Help! Understanding Free and Open-Source Licenses

Privacy Questions
41

I have seen a lot of libraries use any permissively licensed code in GPL. It just can’t be the other way around.

I mentioned Apache 2.0 and GPLv2 because they’re incompatible both ways. Apache 2.0 code cannot be used in a GPLv2 project. Whereas it can be used in a GPLv3 project.

42

Was not aware of that. Any examples you could link?

All the more reason to use AGPLv3 then.

43

The patent clauses of the Apache 2.0 constitute “further restrictions” not permitted by the GPLv2.

From the GPLv2:

  1. Each time you redistribute the Program (or any work based on the
    Program), the recipient automatically receives a license from the
    original licensor to copy, distribute or modify the Program subject to
    these terms and conditions. You may not impose any further
    restrictions on the recipients’ exercise of the rights granted herein.
    You are not responsible for enforcing compliance by third parties to
    this License.

(Emphasis mine and still not a lawyer :stuck_out_tongue: )

44

All the more reason to use AGPLv3 then.

I don’t see how the AGPLv3 relates here at all. If anything, it’s a reason to use GPLv2+ over GPLv2

45

For example, GrapheneOS’s Vanadium adds an extra license clause to their GPLv2 code making an exception for the Apache 2.0’s patent clauses.

Without this, it would be forbidden to use Vanadium’s code in combination with Apache 2.0 code.

While this is a nice thought, it essentially just creates a new license and contributes to License proliferation - Wikipedia

As such, for Trivalent (which includes Vanadium patches) we’ve opted to use the GPLv2 for our changes as well to keep things simple:

1 Like
46

Doh… drop the “A” lol I meant v2+ variant of GPL licenses.

Legalese is only my 50th language.

47

Amazing example and explanation! Thanks!

1 Like
48

Thanks everyone for chiming in, I feel like we’ve either gotten smarter or emboldened eachother to take legal risks we shouldn’t take. Perhaps we need to get someone from the SFC to chime in on if they notice any inaccurate statements. I think the collective knowledge on how developer and consumer adoption is influenced by these license perceptions is valuable in its own right.

So hopefully some takeaways for the purpose of discussion on [this thread] (Add Hubzilla (add new category for "distributed application ecosystems?)):

  • Permissive licensing incentivizes sharing of ideas and deincentivizes big companies creating competing gamed permissive economies
  • Copyleft licensing has a proven track record of deincentivizing big tech opportunism on open source and despite all the philisophical disparities of open source and copyrights, acknowledges the real world risks this imposes on sustainable open ecosystems.
  • A mixture of both types of licensing that uses permissive licensing around the protocols and standards of the ecosystem abstractions that are necessary for interoperability and composability of systems and copyleft of implementations of these protocols draws on both licensing type strengths.
  • You can’t mix GPLv2 licenses with Apache v2. It is like dropping gremlins into water.
  • Users should be aware that the licensing and culture of a software project and its commercial equivalents shapes a lot of their freedoms, and having this cursory understanding can help you understand the incentive structures driving different technology that will future proof you, or cause you to do big painful migrations when a project folds or becomes the puppet of big tech.

Anything I missed?

49

I agree with this framing and this is the goal with Peergos. Most of our protocol spec is already permissive licensed (libp2p, dag-cbor, ipfs), and the core of the implementation is also permissive licensed (GitHub - Peergos/nabu: A minimal Java implementation of IPFS and GitHub - libp2p/jvm-libp2p: a libp2p implementation for the JVM, written in Kotlin 🔥). The rest of the protocol that is not formally specified yet is just a lack of time and resources.

1 Like
50

Maybe related, but I think the main weakness is having the specification be the implementation. Imagine if 802.11 specs were just some MIT C code that worked for one hardware case - I think it mixes the high level contract with unnecessary implementation details. This is a personal nit, as having a standard more written in “stone” can slow development, but increase adoption due to contract stability.

However I haven’t researched it more, and there may be a formal spec for some of the protocols in question. If they exist, then that’s good, and if not, I believe my point still stands.

1 Like
51

This is actually the way the Apache Iceberg project does it:

The main project contains the spec, docs, and the initial library implementation written in Java as this is thr language used by many big data query engines like Apache Spark and Trino.

As more engines that use different languages came about, these libraries have also been added and maintained:

These are all maintained by the same Apache community, despite having different core people who focus on the different language implementations and those who focus more on expressing the specification semantics and assertion tests generally start out in Java with the two main query engines.

This can get confusing for users because they mistale those libraries for clients but they are pretty complocated interfaces for the average user. That said, it really expands the adoption and speed at which people can adopt and lowers spec misunderstandings (especially across languages). Also increases how quickly we find issues with the spec or generally things it doesn’t clarify or assumes based on it being initially written for Java.

52

I would recommend doing this little by little as I mentioned above, when you prioritize the free flow of ideas through a permissively licensed core, in theory you could be the force that combines all those fediverse platforms I listed in the other thresd to start building other core libraries around these protocols which in turn grows the adoption rate of the overall ecosystem which is one of the greatest blockers for average consumers trying to figure out how to free themselves from traditional social and other centralized platforma that hosts marketplaces.

1 Like