[H-GEN] re: OpenSolaris

[Benjamin Carlyle]

On Sun, 2005-02-13 at 14:51 +1100, James C. McPherson wrote:
> Hi Ben,
> comments/responses inline below
> 
> Benjamin Carlyle wrote:
> ...
> > My main concerns about having multiple non-GPL licenses are weakened by
> > this sledgehammer of illumination, but they still exist. I still see the
> > introduction of each new open source license as a vile sin. 
> Ah, now you see that's where you move from advocacy into religion.
> I do not accept that the choice of an appropriate license for a
> product should be religious.

I suppose the strength of feeling the religious connotations of the word
"sin" evoke were a bit inappropriate for this line of thought. I had
hoped the discussion further down in my email would clarify why I felt
it was such a bad thing to add a new license to open source.

> I used to be a linux-bigot and recommended it and purely GPLd
> software at every turn. At some point I realised that this was
> an inappropriate attitude to have and espouse, because it does
> not meet everybody's needs -- it's an all black and white way
> of looking at a world which most definitely includes shades of
> grey.

Yes, I'm still (to continue the religious vocabulary) agnostic about the
GPL specifically and did not seek to advocate it in my previous email.
The GPL has aspects to its terms that irk or instill wonder in many
people from many walks of life. I think GPL advocacy is an interesting
component to criticism of the CDDL, but I would like to separate my
issues from that advocacy. My issue might be best elucadated by a
sketch:

Johnny: Hello, I'm Johnny. I want to write a piece of software and I
wonder if you could answer a question about open source.
Me: Well, hello Johnny. Welcome to the open source world. What can I do
for you?
Johnny: Well, I'd like to use some other open source software in my
project. I'd like to use some public domain software. I'd like to take
some software out of the solaris and linux kernels. I'd like to take a
few pieces from Eclipse, ooh and some code from the apache web server.
Can I really just do that?
Me: Well... no.
Johnny: No? But isn't this open source?
Me: Well, the linux kernel is under the GPL. GPL code can't be combined
with anything that's not GPL compatible, and some of those licenses
aren't GPL compatible.
Johnny: Oh. Well, I guess I'll have to take the GPL bits out. What next?
What license does my software come under after combining these pieces?
Me: It comes under the combination of all of those licenses you've
mentioned. That probably adds up to at least ten or twenty pages of
legalise that your users must wade through and accept before using your
software, and I can't tell you how you would write it.
Johnny: So what will my users be able to do with my software at the end
with a combination license of this sort?
Me: I don't know. You'll have to talk to a lawyer. In fact, I don't even
know if the concept of a combination of this type has ever really been
tested or understood. I don't know if the combination would even still
fit the open source definition. It's possible that clauses in one
document now conflict with clauses in another document in ways never
anticipated.
Johnny: So if I want my users to understand what I'm shipping, all I can
really draw on is one or two licenses... preferrably licenses that have
explicit clauses to allow cooperation, just like the GPL and LGPL have
with each other?
Me: I'm afraid so, but like I said the GPL licenses only really play
nice with each other. All of the other licenses are really based around
protecting your right to fork their code, not your right to combine them
with other software. None of them go to any great lengths to help you
combine them with other open source licenses or to understand the
implications of having done so.
Johnny: Really? And how many of theses mismatched licenses exist?
Me: As I mentioned breifly in my last email, OSI has 58 approved
licenses. OSI doesn't give you an executive breif as to what the
licenses imply morally or legally, nor does it give any guidance on what
sets each license apart from other licenses. It doesn't have any
recommendations as to what you might use if you were to come along with
your own project requirements. All the effort is really left up to the
individual.
Johnny: So what license would you recommend when writing new software?
Me: Make sure that you use a license that is reasonably mature and
well-understood by the community. Don't come along with something new.
Older licenses are more likely to have had the leg-work done in
describing their relationships to some of the other licenses and in
exploring exactly how you would describe your combined work. Pick a
license that fits with your personal moral and legal framework, and good
luck.
Johnny: I guess open source has become a lot more complicated since the
establishment of OSI. I thought they were there to make this stuff
easier.
Me: It seems like the real reason they exist is to create more
incompatible licenses :)

> > What Sun
> > should have been doing instead is attempting to use or create a new
> > version of an existing license. 
> Didn't you read the part which said that the CDDL is a derivative of
> the MPL?

The CDDL isn't simply a derivation. It's a fork. Unless it is widely
seen as a successor of the original license it becomes just another
license (number 58) for everyone to wrap their brains around. Unless Sun
and Mozilla.org are going to get together and agree to both use the CDDL
for future work (and to also give it the name "Mozilla Public License
v2") there is little to be gained by its relationship to the MPL. It's
just number 58 in the list of OSI-approved licenses. What's worse, it
has inherited the MPL's length and complexity, meaning we probably won't
understand its full ramifications for years.

> > The most important thing as far as I am
> > concerned is that Sun gets more than just Sun on board with this new
> > license. I have no objections to the CDDL if it is one of three or four
> > common open source license. 
> This comes back to my point above -- there are a lot more shades
> of grey in this world, and trying to cram everything into 1, 2,
> 3 or 4 licenses just isn't going to work because everybody who
> writes software, assembles solutions and has any need to do anything
> with computers will find that there is nothing that fits best.

I don't think there are as many shades of grey in open source as there
are OSI-approved licenses (fifty-eight!). I don't believe every one is
unique in its purpose and function. I do not advocate a single open
source license (unless it is a "checkbox" licenses that actually
represents a family of licenses based on and understood foundation, such
as creative commons). I believe we should have exactly as many licenses
are there are genuinely unique requirements for distributors. I support
the rights of developers to release their software under any license
they see fit. I also support the rights of users to say "no" to licenses
they don't agree with. I only wish that the non-GPL license brigades
were as consistent and organised as the pro-GPL license brigade. I want
the conversation above to run like this:

Johnny: Hello, I'm Johnny. I want to write a piece of software and I
wonder if you could answer a question about open source.
Me: Well, hello Johnny. Welcome to the open source world. What can I do
for you?
Johnny: Well, I'd like to use some other open source software in my
project. I'd like to use some public domain software. I'd like to take
some software out of the solaris and linux kernels. I'd like to take a
few pieces from Eclipse, ooh and some code from the apache web server.
I'd like to release it all under a closed-source license with the
addition of my closed source software. Can I really just do that?
Me: Well... no.
Johnny: No? But isn't this open source?
Me: Well, the open source world is a diverse set of people and ideas.
They all respect the user, but there are three basic camps. The first
camp says that their software should only be used with other open source
software. The second camp says you can combine their software with your
closed-source software, so long as you keep the two separate forever and
respect the "open-source"ness of their part. Finally, there are a few
really laid-back types who'll let you basically rip off their code
without any further considerations.
Johnny: Oh. Well, I guess I'll have to take the GPL bits out, or make my
closed source part open source. What next? What license does my software
come under after combining these pieces?
Me: Now that we can readily classify the use of these licenses we have
been able to engineer them to work together. You must release your
software under the most restrictive license of any software you use. To
reduce the restrictions on your software, just stop using the encumbered
parts of your program. Replace them with something less restrictive.
Johnny: So all those lingering questions about patent peace, what
happened to them?
Me: Oh, they were solved years ago. We all got around the table and
worked out a set of clauses that would work consistently across the
board and basically everyone could agree on. We used the same clauses in
all of our open source licenses and it blew over after that.
Johnny: Whoopee! Open source is easy! OSI, I love you!

Well, maybe the situation does end up with a few more categories that
just my three... but that would be my personal target. I think three, or
at most six open source licenses covering 90% of open source would be a
huge improvement in actual practical freedom. Knowing you don't have to
consult a lawyer if you want to combine works would be wonderful.

I'll end this email with a quote from a debian-legal poster, quoted
earlier in my blog:

"The CDDL is almost certainly better from pretty much every point of
view (including that of the DFSG) than the current licences for Solaris.
If you had ethical no problems with the old licences for Solaris, you're
unlikely to have ethical problems with the CDDL."

I will also summarise my position one last time:
I bear no ill-will against Sun. I think that what Sun have done is
wonderful and will definitely benefit their customers. The structure of
licenses that OSI is creating with its approval process I find much more
disturbing. OSI has a model of just laying down a set of open source
guidelines that does not include compatibility requirements and gives
all licenses equal preference. I believe that more work has to be done
to investigate and explain open source licenses. I believe that more
work has to be done to ensure and understand compatibility between open
source licenses. I believe that we should be able to work towards the
creation of an expert system that can identify the perfect open source
license for you without requiring you create a new one for your
non-unique situation. I believe that OSI needs to consider compatibility
as part of its basic open source definition. Yes, I understand that
would mean GPLv2 would not be open source, and that a GPLv3 would have
to be drafted with an "I work with everything OSI-approved" clause to be
accepted. I'm concerned that we'll see open source fail as a legal
framework in the longer term if compatibility is not addressed. Whether
it would fall to a closed-source or a different open-source alternative
(even back to the GPL-only world) isn't clear.

-- 
Benjamin Carlyle <benjamincarlyle at optusnet.com.au>