November 18, 2010

Free Software license onion

There are tons of Free Software licenses out there, and it can be confusing choosing one for your Lisp project. I'm writing this guide to clear up some confusion, but be aware that I'm not a lawyer and you probably should consult one if you are going to take advantage of this advice for something that you hope to commercialize.

A good strategy for choosing a license is to consider how the project would fit in a software stack - is it a general-purpose utility library? A library to interface to specific services or hardware? A web server that can be used to build applications? A content management system that you one day hope to commercialize? These projects all have different potential uses, but it would be nice if their licensing terms reflected those uses and allowed the content management system to use the web server, allowed the web server to use the service interface library, and allowed the service interface library to use utilities from the general-purpose library.

I think general-purpose utility libraries should be public domain (consider using the unlicense, which is a copyright waiver with a warranty discalimer). One thing people often want to do is copy-paste one or two functions out of them into random projects. Other good things to put into the public domain include benchmark code and test suites (you can release just those parts of your project as public domain).

Next up on the hierarchy are permissive licenses. There are dozens of these around, however I think only those that are LLGPLv2.1 compatible should be used for Free Software written in Lisp (Wikipedia has a chart summarizing Free Software license compatibilities).

There are a few of these (see the GNU license list whether a particular license is GPL-compatible or not), but generally most of them are like the BSD license. I recommend using the ISC license, which is really concise and is used by OpenBSD. Good examples of projects that can be licensed under a permissive license are parsers for data formats and interfaces to C libraries or web services. Permissive-licensed software can include public domain code and code from most other permissive-licensed software.

Projects you do not want to see forked into a closed-source product without giving back to community should be licensed under the LLGPLv2.1 (version 2.1 specifically, as LGPLv3 code cannot be used in a GPLv2 project). Why the LLGPL and not the LGPL or the GPL? The GPL makes it impossible to use a Lisp library as part of a closed-source product (even if you only use it as a library and make no modifications), and the wording of the LGPL does likewise because the "linking clause" basically presumes you're using C.

LLGPL software can incorporate other LLGPL code, public domain code, and LLGPL-compatible permissive license code, but for example LLGPL code can't be put into an ISC-licensed project (the whole project would have to be re-licensed under the LLGPL).

I think it's pretty obvious that you shouldn't license your Lisp library under the GPL if you want other people to actually use it, but how to decide between a permissive license and the LLGPL? I think that aside from practical considerations, many times it comes down to a moral choice. LLGPL forces sharing reciprocity on others. I believe copyright should be abolished or severely reformed, and until those changes start taking place, the LLGPL can be used to similar effects through the impact of works on which you own the copyright (the real pirates aren't the people downloading mp3s, they're the people violating the GPL).

I think the most interesting licensing situation is when you want to develop commercial software, but allow proprietary use and extension only by certain parties (hopefully ones which will pay you lots of money). The general strategy for this is to dual-license your code under the GPL and a commercial license. The most prominent example of a project using this strategy is MySQL.

One implication of this is that in order to make it into your official repository to be dual-licensed, any patches must have their copyright assigned to you/your company by their contributors.

Which version of the GPL to choose for dual-licensing? I think either v2 or v3 is fine (one important thing v3 includes is the anti-tivoization clause, which prevents closed hardware platforms).

One thing the GPL doesn't cover is running proprietary modifications of GPLed software as a service without any distribution going on (for example, Google is rumored to have Linux kernel patches running that haven't been released). The AGPL addresses this issue. I don't know of any software dual-licensed under the AGPL, but I think it can be a promising strategy for a variety of projects.

6 comments:

Glenn said...

Many countries have no legal concept of public domain, so public domain status puts your software in a sort of legal limbo in those parts of the world, causing some companies to avoid public domain code. So, the most open way to distribute the code is a a copyrighted work that grants an unlimited license to reuse. A disclaimer of warranty always seems prudent.

Anonymous said...

BSD and ISC licenses don't have patent grants. This is important because you could accept code from a contributor who is acting in bad faith, hoping that your users will use their patented IP thus allowing them to sue every end-user you have.

Apache2 is what former OSI head Bruce Perens recommends for the "liberal" copytheft licenses.

Also about 60-70% of opensource software is GPL and people still use it, so I suspect it isn't as much as deterrent as you hope it is.

Simon said...

Nice analysis, thanks. From my own looking at the available options, I came to much the same preferences as you. But I hadn't looked at the ISC License - that seems to be an attractive alternative to BSD.

Vladimir Sedach said...

"Many countries have no legal concept of public domain, so public domain status puts your software in a sort of legal limbo in those parts of the world, causing some companies to avoid public domain code."

I've heard this stated before but I can't find any actual references. It seems the only way this could happen is if the country in question either doesn't have any copyright law, or has perpetual copyright protection for all works.

"Apache2 is what former OSI head Bruce Perens recommends for the "liberal" copytheft licenses."

Good point, I did not know about that. I guess a universal move to Apache2/LLGPLv3/GPLv3 might be in order.

"Also about 60-70% of opensource software is GPL and people still use it, so I suspect it isn't as much as deterrent as you hope it is."

GPL works fine for end-user software (the outer layer of the "onion"; not just desktop software but things like network servers and databases), but if you license your library under the GPL only other GPL projects will be able to use it.

gavenkoa said...

>> Many countries have no legal concept of public domain.

> I've heard this stated before but I can't find any
> actual references. It seems the only way this could
> happen is if the country in question either doesn't
> have any copyright law, or has perpetual copyright
> protection for all works.

Ukrainian and Russian copyright low don't allow authors
state that writing is in public domain. This happen
only after 70 years after authors death.

gavenkoa said...

General discussion list about OSS licence: license-discuss@opensource.org