OpenSSL Planning To Relicense Its Code

[starshipeleven]

Could you please explain these "obvious reasons" for someone who doesn't understand the implications of different FOSS licenses in large projects?

GPL requires you to expose the source code of your version of the software, so if they make possibly dangerous hacks to it to integrate it with their proprietary stuff (to save $$$) they can't hide it. Also allows everyone to know and reverse-engineer their APIs or whatever.

GPL basically neuters patents. It has patent provisions which says that if the patent if it is used in a way that prevents the the user rights as given by GPL (like for example placing code or software between paywalls, or trying to restrict the usage of the patented source in any way), then the software can't be distributed with GPL license.
And again this isn't cool for most companies using OpenSSL.

GPL is viral and any code caught connected to a GPL software can face an opensource takeover and must become GPL or GPL-compatible itself.
It depends from how it is connected and how related it is to the original GPL software, but for example Samsung had to cough up its exFAT driver that was not GPL because someone caught that code inside their linux kernel sources (which are GPL, and that driver was obviously strongly related to Linux kernel).

This last part is especially dangerous, as if you slip and someone else catches some proprietary stuff connected the right way to GPLed code you can get in a crossfire where you are forced to opensource proprietary stuff that isn't even yours but licensed from some third party.

Then there is also Affero GPL that is an expanded GPL that adds that you must provide your full server application to any client that asks for it, so it's even more open than normal GPL that only forces you to share the sources of stuff you redistribute, but not of your in-house software.

These are the main reasons why most hybrid open/closed source companies tend to avoid GPL like plague, while companies that are built over opensource like RedHat or SUSE use GPL freely.

[pal666]

The Apache Software Foundation lawyers disagree on the so-called incompatiblility.

1) they do not disagree. 2) their opinion does not matter, they are from opposite side

Git can add an exception clause if they care so much.

so when one imbecile said that there is no useful gpl2 software except kernel, another imbecile comes to rescue with idea that everyone can add exception?

[pal666]

These are the main reasons why most hybrid open/closed source companies tend to avoid GPL like plague, while companies that are built over opensource like RedHat or SUSE use GPL freely.

you were talking about libraries and license for libraries is called lgpl and nobody avoids it because glibc is lgpl

[starshipeleven]

you were talking about libraries and license for libraries is called lgpl and

The discussion was about using GPL, not LGPL.

And anyway, LGPL only removes the viral nature of GPL, the other 2 points I said still stand. In the discussion on their mailing list, the thing about patents was a pretty big turndown for them.

nobody avoids it because glibc is lgpl

I meant "avoids" in the sense of "not using it for their own products", duh. There is no legal issue in linking proprietary stuff to glibc.

Although there is Musl and other libcs (for embedded usually) that have more company-friendly licenses too, for those that really want to avoid GPL as much as they can.

[ldo17]

The patent termination and indemnification provisions of the Apache license count as forbidden "additional restrictions" according to the GPLv2's language. The FSF thought those were a good idea and, with the GPLv3, they added similar language and made sure it was phrased in a way which wouldn't conflict with the Apache license's version.

Makes you wonder why the Linux kernel developers are so determined to stick with GPLv2, rather than moving to GPLv3?

[TheBlackCat]

Makes you wonder why the Linux kernel developers are so determined to stick with GPLv2, rather than moving to GPLv3?

Because they would need to get an agreement from too many people to make it feasible.

[randomizer]

Because they would need to get an agreement from too many people to make it feasible.

Just say "if we don't hear from you we assume consent". Problem solved!

[wikinevick]

1) they do not disagree. 2) their opinion does not matter, they are from opposite side

I wonder what is "the opposite side", the Apache license is meant to be commercially friendly but no one doubts they stand for open-source. Their opinion matters about as much as the FSF: neither of them actually wrote the code, but at least the Apache Software Foundation is not about telling people what to do with code they didn't wrote.

so when one imbecile said that there is no useful gpl2 software except kernel, another imbecile comes to rescue with idea that everyone can add exception?

The problem is the GPL, not the Apache License, nor the 4 clause BSD or CDDL:, it was made to be incompatible with the anything that doesn't enforce their policies. The GPLv3 is compatible only by virtue of an exception clause and they could have easily added compatiblility with the CDDL in the same way.

[ldo17]

... meant to be commercially friendly but no one doubts they stand for open-source.

Do I detect an implicit assumption that “open-source” cannot be “commercial”?

[ssokolow]

GPL is viral and any code caught connected to a GPL software can face an opensource takeover and must become GPL or GPL-compatible itself.
It depends from how it is connected and how related it is to the original GPL software, but for example Samsung had to cough up its exFAT driver that was not GPL because someone caught that code inside their linux kernel sources (which are GPL, and that driver was obviously strongly related to Linux kernel).

That's FUD and spin-doctored language. The GPL is hereditary, not viral.

In a work with mixed ancestry, the GPL covers the individual GPLed pieces and the combination, but it doesn't flow backwards to infect the pieces under other licenses like MIT, Apache, or MPL... you can still pull those out of the combined work and use them under their original licenses.

The reason companies like Samsung open up code that got mixed in with GPLed stuff is because it's the easier option than suddenly having all of their Linux-containing products (in the case of the exFAT driver being caught with Linux kernel code) being illegal to manufacture and distribute because their violation of the GPL triggered an automatic revocation of their license to use Linux.

(The GPLv3 actually improved that because you technically lose the right to use GPLed code the instant you violate, and there is no obligation to reinstate in GPLv2. The GPLv3 adds a clause that says "if you come into compliance within X amount of time (might have been a month. I forget.), you automatically get your license reinstated.")

Samsung opening up the exFAT driver was basically like taking 2 years in prison for a plea bargain instead of going away for 20 for being convicted after pleading innocence.

Sure, they could have kept their driver closed, but it'd then be illegal for them to produce Android or Tizen devices (among other things which use the Linux kernel) and they could also be taken to court for money.