four.
Maugrim_The_Reaper wrote:Assuming this is the case, you could simply extend the license with an own term based liberally on the AGPL (can't be the same for copyright safety).
That is exactly right. One of the four is meant to duplicate the same process the AGPL uses. Notably, that doesn't solve the webservices loophole. It does, thankfully, limit that loophole in a very big way.
Maugrim_The_Reaper wrote:Now if you assume a link to an archive is such a facility (can't think of many other reasonable facilities - even a view source link has limited usefulness) then with the additional term, meeting the requirements of the GPL v3 section 7d, you would have a program licensed under GPL v3 without the loophole.
Nope. The terms cannot limit private use, and the FSF specifically states that execution is not limited.
Maugrim_The_Reaper wrote:Personally I don't see how any other License terminology can interfere with this - its not stating any dependency on a trigger event (distribution or otherwise). Its simply stating that if the facility exists, it must be preserved with any changes necessary to apply to the modified source.
In US copyright law, the presumption is that once you have possession of the good, you can use it as you like - "Fair use". Fair use does not include the right to make copies, the right to make a modification and pass it off as your own, and so on.

To gain those rights, you have to exchange some rights. Thats generally done in a license. The license specifies what rights the original copyright holder grants to you, and what you have to accept in exchange.

The net result of GPLv3 (especially section 7) is to, like the Affero, put the best possible solution in place to require a view-source link. Unfortunately, due to Copyright Law, that can't include Public Performance.

I did quite a bit of research this weekend, including chatting with some law students. This is obviously not binding legal advice, so don't take it as such. However, here's the summary version.

You can't restrict execution in copyright law. The closest you can come is the concept of "Public Performance". The only problem is that there have only been a handfull of cases testing Public Performance in software. All of them have been in favor of executing the software being Fair Use.

Thats part of why Creative Commons specifically suggests against using the CCL for Software. It has little case law (for software - its just the opposite for multimedia), and what case law it does have, its against the use of the CCL to restrict execution.

Here's the net effect for me:

We're trying to prevent a bad guy from being a jerk. We're trying to legally enforce fairplay. We can put restrictions on when people distribute code. We can restrict what they modify, to ensure that a view-source link remains (if they distribute it). We can even require that their code is licensed like ours.

The only thing we cannot do is prevent someone from taking the code, modifying it, and NOT distributing it. The webservices loophole.

Its unfortunate that Copyright law doesn't have the ability to prevent that issue. However, to get it to do so, you have to stretch several other legal issues to fit it. You can extend public performance, but then Tivo's would be at risk. You can extend EULA's, but then they have more power too. The list goes on.

In the end, we have to accept that the legal system doesnt offer perfect protection. If someone goes to the lengths to avoid ALL those issues, just to abuse the community, its clear that they have no goodwill. From there, we have a number of options, ranging from public shaming, mass competition, and so on.

It stinks, and I don't like that my code CAN be used against me that way, but if thats the closest we can get (and I think it is), and still be opensource/freedom software, I'll take it.

I'm sticking with the GPL.