"Replace React with Mithril for licensing reasons" https://github.com/Automattic/wp-calypso/issues/650
Personally, I increasingly doubt that BSD+PATENTS is even GPL-compatible -- and so potentially Automattic may be violating the GPL by using React integrated with WordPress.
What's especially sad about this is that React isn't even that good compared to other vdoms like Mithril and Inferno and others. React just has a lot of name recognition and mindshare from the Facebook association (which then translates into a rich-get-richer effect with more tutorials and components).
Here is a list of more than twenty alternative vdoms I put together in January 2016 (although Mithril remains my favorite): https://github.com/dojo/meta/issues/11#issuecomment-17679024...
If Facebook has a patent on the vdom, then all the projects in your list violate the patent, and none of them come with even a conditional patent grant from Facebook.
If Facebook does not have a patent on the vdom or other React technology, then those other projects are safe, but so is React, since termination of the patent grant has zero cost to you.
My personal belief is that Facebook has no patents on React, so I feel safe to use React, Mithril, or any other vdom based library. But I can certainly understand people who feel like they need to play it safe, assume Facebook does have a vdom patent, and avoid all such libraries.
But I'm not really following your logic at all. It's like you think Facebook has a patent, but then you only want to use the libraries that maximise your ability to get sued over it? What am I missing?
Also, Facebook has no vdom patent. It's not like you can be granted a secret, hidden patent (even the word "patent" itself means "open").
Incorrect. (This has been clarified many times, including in Facebook's official FAQ about React licensing.)
> Also, Facebook has no vdom patent. It's not like you can be granted a secret, hidden patent (even the word "patent" itself means "open").
I agree. Many people have looked; no one has found one. Hence why I believe there's no risk to using React.
It doesn't address the scenario of Facebook's violating your patents first.
Facebook cannot revoke your React license in any circumstances, as that link makes clear.
In my mind that situation is effectively identical to losing "the right to use" license on grounds of patent suit (like Apache). Interestingly, in Apache you'd still be sued for patent infringement (not copyright infringement) because "right to use" is provided as a patent license.
Yes, but for what patent? People have looked; none have been found. :)
The PATENTS file affects more than just React. It's found in their other projects too.
you mean their patent grant? How can an open source license like apache, MIT or bsd be "revoked"? Do facebook have a public blacklist of people who aren't allowed to use react?
> If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
Note that the "Grant of Copyright License" of Apache doesn't grant you the right to use the work, so revoking the patent license is effectively revoking the whole license (though you can still redistribute the work).
MIT and BSD licenses merely provide short-cuts to understanding a project's licensing
Using React just opens you up to liability, with no real benefit (other than using React). Why would you use it?
How?
Again, if they have a patent, they can sue you if you use one of the alternatives mentioned. If they don't have a patent, they can't sue you if you use React.
What's your thinking behind saying using React adds liability? Because to me, it looks like either it does nothing or it reduces liability.
That seems extremely weird. Normal startups do nothing of the kind; do you have extremely weird investors?
> My investors were very specific about software licenses - we aren't allowed to use GPLv4 or AGPL at all.
Ah, there we go. First off, there's no such thing as GPLv4. Second of all, you do realise that avoiding even the AGPL puts you in a vanishingly rare crowd in these parts, right? Eg, MongoDB is AGPL; of all the reasons I've seen given for avoiding Mongo, the license is a new one on me.
If you've decided to only use GPLv2 or vanilla MIT licenses software that's totally fine, but it is unusual.
If you have a patent, and use React, you can't sue Facebook if they use your patent.
Citation needed. Let's say I have an awesome VR patent, and a React based website. I find out the Oculus violated my patent, what happens next?
Answer: I sue them. :) Nothing about the React license stops this; I will even still have a right to use React. What I won't have is a right to use any patents that Facebook might have on React. But Facebook, as far as is known, has no such patents.
> The license granted hereunder will terminate, automatically and without notice, if you [...] initiate [...] any Patent Assertion
The key part is that if you don't have a license to use the patented technology (or more pertinently - that license is explicitly revoked), you can't legally use that technology, no matter what the BSD license might say: the patent grants supersedes the BSD license.
So, to respond directly to your answer - you lose the right to use React; Facebook can sue you for your use of React, since they own the patents to that technology.
So if you want to operate under the belief that Facebook has no patents to assert, then yes, you will consider yourself to be safe. The fact is that many lawyers, including the Apache Foundations lawyers, disagree with this assertion.
Incorrect. The ASF's objections had nothing to do with believing Facebook had any patents, and many ASF projects are looking to move to Preact, which is presumtively covered by the same patents React would be (if any).
I.e. the exact situation you would be in if you sued Facebook and there was no PATENTS file.
The "implied" license doesn't have a strong legal finding backing it up yet. Even so, most lawyers are comfortable with the idea that if a company tells other people to freely use their software, they can't then come back around and sue those same people.
To me, the most important part of a vdom library like Mithril is using the HyperScript API with it, a library which predates React: Aug 20, 2012: https://github.com/hyperhype/hyperscript/tree/9237f590f3bc82... May 2013: https://github.com/facebook/react/blob/75897c2dcd1dd3a6ca462...
Personally, I feel templating approaches to making JavaScript-powered UIs like React's JSX or Angular's own templating approach or the templating systems in many other UI systems are obsolete. Modern webapps can use Mithril+Tachyons+JavaScript/TypeScript to write components in single files where all the code is just JavaScript/TypeScript. Such apps don't need to be partially written in either CSS and some non-standard variant of HTML that reimplements part of a programming language (badly). (Well, there may be a tiny bit of custom CSS needed on top of Tachyons, but very little.)
Here is an example of a coding playground I wrote that way with several examples in it which use that approach: http://rawgit.com/pdfernhout/Twirlip7/master/src/ui/twirlip7...
So, by writing UIs using HyperScript (plus a vdom library), you can potentially (with some work) replace a backend like Mithril with almost any other vdom or even a non-vdom solution. So, that is another way I mitigate this risk when I have a choice.
Granted, I know many web developers grew up on tweaking HTML and love HTML-looking templates and so they love JSX or whatever and are happy to ignore how hard it is to refactor such non-code stuff in the middle of their applikcations or validate it (granted, some IDEs are getting better at that). But I came to web development from desktop and embedded development working with systems where you (usually) generated UIs directly from code (e.g. using Swing, Tk, wxWidgets, and so on). I like the idea that standard tools can help me refactor all the code I work on and detect many inconsistencies.
Maybe a deeper issue for me is that with BSD+PATENTS Facebook is redefining what "open source" means in a way that is harmful to the open source community -- and also free software community as well like with Automattic using React on top of a GPLd WordPress. Which is why the Apache Foundation rejected the React license.
That said, I would expect that vdom libraries like Mithril that work in a very different way than React would be less likely to be claimed by Facebook to infringe a React-related patent than, say, Preact which tries to duplicate the React API.
Of course, this is all speculation with a lot of unknowns. It all is another example of why software patents are very problematical ways to "promote the Progress of Science and useful Arts".
That, to me, is also a significant warning sign.
Of course, you are right that legal and corporate should review such a license. And for any company that deals in patents (or has customers who deal in patents), the likely answer is "no way".
That's the conundrum for any open source project and the exposed danger of the BSD license.
I doubt some statement of opinion in some out-of-the-way place that did not accompany the software directly would hold up in court.
That said, your point on uncertainty is why many people prefer the Apache2 License or the GPL3 which have an explicit patent grant (but not a one-sided grant like in Facebook's PATENTS file).
From there:
In 2005, Dan Ravicher explained[2] that, in the USA, recipients of software under the GNU GPL version 2 receive an implicied patent grant, based on the following US case law.
* De Forest Radio, 273 U.S. 236 (1927) "No formal granting of a license is necessary in order to give it effect. Any language used by the owner of the patent, or any conduct on his part exhibited to another from which that other may properly infer that the owner consents to his use of the patent in making or using it, or selling it, upon which the other acts, constitutes a license."
* Hewlett - Packard Co. v . Repeat - O-Type Stencil Mfg. Corp. , Inc., 123 F. 3d 1445 (Fed. Cir. 1997). "Generally, when a seller sells a product without restriction, it in effect promises the purchaser that in exchange for the price paid, it will not interfere wit h the purchaser's full enjoyment of the product purchased. The buyer has an implied license under any patents of the seller that dominate the product or any uses of the product to which the parties might reasonably contemplate the product will be put."
* Bottom Line Mgmt., Inc. v. Pan Man, Inc., 228 F. 3d 1352 (Fed. Cir. 2000) "Unless the parties provide otherwise, the purchaser of a patented article has an implied license not only to use and sell it, but also to repair it to enable it to function properly. This implied license covers both the original purchaser of the article and all subsequent purchasers"
Legal scholars are mixed on that, and it hasn't been tested in court.
But that implicit license is certainly better than the explicit license in FB's code.
To sum up: you may be worse off with BSD+Patents.
The only clarity they offer is that they have their license in place for litigation purposes.
For a personal project, everybody can make their own decisions. For a project involving a corporate entity or an institution, it is irresponsible to leverage any facebook licensed software without a legal review of the license. I'm not saying that it's bad. I'm not saying that it's good. I'm saying that however a laymen may interpret the license, there is a high chance of being wrong. Better to have the professionals review it and make a judgement call. I have seen many people state that their legal departments reviewed the license and have come back in some cases supporting the use of facebook software, in other cases denying the ability to use it. Even among professionals there seems to be disagreement.
There is a common understanding of many open source licenses. There is none surrounding facebook's.
I have asked ASF to have their lawyers make a public interpretation of the facebook BSD+Patents license for the betterment of the community, but the response was along the lines of "no lawyer would do that." Someone else might have better luck with the FSF. The FSF does support the idea of patent clauses, or at least at one point they did. I have seen nothing from them regarding the facebook license specifically though.
And this is a problem, because we all know how much of a huge pain in the ass it is to get any new license or legal issue relating to open source cleared with a big corporation's legal dept.
I think this is a pretty clear signal from Facebook that at least part of the company really doesn't care if people use Facebook open source or not. After all the work some in the company have done to promote Facebook open source, to great benefit to the company for recruiting and for synergy with other large company open source, that is a big surprise to me.
This kind of tone-deaf response from part of the company with the other half frustrated that it's causing so many problems reminds me more of how large old, moribund companies like IBM operate. It's a surprise that Facebook's already there, or at least starting to be.
This, to me, is a significant warning sign.
I was leery of the React license to begin with. But the community at large had _almost_ convinced me that it was nothing to worry about.
Unfortunately, Facebook's position as stated here is clearly that the license is weaponized for a reason. I think it's irresponsible to leverage software with this license without clear guidance from legal and corporate overlords stating that it's OK.