News for hackers. Stuff that matters.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by dragonwriter on Saturday October 31, 2020 @04:38PM (#24955014)
> Nit: Licenses are not by definition revocable. They can be revocable or irrevocable.

Not: Gratuitous (not contract) licenses are, by strong legal precedent, revocable by notice at will by the licensor. The content and context of the license (including the statement that it is irrevocable) may impact the effect given to revocation due to other legal principles, particularly promissory estoppel, but those are separate from revocability.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Saturday October 31, 2020 @05:06PM (#24955200)
It's perfectly possible to take in software project contributions under license, rather than assignment, without fear of losing rights at the drop of a hat. Apache does it. Eclipse does it. Nearly all the major companies stewarding open projects do it.

I'm not aware of any substantive distinction in the words "revocation", "termination", or the like, except with specific reference to 203. The question is whether you can show license if they plead infringement. In practice, they'll often plead breach, too.

Bare copyright licenses are largely theoretical here. If the terms of a unilateral grant include assurance of irrevocability, thats a strong fact for reliance and estoppel. If there's any question what the terms meant, it will be resolved by rules of contract construction, because it's not a public statute, and contract rules are the rules we have. There is a default rule, when the terms are silent, but it's just a default.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Saturday October 31, 2020 @04:48PM (#24955081)
I don't have a horse in this race, but I've become curious. Can you identify the cases and jurisdictions that provide this strong precedent? I.e. who has successfully cancelled a permanent irrevocable license, even having provided it gratuitously? If true, your claim would seem to make some of the principles open source licenses are based on untenable. I would think I would already be aware of that.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Saturday October 31, 2020 @05:29PM (#24955342)
Replying to myself after a very brief search (IANAL, so responsible readers should be skeptical). This seems to have been a common concern around the turn of the century (sufficient to prompt 'abundance of caution' warnings to require copyright assignment in GPL'd projects from none less than Eben Moglen), it seems to no longer to be thought likely to succeed in litigation. Bruce Perens seems to feel that Jacobsen v, Katzer is the dispositive precedent in US. Useful layperson's summary at https://www.zdnet.com/article/what-happens-if-you-try-to-tak...
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by tzs on Saturday October 31, 2020 @07:56PM (#24956253)
The question of whether or not you can revoke an open source license would go away if the people writing the licenses would say in their licenses that they are irrevocable or perpetual or in perpetuity.

I have not been able to figure out why so few major ones do. Of the OSI approved licenses, I think the only ones that say so are AFL-3.0, AGPL-3.0, APL-1.0, APSL-2.0, Apache-2.0, CATOSL-1.1, ECL-2.0, EUDatagrid, EUPL-1.1, GPL-3.0, LiLiQ-P-1.1, LiLiQ-R-1.1, LiLiQ-Rplus-1.1, MulanPSL-2.0, NPOSL-3.0, OCLC-2.0, OSL-1.0, OSL-2.1, OSL-3.0, RPSL-1.0, SimPL-2.0, Simple-2.0, UCL-1.0, osl-1.0, osl-2.1, and the Unlicense.

Only AGPL, GPLv3, and Apache 2 from that list are really widely used.

Much less talked about than whether or not you can revoke a license, but probably as important for most open source licenses, is what happens if rather than trying to revoke the license you try to stop issuing new licenses?

Take GPLv2. Suppose I license some code I own to Alice under GPLv2. Later Alice gives a copy to Bob. Where does Bob's license come from?

GPLv2 says, "Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions". GPLv3 has similar language.

If I say that I'm no longer going to issue licenses, and sue Bob for copyright infringement, what will his defense be?

He could argue that my license to Alice obligates me to issue a license to him. That falls under an area of law called the law of third party beneficiaries. Commonly you run into that in situations such as life insurance. I enter into a contract with a life insurance company to benefit specific third parties named in the contract, and that gives them some rights to sue to enforce the contract even though they are not a party to it.

I haven't seen much analysis of how the law of third party beneficiaries would work when applied to an open source license, but I'm not optimistic it would do much. Third party beneficiary rights tend to be weak at best if the third party is not a specific entity that the contract was made specifically to benefit. Someone downstream from Alice might be too vague to be a third party beneficiary, and it probably gets worse the farther downstream they are.

How about Alice? She could probably intervene to force me to honor my license to her and issue Bob a license. That's still going to put a damper on downstream redistribution. If you want to use the code without much legal worry, you'd need to make sure you got it from someone who would be willing to intervene if you got sued by me.

As with the revocation question, this too could be avoided be better drafting of the licenses. It's not a problem for Apache 2, for example, because the Apache 2 license grant is "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form".

The key in there is "sublicense". When Alice gives Bob a copy, Bob can get his license directly from Alice via her use of the sublicensing right I gave her.

I think that the only widely used open source licenses that do this are Apache 2 and MIT.

The GPL family specifically says that you cannot sublicense. I think they did this because they did not want people using sublicensing to give out licenses that did not include all of the GPL rights. Better would have been to allow sublicensing but to explicitly say that when you sublicense you must include all the rights that were in the license you received from upstream.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by user5994461 on Sunday November 01, 2020 @08:21AM (#24959318)
>>> Take GPLv2. Suppose I license some code I own to Alice under GPLv2. Later Alice gives a copy to Bob. Where does Bob's license come from?

There is some case law around that in France. A software company makes GPL software or library, a contracting firm uses/modifies it, reselling the result to some clients.

In 2 cases I am aware of, the final client was the government and sued the contracting firm for breach of contract (the GPL is a contract) and won. (Winning is relative of course because the client can't use the software they paid for anymore and years are passing by in court).

The contract creates a chain of contractual responsibility, which I am not an expert in, but as far as I understand it opens any party to being sued by any other party.

Yes it means that GPL developers, by giving an open contract to anybody who is willing to take it, are pretty much opening themselves to be sued by the entire world.

In practice you sue for a purpose (maximizing damages :D) so the purpose guides whom to pursue on which grounds.

Now to answer your question... what happens if you decide to cancel the license? Well, you can't unilaterally cancel a contract on a whim.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by dragonwriter on Sunday November 01, 2020 @03:29AM (#24958030)
> The question of whether or not you can revoke an open source license would go away if the people writing the licenses would say in their licenses that they are irrevocable or perpetual or in perpetuity.

Since the entire issue is that gratuitous licenses are, as a matter of law, revocable by notice regardless of their surface conditions, no, it wouldn't.

Such terms may make downstream licensees more secure that, in the event of revocation, courts will limit the effect of that revocation to avoid them incurring undue loss based on their reasonable reliance on the promises in the licenses while it was being offered under principles like promissory estoppel, though.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Sunday November 01, 2020 @10:45AM (#24960196)
You keep making the claim that it's settled law that, regardless of license terms like permanence and unrevokability, any gratuitous license is trivially revokable by the copyright owner. Once again, I ask that you cite the jurisdiction, case law and precedent that you're basing that on.

Edit: it just occurred to me that even if that is true, its salience here might depend on what "gratuitous" means and whether it applies to the license in question. (I reiterate that IANAL, so usual cautions). Proponents of copyleft licenses would claim that licensor and -ee are both receiving value. The licensor receives the value of improvements and enhancements to their original work while the licensee gets access to the base system and permission to modify it to their needs as well as sharing the licensor's protections and value on their own contributions. There seems to be a plausible argument (reminder: IANAL!) that an exchange of value has occured.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Saturday October 31, 2020 @10:22PM (#24956787)
Heather Meeker has written about "direct licensing", without rights to sublicense, in at least one of her books. I'm sure she's mentioned it somewhere online, too.

The Blue Oak Model License takes reliability a step beyond even Apache 2 and GPLs, with an express statement of irrevocability (in plain terms) and an express statement that terms are both conditions and contractual obligations. https://blueoakcouncil.org/license/1.0.0

If you're really down in the weeds, probably best to send me up an e-mail.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by andi999 on Saturday October 31, 2020 @05:20PM (#24955286)
I would also like to hear that. It sounds almost like if Linus wanted to cash in, he could just revoke the license? I doubt that.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by webmaven on Monday November 02, 2020 @12:06AM (#24964974)
> I would also like to hear that. It sounds almost like if Linus wanted to cash in, he could just revoke the license? I doubt that.

That would be the implication only if Linus was the sole copyright owner.

As it is, no one is asked to assign their copyright when contributing code to the Linux kernel, and the amount of code still remaining in the kernel that Linus has personally written himself is a rather small portion.

So if Linus were to "take his ball and go home" as it were, the affected code could be replaced.

That said, the multiplicity of contributors that retain their copyright to their contributions is also why relicensing the kernel to GPL 3 is largely a non-starter, even if Linus weren't opposed to it (and he is).

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by user5994461 on Saturday October 31, 2020 @07:11PM (#24955993)
>>> Not: Gratuitous (not contract) licenses are...

Note that "license" is a US concept that does not exist in Europe. Licenses here are systematically interpreted as full fledged contracts and fall under contract law.

Have to point out how this seemingly minor point in parenthesis really highlights how the comment is wrong and misplaced for a good chunk of the world.

P.S. Not trying to criticize here, just pointing out that copyright is vast and complex.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by dragonwriter on Saturday October 31, 2020 @07:36PM (#24956147)
> Note that "license" is a US concept

Well, English, long predating the US.

> that does not exist in Europe.

Well, it exists in the UK and, I'm fairly certain, Ireland.

> Licenses here are systematically interpreted as full fledged contracts and fall under contract law.

Do contracts in your jurisdictions not require mutual consideration or are licenses without mutual consideration facially defective? And is this gratuitous licenses in general don't exist or just in copyright?

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by user5994461 on Saturday October 31, 2020 @07:50PM (#24956224)
Long story short. US contracts (common law) require consideration (both parties give something to the other). License couldn't be contracts because they give rights without getting anything in return. That's why it's a separate concept.

European contracts (civil law) don't require consideration. Thus there's no need for a separate concept of license. (Allow me to skip the Europe vs UK debate for brevity ^^)

You can have a read at this article on a recent GPL court case in France, see section "French Law" that explains how some of the major differences https://thehftguy.com/2020/09/15/french-judge-rules-gpl-lice...

Guess I should write a dedicated article on licenses vs contracts so I can just point people to it. Is it something you would be interested in?

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Saturday October 31, 2020 @10:39PM (#24956833)
In practice, we don't think much about failures of consideration in the US, at least outside of law school. Even without any stated exchange in the terms of a license, courts have obligingly found one for the licensor-plaintiff in surrounding circumstances. See Jacobsen v Katzer way back when, Artifex v Hancom more recently.

We do have rules for unilateral contracts and induced reliance, but they don't seem to come up much.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by dragonwriter on Sunday November 01, 2020 @03:51AM (#24958125)
Jacobsen v. Later found a lot of interesting things, but the existence of a contract based on what otherwise would appear to be a gratuitous open source license doesn't appear to be one of them (at least in the Federal Circuit decision where that doesn't appear to have been an issue in dispute; there is a passing reference to consideration when discussing another issue, and it's clear that the District Court ruled -- and the Federal Circuit reversed on this point -- that the case should be resolved under contract rather than copyright terms, but it's not clear from the Federal Circuit that the District Court ruled this way basses on the existence of a contract or based on the general legal principle that, but for the areas of legal distinction between bare licenses and contracts, licenses are applied based on contract law. And the Federal Circuit reversal wasn't based on anything which would distinguish those, but on finding that the conditions in the Artistic License were valid as conditions rather the covenants, leaving bare copyright claims available in the event the terms were violated.

Artifex v Hancom also doesn't seem to offer much, since that there was a contract doesn't appear to be a point in dispute.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Sunday November 01, 2020 @05:08PM (#24962965)
From the Federal Circuit Jacobsen opinion, summarizing the action below, which to that point was motion practice on preliminary injunction:

> ... The District Court found that Jacobsen had a cause of action only for breach of contract, rather than an action for copyright infringement based on breach of the conditions of the Artistic License. Because a breach of contract creates no presumption of irreparable harm, the District Court denied the motion for a preliminary injunction. > > Jacobsen appeals the finding that he does not have a cause of action for copyright infringement. ...

The appellate court vacated and remanded.

In its analysis:

> Traditionally, copyright owners sold their copyrighted material in exchange for money. The lack of money changing hands in open source licensing should not be presumed to mean that there is no economic consideration, however. There are substantial benefits, including economic benefits, to the creation and distribution of copyrighted works under public licenses that range far beyond traditional license royalties. For example, program creators may generate market share for their programs by providing certain components free of charge. Similarly, a programmer or company may increase its national or international reputation by incubating open source projects. Improvement to a product can come rapidly and free of charge from an expert not even known to the copyright holder. The Eleventh Circuit has recognized the economic motives inherent in public lenses, even where profit is not immediate. See Planetary Motion, Inc. v. Techsplosion, Inc., 261 F.3d 1188, 1200 (11th Cir.2001) (...).

Summing up the issue at bar:

> The heart of the argument on appeal concerns whether the terms of the Artistic License are conditions of, or merely covenants to, the copyright license.

In construing the terms of the license, the Federal Circuit explicitly references state contract law:

> Under California contract law, "provided that" typically denotes a condition.

Artifex v. Hancom is important in part because there wasn't any real dispute on contract enforcement. But the license at issue was GPLv2, whose author, the FSF, had long insisted it was just a license. From the terms:

> You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

In the order on motion for partial summary judgment, the court notes:

> The license was not free in the sense that there was no consideration owed under the agreement.

It then cites Jacobsen on "lack of money changing hands".

Later:

> Plaintiff gave away its Ghostscript program in consideration for the user making its software open source, which Defendant does not dispute it did not do. The record supports a finding that Defendant received a benefit (the use of Ghostscript) at Plaintiff's expense by depriving Plaintiff of the value of having Defendant's software open source.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Sunday November 01, 2020 @06:47PM (#24963577)
Oops. Artifex was a GPLv3 case, not a GPLv2 case. GPLv3 section 9 is a little different:

> You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Saturday October 31, 2020 @10:32PM (#24956813)
Speaking generally, the vast majority of writing I've seen about "bare licenses" that aren't also contracts comes from theory, and particularly early, FSF-affiliated theory. Not practice. Not courts.

There was activist fear about the dark power of contract law, as opposed to just copyright. And some political lobbying about the kinds of rules copyright owners should be able to impose and enforce under copyright law. They wanted to distinguish EULAs and NDAs—contract, bad—from licenses—good. Arguably, Moglen and friends were overtaken by legal decisions on both fronts.

Nimmer, our go-to treatise on copyright law, more openly acknowledges the deep links between copyright and contract law. Despite the fact that in the US, copyright law is federal (national) law and contract law is primarily state law.

For the vast majority of people and firms, all of this is political trivia.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by throwhypothetic on Saturday October 31, 2020 @04:54PM (#24955118)
If a project is licensed under the AGPL, does that mean contributions to it are also licensed under the AGPL?

Hypothetically if all the contributions were public domain code included in an AGPL project, then wouldn't the maintainer be within their rights to include those contributions in a closed-source version of the project?

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Saturday October 31, 2020 @05:10PM (#24955220)
You cannot change the license on code that is copyrighted by another party, unless that other party has already licensed you to do so (e.g a release under version x of some license may permit licensing under the terms of later versions.). The whole point of open source licensing is to prevent future releases from being under more restrictive licenses. Copyright holders always have the option to change their own licensing, but they do not have such freedom if their code is a derivative work, especially if their access to the other work was through an open source license.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by throwhypothetic on Saturday October 31, 2020 @05:14PM (#24955246)
That much I understand, but what's the default license if the contributors didn't specify a license with their contributions? Is it implied that their contribution is licensed according to the full project's license?

Much of the discussion is assuming that because the project was AGPL, then the various contributions were AGPL as well. Whether or not that's the case is my question.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Saturday October 31, 2020 @05:32PM (#24955364)
IANAL, but my understanding is that if their contribution is a derivative work (as most would clearly be), they would be subject to the same license restrictions that restricted their access to the original project. I.e. they had no permission to create the derivative work, and thus no right to release it under any license. If the contribution isn't a derivative work, then the project shouldn't be accepting it without a copyright assignment or license.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by OJFord on Saturday October 31, 2020 @06:11PM (#24955619)
That would make sense, but then what are 'Contributor Licence Agreement's for?
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by tpxl on Saturday October 31, 2020 @06:41PM (#24955783)
If you contribute to a GPL project, your contribution is licensed under GPL, but it's your copyright, not the project owners. The Contributor License Agreement transfers the copyright from you to the project owner, so they may re-license (or dual license) in the future.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by user5994461 on Saturday October 31, 2020 @06:59PM (#24955906)
Assuming the project specified the license as AGPL, the contributions would be under AGPL as well.

Note that the project currently doesn't state any license (there's no license.md). No idea if there was a license specified before when the contributions were made.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by dragonwriter on Sunday November 01, 2020 @10:37AM (#24960142)
> The whole point of open source licensing is to prevent future releases from being under more restrictive licenses.

That a point of copyleft licenses. It's not a point of permissive licenses. Providing a certain degree of freedom to the direct licensee is the common shared point of open source licenses, permissive and copyleft.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by kemitchell on Sunday November 01, 2020 @05:15PM (#24963015)
There is no canonical set of purposes behind any license, copyleft or permissive. The license drafter had their own goals in mind, but their terms get repurposed by others.

Even very popular permissive licenses have been written with contribution front-and-center in mind. See, for example, the contribution-related terms of Apache 2. The definition of contribution. The built-in CLA. The compromise on scope of the patent grant.

Re:Octotree – Proprietary Firefox extension contains AGPL-li... by ajarmst on Sunday November 01, 2020 @10:58AM (#24960305)
Fair point on the semantic vagueness of "open source", I'll exercise more caution. However, I think it was clear in context what category of licenses I and the main conversational thread are referencing.
Re:Octotree – Proprietary Firefox extension contains AGPL-li... by michaelmrose on Saturday October 31, 2020 @05:16PM (#24955256)
Can you please cite some examples of copyright licenses which were revoked unilaterally at will and in what circumstances. Note not legal theories to the effect that this is so, actual cases of revocation.