You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@harmony.apache.org by Geir Magnusson Jr <ge...@pobox.com> on 2006/08/21 16:12:30 UTC

[legal] Re: Bringing License arguments to Sun

Stefano Mazzocchi wrote:
> Geir Magnusson Jr wrote:
> 
>>> CDDL is an example of clever lawyer work to modernize best licensing
>>> practices, but those are best practices in protection not in social
>>> empowerment!
>> I don't understand that.  Do you see the CDDL as somehow restricting
>> communities? 
> 
> No, I see CDDL something that will significantly slow or hinter the
> licensing compatibility assessment from both the ASF and the FSF.
> 
> I fully recognize the lack of IP protection in older licenses (which
> might look like a naive "if we ignore it maybe it will go away" policy )
> but I think that licensing the code, the trademarks and the IP
> separately is another fully viable strategy.

I'm going to assume that from here forward, when you say "IP" you mean
'patent'?

> 
> I would use an MIT license for the code and a different license for the
> IP. The "injected IP" problem can be dealt with a contribution agreement
> which does *not* need to be part of the license (like apache did, for
> example).

But our license is very explicit about patents as well.

> 
> As far as IP protection is concerned, Sun owns (or has acquired the
> rights to relicense) the existing IP, they will only need to be
> concerned about new ones coming in from contributions and for that they
> can have contributors sign IP agreements (like we do for Harmony, for
> example, even if the license, in theory, already covers that).

Yes....

> 
> So, in theory, one could take an MIT-licensed RI, add some code with
> special IP (say a new garbage collector), pass the tests and then decide
> to charge people for the license of that IP.

Yes - I'm all for that.  And you can achieve that w/ CDDL also.  (I'm
not pushing CDDL here - my choice would be Apache License knowing that
all will be well w/ GPLv3, which I thought was scheduled to arrive at
about the same time as the code from Sun anyway...

> 
> Sun could decide that they consider this "free riding" and that they
> want everybody to have a piece of that cake, so they can use a license
> that is not violently reciprocal on code donations but it is on IP (and
>  CDDL falls under this category).
> 
> The problem with this, it's that it makes it incompatible with the GPL,
> ending up alienating some of the very people they are counting on
> pleasing (and you can expect all sort of internal and external
> frustration would that happen).

But GPLv3 is coming.

> 
> So, the choice is, in my eyes, whether to 'enforce' the reciprocity of
> IP licensing of not.
> 
> Here, there is a lesson to be learned from the reciprocity on code: the
> BSD license does *not* force you to contribute back but many do anyway,
> and the freedom of being allowed *not to* is what makes the BSD license
> more palatable than, say, the GPL to many (unless you use a mysql-like
> unlock-the-gpl business model, which is another [legal]story).

Few things in this paragraph :

1) I prefer to think of BSD as not restricting your freedom, rather than
 allowing you to something, but as it is a license, it is in a sense
allowing the freedom.

2) MySQL - No comment, other than I'd not be too keen in participating
in a MySQL-like ecosystem around a Java implementation.

> 
> People contribute back even if they are not forced to because it's
> convenient for them to do so, or they are left with the burden of
> maintaining a branch. The same exact argument applies to IP.

I don't see that.  There's no burden to not contributing patent licenses
to a codebase, compared to maintaining an "internal fork" if you choose
not to give modifications back to the community.

> 
> So, if the RI license does *not* force people to donate the IP to the
> modifications that are made and redistributed (after passing the tests
> and obtaining certification), they are actually forking, just like OSI
> licenses are designed to allow. But they are now on their own, against
> the rest of the world. The FOSS ecology has shown that branches are very
> hard to maintain anyway, especially against very active and healthy
> communities (which has become the ASF motto, community is more important
> than code, and, I would add, a license has to protect the community more
> than the code).

I'm still not seeing it if my assumption about you meaning "patent" when
you say "IP" is valid - what it could do is create a situation where no
one would want to do anything out of fear of patent action.  Modern OSS
licenses solve this partway by having contributors explicitly license
patents they own that are covered by their contributions.

> 
> And if the fork is killed or goes unfeasible and people try to inject
> known or submerged IP with contributions to the RI, the community
> watching and a solid contribution agreement will prevent that.
> 
> In case of contributions that are covered by unknown IP, there is very
> little one can do to prevent in the license that covers the "usage" of
> the code.

I don't understand that sentence.

> 
> My reasoning for going simple and non-reciprocal for both code and IP is
> *not* that I'm ignoring the issue, it's that there is no need for a
> reciprocal licensing of the IP, as I claim that it will be
> socio-economically inconvenient for anybody to do so. They will try,
> they will fail, as much as there is no apache# or tomcat++.
> 
> Just like the BSD, giving people the "freedom of choice" on whether to
> donate code back or keep it for themselves, has been proved to be
> *extremely* effective in creating healthy, innovative and open
> contribution ecosystems. I believe the same freedom on IP contribution
> is a valid and not more risky strategy that will make the java RI code
> maximally used and, just like other examples, foster compatibility by
> becoming, de-facto, the only socio-economically maintainable/feasible
> implementation over time.

I think that there actually is a problem because of the asymmetry in the
ecosystem.

Big Co and Bigger Co  have loads of patents on this technology, I
assume.  Stefano Co. has zero.  Big Co and Bigger Co can cross license
to keep the peace between them.  Stefano Co can't.  Stefano Co is
subject to whatever whims Big Co and Bigger Co have unless mechanisms
like the patent languages in modern licenses are in force.  True, by not
contributing, they stay clear of the patent license obligation, but a
counterstrategy to that is to try and form as big a 'commons' as
possible, leaving non-participants as outliers.  IOW, create a community
of "patent peace", be it via a common codebase that all have contributed
to, or something more explicit - a patent pool or such.

> 
> And the choice of maximum freedom (given OSI/free-software parameters)
> and maximum compatibility is, IMHO, a necessary condition for a social
> ecosystem and dynamics that will guard the RI way more effectively (and
> at lower costs!) than any license or army of lawyers can do.
> 
>> I think that CDDL is a reasonable license, and if I wasn't
>> allowed to use a BSD-style license for whatever reason, I'd go that way...
> 
> I never said it's a bad license. I'm saying it's not the one I would
> choose and I gave a socio-economical analysis on why I think this is so.

I guess I didn't understand the analysis, as I see that significant
threats remain within the resulting ecosystem, threats that if we don't
already know how to deal with, we're working hard on finding solutions.

> 
> CDDL will lower the perceived fear of "free riding" using IP protection
> strategies in Sun executives, but at the price of alienating a huge part
> of the java FOSS ecosystem.

I dunno.  Assume you have the GPLv3 now.  Isn't that statement
non-operational?

And since that's just a matter of months, isn't this really about having
a "brand approved" license that successfully interoperates, rather than
any real philosophical incompatibility?

> 
> Just like I'm sure Sun is willing to think about lack of reciprocity for
> code donations, I'm suggesting that they evaluate the same exact
> strategy for IP, trusting that the socio-economical dynamics that this
> will create will be a much more effective as a protection mechanism
> *and* will provide them with a solution that will win for them and will
> win for all the FOSS communities involved, no matter what current or
> past licensing beliefs.

I think you have to be really careful about how you think about that
"lack of reciprocity", because comparing it to how patents are treated
is very different.   The "lack of reciprocity" in Sun's projects to date
is a copyright grant of joint ownership, not a license to use under terms.

By asking for joint copyright, Sun is getting free and unfettered
licensing rights to do whatever they want with the code.  A CDDL-style
or Apache License-style patent structure isn't the same thing.

Very simply speaking, the Apache patent license boils down to this :

"Each Contributor hereby grants to You a patent license to use (et al)
the Work"

That doesn't mean "You" can do anything you want with that patent
license, which is what Sun is able to do with the joint copyright
assignment.

Of course, Sun is free to continue with that if they choose.  I just
hope that what they create is a level playing field, so there are no
needless barriers to participation.

> 
> I perfectly realize that I'm suggesting a bold move that might feel too
> risky, especially for somebody that has not experienced as much as we
> did in the ASF the power of social dynamics in respect to protection and
> stability.
> 
> That said, it's hard to deny that the ASF has never experienced, in 10
> years of operation, a single fork, despite the complete lack of
> reciprocity provisions in its licensing strategy, showing that, although
> counterintuitive, healthy communities are even more effective than
> licensing restrictions in protecting the evolution of a codebase.

I agree with you, but there have been several forks over the years.  IBM
forked httpd, IBM, JBoss, ObjectWeb others forked WS...  I'd even argue
that Sun is technically forking Derby in their "JavaDB" product, and IBM
"pre-forked" Derby with the Cloudscape product that was the source of
Derby ... :)

There's nothing wrong with that, and it really never hurt our
communities (as evidenced by the strength of httpd and WS as
examples...), and in some cases, they came back or gave back.  We have
no problems with people forking if they choose, as they tend to come
back anyway.

And I'm expecting that people will fork Harmony code, and I don't think
that's bad.

But that's orthogonal to the notion of patent freedom - I want to make
sure we don't wind up in a situation where no one wants to do anything
because of patent fears.

Maybe the thing to do of patent-silent license is necessary is for Sun
to work with the rest of the industry (IBM, BEA, Apple, MSFT, Intel etc)
and create a "patent commons" of all patents each company owns related
to Java, managed runtimes, etc, with a clear covenant not to sue...

geir

(Given that I mentioned my employer, Intel,  I want to make it clear
that this is my personal opinion and should not be taken to represent
the position of Intel Corporation....)

---------------------------------------------------------------------
Terms of use : http://incubator.apache.org/harmony/mailing.html
To unsubscribe, e-mail: harmony-dev-unsubscribe@incubator.apache.org
For additional commands, e-mail: harmony-dev-help@incubator.apache.org