1. Feb 16th, 2009

    Solving the 5256 problem

    Did you know there are 73 (!) open source licenses? If you’re pulling in pieces of code from different sources, you have to deal with the legality of mixing different licenses, some licenses just don’t mix that well, which works out to 5256 combinations!

    Bruce Perens argues we only need three open source licenses:

    So, my set includes two base licenses: Apache 2.0 and GPL3, and two derivatives of GPL3: LGPL3 and Affero GPL3. To use them, you’ll have to learn two licenses, and two sets of variations on one of those licenses. All of them are compatible with each other. Suddenly, Open Source isn’t as complicated as those 5,256 combinations of two of the approved 73 licenses!

    To me, open source is about reducing friction, license plurality has the opposite effect. The thing is, when you look at each and every license in isolation, each one is unique and special in its own way. Yet, each and every license is how we end up with the 5256 problem. It’s time we started thinking about the larger picture. Yes, the Foo License is great and amazing, but in the overall not using the Foo License is even better!

    If you could give up on using just one of the non-essential licenses, which would it be?

    Printable PDF | Posted by Assaf Filed in general 9 Comments »

    1. Feb 16th, 2009

      Dr Nic

      I think I’m fortunate that most of the libraries I want to use or chop up and reuse are MIT license or another version of “do what you want with it”. Fortunately this is the common license for most/all Ruby libraries/gems/plugins.

      To date, I don’t think any of my libraries have a dependency on a GPL-like license. I avoid them.

      So I think I have 1 license combination in my life.

    2. Feb 16th, 2009

      Assaf

      Have you looked at the Ruby license, which covers the core/standard libraries?

      What about deploying the code on JRuby?

      When you’re using OpenSSL or Libxml or Syck or Cocoa through a Ruby library, which license is actually in effect?

      You might not be aware of the mess, but legally it’s still there. And it’s a big problem giving a clean bill of health to even the most trivial of scripts.

    3. Feb 16th, 2009

      Antoine Toulme

      I think the MIT license, the BSD license, and the wtfpl license should merge.

      If they could go by the terms of the wtfpl, that’s be great.

    4. Feb 16th, 2009

      Dr Nic

      Hmm, I guess I’ve never read the MIT license either. I probably don’t read the “ToS” rules on each website I subscribe to either. I hope I don’t get sued by an unhappy user one day.

      Actually, what is the consequence of mixing/merging licenses? Should I worry/care?

    5. Feb 16th, 2009

      Assaf

      I know a lot of open source developers operate under the Friends & Family License Agreement. They don’t really read, understand or obey the license, but it works because we’re all one big family of open source developers, and you’re not going to sue people with good intents.

      Business has different exposure. A mixture can be toxic in that it’s illegal to distribute the code under either license, and so now you have software you can’t ship, hardware you can’t ship, a core piece of infrastructure you have to decommission, etc. As a business you need to pay close attention to the licenses you use and how they mix together.

    6. Feb 16th, 2009

      Dr Nic

      Before we ship CommitChat, which I think is the first distributable commercial thing I’ve made in years, I will go back and double check the licenses of libraries we use. I think most just ask “Please give attribution”. But, I’ll double check. Thanks for the reminder/warning.

    7. Feb 16th, 2009

      Matthieu

      I’d replace LGPL with MPL. The definition of linking is far too imprecise. MPL is much clearer and even if it’s slightly less viral, it has a good code-sharing kick. I haven’t much love for MIT either, it’s too short and there are no patent termination clauses.

      By the way even when we’re all open source developers, hippie-like and free love there are some dangers in combining incompatible license. It’s the main reason of existence for many big foundations (Apache, Mozilla, Linux, …). When your project becomes popular, you won’t be able to escape private interests. Then all bets are off. I know of at least one careless guy who’s been sued, he didn’t enjoy the experience.

    8. Feb 16th, 2009

      Garrett Albright

      I like Antoine’s idea. Rid the world of phony “open source with an asterisk” copyleft licenses!

    9. Feb 17th, 2009

      elliottcable

      I disagree, personally. I’m going to be working with a lawyer friend soon-ish to put together yet another license, however, this one has different goals, so I don’t know if it’d even make your goal of open source licenses. Hopefully I won’t be adding a further 74 to your total!

    Your comment, here ⇓