Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Glenn Maynard wrote: Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. Agreed. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think that's a non-free boundary at all. The GPL has the same make available on the same medium clause, so the No, it doesn't -- for two reasons. First, the referrerents are diffent. same medium as the binary and same medium as the interface are different. What if this is a kiosk? Must I provide source by scrolling it up the screen? Second, the GPL talks about a medium customarily used for software exchange. It specifically *doesn't* require the same medium, party to avoid this bug. You're taking one part of my message out of context, and analyzing it without considering the rest. I'm saying that the GPL has the same clause as the hypothetical license would, which is true by definition, since in the hypothetical license, I incorporated the GPL clause in question (3) by reference; I did not intend to suggest that on the same medium was the *only* option. There would be a full set of clauses that would parallel GPL clauses 3 a-c, so one could either accompany the binary with source, or distribute an offer. But the GPL doesn't *have* a same medium clause at all. There's nothing like that in the GPL. Some poster back there -- I can't tell through the quotes -- wrote that on the same medium is non-free. You countered that it isn't, because it's the same as the GPL. But the GPL doesn't have that at all. My apologies for the sloppy phrasing. s/same medium/same act of distribution/g. The point I was making was that by definition, the same wording for methods of distribution was used in both the hypothetical license and the GPL, because the hypothetical license referenced GPL clause 3 for its methods of distribution. I was simply drawing a similarity between the free path of the GPL and the hypothetical license, for the purposes of showing below that both can cause severe inconvenience. Please highlight the section of the GPL which you believe is similar to this, including the text which talks about source being distributed on the same medium. As I said above, same medium was sloppy phrasing; same act of distribution is more accurate. Providing the full source to this Wikipedia-like encyclopedia via SMS would be nearly impossible and prohibitively expensive, and as you said above, quite useless to the recipient. (And I don't think providing only the source for each page would be acceptable, nor would it really be feasible or useful either.) You would again need to provide the source via a separate medium. Why wouldn't providing the source for the page be acceptable? It's the work which is being copied to you. And Wikipedia is a great example of this: the source for a page is roughly the same order of magnitude as the page, and there's a link *right there* on every page to get the source. So you could GPL the content of Wikipedia and it would work fine as is, even over WAP for cellphones. (You seem to have switched from SMS to WAP. I'm going to stick with the SMS example for now.) First, it is quite a stretch to say that one page of a heavily-hyperlinked and interwoven encyclopedia is an independent work. To do so, I believe you would be implying that Wikipedia is merely an aggregation of a number of separate and independent works, which I do not believe is accurate. No, I'm not implying that at all. You're providing one part of a larger work, but when you separate it out by itself, sure, that's a work too. Articles in a normal encyclopedia are often credited to individual authors. It's not a mere aggregation of separate and independent works. It's a combination of integrated and dependent works. Sets of articles are interesting on their own; often, a singleton set is interesting. If you had truly taken Wikipedia and abridged it, creating a new work, which you then distributed, then it would be acceptable to distribute only the source for your new work. However, that is not what you are doing here. Instead, you are taking a larger work and serving pieces of it at a time. Perhaps you'd be more convincing with a different example, like a normal book. But an enclopedia is so clearly composed of many works precisely because it is
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Glenn Maynard wrote: Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. Agreed. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think that's a non-free boundary at all. The GPL has the same make available on the same medium clause, so the No, it doesn't -- for two reasons. First, the referrerents are diffent. same medium as the binary and same medium as the interface are different. What if this is a kiosk? Must I provide source by scrolling it up the screen? Second, the GPL talks about a medium customarily used for software exchange. It specifically *doesn't* require the same medium, party to avoid this bug. You're taking one part of my message out of context, and analyzing it without considering the rest. I'm saying that the GPL has the same clause as the hypothetical license would, which is true by definition, since in the hypothetical license, I incorporated the GPL clause in question (3) by reference; I did not intend to suggest that on the same medium was the *only* option. There would be a full set of clauses that would parallel GPL clauses 3 a-c, so one could either accompany the binary with source, or distribute an offer. But the GPL doesn't *have* a same medium clause at all. There's nothing like that in the GPL. Some poster back there -- I can't tell through the quotes -- wrote that on the same medium is non-free. You countered that it isn't, because it's the same as the GPL. But the GPL doesn't have that at all. I was simply drawing a similarity between the free path of the GPL and the hypothetical license, for the purposes of showing below that both can cause severe inconvenience. Please highlight the section of the GPL which you believe is similar to this, including the text which talks about source being distributed on the same medium. only reason you are suggesting it shouldn't apply here is because you are providing a service rather than distributing a GPLed work. See below for a case where providing source for a distributed work could be just as onerous. Consider what would happen if you started a service to provide GPLed Wikipedia-like content via SMS. (Ignore the fact that Wikipedia itself is GFDLed; consider a hypothetical GPLed version.) In this case, you would have the same requirement to provide source to the recipients. Are we talking about the content, or the server? The source to the provided works seems perfectly reasonable. I'm referring to the content being served. Providing the full source to this Wikipedia-like encyclopedia via SMS would be nearly impossible and prohibitively expensive, and as you said above, quite useless to the recipient. (And I don't think providing only the source for each page would be acceptable, nor would it really be feasible or useful either.) You would again need to provide the source via a separate medium. Why wouldn't providing the source for the page be acceptable? It's the work which is being copied to you. And Wikipedia is a great example of this: the source for a page is roughly the same order of magnitude as the page, and there's a link *right there* on every page to get the source. So you could GPL the content of Wikipedia and it would work fine as is, even over WAP for cellphones. (You seem to have switched from SMS to WAP. I'm going to stick with the SMS example for now.) First, it is quite a stretch to say that one page of a heavily-hyperlinked and interwoven encyclopedia is an independent work. To do so, I believe you would be implying that Wikipedia is merely an aggregation of a number of separate and independent works, which I do not believe is accurate. No, I'm not implying that at all. You're providing one part of a larger work, but when you separate it out by itself, sure, that's a work too. Articles in a normal encyclopedia are often credited to individual authors. It's not a mere aggregation of separate and independent works. It's a combination of integrated and dependent works. Sets of articles are interesting on their own; often, a singleton set is interesting. You're simply providing one part of a larger work, and it is that larger work that you should be distributing the source for. Also consider what happens if you make a full-text search; the results page would be a
Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Glenn Maynard wrote: Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. Agreed. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think that's a non-free boundary at all. The GPL has the same make available on the same medium clause, so the No, it doesn't -- for two reasons. First, the referrerents are diffent. same medium as the binary and same medium as the interface are different. What if this is a kiosk? Must I provide source by scrolling it up the screen? Second, the GPL talks about a medium customarily used for software exchange. It specifically *doesn't* require the same medium, party to avoid this bug. You're taking one part of my message out of context, and analyzing it without considering the rest. I'm saying that the GPL has the same clause as the hypothetical license would, which is true by definition, since in the hypothetical license, I incorporated the GPL clause in question (3) by reference; I did not intend to suggest that on the same medium was the *only* option. There would be a full set of clauses that would parallel GPL clauses 3 a-c, so one could either accompany the binary with source, or distribute an offer. I was simply drawing a similarity between the free path of the GPL and the hypothetical license, for the purposes of showing below that both can cause severe inconvenience. only reason you are suggesting it shouldn't apply here is because you are providing a service rather than distributing a GPLed work. See below for a case where providing source for a distributed work could be just as onerous. Consider what would happen if you started a service to provide GPLed Wikipedia-like content via SMS. (Ignore the fact that Wikipedia itself is GFDLed; consider a hypothetical GPLed version.) In this case, you would have the same requirement to provide source to the recipients. Are we talking about the content, or the server? The source to the provided works seems perfectly reasonable. I'm referring to the content being served. Providing the full source to this Wikipedia-like encyclopedia via SMS would be nearly impossible and prohibitively expensive, and as you said above, quite useless to the recipient. (And I don't think providing only the source for each page would be acceptable, nor would it really be feasible or useful either.) You would again need to provide the source via a separate medium. Why wouldn't providing the source for the page be acceptable? It's the work which is being copied to you. And Wikipedia is a great example of this: the source for a page is roughly the same order of magnitude as the page, and there's a link *right there* on every page to get the source. So you could GPL the content of Wikipedia and it would work fine as is, even over WAP for cellphones. (You seem to have switched from SMS to WAP. I'm going to stick with the SMS example for now.) First, it is quite a stretch to say that one page of a heavily-hyperlinked and interwoven encyclopedia is an independent work. To do so, I believe you would be implying that Wikipedia is merely an aggregation of a number of separate and independent works, which I do not believe is accurate. You're simply providing one part of a larger work, and it is that larger work that you should be distributing the source for. Also consider what happens if you make a full-text search; the results page would be a derivative of quite a number of pages, and their sources would be far larger than that results page. If you had truly taken Wikipedia and abridged it, creating a new work, which you then distributed, then it would be acceptable to distribute only the source for your new work. However, that is not what you are doing here. Instead, you are taking a larger work and serving pieces of it at a time. Furthermore, even if it *were* acceptable to distribute only the source to the single page being served, you still would not be providing it in a particularly usable or useful form, and you would, at a minimum, double the number of messages required. Also, consider the more modern version of SMS, called MMS. It can be used to transmit large quantities of data to a phone, including pictures, video, *applets*, etc. This is clearly distribution. Suppose an applet were GPLed. It still would be difficult to transmit the source to people's phones (or
Re: Web application licenses
Glenn Maynard wrote: Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. Agreed. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think that's a non-free boundary at all. The GPL has the same make available on the same medium clause, so the only reason you are suggesting it shouldn't apply here is because you are providing a service rather than distributing a GPLed work. See below for a case where providing source for a distributed work could be just as onerous. Consider what would happen if you started a service to provide GPLed Wikipedia-like content via SMS. (Ignore the fact that Wikipedia itself is GFDLed; consider a hypothetical GPLed version.) In this case, you would have the same requirement to provide source to the recipients. Providing the full source to this Wikipedia-like encyclopedia via SMS would be nearly impossible and prohibitively expensive, and as you said above, quite useless to the recipient. (And I don't think providing only the source for each page would be acceptable, nor would it really be feasible or useful either.) You would again need to provide the source via a separate medium. Also, consider the more modern version of SMS, called MMS. It can be used to transmit large quantities of data to a phone, including pictures, video, *applets*, etc. This is clearly distribution. Suppose an applet were GPLed. It still would be difficult to transmit the source to people's phones (or perhaps impossible, if the complete source were too large). Yet we do not say the GPL is non-free because of these cases, nor should we. Just because a requirement to provide source code might be inconvenient or even impossible in a particular case does not mean the license is non-free. I don't think an alternative, make it available by some medium--for example, setting up a webserver and pointing to it--is reasonable, since it boils down to if you run an SMS server, you must also run a webserver. That becomes an unrecoupable expense if nobody actually downloads it. If I'm not already running a webserver, merely setting one up will cost me monthly. That is one of many alternatives; others include mail-order CDs (if you think you won't get many requests), email me for the source, etc. (I'm hoping that we agree that you must run a file distribution server if you use this software is non-free, at least.) Of course, because it dictates the use of a particular technology. That's the same reason I think the Affero GPL is non-free: it specifies HTTP as a medium, which makes it impossible to make derivative works that are servers but not HTTP servers. As for make an offer: just as I don't consider the GPL's 3-year offer requirement free on its own[1], I wouldn't consider the same requirement free in this context: every time I modify the software and install it on my server, I'd have to archive the source, just in case somebody requests that revision. And consider again the case of distributing Wikipedia-like content via SMS, where this content changes regularly: you would again need to archive every version (since as stated above, you can't accompany each transmitted version with its source under GPL 3a). As a side argument, even making such an offer is costly in this context. I don't think I'd buy the argument that but we allow that with the GPL (that is, we allow it to require the copyright/output blurb, which is comparable to requiring an output of an offer of source), because I don't think many people have seriously considered the GPL's output blurbs in this context. That sounds a lot like I think this argument might work against the GPL in this case too, so let's not go there.. :) A copyright notice is only a handful of bytes, and other than a medium like SMS, there are few cases where it would be difficult to include. It might also be possible to only provide it once per user; I don't know if that would be legal, but it certainly seems reasonable. As for possibility of a large mandatory output blurb, I tend to agree with those who say that GPL 2c is extremely close to the line (if not over it), and that in any other license it would be considered non-free. Furthermore, in the cases given above for distributing a GPLed work via SMS, you would have the same problem. I think distribution via SMS is a pathological case, and you can probably find many ways in which existing licenses would cause
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: Glenn Maynard wrote: Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. Agreed. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think that's a non-free boundary at all. The GPL has the same make available on the same medium clause, so the No, it doesn't -- for two reasons. First, the referrerents are diffent. same medium as the binary and same medium as the interface are different. What if this is a kiosk? Must I provide source by scrolling it up the screen? Second, the GPL talks about a medium customarily used for software exchange. It specifically *doesn't* require the same medium, party to avoid this bug. only reason you are suggesting it shouldn't apply here is because you are providing a service rather than distributing a GPLed work. See below for a case where providing source for a distributed work could be just as onerous. Consider what would happen if you started a service to provide GPLed Wikipedia-like content via SMS. (Ignore the fact that Wikipedia itself is GFDLed; consider a hypothetical GPLed version.) In this case, you would have the same requirement to provide source to the recipients. Are we talking about the content, or the server? The source to the provided works seems perfectly reasonable. Providing the full source to this Wikipedia-like encyclopedia via SMS would be nearly impossible and prohibitively expensive, and as you said above, quite useless to the recipient. (And I don't think providing only the source for each page would be acceptable, nor would it really be feasible or useful either.) You would again need to provide the source via a separate medium. Why wouldn't providing the source for the page be acceptable? It's the work which is being copied to you. And Wikipedia is a great example of this: the source for a page is roughly the same order of magnitude as the page, and there's a link *right there* on every page to get the source. So you could GPL the content of Wikipedia and it would work fine as is, even over WAP for cellphones. Also, consider the more modern version of SMS, called MMS. It can be used to transmit large quantities of data to a phone, including pictures, video, *applets*, etc. This is clearly distribution. Suppose an applet were GPLed. It still would be difficult to transmit the source to people's phones (or perhaps impossible, if the complete source were too large). Sure, but that doesn't help with the SMS case. And if you can get applets on your phone, you can get an editor on your phone. Maybe even a network interface to a fast machine with a compiler, to bring in another example. Yet we do not say the GPL is non-free because of these cases, nor should we. Just because a requirement to provide source code might be inconvenient or even impossible in a particular case does not mean the license is non-free. Actually, I think it does. A requirement which makes some *uses* (not business models) impossible is non-free. You're placing requirements on use cases, so I don't expect you to like that model. But if you want to convince people that you can do required source distribution on use, you've got to find a way to do it that's universally applicable. I don't think an alternative, make it available by some medium--for example, setting up a webserver and pointing to it--is reasonable, since it boils down to if you run an SMS server, you must also run a webserver. That becomes an unrecoupable expense if nobody actually downloads it. If I'm not already running a webserver, merely setting one up will cost me monthly. That is one of many alternatives; others include mail-order CDs (if you think you won't get many requests), email me for the source, etc. How about email me to work out a method? A copyright notice is only a handful of bytes, and other than a medium like SMS, there are few cases where it would be difficult to include. Traffic lights, elevator controls, all those situations where the user thinks he's interacting with a machine, not some piece of software. And the copyright notices for *every library in use* would be insane. Furthermore, in the cases given above for distributing a GPLed work via SMS, you would have the same problem. I think distribution via SMS is a pathological case, and you can probably find many ways in which existing licenses
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: Well, I'm not reciting, dancing, or acting postfix. I'm not rendering it or playing it either, as far as I can tell. I don't even *see* its code, which seems quite different from music I'm playing or a dramatic work I'm rendering. playing is a rather generic word (example sentences from dictionary.com include The fountains played in the courtyard and played the matter quietly). I don't see that you're not playing it. Alternatively, you might want to argue that computer programs are not copyrightable at all [based on arguments analogous to the one you're presenting now]. playing a CD or a player piano, I still don't see the output at all. I do not perceive the work in any way. I'll agree that you're not seeing the raw bits, but nobody ever sees the raw bits. Instead, you see things resulting from those bits. You just defeated yourself. Nobody has ever tried to extend the copyright of a program to include output produced when running the program. Why would this be different when the program sends its output over a network? -- Måns Rullgård [EMAIL PROTECTED]
Re: Web application licenses
On Wed, 18 Aug 2004, Måns Rullgård wrote: Nobody has ever tried to extend the copyright of a program to include output produced when running the program. If no one has tried, it's because it's quite trivial to contruct a case where a program's output is copyrightable and covered by the copyright of the program. Consider a script that calls imagemagick to create an copyrightable image steming entirely from information contained in the script. Or a LaTeX program for that matter. Don Armstrong -- There are two major products that come out of Berkeley: LSD and UNIX. We don't believe this to be a coincidence. -- Jeremy S. Anderson http://www.donarmstrong.com http://rzlab.ucr.edu
Re: Web application licenses
Don Armstrong [EMAIL PROTECTED] writes: On Wed, 18 Aug 2004, Måns Rullgård wrote: Nobody has ever tried to extend the copyright of a program to include output produced when running the program. If no one has tried, it's because it's quite trivial to contruct a case where a program's output is copyrightable and covered by the copyright of the program. Consider a script that calls imagemagick to create an copyrightable image steming entirely from information contained in the script. Or a LaTeX program for that matter. OK, I forgot to mention those cases where the program includes parts of itself in the output. However, there is no way an email sent through postfix can be a work derived from the postfix code. The same reasons apply here as to compilers. The copyright of object code produced by a compiler is exactly the same as that of the source file. Compiling the source code is considered use of the compiler, and the output is not a work derived from the compiler. -- Måns Rullgård [EMAIL PROTECTED]
Re: Web application licenses
Don Armstrong wrote: On Wed, 18 Aug 2004, Måns Rullgård wrote: Nobody has ever tried to extend the copyright of a program to include output produced when running the program. If no one has tried, it's because it's quite trivial to contruct a case where a program's output is copyrightable and covered by the copyright of the program. Consider a script that calls imagemagick to create an copyrightable image steming entirely from information contained in the script. Or a LaTeX program for that matter. Don Armstrong I think Bison is a good example here: The parts of the output that are copied from Bison's source code remain part of Bison, and are licensed under Bison's license. The parts of the output that are derived from the input are a mechanically transformed version of the input, and thus have the same copyright and license as the input.* Together, the combined work must satisfy both licenses; With the parts from Bison taken out, the work is the input, albeit mechanically transformed. * (Non-creative transformations do not create derived works - a uuencoded, tarred, etc. version of a work is not derived from the work, it /is/ the work.) GNU seems to be very much of the opinion that transformations of the source code are copyrightable, while output that depends on the input is not: http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForNF It might also be worth noting that proprietary applications such as Microsoft Office don't use copyright to restrict 'public performance' of the program, instead relying on an EULA (http://download.microsoft.com/download/1/2/5/12538ba0-3d24-4f00-aab1-dd9ff4aacfc9/en_client_eula.pdf). -- Lewis Jardine IANAL IANADD
Re: Web application licenses
On Wed, Aug 18, 2004 at 11:56:11AM +0200, Måns Rullgård wrote: OK, I forgot to mention those cases where the program includes parts of itself in the output. However, there is no way an email sent through postfix can be a work derived from the postfix code. The same reasons apply here as to compilers. The copyright of object code produced by a compiler is exactly the same as that of the source file. Compiling the source code is considered use of the compiler, and the output is not a work derived from the compiler. I think it's clear that, in the general case, this service class of restrictions goes beyond copyright law, which puts it in the contract license category. I don't know of any use restrictions which we consider free[1], and I'm not aware of any licenses in Debian which form a contract with the user (versus simply granting permissions); I'm very wary of them. I'm also wary of them for other reasons. There's an argument that as no compensation is provided by users, in some jurisdictions it's impossible to form a binding contract, which means that regardless of anything the contract says, the author may be able to take it away at whim as if it had a revocation clause. (I've seen counterarguments like agreement to warranty disclaimer is compensation, but I'm not yet convinced of that.) http://lwn.net/Articles/60057 and http://lwn.net/Articles/61292 suggest some other possible issues with contract licenses. Finally, I think it's a very useful goal for Debian to be *usable* without having to worry about license conditions. Users should be able to trust that licenses in Debian restrict only distribution, and don't attempt to restrict simple use in any way (which includes, in my mind, using proftpd to distribute my files). By my (poor) understanding, an enforcable copyright license, which by definition can only restrict distribution, can't break this; but contract licenses can. This service class of licenses is designed to. [1] I'm not sure if advertising clauses count; they're something like use restrictions (in that they seem to go beyond copyright), but they don't talk about use. -- Glenn Maynard
Re: Web application licenses
Lewis Jardine writes: It might also be worth noting that proprietary applications such as Microsoft Office don't use copyright to restrict 'public performance' of the program, instead relying on an EULA (http://download.microsoft.com/download/1/2/5/12538ba0-3d24-4f00-aab1-dd9ff4aacfc9/en_client_eula.pdf). Microsoft uses that EULA to mention a lot of other rights reserved by copyright law, like how many copies you can make, or whether your license to distribute Media Elements is transferable. Those examples are just from skimming the first page; a public performance ban in the EULA does not mean that public performance is not also protected by copyright law. Michael Poole
Re: Web application licenses
I'll agree that you're not seeing the raw bits, but nobody ever sees the raw bits. Instead, you see things resulting from those bits. On Wed, Aug 18, 2004 at 09:51:13AM +0200, Måns Rullgård wrote: You just defeated yourself. Nobody has ever tried to extend the copyright of a program to include output produced when running the program. Why would this be different when the program sends its output over a network? This is kinda like: Don't be silly. If there were a $10 bill on the street, someone would have already picked it up. However, I'll agree that copyright law doesn't fit very well into the realm of computer programs and machine-machine communications. That's not what it was designed to for. -- Raul
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: Alternatively, you might want to argue that computer programs are not copyrightable at all [based on arguments analogous to the one you're presenting now]. The execution isn't, any more than the cycle of an engine is copyrightable. The code is. In other words, the creative expression is, but the function is not. So execution of code is not protected by copyright any more than any other machine is. Running some code doesn't interact with the creative parts, only the functional parts, so that's not protected by copyright[1]. This is old news. -Brian [1] I'm being a bit fast and loose here in not dealing with quines or programs that print poetry. In that case, it's not the running program that is protected, but the output of that program which is a duplication and transmission of a creative work. -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
On Tue, 17 Aug 2004, Brian Thomas Sniffen wrote: I don't interact with Postfix. I also don't interact with the kernel. I interact with things that interact with those -- Gnus, and Emacs, for example. But many of the commands I run don't give me any output; they just change the state of the world in some way. Often, those ways are not perceivable to me. I don't interact with a web application. I interact with a browser
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: Alternatively, you might want to argue that computer programs are not copyrightable at all [based on arguments analogous to the one you're presenting now]. On Wed, Aug 18, 2004 at 11:50:32AM -0400, Brian Thomas Sniffen wrote: The execution isn't, any more than the cycle of an engine is copyrightable. The code is. In other words, the creative expression is, but the function is not. I agree with you here. So execution of code is not protected by copyright any more than any other machine is. Running some code doesn't interact with the creative parts, only the functional parts, so that's not protected by copyright[1]. This is old news. I disagree with you here. [1] I'm being a bit fast and loose here in not dealing with quines or programs that print poetry. In that case, it's not the running program that is protected, but the output of that program which is a duplication and transmission of a creative work. I agree with you here. -- Raul
Re: Web application licenses
Ken Arromdee [EMAIL PROTECTED] writes: On Tue, 17 Aug 2004, Brian Thomas Sniffen wrote: I don't interact with Postfix. I also don't interact with the kernel. I interact with things that interact with those -- Gnus, and Emacs, for example. But many of the commands I run don't give me any output; they just change the state of the world in some way. Often, those ways are not perceivable to me. I don't interact with a web application. I interact with a browser Exactly. This is one reason why a license that said if you modify Apache and run it so that others can use it, you must offer them the source is not Free. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: Raul Miller [EMAIL PROTECTED] writes: Alternatively, you might want to argue that computer programs are not copyrightable at all [based on arguments analogous to the one you're presenting now]. On Wed, Aug 18, 2004 at 11:50:32AM -0400, Brian Thomas Sniffen wrote: The execution isn't, any more than the cycle of an engine is copyrightable. The code is. In other words, the creative expression is, but the function is not. I agree with you here. So execution of code is not protected by copyright any more than any other machine is. Running some code doesn't interact with the creative parts, only the functional parts, so that's not protected by copyright[1]. This is old news. I disagree with you here. Well, maybe I'm mistaken in some way there. Can you explain to me why and how copyright limits me from running a program against the wishes of the author? [1] I'm being a bit fast and loose here in not dealing with quines or programs that print poetry. In that case, it's not the running program that is protected, but the output of that program which is a duplication and transmission of a creative work. I agree with you here. -- Raul -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
So execution of code is not protected by copyright any more than any other machine is. Running some code doesn't interact with the creative parts, only the functional parts, so that's not protected by copyright[1]. This is old news. Raul Miller [EMAIL PROTECTED] writes: I disagree with you here. On Wed, Aug 18, 2004 at 03:00:42PM -0400, Brian Thomas Sniffen wrote: Well, maybe I'm mistaken in some way there. Can you explain to me why and how copyright limits me from running a program against the wishes of the author? I don't think this is a big issue -- I believe you already stated that you were oversimplifying. Basically, what you were saying is true for a typical class of programs but need not be true for the general case. -- Raul
Re: Web application licenses
On Wed, 18 Aug 2004, Måns Rullgård wrote: Don Armstrong [EMAIL PROTECTED] writes: On Wed, 18 Aug 2004, Måns Rullgård wrote: Nobody has ever tried to extend the copyright of a program to include output produced when running the program. If no one has tried, it's because it's quite trivial to contruct a case where a program's output is copyrightable and covered by the copyright of the program. the output is not a work derived from the compiler. Finally we've come to the critical point. It doesn't really matter if you're dealing with a public performance or not. All that matters is whether or not the output is a work derived from the program. For some compilers, it might be. For others, possibly not. Don Armstrong -- [A] theory is falsifiable [(and therefore scientific) only] if the class of its potential falsifiers is not empty. -- Sir Karl Popper _The Logic of Scientific Discovery_ §21 http://www.donarmstrong.com http://rzlab.ucr.edu
Re: Web application licenses
On Wed, Aug 18, 2004 at 01:16:44PM -0700, Don Armstrong wrote: On Wed, 18 Aug 2004, Måns Rullgård wrote: Don Armstrong [EMAIL PROTECTED] writes: On Wed, 18 Aug 2004, Måns Rullgård wrote: Nobody has ever tried to extend the copyright of a program to include output produced when running the program. If no one has tried, it's because it's quite trivial to contruct a case where a program's output is copyrightable and covered by the copyright of the program. the output is not a work derived from the compiler. Finally we've come to the critical point. It doesn't really matter if you're dealing with a public performance or not. All that matters is whether or not the output is a work derived from the program. For some compilers, it might be. For others, possibly not. As a general point of note, it is *really hard* to implement a correct C compiler where the output isn't derived from the compiler in some respects. Most languages are similar. -- .''`. ** Debian GNU/Linux ** | Andrew Suffield : :' : http://www.debian.org/ | `. `' | `- -- | signature.asc Description: Digital signature
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: 17 USC 101 and Articles 4 and 8 of the WIPO Copyright Treaty probably suffice. They definitely classify a network-provided application as public performance -- unless you believe that executing a program does not count as a performance of it, which to me sounds far out-there. On Sat, Aug 14, 2004 at 11:20:54AM -0400, Brian Thomas Sniffen wrote: [quotes 17 USC 101 definitions of performance...] In other words, it's very clear that my running postfix to send you this message is not a public performance of postfix. It's very clear to me that performance and public performance are two different things -- cases of public performance being a subset of cases of performance. It's also clear to me, from reading the bit of 17 USC 101 you quoted, that running postfix constitutes a performance, even if it's not a public performance. -- Raul
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: Michael Poole [EMAIL PROTECTED] writes: 17 USC 101 and Articles 4 and 8 of the WIPO Copyright Treaty probably suffice. They definitely classify a network-provided application as public performance -- unless you believe that executing a program does not count as a performance of it, which to me sounds far out-there. On Sat, Aug 14, 2004 at 11:20:54AM -0400, Brian Thomas Sniffen wrote: [quotes 17 USC 101 definitions of performance...] In other words, it's very clear that my running postfix to send you this message is not a public performance of postfix. It's very clear to me that performance and public performance are two different things -- cases of public performance being a subset of cases of performance. It's also clear to me, from reading the bit of 17 USC 101 you quoted, that running postfix constitutes a performance, even if it's not a public performance. That would be this bit? To ''perform'' a work means to recite, render, play, dance, or act it, either directly or by means of any device or process or, in the case of a motion picture or other audiovisual work, to show its images in any sequence or to make the sounds accompanying it audible. Well, I'm not reciting, dancing, or acting postfix. I'm not rendering it or playing it either, as far as I can tell. I don't even *see* its code, which seems quite different from music I'm playing or a dramatic work I'm rendering. The motion picture/audiovisual phrase doesn't apply at all. And the device-or-process bit doesn't help you, because unlike the case of playing a CD or a player piano, I still don't see the output at all. I do not perceive the work in any way. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: The motion picture/audiovisual phrase doesn't apply at all. And the device-or-process bit doesn't help you, because unlike the case of playing a CD or a player piano, I still don't see the output at all. I do not perceive the work in any way. Come again? Exactly how do you interact with the program if you don't perceive it? Michael Poole
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: The motion picture/audiovisual phrase doesn't apply at all. And the device-or-process bit doesn't help you, because unlike the case of playing a CD or a player piano, I still don't see the output at all. I do not perceive the work in any way. Come again? Exactly how do you interact with the program if you don't perceive it? I don't interact with Postfix. I also don't interact with the kernel. I interact with things that interact with those -- Gnus, and Emacs, for example. But many of the commands I run don't give me any output; they just change the state of the world in some way. Often, those ways are not perceivable to me. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Raul Miller [EMAIL PROTECTED] writes: It's also clear to me, from reading the bit of 17 USC 101 you quoted, that running postfix constitutes a performance, even if it's not a public performance. On Tue, Aug 17, 2004 at 07:25:54PM -0400, Brian Thomas Sniffen wrote: That would be this bit? To ''perform'' a work means to recite, render, play, dance, or act it, either directly or by means of any device or process or, in the case of a motion picture or other audiovisual work, to show its images in any sequence or to make the sounds accompanying it audible. Yes. Well, I'm not reciting, dancing, or acting postfix. I'm not rendering it or playing it either, as far as I can tell. I don't even *see* its code, which seems quite different from music I'm playing or a dramatic work I'm rendering. playing is a rather generic word (example sentences from dictionary.com include The fountains played in the courtyard and played the matter quietly). I don't see that you're not playing it. Alternatively, you might want to argue that computer programs are not copyrightable at all [based on arguments analogous to the one you're presenting now]. playing a CD or a player piano, I still don't see the output at all. I do not perceive the work in any way. I'll agree that you're not seeing the raw bits, but nobody ever sees the raw bits. Instead, you see things resulting from those bits. Thanks, -- Raul
Re: Web application licenses
Brian Thomas Sniffen writes: But in your model, am I performing the MUA, the MTA, the network stack, libc, the firewall, the NAT software, the routers in between, Spamassassin on your side, the mailing list manager, your MTA, MDA, or MUA? All of them? You perform the MUA, MTA, network stack, libc and anything else you cause to run on your side. You sending mail would be private performance of those, because you both operate and invoke the software, and so you would not be bound by restrictions on their public performance. I would be publicly performing the MTA on my end for you when my MTA accepts mail from you. Execution of my mail filters, MDA and MUA are private performance on my part. I do not see how altering the data in transit is pertinent. Are you arguing that because some application uses IPv4, it can be encumbered by a copyright license on code running on a router, or vice versa? No, but surely the person running the router is performing its code, in your model. And if the router alters data in transit, then it creates a derivative work as it passes the packets along, right? Surely, then, the license on that alteration matters. Yes, the person operating the router is publicly performing the router's code. However, because mechanical transformations are not derivative works under copyright law, and because communications providers are allowed to forward data on request[1], the router's forwarding actions do not infringe any copyright on either the data or programs that generate the data. [1]- 17 USC 111(a)(3), plus any implicit permission from originator. Michael Poole
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: But in your model, am I performing the MUA, the MTA, the network stack, libc, the firewall, the NAT software, the routers in between, Spamassassin on your side, the mailing list manager, your MTA, MDA, or MUA? All of them? You perform the MUA, MTA, network stack, libc and anything else you cause to run on your side. You sending mail would be private performance of those, because you both operate and invoke the software, and so you would not be bound by restrictions on their public performance. I would be publicly performing the MTA on my end for you when my MTA accepts mail from you. Execution of my mail filters, MDA and MUA are private performance on my part. But there's no creativity in my execution of that code -- only what was originally there. That is, since a computer program is partly creative expression of an idea, and partly a functional device, copyright law protects the former but not the latter. So in executing the code, I'm not interacting with the creative expression at all: I'm using it, not performing it. That's no more a public performance than driving a well-designed sports car is a public performance of its design. I do not see how altering the data in transit is pertinent. Are you arguing that because some application uses IPv4, it can be encumbered by a copyright license on code running on a router, or vice versa? No, but surely the person running the router is performing its code, in your model. And if the router alters data in transit, then it creates a derivative work as it passes the packets along, right? Surely, then, the license on that alteration matters. Yes, the person operating the router is publicly performing the router's code. However, because mechanical transformations are not derivative works under copyright law, and because communications providers are allowed to forward data on request[1], the router's forwarding actions do not infringe any copyright on either the data or programs that generate the data. I wasn't talking about a purely mechanical transformation -- consider that I replace one out of every thousand packets with my own poetry. The license on the poetry then does matter. I suspect you may misunderstand the way in which mechanical transformations are not derivative works -- it's not that there's no copyright on the work after it's been transformed, but rather that it's exactly the same copyright as before transformation. [1]- 17 USC 111(a)(3), plus any implicit permission from originator. Michael Poole -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: Yes, the person operating the router is publicly performing the router's code. However, because mechanical transformations are not derivative works under copyright law, and because communications providers are allowed to forward data on request[1], the router's forwarding actions do not infringe any copyright on either the data or programs that generate the data. I wasn't talking about a purely mechanical transformation -- consider that I replace one out of every thousand packets with my own poetry. The license on the poetry then does matter. I suspect you may misunderstand the way in which mechanical transformations are not derivative works -- it's not that there's no copyright on the work after it's been transformed, but rather that it's exactly the same copyright as before transformation. I understand that the copyright is the same as for the original form. That is why the licenses don't affect each other. For reasons that apparently are not so obvious as I thought, I did not deal with such a peculiar and legally dangerous operation as some network element replacing data mid-stream. Even if someone did that, I do not see why it would avoid restrictions on public performance of a program. Michael
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: Yes, the person operating the router is publicly performing the router's code. However, because mechanical transformations are not derivative works under copyright law, and because communications providers are allowed to forward data on request[1], the router's forwarding actions do not infringe any copyright on either the data or programs that generate the data. I wasn't talking about a purely mechanical transformation -- consider that I replace one out of every thousand packets with my own poetry. The license on the poetry then does matter. I suspect you may misunderstand the way in which mechanical transformations are not derivative works -- it's not that there's no copyright on the work after it's been transformed, but rather that it's exactly the same copyright as before transformation. I understand that the copyright is the same as for the original form. That is why the licenses don't affect each other. For reasons that apparently are not so obvious as I thought, I did not deal with such a peculiar and legally dangerous operation as some network element replacing data mid-stream. Even if someone did that, I do not see why it would avoid restrictions on public performance of a program. It's not peculiar and dangerous; it's relatively common. Many HTTP proxies, for example, do this. What I'm trying to point out is that transformations happen along the way. Not all of them are strictly mechanical. This was meant to demonstrate the poor public policy of sweeping networked computer programs into the public performance category. In any case, let's look more closely at the router. It is, you assert, a public performance of the router code. So Cisco gets to charge him for this, and separately license this use of IOS? And maybe charge more for use with non-Cisco products? Hm. And Microsoft, they get to license performance of Word by providing its output over a network... oh, that isn't performance? Then why is it performance to provide Apache's output over a network? Now I'm all confused again. How can I tell whether some use of software is a public performance of it, since copyright law doesn't tell me? All it says is stuff about remote public performances involving images and sounds. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: It's not peculiar and dangerous; it's relatively common. Many HTTP proxies, for example, do this. What I'm trying to point out is that transformations happen along the way. Not all of them are strictly mechanical. This was meant to demonstrate the poor public policy of sweeping networked computer programs into the public performance category. Almost by definition, computers perform mechanical transformations. If you have software that can -- and does -- make creative changes to data it processes, any number of people would be interested in it. Otherwise, only people can make changes that alter copyrights. (I ignore trivial changes, like discarding the entire data set, which would eliminate any copyrighted content in the output.) In any case, let's look more closely at the router. It is, you assert, a public performance of the router code. So Cisco gets to charge him for this, and separately license this use of IOS? And maybe charge more for use with non-Cisco products? Hm. Under my model, if they wanted to, they could try that. If they did, they would probably find themselves losing market share to competitors or facing anti-trust lawsuits. And Microsoft, they get to license performance of Word by providing its output over a network... oh, that isn't performance? Then why is it performance to provide Apache's output over a network? Who runs the word processor to produce that output? If it is a member of the public (relative to the person who owns the copy), I would consider that public performance. If you own a copy of Word and run it, that is very different from allowing me to run it, regardless of what you do with the output from your use. Your argument is a form of the long-discredited FUD about the Linux kernel's GPL license contaminating applications that run on it. Michael
Re: Web application licenses
Brian Thomas Sniffen writes: I disbelieve that, without agreeing to some EULA forbidding it, I am forbidden by copyright law to install a computer game in a public place. I might be wrong, but that sounds far enough out-there that I'd want to see references. 17 USC 101 and Articles 4 and 8 of the WIPO Copyright Treaty probably suffice. They definitely classify a network-provided application as public performance -- unless you believe that executing a program does not count as a performance of it, which to me sounds far out-there. On the other hand, I don't see how that's at all connected to the case in question: use of software by network service, and whether it's Free to require that source to such software be provided. I believe that use of software over a network (by members of the public) is public performance of it, and protected under copyright law. If that is correct, the argument over what it means to access the software over a network is moot, since public performance is not defined in terms of how the user accesses the work. People accept the GPL's boundary of copyleft (components normally shipped with the computer); that can certainly be applied to network servers, avoiding the argument that if the kernel and C library used such a license you might have to distribute sources for them too. I do not have wording that adequately balances freedom of use with copyleft for modified network services, but neither do I have proof that such a balance is impossible. My point in the above is to argue that copyright law _could_ enforce that kind of balance if someone finds one. Michael Poole
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: I disbelieve that, without agreeing to some EULA forbidding it, I am forbidden by copyright law to install a computer game in a public place. I might be wrong, but that sounds far enough out-there that I'd want to see references. 17 USC 101 and Articles 4 and 8 of the WIPO Copyright Treaty probably suffice. They definitely classify a network-provided application as public performance -- unless you believe that executing a program does not count as a performance of it, which to me sounds far out-there. Section 101 very clearly says: To ''perform'' a work means to recite, render, play, dance, or act it, either directly or by means of any device or process or, in the case of a motion picture or other audiovisual work, to show its images in any sequence or to make the sounds accompanying it audible. To perform or display a work ''publicly'' means - (1) to perform or display it at a place open to the public or at any place where a substantial number of persons outside of a normal circle of a family and its social acquaintances is gathered; or (2) to transmit or otherwise communicate a performance or display of the work to a place specified by clause (1) or to the public, by means of any device or process, whether the members of the public capable of receiving the performance or display receive it in the same place or in separate places and at the same time or at different times. To ''transmit'' a performance or display is to communicate it by any device or process whereby images or sounds are received beyond the place from which they are sent. In other words, it's very clear that my running postfix to send you this message is not a public performance of postfix. On the other hand, I don't see how that's at all connected to the case in question: use of software by network service, and whether it's Free to require that source to such software be provided. I believe that use of software over a network (by members of the public) is public performance of it, and protected under copyright law. If that is correct, the argument over what it means to access the software over a network is moot, since public performance is not defined in terms of how the user accesses the work. I used to believe that too. Then I read the relevant law. Unless it's changed dramatically regarding public performance in the last five years, I believe that is not the case. Policy-wise, it might be a good idea. But it isn't the law now. People accept the GPL's boundary of copyleft (components normally shipped with the computer); that can certainly be applied to network servers, avoiding the argument that if the kernel and C library used such a license you might have to distribute sources for them too. But what's the OS for the network? Why is the web server on the other end relevant, as well as the CGI script it's presenting, but not the network equipment in between? Especially if it's altering the data in transit? I do not have wording that adequately balances freedom of use with copyleft for modified network services, but neither do I have proof that such a balance is impossible. My point in the above is to argue that copyright law _could_ enforce that kind of balance if someone finds one. I'm not convinced. Look, I'm claiming something is likely impossible. It's very easy to prove me wrong: provide a demonstration. A demonstration would even be useful, since we could then guarantee more freedom to users. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: In other words, it's very clear that my running postfix to send you this message is not a public performance of postfix. Perhaps that is clear to you. I think to execute software is to render it, even if you do not use common sense in applying the standards for literary work to software. In the absence of specific case law (I could not find any), we may have to agree to disagree. People accept the GPL's boundary of copyleft (components normally shipped with the computer); that can certainly be applied to network servers, avoiding the argument that if the kernel and C library used such a license you might have to distribute sources for them too. But what's the OS for the network? Why is the web server on the other end relevant, as well as the CGI script it's presenting, but not the network equipment in between? Especially if it's altering the data in transit? I do not see how altering the data in transit is pertinent. Are you arguing that because some application uses IPv4, it can be encumbered by a copyright license on code running on a router, or vice versa? Michael Poole
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: In other words, it's very clear that my running postfix to send you this message is not a public performance of postfix. Perhaps that is clear to you. I think to execute software is to render it, even if you do not use common sense in applying the standards for literary work to software. In the absence of specific case law (I could not find any), we may have to agree to disagree. That's not common sense -- the copyright law special-cases literary works, sound recordings, musical compositions intended for dramatic works and those not so intended, and so on. That is, it special-cases *everything*. Public performance is very clearly described, and the definition lists images and sounds -- the software transmitting this message has neither. So in sending this, I'm not performing any software. But in your model, am I performing the MUA, the MTA, the network stack, libc, the firewall, the NAT software, the routers in between, Spamassassin on your side, the mailing list manager, your MTA, MDA, or MUA? All of them? People accept the GPL's boundary of copyleft (components normally shipped with the computer); that can certainly be applied to network servers, avoiding the argument that if the kernel and C library used such a license you might have to distribute sources for them too. But what's the OS for the network? Why is the web server on the other end relevant, as well as the CGI script it's presenting, but not the network equipment in between? Especially if it's altering the data in transit? I do not see how altering the data in transit is pertinent. Are you arguing that because some application uses IPv4, it can be encumbered by a copyright license on code running on a router, or vice versa? No, but surely the person running the router is performing its code, in your model. And if the router alters data in transit, then it creates a derivative work as it passes the packets along, right? Surely, then, the license on that alteration matters. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Glenn Maynard wrote: On Thu, Aug 12, 2004 at 10:32:56AM -0700, Josh Triplett wrote: True. The question becomes: is it too onerous? After all, people have said the GPL is onerous. Consider the reference card scenario. Either you distribute source at the same time (which is extremely onerous for a reference card) or you use the offer valid for three years approach (which is not considered the Free option in the GPL). Well, the measure of my personal opinion is whether I'd cease using and/or modifying a work because of a requirement. I don't expect Debian to comply with that, but I hope it's a relevant data point. If Apache required me to distribute source if I used it as a server, I'd immediately stop using it and I'd never consider contributing to it, because I don't want to have to serve a local mirror of the Apache source in order to use it. As you said, that's not a criteria Debian can use; you need to quantify exactly what fails your I'd cease using and/or modifying a work critera. If anything that requires you to provide source for the server software you use to those who interact with that server would fail it, then no license that attempted to cover providing source to users of a service would ever fulfill your criteria. I personally think that requirement is reasonable. Point them to ftp.debian.org no longer works if I had to modify a couple lines of code to get the thing to compile, so I don't think that avoids the fact that the above is overburdensome. It's also risky; if ftp.debian.org goes down, I may be in violation of the license indefinitely, unless I happen to notice. Also, ftp.debian.org doesn't keep source for all old packages around; if I don't upgrade my testing machine, my binary won't match the source on that server, and I'll be in violation. snapshot.debian.net then. And don't forget that you are allowed to recoup your costs of performing source distribution. (That doesn't address first couple points. I don't want to expose myself to liability based on Debian's servers remaining where they are.) I don't think Debian's archives are relevant, because they no longer help when I've made simple modifications. It makes the case of using the software unmodified easier, but the case of using it modified is just as important, and there won't always be a free third-party mirror available--the existance or lack of an FTP server can't sanely change whether a license is free or not. I think that, for this discussion, we should assume every piece of relevant software is modified, since that's the hardest case to get right. If you can get that case to work, unmodified use should be easy. Agreed; if the license is not free for modified use (where you need to distribute the modified version yourself), it is not free. However, you didn't respond to the fact that you are allowed to recoup your costs; does that affect your argument that a requirement to distribute source is excessively burdensome? In practice, none of this, when applied to binary distribution (GPL), has ever been a serious problem for me: binaries and source tend to be of a similar magnitude in size--making a 5-meg source available with a 5-meg binary is generally not a big jump. Making a 6-meg source available with a 10k source file, however, is different by several orders of magnitude. I would not use Apache if it was under this type of license; it fails my personal pain in the ass test. I can think of many cases where the source is larger or more onerous to distribute than the binary. Consider the case where the binary is in an embedded system. Also consider the case when the binary is a printed book, or a reference card, or a printed handout. I don't think requiring distribution of source that's 600 times the size of the actual data being served by the daemon is reasonable at all. What if you are distributing a book, or a handout, or a flyer, or a reference card, and you suddenly have to either include a CD of source with every copy, or include an offer to provide source? That could certainly be considered onerous, and yet it is considered to be Free. I can also easily imagine scenarios for the GPL where the source is far larger than the binary; the kernel source is 30-40MB compressed, and kernels can be compiled to fit on a single floppy. The same is true for the build trees of most embedded systems; the source is far larger than the actual space on the device. The requirement to provide source under the GPL does some cases prevents people from distributing their modifications, since they have the resources to host the binaries but not the much larger source. Nevertheless, we do not consider the GPL non-free. All of this aside, this still looks like a use restriction. Are there any functional use restrictions which we currently allow? The BSD advertising clause (although there are many who would like to change that, myself probably included). That's probably
Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: And obtaining GNU Emacs does not entitle you to run it on a gnu.org machine. Why should this be any different? You have control over your own boxes and what runs on them. I have the same control over mine. If you make software available, I can run it on my boxes, but not on yours unless you permit it. This would still give me Freedom over the software I'm using; what you suggest would infringe _your_ Freedom to decide what software you run on your own hardware. Some software, like Emacs or gcc, is mostly local. Some software, like traffic-signal control software, or homeland-security massive database software, is useful only where it is; it is inherently remote. I have no interest in running my own Giant Database Aggregator of Doom. I just want to make sure *theirs* works right, and doesn't compromise the privacy of citizens. (Ignoring for the moment the fact that citizens should have control over their own governments actions, especially when those actions involve themselves...) No Free license should ever require someone to allow you to modify the software running on a machine that they control, without their permission. That might well advance your own freedom, but at the cost of their freedom. Furthermore, I disagree that any piece of software could only be useful in a certain situation; that assumes that no one could possibly come up with another useful purpose for it, which is almost certainly false. * Allowing a user to log into your box and run the software. So if I want to have a dialup server, it must include the source for all its This sentence seems incomplete. Yes. It should say something about all the dialup's software, or maybe just software I've modified. I don't think one of those cases can be Free if the other isn't, since you should have the right to modify every piece of software you use. Yes, you would have to provide source for the programs users may run on your server, if those programs are covered by this license, or are based on such software. However, that can probably be handled for 99% of the software on that server by saying Get it from *.debian.org. No, I routinely modify all software I install and give those modifications to others. Those are both freedoms Debian wants to guarantee, so a license can't be free if it restricts me from doing them in any quantity. Agreed, but the suggested license does not restrict you from doing so; it places requirements on what you must also do if you do so. For example, look at the response to the stoplight provision here: You really _should_ be able to get the source to everything you interact with that is under this license. On the other hand, that is a good example of how the requirement might be difficult to meet. Then again, the DoT can always choose not to derive their software from software under this license. You're suggesting that some people might want to avoid modifying free software and using it, because they don't want to bear the burden that this would have. That just doesn't sound like free software to me. There are plenty of circumstances under which someone might choose to avoid GPLed software as well due to inconvenience or to license terms that they don't want to comply with, but that doesn't make the GPL non-free; see http://lists.debian.org/debian-legal/2004/08/msg00301.html (Message-ID: [EMAIL PROTECTED]) and http://lists.debian.org/debian-legal/2004/08/msg00324.html (Message-ID: [EMAIL PROTECTED]) for some examples of cases where the GPL could also be burdensome. No, but if I don't have those things then I can't use the software anyway. My point is, you are asking for too much control over how the other party uses their hardware. You should certainly have the right to use it on your own hardware; that would be more freedom than you have now, and certainly enough to consider it Free Software. I'm sure that there is plenty of software in Debian main that neither of us could take advantage of for whatever reason. That does not make the software any less Free. True, but your argument for why they should have to give me copies of their software is that to do so enhances my freedom. I don't understand why that argument applies to software and not hardware. If I implement an Emacs Machine, which provides Emacs but only in hard-wired circuits, but in such a way that it's a derivative of a work under this license, is it free to require me to give you one? To give you the plans? If you give me access to such a machine, you would need to give me the plans for that machine, yes; you certainly would not be required to distribute the machine itself. Why is the answer different for software? It isn't. The plans for software are the source code, and the machine would be the binary. This proposed license would require you to distribute the source code; it says nothing about distributing
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: As you said, that's not a criteria Debian can use; you need to quantify exactly what fails your I'd cease using and/or modifying a work critera. If anything that requires you to provide source for the server software you use to those who interact with that server would fail it, then no license that attempted to cover providing source to users of a service would ever fulfill your criteria. I personally think that requirement is reasonable. Just as Glenn's personal preferences are too fuzzy to work for Debian, so is your definition of users of a service. You need to specify very clearly what you mean to include and what you don't. I don't think any definition can incorporate a reasonable number of users without being non-free, but I am interested to see the attempt. However, you didn't respond to the fact that you are allowed to recoup your costs; does that affect your argument that a requirement to distribute source is excessively burdensome? Individual cost isn't enough; the cost of providing source to a billion people is much higher than a billion times the cost of providing source to one person. What if you are distributing a book, or a handout, or a flyer, or a reference card, and you suddenly have to either include a CD of source with every copy, or include an offer to provide source? That could certainly be considered onerous, and yet it is considered to be Free. That's the only way to get the recipient freedom. Giving source to a user doesn't even guarantee him freedom. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: My point is, you are asking for too much control over how the other party uses their hardware. You should certainly have the right to use it on your own hardware; that would be more freedom than you have now, and certainly enough to consider it Free Software. I'm sure that there is plenty of software in Debian main that neither of us could take advantage of for whatever reason. That does not make the software any less Free. True, but your argument for why they should have to give me copies of their software is that to do so enhances my freedom. I don't understand why that argument applies to software and not hardware. If I implement an Emacs Machine, which provides Emacs but only in hard-wired circuits, but in such a way that it's a derivative of a work under this license, is it free to require me to give you one? To give you the plans? If you give me access to such a machine, you would need to give me the plans for that machine, yes; you certainly would not be required to distribute the machine itself. Why is the answer different for software? It isn't. The plans for software are the source code, and the machine would be the binary. This proposed license would require you to distribute the source code; it says nothing about distributing the binary (if the two are distinct, anyway). OK. So if I'm using a machine to provide you with an Emacs service, I have to give you the plans. For a software machine, does that include the OS kernel? The VMware instance I'm running it in? The underlying OS? The CPU, the network drivers? The GPL has a clear place to draw a line: what is distributed with the work, and not part of the OS. It can do that because it's tying into copyright law, and the idea of distribution is clear. I don't think you have anything like that clear line for use. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: The GPL has a clear place to draw a line: what is distributed with the work, and not part of the OS. It can do that because it's tying into copyright law, and the idea of distribution is clear. I don't think you have anything like that clear line for use. At what point does use of the application send so much of its creative portion to the user that it constitutes distribution? Does sending just one file comprise distribution of the work? The line is not so clear as you imply. Copyright law also reserves the right of public performance for works. There is no clear line for that, but if you ask yourself are the protected elements of this work being made public? it is probably clearer than what does it mean to use software remotely? Michael Poole
Re: Web application licenses
* Josh Triplett [EMAIL PROTECTED] [040812 19:36]: I can think of many cases where the source is larger or more onerous to distribute than the binary. Consider the case where the binary is in an embedded system. Also consider the case when the binary is a printed book, or a reference card, or a printed handout. But the source is elementary for using your freedoms, so it cannot be to onerous to be free software, as it would evade the context. The embedded system is no real counter-example. Adding a CD with the sources additional to the system is all but onerous. With a printed handout: Just have also some CDs or other storage devices ready and offer everyone to also give one of those. Normally noone will want to have one. (No GPL violated, they could have one for no cost, they choose to ignore it). When too many people want it so that it could be onerous, that is normaly a sign that this a justified request. (i.e. something were people need it) Hochachtungsvoll, Bernhard R. Link -- Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: The GPL has a clear place to draw a line: what is distributed with the work, and not part of the OS. It can do that because it's tying into copyright law, and the idea of distribution is clear. I don't think you have anything like that clear line for use. At what point does use of the application send so much of its creative portion to the user that it constitutes distribution? Does sending just one file comprise distribution of the work? The line is not so clear as you imply. What is this creative portion? Use of apache doesn't infringe on the Apache group's copyrights at all, unless you're using it to transmit copies of apache. Copyright law also reserves the right of public performance for works. There is no clear line for that, but if you ask yourself are the protected elements of this work being made public? it is probably clearer than what does it mean to use software remotely? The only way I know of to give a public performance of apache is to rent a hall and read the source code from the stage. Running the program is not a public performance. Why? Because performance of oratory, dance, puppetry, or music itself has creative expression. Yoko Ono and William Shatner each sing Lucy in the Sky rather differently from John and Paul. You *can't* sing an unmodified song. But your machine and mine each run Apache identically. The public performance right is in there to differentiate Yoko Ono singing from Yoko Ono printing up a bunch of copies of the sheet music -- that is, so you can give somebody distribution rights without giving them performance rights. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen writes: The only way I know of to give a public performance of apache is to rent a hall and read the source code from the stage. Running the program is not a public performance. Why? Because performance of oratory, dance, puppetry, or music itself has creative expression. Yoko Ono and William Shatner each sing Lucy in the Sky rather differently from John and Paul. You *can't* sing an unmodified song. I hope you are being facetious about reading the source code from a stage. If not, I suggest you review the applicability of the limit on public performance to things such as audio bitstreams over a network and computer games installed on computers at Internet cafes. Clauses forbidding the latter are common in end-user licenses for multiplayer games; game publishers prefer to charge Internet cafes more for a more permissive license. Most US videos and DVD include a copyright warning that says something to the effect that This film is licensed for private home viewing only. All that is based in the protection of public performance. See, for example, http://www.bitlaw.com/copyright/scope.html#performance. Google is strongly recommended. Michael Poole P.S. I am subscribed to debian-legal; there is no need to Cc me.
Re: Web application licenses
On Thu, Aug 12, 2004 at 10:34:27PM -0700, Josh Triplett wrote: However, you didn't respond to the fact that you are allowed to recoup your costs; does that affect your argument that a requirement to distribute source is excessively burdensome? There's a fair cost involved in just keeping the source around; if I made a quick mod to the software and rebuilt, I don't necessarily want to have the whole source distribution (think kernel or X) hanging around clogging up my hard drive. I can only recoup the cost if someone requests a copy, otherwise it's a sunk cost; but I have to keep the source around just in case. Unless the original licensors are willing to cover that cost for me? No? I didn't think so. In that case I'm out the money. Probably not a lot of money (unless I had to buy a new HDD or tape drive because all these copies of huge source tarballs filled up my available space). - Matt signature.asc Description: Digital signature
Re: Web application licenses
Michael Poole [EMAIL PROTECTED] writes: Brian Thomas Sniffen writes: The only way I know of to give a public performance of apache is to rent a hall and read the source code from the stage. Running the program is not a public performance. Why? Because performance of oratory, dance, puppetry, or music itself has creative expression. Yoko Ono and William Shatner each sing Lucy in the Sky rather differently from John and Paul. You *can't* sing an unmodified song. I hope you are being facetious about reading the source code from a stage. Yes. For example, reading it *without* stage is also public performance. If not, I suggest you review the applicability of the limit on public performance to things such as audio bitstreams over a network and computer games installed on computers at Internet cafes. I disbelieve that, without agreeing to some EULA forbidding it, I am forbidden by copyright law to install a computer game in a public place. I might be wrong, but that sounds far enough out-there that I'd want to see references. On the other hand, I don't see how that's at all connected to the case in question: use of software by network service, and whether it's Free to require that source to such software be provided. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
On Thu, Aug 12, 2004 at 10:34:27PM -0700, Josh Triplett wrote: However, you didn't respond to the fact that you are allowed to recoup your costs; does that affect your argument that a requirement to distribute source is excessively burdensome? Not really, since it's my time that I'm concerned about, and time can't be recouped. Here's a case that I'd remembered vaguely but havn't been able to find again until now: http://lists.debian.org/debian-legal/2003/03/msg00369.html In this case, the only realistic way to fulfill this type of source to network users requirement is by some other channel than the actual network. Costs aside, spamming the source at the SMS receiver is useless; it needs to be sent to a computer. This isn't a matter of resources; the very medium itself is not designed for the transmission of source code, and a make the source available on the same medium could make use in this context not onerous, but impossible, and I think that's a clear non-free boundary. I don't think an alternative, make it available by some medium--for example, setting up a webserver and pointing to it--is reasonable, since it boils down to if you run an SMS server, you must also run a webserver. That becomes an unrecoupable expense if nobody actually downloads it. If I'm not already running a webserver, merely setting one up will cost me monthly. (I'm hoping that we agree that you must run a file distribution server if you use this software is non-free, at least.) As for make an offer: just as I don't consider the GPL's 3-year offer requirement free on its own[1], I wouldn't consider the same requirement free in this context: every time I modify the software and install it on my server, I'd have to archive the source, just in case somebody requests that revision. As a side argument, even making such an offer is costly in this context. I don't think I'd buy the argument that but we allow that with the GPL (that is, we allow it to require the copyright/output blurb, which is comparable to requiring an output of an offer of source), because I don't think many people have seriously considered the GPL's output blurbs in this context. [1] refresher: as we've discussed elsewhere, requiring that I archive the source for every binary I distribute for several years is unreasonable; fortunately, GPL#3a makes this irrelevant What if you are distributing a book, or a handout, or a flyer, or a reference card, and you suddenly have to either include a CD of source with every copy, or include an offer to provide source? That could certainly be considered onerous, and yet it is considered to be Free. I personally don't tend to think that requiring that I include a CD along with a handout is reasonable; it's just a battle that I've never had the inclination to fight. Personally, I don't think this is a use restriction, because I think using software to provide services to others goes beyond your own use, since it involves others; those others deserve freedom as well. The purpose of the restriction isn't what makes it a use restriction or not. If it restricts use, it's a use restriction. This says if you use this program to generate stuff for others, do this and that; that's a use restriction by my understanding, just as is you may not use this software to spam. -- Glenn Maynard
Re: Web application licenses
Glenn Maynard wrote: On Fri, Aug 06, 2004 at 01:15:38PM -0700, Josh Triplett wrote: Note, of course, that you only need to release the source to the work(s) derived from a work under this license, which may not be everything running on the kiosk. (Of course, you _should_, but you are not _required_ to.) ... unless the license is viral. The general case of an entire system under this type of license should be considered; a license shouldn't be considered free if its restrictions become too onerous when applied to lots of pieces of software. Very true. Yes, you would have to provide source for the programs users may run on your server, if those programs are covered by this license, or are based on such software. However, that can probably be handled for 99% of the software on that server by saying Get it from *.debian.org. The case where every piece of software is in some way modified must be considered. Onerous only if modified is still onerous--modification is fundamental. True. The question becomes: is it too onerous? After all, people have said the GPL is onerous. Consider the reference card scenario. Either you distribute source at the same time (which is extremely onerous for a reference card) or you use the offer valid for three years approach (which is not considered the Free option in the GPL). They don't necessarily need to provide source download services, and if they do, they needn't provide those services from the same server that uses the modified Apache. I would be satisfied with any mechanism that provides the machine-readable source for no more than the cost of distribution. This means that, in order to make use of Apache (were it under this type of license), I would have to commit to responding to requests for source, as well as make the offer. That means that I either have to put the source up somewhere--a 6+-meg archive, even if I'm just setting up a daemon to host one 10k text file[1]--or I have to set up some means of contacting me, sending me money to buy media and pay shipping, and I have to spend the time actually burning a CD and driving to a mailbox if somebody decides to request it from me. this is completely unacceptable to me--in practice, it would probably eat about an hour of my time. Point them to ftp.debian.org no longer works if I had to modify a couple lines of code to get the thing to compile, so I don't think that avoids the fact that the above is overburdensome. It's also risky; if ftp.debian.org goes down, I may be in violation of the license indefinitely, unless I happen to notice. Also, ftp.debian.org doesn't keep source for all old packages around; if I don't upgrade my testing machine, my binary won't match the source on that server, and I'll be in violation. snapshot.debian.net then. And don't forget that you are allowed to recoup your costs of performing source distribution. The point is that it is burdensome in some cases does not automatically equate to it is non-free; the GPL and other licenses can be burdensome in some cases as well. In practice, none of this, when applied to binary distribution (GPL), has ever been a serious problem for me: binaries and source tend to be of a similar magnitude in size--making a 5-meg source available with a 5-meg binary is generally not a big jump. Making a 6-meg source available with a 10k source file, however, is different by several orders of magnitude. I would not use Apache if it was under this type of license; it fails my personal pain in the ass test. I can think of many cases where the source is larger or more onerous to distribute than the binary. Consider the case where the binary is in an embedded system. Also consider the case when the binary is a printed book, or a reference card, or a printed handout. [1] even if it's only for my own use, with a password--other people still interact with it, when receiving the access denied page True, but that isn't really the intention. There must be some way to define interact sanely. I really don't want to include access denied; consider the effects on firewalled or other limited-access machines. :) (Of course, a good firewall doesn't even respond with access denied, but that's not relevant here.) - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
On Thu, Aug 12, 2004 at 10:32:56AM -0700, Josh Triplett wrote: True. The question becomes: is it too onerous? After all, people have said the GPL is onerous. Consider the reference card scenario. Either you distribute source at the same time (which is extremely onerous for a reference card) or you use the offer valid for three years approach (which is not considered the Free option in the GPL). Well, the measure of my personal opinion is whether I'd cease using and/or modifying a work because of a requirement. I don't expect Debian to comply with that, but I hope it's a relevant data point. If Apache required me to distribute source if I used it as a server, I'd immediately stop using it and I'd never consider contributing to it, because I don't want to have to serve a local mirror of the Apache source in order to use it. Point them to ftp.debian.org no longer works if I had to modify a couple lines of code to get the thing to compile, so I don't think that avoids the fact that the above is overburdensome. It's also risky; if ftp.debian.org goes down, I may be in violation of the license indefinitely, unless I happen to notice. Also, ftp.debian.org doesn't keep source for all old packages around; if I don't upgrade my testing machine, my binary won't match the source on that server, and I'll be in violation. snapshot.debian.net then. And don't forget that you are allowed to recoup your costs of performing source distribution. (That doesn't address first couple points. I don't want to expose myself to liability based on Debian's servers remaining where they are.) I don't think Debian's archives are relevant, because they no longer help when I've made simple modifications. It makes the case of using the software unmodified easier, but the case of using it modified is just as important, and there won't always be a free third-party mirror available--the existance or lack of an FTP server can't sanely change whether a license is free or not. I think that, for this discussion, we should assume every piece of relevant software is modified, since that's the hardest case to get right. If you can get that case to work, unmodified use should be easy. In practice, none of this, when applied to binary distribution (GPL), has ever been a serious problem for me: binaries and source tend to be of a similar magnitude in size--making a 5-meg source available with a 5-meg binary is generally not a big jump. Making a 6-meg source available with a 10k source file, however, is different by several orders of magnitude. I would not use Apache if it was under this type of license; it fails my personal pain in the ass test. I can think of many cases where the source is larger or more onerous to distribute than the binary. Consider the case where the binary is in an embedded system. Also consider the case when the binary is a printed book, or a reference card, or a printed handout. I don't think requiring distribution of source that's 600 times the size of the actual data being served by the daemon is reasonable at all. All of this aside, this still looks like a use restriction. Are there any functional use restrictions which we currently allow? -- Glenn Maynard
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: And obtaining GNU Emacs does not entitle you to run it on a gnu.org machine. Why should this be any different? You have control over your own boxes and what runs on them. I have the same control over mine. If you make software available, I can run it on my boxes, but not on yours unless you permit it. This would still give me Freedom over the software I'm using; what you suggest would infringe _your_ Freedom to decide what software you run on your own hardware. Some software, like Emacs or gcc, is mostly local. Some software, like traffic-signal control software, or homeland-security massive database software, is useful only where it is; it is inherently remote. I have no interest in running my own Giant Database Aggregator of Doom. I just want to make sure *theirs* works right, and doesn't compromise the privacy of citizens. * Allowing a user to log into your box and run the software. So if I want to have a dialup server, it must include the source for all its This sentence seems incomplete. Yes. It should say something about all the dialup's software, or maybe just software I've modified. Yes, you would have to provide source for the programs users may run on your server, if those programs are covered by this license, or are based on such software. However, that can probably be handled for 99% of the software on that server by saying Get it from *.debian.org. No, I routinely modify all software I install and give those modifications to others. Those are both freedoms Debian wants to guarantee, so a license can't be free if it restricts me from doing them in any quantity. For example, look at the response to the stoplight provision here: You really _should_ be able to get the source to everything you interact with that is under this license. On the other hand, that is a good example of how the requirement might be difficult to meet. Then again, the DoT can always choose not to derive their software from software under this license. You're suggesting that some people might want to avoid modifying free software and using it, because they don't want to bear the burden that this would have. That just doesn't sound like free software to me. No, but if I don't have those things then I can't use the software anyway. My point is, you are asking for too much control over how the other party uses their hardware. You should certainly have the right to use it on your own hardware; that would be more freedom than you have now, and certainly enough to consider it Free Software. I'm sure that there is plenty of software in Debian main that neither of us could take advantage of for whatever reason. That does not make the software any less Free. True, but your argument for why they should have to give me copies of their software is that to do so enhances my freedom. I don't understand why that argument applies to software and not hardware. If I implement an Emacs Machine, which provides Emacs but only in hard-wired circuits, but in such a way that it's a derivative of a work under this license, is it free to require me to give you one? To give you the plans? Why is the answer different for software? -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. Really, the main cases I'm thinking of here are: * Using the software to power a website or web service. But I don't directly use your CGI scripts. They aren't even network-aware. I'm talking to Apache, which you probably haven't modified. In fact, I'm not even talking to Apache. I'm talking to your kernel -- or the network switches between you and me. I'm not even sure I *am* talking to you, what with dynamic routing tables and all. And in fact, I'm not talking to the network at all. I'm just using this unmodified Mozilla Firefox, and it renders various results of RPC calls for me. Hence the problem: the license can't rely too much on common sense. This makes it either too specific (only web services, for example) and therefore miss many cases, or too general (software used to run a business), and become onerous. However, I still think it's possible to write a license that would work. * Using the software in a kiosk that others can directly interact with. OK, *that* I'll agree is reasonably direct. There, you have a work -- the kiosk -- which has components GUI, OS, application, etc. Note, of course, that you only need to release the source to the work(s) derived from a work under this license, which may not be everything running on the kiosk. (Of course, you _should_, but you are not _required_ to.) But if I put up a bronze plaque, should I be obliged to provide the source, complete with build tools, to anyone who can see it? I continue to have trouble seeing how that promotes freedom: even if you have the source, you don't have my kiosk, and you can't just run whatever you want there. For example, even if Debian Airlines gave out the source to its fast-checkin kiosks, that would not give anybody freedom to alter the operation of those kiosks. And obtaining GNU Emacs does not entitle you to run it on a gnu.org machine. Why should this be any different? You have control over your own boxes and what runs on them. I have the same control over mine. If you make software available, I can run it on my boxes, but not on yours unless you permit it. This would still give me Freedom over the software I'm using; what you suggest would infringe _your_ Freedom to decide what software you run on your own hardware. * Allowing a user to log into your box and run the software. So if I want to have a dialup server, it must include the source for all its This sentence seems incomplete. Yes, you would have to provide source for the programs users may run on your server, if those programs are covered by this license, or are based on such software. However, that can probably be handled for 99% of the software on that server by saying Get it from *.debian.org. For example, suppose someone wanted to use GCC as a basis for the compiler for a new language, but they didn't want to release the source for it. All they would need to do is make the changes, put them behind a web-accessible SOAP API, and tell people to use that for compilation (and perhaps distribute a small client for that service to install as /usr/bin/secretarch-gcc). This would sidestep the GPL, since the code is not being distributed to those users; nevertheless, the users of such a service certainly deserve the code behind it, under a Free license. The license I suggested is an attempt to avoid that. I just don't see a way to avoid that in a free way. I understand your motivation for doing this, but I don't think you can do it without prohibiting behavior necessary for freedom. I'd be interested to see a way to do so. I strongly believe there is a way to do it Freely; it just hasn't been found yet. I do wonder what publically means. If I'm offering to hand a CD to anyone who asks me for one in person, is that public enough? Or must I run a web server to distribute it, and thus (assuming this license is broadly used) have to distribute a web server too? Publically meaning that rather than making special arrangements with any
Re: Web application licenses
On Fri, Aug 06, 2004 at 01:15:38PM -0700, Josh Triplett wrote: Note, of course, that you only need to release the source to the work(s) derived from a work under this license, which may not be everything running on the kiosk. (Of course, you _should_, but you are not _required_ to.) ... unless the license is viral. The general case of an entire system under this type of license should be considered; a license shouldn't be considered free if its restrictions become too onerous when applied to lots of pieces of software. Yes, you would have to provide source for the programs users may run on your server, if those programs are covered by this license, or are based on such software. However, that can probably be handled for 99% of the software on that server by saying Get it from *.debian.org. The case where every piece of software is in some way modified must be considered. Onerous only if modified is still onerous--modification is fundamental. They don't necessarily need to provide source download services, and if they do, they needn't provide those services from the same server that uses the modified Apache. I would be satisfied with any mechanism that provides the machine-readable source for no more than the cost of distribution. This means that, in order to make use of Apache (were it under this type of license), I would have to commit to responding to requests for source, as well as make the offer. That means that I either have to put the source up somewhere--a 6+-meg archive, even if I'm just setting up a daemon to host one 10k text file[1]--or I have to set up some means of contacting me, sending me money to buy media and pay shipping, and I have to spend the time actually burning a CD and driving to a mailbox if somebody decides to request it from me. this is completely unacceptable to me--in practice, it would probably eat about an hour of my time. Point them to ftp.debian.org no longer works if I had to modify a couple lines of code to get the thing to compile, so I don't think that avoids the fact that the above is overburdensome. It's also risky; if ftp.debian.org goes down, I may be in violation of the license indefinitely, unless I happen to notice. Also, ftp.debian.org doesn't keep source for all old packages around; if I don't upgrade my testing machine, my binary won't match the source on that server, and I'll be in violation. In practice, none of this, when applied to binary distribution (GPL), has ever been a serious problem for me: binaries and source tend to be of a similar magnitude in size--making a 5-meg source available with a 5-meg binary is generally not a big jump. Making a 6-meg source available with a 10k source file, however, is different by several orders of magnitude. I would not use Apache if it was under this type of license; it fails my personal pain in the ass test. [1] even if it's only for my own use, with a password--other people still interact with it, when receiving the access denied page -- Glenn Maynard
Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: Hmmm, good point. That goes back to the problem regarding Debian not keeping old versions around. I had imagined that the user could usually just point to their distributor unless they personally changed the software, but that doesn't cover the case when that distributor no longer distributes. It also has privacy and security implications. I can't just say This is apache, get it from apache.org. I have to say This is apache version 1.3.26 with the following plugins... and I need to do it in a way accessible to anyone using the software -- even if all I serve them is a buzz off, you're unauthenticated page. But standard advice on network security is *not* to advertise specific banners. I don't think much of that advice, but I sure do see a lot of it. Is it free to make this kind of requirement of users of the software, that they ignore good security practice? If your network would be insecure if someone knew the versions of software you run, then your network is insecure. - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
On Mon, Aug 02, 2004 at 10:22:39PM -0700, Josh Triplett wrote: But standard advice on network security is *not* to advertise specific banners. I don't think much of that advice, but I sure do see a lot of it. Is it free to make this kind of requirement of users of the software, that they ignore good security practice? If your network would be insecure if someone knew the versions of software you run, then your network is insecure. In practice, you're both right: security by obscurity, alone, isn't secure, but in practice it's a very real gain to not advertise immediately what your set of bugs are--if it gives you five more minutes to respond to a security advisory, then it's a win. I won't overgeneralize; some free licenses do place restrictions on security- related decisions (the GPL prevents me from adding some security-related features and not releasing the source for the above reason), but I don't think it's a good thing in general. I should decide my security philosophy, not anyone else. -- Glenn Maynard
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED]: But standard advice on network security is *not* to advertise specific banners. I don't think much of that advice, but I sure do see a lot of it. Is it free to make this kind of requirement of users of the software, that they ignore good security practice? If your network would be insecure if someone knew the versions of software you run, then your network is insecure. Security isn't just a binary quality. In particular, you should worry about someone (or a worm) using a search engine or scan of IP addresses to find vulnerable machines. So, if you do advertise your software version on a web page, it's probably helpful to tell Google, etc not to index that page, and if you put the information in a form that makes it harder to automatically query, that might help, too.
Re: Web application licenses
On Tue, Aug 03, 2004 at 09:40:12AM +0100, Edmund GRIMLEY EVANS wrote: Security isn't just a binary quality. [Can't sleep, trying to find something boring enough to fix that. Didn't quite work...] Security is not always the same thing from one person to the next. Ok, sure, some things are fairly obvious for almost everyone (buffer overflows are bad security -- more generally, anything where what the computer does is different from what the responsible person thinks the computer is doing is bad), but... I'm tempted to bring in Ben Franklin's quote about temporary security. That said, the concept of http headers must say apache 1.36 is so far out of line from free software that it's almost irrelevant. Even if we somehow allowed a requirement to announce specific information about version, a requirement that the software couldn't be upgraded to some locally defined version would make it non-free. -- Raul
Re: Web application licenses
Glenn Maynard [EMAIL PROTECTED] writes: I won't overgeneralize; some free licenses do place restrictions on security- related decisions (the GPL prevents me from adding some security-related features and not releasing the source for the above reason), No, it doesn't. It merely requires that those who have copies of software with the features have the source. So, for example, I could write a hardened web server based on some GPL'd web server and then give copies only to people I trust; as long as I make my trust decisions wisely, only good guys will ever get copies. -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
On Tue, Aug 03, 2004 at 11:11:12AM -0400, Brian Thomas Sniffen wrote: Glenn Maynard [EMAIL PROTECTED] writes: I won't overgeneralize; some free licenses do place restrictions on security- related decisions (the GPL prevents me from adding some security-related features and not releasing the source for the above reason), No, it doesn't. It merely requires that those who have copies of software with the features have the source. So, for example, I could write a hardened web server based on some GPL'd web server and then give copies only to people I trust; as long as I make my trust decisions wisely, only good guys will ever get copies. Which means I can't give my security enhancements to anyone I don't trust; whereas I might be willing to give people binaries to get a minor obscurity benefit for everyone, I won't be able to give it to anyone. I'm not saying this case is a bad thing, that this is a failing of the GPL, or anything like that. It's just the type of thing that makes me not jump all the way to licenses shouldn't make any restrictions on my security decisions. The case under discussion is somewhat different, of course, since it's a use restriction. -- Glenn Maynard
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. Really, the main cases I'm thinking of here are: * Using the software to power a website or web service. But I don't directly use your CGI scripts. They aren't even network-aware. I'm talking to Apache, which you probably haven't modified. In fact, I'm not even talking to Apache. I'm talking to your kernel -- or the network switches between you and me. I'm not even sure I *am* talking to you, what with dynamic routing tables and all. And in fact, I'm not talking to the network at all. I'm just using this unmodified Mozilla Firefox, and it renders various results of RPC calls for me. * Using the software in a kiosk that others can directly interact with. OK, *that* I'll agree is reasonably direct. There, you have a work -- the kiosk -- which has components GUI, OS, application, etc. But if I put up a bronze plaque, should I be obliged to provide the source, complete with build tools, to anyone who can see it? I continue to have trouble seeing how that promotes freedom: even if you have the source, you don't have my kiosk, and you can't just run whatever you want there. For example, even if Debian Airlines gave out the source to its fast-checkin kiosks, that would not give anybody freedom to alter the operation of those kiosks. * Allowing a user to log into your box and run the software. So if I want to have a dialup server, it must include the source for all its For example, suppose someone wanted to use GCC as a basis for the compiler for a new language, but they didn't want to release the source for it. All they would need to do is make the changes, put them behind a web-accessible SOAP API, and tell people to use that for compilation (and perhaps distribute a small client for that service to install as /usr/bin/secretarch-gcc). This would sidestep the GPL, since the code is not being distributed to those users; nevertheless, the users of such a service certainly deserve the code behind it, under a Free license. The license I suggested is an attempt to avoid that. I just don't see a way to avoid that in a free way. I understand your motivation for doing this, but I don't think you can do it without prohibiting behavior necessary for freedom. I'd be interested to see a way to do so. I do wonder what publically means. If I'm offering to hand a CD to anyone who asks me for one in person, is that public enough? Or must I run a web server to distribute it, and thus (assuming this license is broadly used) have to distribute a web server too? Publically meaning that rather than making special arrangements with any particular party, it would be acceptable to tell users of your service that the source is already available from such-and-such location. It's possible that this should be clarified, but I believe that publically available has a legal meaning. That clause was mostly included for convenience, so that you were not required to make arrangements with each individual user who wanted source, and could just provide a notice saying source available here. Perhaps the approach seen in some Free licenses -- provide a way for the source to be obtained is better? A few extra words to add clarity, specifying what we *actually* mean, can only be an improvement. Does the Department of Transportation need to make stoplight software generally available? While I do think government software should always be Free Software and distributed to the public, I would not really classify that case as direct interaction, or really interaction at all. But I manipulate an input device to obtain results from the computer -- I move my car over the magnetometer, and the light changes. If that's built on software under your license, is it direct interaction? How can I be made aware of my rights to the source in that situation? Does google have to make its source code available? If that code is a derivative of code under such a license, then yes. If so, why? It's not going to do anybody else any *good*, since we don't
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: Hmmm, good point. That goes back to the problem regarding Debian not keeping old versions around. I had imagined that the user could usually just point to their distributor unless they personally changed the software, but that doesn't cover the case when that distributor no longer distributes. It also has privacy and security implications. I can't just say This is apache, get it from apache.org. I have to say This is apache version 1.3.26 with the following plugins... and I need to do it in a way accessible to anyone using the software -- even if all I serve them is a buzz off, you're unauthenticated page. But standard advice on network security is *not* to advertise specific banners. I don't think much of that advice, but I sure do see a lot of it. Is it free to make this kind of requirement of users of the software, that they ignore good security practice? -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. Really, the main cases I'm thinking of here are: * Using the software to power a website or web service. * Using the software in a kiosk that others can directly interact with. * Allowing a user to log into your box and run the software. For example, suppose someone wanted to use GCC as a basis for the compiler for a new language, but they didn't want to release the source for it. All they would need to do is make the changes, put them behind a web-accessible SOAP API, and tell people to use that for compilation (and perhaps distribute a small client for that service to install as /usr/bin/secretarch-gcc). This would sidestep the GPL, since the code is not being distributed to those users; nevertheless, the users of such a service certainly deserve the code behind it, under a Free license. The license I suggested is an attempt to avoid that. I do wonder what publically means. If I'm offering to hand a CD to anyone who asks me for one in person, is that public enough? Or must I run a web server to distribute it, and thus (assuming this license is broadly used) have to distribute a web server too? Publically meaning that rather than making special arrangements with any particular party, it would be acceptable to tell users of your service that the source is already available from such-and-such location. It's possible that this should be clarified, but I believe that publically available has a legal meaning. That clause was mostly included for convenience, so that you were not required to make arrangements with each individual user who wanted source, and could just provide a notice saying source available here. Does the Department of Transportation need to make stoplight software generally available? While I do think government software should always be Free Software and distributed to the public, I would not really classify that case as direct interaction, or really interaction at all. Does google have to make its source code available? If that code is a derivative of code under such a license, then yes. If so, why? It's not going to do anybody else any *good*, since we don't have 100 kilomachine clusters sitting around idle to use. So this doesn't get us Freedom; we can't change the google interface we use in practice. And getting a copy of Apache doesn't entitle you to hardware equivalent to that which powers apache.org, and getting a copy of Neverball or BZFlag doesn't entitle you to 3D hardware, and getting a copy of CERNlib doesn't entitle you to a particle accelerator. You would have no rights to change the version of the software Google runs on its own servers. You _could_ deploy the software on your own systems however you pleased. That is certainly Freedom. Slashdot *does* publish its code, but this doesn't give me freedom with respect to Slashdot. Of couse not; you shouldn't be able to control the actual installation of the software on slashdot.org. You can, however, create your own installation, and many people have. I just don't see how compelling source distribution from a networked provider actually increases freedom -- since I don't care about changing the code I have, I care about changing the code *they* have. And similarly, just because Mozilla is Free Software doesn't mean you can directly change the software as distributed from mozilla.org. It only means you can change your copy of Mozilla, and distribute the results to anyone who is interested. I think it's great that some sites publish their code. But I don't see any benefit to freedom from compelling them to do so. On the other hand, a compulsive *open interface* would be a useful thing. Say, if Google were using a weirdly licensed web server which compelled them to provide an RPC function allowing arbitrary queries, so that others could access their data in surprising new ways. This, on the other hand, seems like a ridiculous restriction. No server should mandate what services you must provide using that server. - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] wrote: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. It is difficult for me to see how you define direct use to include something like Apache, but not include something like libc or the kernel. It seems a bit of a stretch to require people to distribute those when they are just running a webserver. It would make it much, much, much, much harder to set up a public website. Regards, Walter Landry [EMAIL PROTECTED]
Re: Web application licenses
Walter Landry wrote: Josh Triplett [EMAIL PROTECTED] wrote: Brian Thomas Sniffen wrote: Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. It is difficult for me to see how you define direct use to include something like Apache, but not include something like libc or the kernel. That's exactly why I corrected it to direct interaction. Although it would be useful to require distribution of a modified libc as well, since it would be linked into Apache under this license. It seems a bit of a stretch to require people to distribute those when they are just running a webserver. It would make it much, much, much, much harder to set up a public website. Consider that 99.9% of sites don't have a locally modified Apache, and could just say unmodified, get it from apache.org (or their distribution's Apache package, if they got it from a distribution). - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: Does the Department of Transportation need to make stoplight software generally available? While I do think government software should always be Free Software and distributed to the public, I would not really classify that case as direct interaction, or really interaction at all. I don't see the distinction. A stop light with a sensor is just a simple multi-player game--you push a key, and it changes the internal state of the game, and if you hit it at the right time, the screen changes color. What about elevator software? There's certainly direct interaction there. For example, suppose someone wanted to use GCC as a basis for the compiler for a new language, but they didn't want to release the source for it. All they would need to do is make the changes, put them behind a web-accessible SOAP API, and tell people to use that for compilation They could also write a translator from that language to C or Java bytecode and use GCC as a backend. They could also make the compiler free and make the library proprietary (a compiler for E used to do this with GCC). Besides the computering power needed to run this, how many people are eager to use a proprietary language where you have to submit all your code to the company? If the website invokes a bash script that invokes sed, recode, GCC, gas and ld, which if any of those seven programs did the user directly interact with? David Starner -- [EMAIL PROTECTED] -- ___ Sign-up for Ads Free at Mail.com http://promo.mail.com/adsfreejump.htm
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] wrote: Walter Landry wrote: Josh Triplett [EMAIL PROTECTED] wrote: My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. It is difficult for me to see how you define direct use to include something like Apache, but not include something like libc or the kernel. That's exactly why I corrected it to direct interaction. Although it would be useful to require distribution of a modified libc as well, since it would be linked into Apache under this license. I don't understand the difference between those terms. In any case, I still don't see how you can word it without requiring one of two things: 1) Someone can write a thin wrapper that you directly interact with. The wrapper merely forwards requests. 2) You require everyone whose machine responds to ping to distribute large parts of the operating system. It seems a bit of a stretch to require people to distribute those when they are just running a webserver. It would make it much, much, much, much harder to set up a public website. Consider that 99.9% of sites don't have a locally modified Apache, and could just say unmodified, get it from apache.org (or their distribution's Apache package, if they got it from a distribution). 99.9% of sites use a _modified_ Apache, which they got from their distributors. If they are running something like Debian's testing, you may not be able to get it from the distributor anymore. Regards, Walter Landry [EMAIL PROTECTED]
Re: Web application licenses
Walter Landry wrote: Josh Triplett [EMAIL PROTECTED] wrote: Walter Landry wrote: Josh Triplett [EMAIL PROTECTED] wrote: My _intent_ with the phrase direct use was to avoid such issues. I'm aiming only for the case where a user directly _interacts_ with the software, so perhaps I should have said direct interaction instead of direct use. It is difficult for me to see how you define direct use to include something like Apache, but not include something like libc or the kernel. That's exactly why I corrected it to direct interaction. Although it would be useful to require distribution of a modified libc as well, since it would be linked into Apache under this license. I don't understand the difference between those terms. In any case, I still don't see how you can word it without requiring one of two things: 1) Someone can write a thin wrapper that you directly interact with. The wrapper merely forwards requests. 2) You require everyone whose machine responds to ping to distribute large parts of the operating system. Basically, think of the GPL's requirements for what must be distributed if you were distributing the server the user interacts with. This would normally be the server and everything you link with it. It seems a bit of a stretch to require people to distribute those when they are just running a webserver. It would make it much, much, much, much harder to set up a public website. Consider that 99.9% of sites don't have a locally modified Apache, and could just say unmodified, get it from apache.org (or their distribution's Apache package, if they got it from a distribution). 99.9% of sites use a _modified_ Apache, which they got from their distributors. If they are running something like Debian's testing, you may not be able to get it from the distributor anymore. Hmmm, good point. That goes back to the problem regarding Debian not keeping old versions around. I had imagined that the user could usually just point to their distributor unless they personally changed the software, but that doesn't cover the case when that distributor no longer distributes. - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
Josh Triplett [EMAIL PROTECTED] writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. So if I use software under such a license in a network switch, to whom am I obliged to distribute source? How about a web proxy? I do wonder what publically means. If I'm offering to hand a CD to anyone who asks me for one in person, is that public enough? Or must I run a web server to distribute it, and thus (assuming this license is broadly used) have to distribute a web server too? Does the Department of Transportation need to make stoplight software generally available? Does google have to make its source code available? If so, why? It's not going to do anybody else any *good*, since we don't have 100 kilomachine clusters sitting around idle to use. So this doesn't get us Freedom; we can't change the google interface we use in practice. Slashdot *does* publish its code, but this doesn't give me freedom with respect to Slashdot. I just don't see how compelling source distribution from a networked provider actually increases freedom -- since I don't care about changing the code I have, I care about changing the code *they* have. I think it's great that some sites publish their code. But I don't see any benefit to freedom from compelling them to do so. On the other hand, a compulsive *open interface* would be a useful thing. Say, if Google were using a weirdly licensed web server which compelled them to provide an RPC function allowing arbitrary queries, so that others could access their data in surprising new ways. As it happens, *they* do this anyway. But nytimes.com doesn't, and msnbc doesn't, etc. -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
On Mon, Jul 26, 2004 at 10:22:37AM -0400, Brian Thomas Sniffen wrote: I just don't see how compelling source distribution from a networked provider actually increases freedom -- since I don't care about changing the code I have, I care about changing the code *they* have. Here's the loophole: Take a GPLed application. Modify it. Do not release the source, or the binaries. Run the application on your own servers, and sell accounts to use it (via ssh, vnc, or whatever). All these sort of licenses are trying to block this, and variations on it. I've never actually seen one that worked without being grossly overbearing to the point of being non-free. -- .''`. ** Debian GNU/Linux ** | Andrew Suffield : :' : http://www.debian.org/ | `. `' | `- -- | signature.asc Description: Digital signature
Re: Web application licenses
Andrew Suffield [EMAIL PROTECTED] writes: On Mon, Jul 26, 2004 at 10:22:37AM -0400, Brian Thomas Sniffen wrote: I just don't see how compelling source distribution from a networked provider actually increases freedom -- since I don't care about changing the code I have, I care about changing the code *they* have. Here's the loophole: Take a GPLed application. Modify it. Do not release the source, or the binaries. Run the application on your own servers, and sell accounts to use it (via ssh, vnc, or whatever). Yes, that's fine. I don't see that as a loophole. Because you're not just providing me with access to the program -- you're providing the CPU cycles to run it, and maybe the database it operates on, and access to other resources which are important for its operation. And you've got to *keep* deploying more servers to make this work, and can't sell or rent any of these servers to others without your code getting out. Several people tried this model during the .com boom. It didn't work. They ended up switching to entirely proprietary software so they could lease and sell hardware without losing control of their code. All these sort of licenses are trying to block this, and variations on it. I've never actually seen one that worked without being grossly overbearing to the point of being non-free. Even if that business model did work, and this were an active threat to freedom, how does forcing distribution of the source code get freedom to the users? If it did, as in the case of the GPL -- they already have and can run the software, so getting them source lets them modify it -- then I'd reluctantly support this. I'd believe you when you say it's necessary to protect freedom. But in the current circumstances, I don't see anybody losing freedom to this hole, and I don't see a way to get those hypothetical people freedom by compelling source distribution -Brian -- Brian Sniffen [EMAIL PROTECTED]
Re: Web application licenses
* Josh Triplett: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. I can understand the rationale behind such clauses, but I consider them a severe threat to free software. Right now, I'm not forced to deal with license issues if I'm not distributing anything, and I really like this aspect.
Re: Web application licenses [was Re: Choice of venue, was: GUADEC report]
Glenn Maynard wrote: On Thu, Jul 22, 2004 at 04:10:24PM -0700, Josh Triplett wrote: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. Consider the general case: if my entire system was under this license, then my small web page (serving a few small files at my 30k/sec) would require me to put the source to Apache, glibc, openssl, and the other dependencies (and possibly the kernel, depending where you draw the line). If I was on a modem doing the same thing--which many people do--then even making only the Apache source available to anyone who has access to the page (at 5k/sec) is a huge cost. (Each person downloading would tie up the line for a long time.) The costs of sending source code are generally comparable to the costs of sending binaries; but the costs of sending source are, in many cases, orders of magnitude greater than the costs of making it available for use. I seem to recall other, more specific cases showing related problems (where the cost transmitting on some media was on the order of pennies per sentence), but I can't recall them, or which discussion it came up in. Anyone remember? First of all, that sounds more like a matter of inconvenience, not a matter of non-freeness. After all, there are probably situations under which it would be a burden to distribute the source for a GPLed binary you are distributing. For example, what if you had a 10MB quota on your FTP server, the binaries were 5MB, and the source was 15MB? Second, that could be made more convenient by allowing you to point to another location if the software is unmodified. Third, you don't necessarily need to distribute the source to the software via the same medium as the service; you could offer to mail a CD, and require compensation for your costs of doing so. - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
On Sat, Jul 24, 2004 at 12:08:56PM -0700, Josh Triplett wrote: It does seem like if the public performance right covers making a video game available for public use (which probably came up in a case against an arcade), it should also apply for making a web application available for public use. This is unprecedented, and therefore lawyer-bait. Pretty much any stupid decision is possible, depending on who bribed their way into the courthouse at the time. -- .''`. ** Debian GNU/Linux ** | Andrew Suffield : :' : http://www.debian.org/ | `. `' | `- -- | signature.asc Description: Digital signature
Re: Web application licenses
On Sat, Jul 24, 2004 at 12:08:56PM -0700, Josh Triplett wrote: As is often mentioned, if you take DFSG6 that far, you could use it to argue that the GPL discriminates against the field of offering proprietary modified versions of the software. I don't think DFSG6 can sanely be taken that far, and I think it can only really be applied to non-commercial use, not for use in weapons research or development, and similar clauses. On reflection, I don't think that's really an argument that we shouldn't interpret DFSG#6 that way; only that, upon doing so, we should apply it with the same judgement required for the rest of the DFSG. A license that says redistribution is only allowed in June would be non- free, because it places an unacceptable restriction on redistribution. We (d-legal) would say that it violates DFSG#1. It says may not restrict. Now, on the same token as the DFSG#6 argument, this could be taken too far. The BSD license restricts distribution: you can't remove copyright notices. The GPL restricts it in obvious ways. Just about every license can be argued to restrict distribution, but some restrictions are allowed. That doesn't mean that we should ignore DFSG#1, and allow any restrictions anyone can think up; it just means that judgement must be applied. I think that good judgement should apply to DFSG#6 in the same way. Yes, it's possible for somebody to argue that the GPL discriminates against commercial vendors. (It does; I'm sure many of us have been on that side of the fence at one point or another, in the course of earning a living.) The clear project consensus is that this is acceptable. Some people do argue that we, as a project, either can't or shouldn't need to employ such judgement, and that the DFSG should be adjusted to eliminate it; as I've said, I disagree. -- Glenn Maynard
Re: Web application licenses [was Re: Choice of venue, was: GUADEC report]
On Sat, Jul 24, 2004 at 12:18:33PM -0700, Josh Triplett wrote: First of all, that sounds more like a matter of inconvenience, not a matter of non-freeness. After all, there are probably situations under which it would be a burden to distribute the source for a GPLed binary you are distributing. For example, what if you had a 10MB quota on your FTP server, the binaries were 5MB, and the source was 15MB? It's two situations: in one, you can't distribute binaries unless you can distribute source; in the other, you can't use the program at all (effectively) unless you can distribute source. It seems, to me, that the jump from being able to distribute binaries to source is fairly small, where in some cases the jump from being able to use the program to serve requests to being able to send the source is large. It also feels like a use restriction; are there any use restrictions which are considered free, or do you think this is not one? Second, that could be made more convenient by allowing you to point to another location if the software is unmodified. Freedom to use modified sources is just as important as freedom to use unmodified sources--making the latter more free isn't very interesting unless it also applies to the former. Third, you don't necessarily need to distribute the source to the software via the same medium as the service; you could offer to mail a CD, and require compensation for your costs of doing so. I'd be pretty screwed if a couple thousand people made such a request. -- Glenn Maynard
Re: Web application licenses
Glenn Maynard wrote: On Sat, Jul 24, 2004 at 12:08:56PM -0700, Josh Triplett wrote: As is often mentioned, if you take DFSG6 that far, you could use it to argue that the GPL discriminates against the field of offering proprietary modified versions of the software. I don't think DFSG6 can sanely be taken that far, and I think it can only really be applied to non-commercial use, not for use in weapons research or development, and similar clauses. On reflection, I don't think that's really an argument that we shouldn't interpret DFSG#6 that way; only that, upon doing so, we should apply it with the same judgement required for the rest of the DFSG. [...] Some people do argue that we, as a project, either can't or shouldn't need to employ such judgement, and that the DFSG should be adjusted to eliminate it; as I've said, I disagree. Definitely; the DFSG should always be interpreted by good judgement, and not mechanically as a set of rules. - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
Josh Triplett writes: Michael Poole wrote: For the purposes of making it a purely copyright based license, it is probably desirable to only have such a clause kick in for works based on the software. Use (whether by the recipient or by third parties) of software is not, as far as I know, a right reserved under copyright law -- but preparing a derived work is. Agreed, especially considering that if the work was completely unmodified and separate, then you could just as easily obtain the source of the original Free Software program (assuming it is generally available, which will cover the vast majority of cases). So other than that, you would consider this clause Free? I would, but as I said before, I have an agenda with respect to remote application licenses. I can see arguments against it based on DFSG#6 (discrimination against the field of remotely offering modified versions of the software -- silly, I know) and the Chinese Dissident test (Any requirement for sending source modifications to anyone other than the recipient of the modified binary -- although I think the spirit of the test would accept the clause). I think the DFSG#6 argument applies more clearly to the original version you proposed, where anyone running the software in a kiosk might have to make source code available to users who walk up and do even a trivial amount of interaction. The version I suggested might be easily violated by proxy, though. Suppose Joe and Jane are in cahoots. Jane modifies an application under the license and gives the source to Joe. Joe offers the modified application, but not the source, to the public. Each have done what the license literally requires of them, but not what was intended. At least one previous discussion has mentioned public performance of a work being controlled by copyright, and using this as a lever to achieve the above. My reading of 17 USC 106(4) suggests that this is not applicable to software. (See http://www4.law.cornell.edu/uscode/17/106.html) Based on that, it indeed does not seem to apply, assuming that the software cannot be construed as an audiovisual work (which would depend on the software). As Andrew Suffield wrote, software is classified as a literary work in the USA (some software is also an audiovisual work). Bitlaw remarks[1] that there is no clear interpretation of the public performance or display rights for software, though; some lawyer will probably make a career (or at least a small fortune) off that point in the next decade. [1]- http://www.bitlaw.com/copyright/scope.html Michael Poole
Web application licenses [was Re: Choice of venue, was: GUADEC report]
Glenn Maynard wrote: On Mon, Jul 19, 2004 at 06:09:20PM -0400, Michael Poole wrote: The exception I mentioned would be for web application-type software. I am somewhat biased since the free software I write and maintain is in that category, but I think it is justifiable for a license to require that someone who makes a modified version of free software operable by others also make the modified source available to those users. The hard balance there is between copyleft-style code sharing and the burden imposed on operators of kiosks or embedded devices, where users may not care about the source code (or who may request it en masse to protest unrelated issues). I've seen general, vague agreement with this in principle, but I don't think anyone has come up with a license implementing this without creating lots of problems. How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. direct handles the problem of needing to provide the software you use to run a service business to the customers of that business; it limits the obligation to software a user interacts with directly. Part a) makes it unnecessary to provide the software specifically to any given user if you are already distributing the software publically; it is there mostly for convenience of distributors. Part b) covers the case in which you are not distributing the software publically, but you are providing it for use by another party; the reference to GPL section 3 avoids needing to explicitly specify all the ways you may distribute and all the obligations regarding distribution. (This clause is written as though it were to be used as part of the GPL; if it weren't, it should be more specific about what GPL it is referring to, or just include the relevant clauses directly.) - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses
Josh Triplett writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. For the purposes of making it a purely copyright based license, it is probably desirable to only have such a clause kick in for works based on the software. Use (whether by the recipient or by third parties) of software is not, as far as I know, a right reserved under copyright law -- but preparing a derived work is. At least one previous discussion has mentioned public performance of a work being controlled by copyright, and using this as a lever to achieve the above. My reading of 17 USC 106(4) suggests that this is not applicable to software. (See http://www4.law.cornell.edu/uscode/17/106.html) Michael Poole
Re: Web application licenses
Michael Poole wrote: Josh Triplett writes: How about something vaguely like: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. For the purposes of making it a purely copyright based license, it is probably desirable to only have such a clause kick in for works based on the software. Use (whether by the recipient or by third parties) of software is not, as far as I know, a right reserved under copyright law -- but preparing a derived work is. Agreed, especially considering that if the work was completely unmodified and separate, then you could just as easily obtain the source of the original Free Software program (assuming it is generally available, which will cover the vast majority of cases). So other than that, you would consider this clause Free? At least one previous discussion has mentioned public performance of a work being controlled by copyright, and using this as a lever to achieve the above. My reading of 17 USC 106(4) suggests that this is not applicable to software. (See http://www4.law.cornell.edu/uscode/17/106.html) Based on that, it indeed does not seem to apply, assuming that the software cannot be construed as an audiovisual work (which would depend on the software). - Josh Triplett signature.asc Description: OpenPGP digital signature
Re: Web application licenses [was Re: Choice of venue, was: GUADEC report]
On Thu, Jul 22, 2004 at 04:10:24PM -0700, Josh Triplett wrote: If you make the software or a work based on the software available for direct use by another party, without actually distributing the software to that party, you must either: a) Distribute the complete corresponding machine-readable source code publically under this license, or b) Make the source code available to that party, under the all the same conditions you would need to meet in GPL section 3 if you were distributing a binary to that party. Consider the general case: if my entire system was under this license, then my small web page (serving a few small files at my 30k/sec) would require me to put the source to Apache, glibc, openssl, and the other dependencies (and possibly the kernel, depending where you draw the line). If I was on a modem doing the same thing--which many people do--then even making only the Apache source available to anyone who has access to the page (at 5k/sec) is a huge cost. (Each person downloading would tie up the line for a long time.) The costs of sending source code are generally comparable to the costs of sending binaries; but the costs of sending source are, in many cases, orders of magnitude greater than the costs of making it available for use. I seem to recall other, more specific cases showing related problems (where the cost transmitting on some media was on the order of pennies per sentence), but I can't recall them, or which discussion it came up in. Anyone remember? -- Glenn Maynard
