I think Clause 5 (about export) was copied from another license, possibly
MIT's PGP distribution. I'm assuming it helps me legally somehow, although I
agree with you that it's not clear how.
Clause 6 (about patents) was added to satisfy RSA Security's lawyers years
ago back around version 1.1. (They were threatening to sue me at one point.)
Of course the patent on the RSA algorithm has expired but I'm going to leave
that clause there to be safe.
I could possibly move some of these clauses outside the license, but the
license is the only thing that (according to the license) must be
distributed along with the source code, so it's simpler to just leave them
in there.
So unless anyone wants to pay a lawyer to write up a new license for me, or
to determine that some standard open source license is suitable for my
purposes, I'm inclined to not touch the license text at this point, since it
has served me pretty well up to now. :)
-----Original Message-----
From: Geoff Beier
Sent: Tuesday, November 30, 2010 7:26 PM
To: Wei Dai
Cc: Jeffrey Walton ; Crypto++ Users
Subject: Re: Crypto++ License and meaning of "Compilation"
Here's my (non-lawyer... I Am Not A Lawyer and This Is Not Legal
Advice :-)) read:
- the disclaimer of copyright on the individual files is quite clear
to me, as someone who is in the habit of reading free software
licenses and determining whether they are compatible with my project.
- I consider the license on the library to be similarly clear and have
no heartburn about using it in any of my projects, regardless of how
they are licensed. To my eye, it's compatible with any copyleft,
commercial or free license I've ever personally cared to use.
- I can see where the confusion originates.
Consider the clauses of the license:
"1. Any copy or modification of this compilation in any form, except
in object code form as part of an application software, must include
the above copyright notice and this license."
and
"3. Wei Dai makes no warranty or representation that the operation of the
software in this compilation will be error-free, and Wei Dai is under no
obligation to provide any services, by way of maintenance, update, or
otherwise. THE SOFTWARE AND ANY DOCUMENTATION ARE PROVIDED "AS IS"
WITHOUT EXPRESS OR IMPLIED WARRANTY INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. IN NO EVENT WILL WEI DAI OR ANY OTHER CONTRIBUTOR BE LIABLE FOR
DIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
4. Users will not use Wei Dai or any other contributor's name in any
publicity or advertising, without prior written consent in each case."
strike me as essentially equivalent to the terms of the standard
liberal, non-copyleft BSD license. It might make them less ambiguous
if you were to make the language identical to BSD, since that's been
so widely analyzed and accepted by lawyers who do that for a living.
"2. Users of this software agree that any modification or extension
they provide to Wei Dai will be considered public domain and not
copyrighted unless it includes an explicit copyright notice."
Is not something that's commonly found in free software licenses, in
my experience. Rather, it's the kind of thing that project maintainers
require you to agree to as a condition of having your code accepted
for inclusion into the upstream project. Assuming I've correctly
assessed this, it might be clearer if it were moved from the license
into a contributor's agreement.
"5. Export of this software from the United States may require a
specific license from the United States Government. It is the
responsibility of any person or organization contemplating export
to obtain such a license before exporting."
This clause strikes me as useless. I do not see how its inclusion in
the license changes anything; if you're subject to the requirements
the clause mentions, you or your organization need to obtain that
license before exporting your software regardless of any statement
your license makes. I don't see how this is more meaningful by putting
it in the license than by putting it in the manual.
"6. Certain parts of this software may be protected by patents. It
is the users' responsibility to obtain the appropriate
licenses before using those parts."
My understanding of this clause is identical to my understanding of
clause 5, unless Wei Dei (or whomever he transfers copyright to) is
attempting to retain patent protections for portions of crypto++. I
don't see any way a license between Wei Dei and a recipient of his
software can have any binding impact on the recipient's rights to any
patents a third party might assert. This seems better placed in the
manual than the license, to my (again, admittedly non-legal) eye.
"If this compilation is used in object code form in an application
software, acknowledgement of the author is not required but would be
appreciated. The contribution of any useful modifications or extensions
to Wei Dai is not required but would also be appreciated."
This seems as well placed in the manual as the license. I don't see
any condition of use here.
So, for my totally non-authoritative but carefully considered TL;DR
summary response to this question:
I thought my explanation on the website was pretty clear, but apparently
not. Can anyone suggest any changes to the text that might make it
clearer?
I think the license would have a clearer but equivalent meaning if you
placed the compilation under the standard 3-clause BSD license, made
clause 2 a condition of accepting contributions into the library
(separate from the license) and moved the rest to the front matter of
the manual.
All that should go to say I have never considered the license to be
unclear (unless you contradict any of the points I've made above...)
but I can see why some reviewers might be challenged by it.
Geoff
--
You received this message because you are subscribed to the "Crypto++ Users"
Google Group.
To unsubscribe, send an email to
[email protected].
More information about Crypto++ and this group is available at
http://www.cryptopp.com.
--
You received this message because you are subscribed to the "Crypto++ Users"
Google Group.
To unsubscribe, send an email to [email protected].
More information about Crypto++ and this group is available at
http://www.cryptopp.com.
