Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Steve McIntyre
On Fri, Aug 05, 2022 at 10:49:05AM +, Stephan Verbücheln wrote:
>On Fri, 2022-08-05 at 10:31 +0100, Steve McIntyre wrote:
>> 
>> That's not a restriction, though. It's *not* saying "you may not use
>> this software for XXX", it's saying "this software is not intended
>> for XXX". There's quite a difference there IMHO.
>
>To me it sounds like a more explicit “No Warranty” clause for critical
>applications.

Yup, exactly.

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
Who needs computer imagery when you've got Brian Blessed?



Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Stephan Verbücheln
On Fri, 2022-08-05 at 10:31 +0100, Steve McIntyre wrote:
> 
> That's not a restriction, though. It's *not* saying "you may not use
> this software for XXX", it's saying "this software is not intended
> for XXX". There's quite a difference there IMHO.

To me it sounds like a more explicit “No Warranty” clause for critical
applications.

Regards



Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Steve McIntyre
Mihai wrote:
>
>* On 8/5/22 01:09, Ben Westover wrote:
>> Those are based on conversations that are almost a decade old, and some 
>> things have changed since then. I just wanted a re-review of the license 
>> in 2022 to see if the complaints from before still hold up today.
>
>I can see how the outcome of, e.g., legal disputes can change the view on a
>license over time, especially since this would indicate practical application
>and interpretation of a license. Your request is understandable.
>
>I am, as a layman, still having a hard time understanding why any version of 
>the
>APSL license would be considered free in the first place, since it certainly
>contains a discrimination clause in section 8:
>
>> You acknowledge that the Covered Code is not intended for use in the
>> operation of nuclear facilities, aircraft navigation, communication
>> systems, or air traffic control machines in which case the failure of
>> the Covered Code could lead to death, personal injury, or severe
>> physical or environmental damage.
>
>This directly contradicts freedom 0 and has been part of any APSL version, only
>slightly modified in wording ("Covered Code" vs. "Original Code" in previous
>versions), from version 1.0 to 2.0.

That's not a restriction, though. It's *not* saying "you may not use
this software for XXX", it's saying "this software is not intended for
XXX". There's quite a difference there IMHO.

>Daniel Hakimi pointed out a way of interpretation for which this would not be
>problematic due to internal contradiction:
>
>> Perhaps the OSI and FSF interpret this as only relating to the warranty...
>> But there is no warranty.
>
>Another way of interpreting this is by taking the words "not intended for use
>in" literally and arguing that as long as the author of the software does not
>intend the software to be used in these fields, everything is fine. However,
>that falls short to the actual deployment, which is also covered by this
>license, and the term also applies to purely users/integrators. In such a case,
>you, as a user/integrator, could claim that the usage in these fields was *not
>intended*, but *accidentally occurred*.
>
>Now, obviously, these arguments are not very convincing, but crucially, I have
>not found any statement from the FSF as to why they have deemed this subsection
>to be a non-problem. I might just go ahead and ask them directly.

I think it's lawyer-speak CYA. There's nothing magic there.

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
"We're the technical experts.  We were hired so that management could
 ignore our recommendations and tell us how to do our jobs."  -- Mike Andrews



Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Mihai Moldovan
* On 8/5/22 01:09, Ben Westover wrote:
> Those are based on conversations that are almost a decade old, and some 
> things have changed since then. I just wanted a re-review of the license 
> in 2022 to see if the complaints from before still hold up today.

I can see how the outcome of, e.g., legal disputes can change the view on a
license over time, especially since this would indicate practical application
and interpretation of a license. Your request is understandable.

I am, as a layman, still having a hard time understanding why any version of the
APSL license would be considered free in the first place, since it certainly
contains a discrimination clause in section 8:

> You acknowledge that the Covered Code is not intended for use in the
> operation of nuclear facilities, aircraft navigation, communication
> systems, or air traffic control machines in which case the failure of
> the Covered Code could lead to death, personal injury, or severe
> physical or environmental damage.

This directly contradicts freedom 0 and has been part of any APSL version, only
slightly modified in wording ("Covered Code" vs. "Original Code" in previous
versions), from version 1.0 to 2.0.

Daniel Hakimi pointed out a way of interpretation for which this would not be
problematic due to internal contradiction:

> Perhaps the OSI and FSF interpret this as only relating to the warranty...
> But there is no warranty.

Another way of interpreting this is by taking the words "not intended for use
in" literally and arguing that as long as the author of the software does not
intend the software to be used in these fields, everything is fine. However,
that falls short to the actual deployment, which is also covered by this
license, and the term also applies to purely users/integrators. In such a case,
you, as a user/integrator, could claim that the usage in these fields was *not
intended*, but *accidentally occurred*.

Now, obviously, these arguments are not very convincing, but crucially, I have
not found any statement from the FSF as to why they have deemed this subsection
to be a non-problem. I might just go ahead and ask them directly.


In the thread started by John Paul Adrian Glaubitz in 2020 regarding the APSL
1.2, one issue I had with the license was the practical implications employed by
section 2.2 (c) (2.0 version):

> (c) If You Externally Deploy Your Modifications, You must make
> Source Code of all Your Externally Deployed Modifications either
> available to those to whom You have Externally Deployed Your
> Modifications, or publicly available. Source Code of Your Externally
> Deployed Modifications must be released under the terms set forth in
> this License, including the license grants set forth in Section 3
> below, for as long as you Externally Deploy the Covered Code or twelve
> (12) months from the date of initial External Deployment, whichever is
> longer. You should preferably distribute the Source Code of Your
> Externally Deployed Modifications electronically (e.g. download from a
> web site).

Compare this to the GPL 2:

> 3. You may copy and distribute the Program (or a work based on it, under
>Section 2) in object code or executable form under the terms of Sections 1
>and 2 above provided that you also do one of the following:
>
>a) Accompany it with the complete corresponding machine-readable source
>   code, which must be distributed under the terms of Sections 1 and 2
>   above on a medium customarily used for software interchange; or,
>b) Accompany it with a written offer, valid for at least three years, to
>   give any third party, for a charge no more than your cost of physically
>   performing source distribution, a complete machine-readable copy of the
>   corresponding source code, to be distributed under the terms of Sections
>   1 and 2 above on a medium customarily used for software interchange; or,
>c) Accompany it with the information you received as to the offer to
>   distribute corresponding source code. (This alternative is allowed only
>   for noncommercial distribution and only if you received the program in
>   object code or executable form with such an offer, in accord with
>   Subsection b above.)

The difference between having to make source code available unconditionally (to
users or publicly, which thankfully is an or-condition) vs. upon request can be
a huge one. Contrary to what I have written for APSL 1.2 in 2020, APSL 2.0's
section is compatible with the DFSG as far as I can see, so this is not a
concern, but practically, APSL 2.0 can be inconvenient. Imagine Debian was
forced to stop distribution of source and binary forms. In such a case, to stay
conformant with the license, it would need to find a way to continue
distributing APSL-2.0-licensed source code publicly, for practical matters, to
meet the twelve months requirement. For GPL-2-licensed software, it would be
enough to have somebody available to 

Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Stephan Verbücheln
On Fri, 2022-08-05 at 08:25 +0800, Paul Wise wrote:
> I wouldn't put any weight on the presence of the APSL 2.0 license
> text
> in the archive, probably it got into Debian in those packages due to
> lack of copyright/license review rather than deliberate acceptance,
> especially since it is in one of the many code copies in both of
> them.

There could also be cases of dual-licensing.

Regards



Re: Is the APSL 2.0 DFSG-compliant?

2022-08-05 Thread Stephan Verbücheln
> Interesting, the APSL 2.0 is seen in some relatively important
> packages like Chromium and QtWebEngine.

What code is exactly under that license? As far as I know, WebKit
itself (which Chromium is a fork of) is licensed under LGPL (KDE code)
and 2-clause BSD (Apple code).

In your example of Chromium, it appears to be “XNU” and “Cross-Platform
Mach Interface Generator (mig)”.

https://sources.debian.org/src/chromium/103.0.5060.134-1/third_party/mig/README.chromium/

So for Debian GNU/Linux, it could be easily removed and ignored.
However, Debian GNU/Darwin might want to have those libraries.

Regards