OpenSSL 3.0 Officially Released

[Awesomeness]

But is it secure?

Totally secure until the next major flaw, that isn't present in LibreSSL, is found.

[fanbelt]

I don't think a BSD+Patent license that's compatible with the GPLv2 is possible because the patent-related requirements, being not present in the GPLv2, would count as additional restrictions and thus inherently GPLv2-incompatible.

The LLVM exception is sort of a grey area since it's effectively saying "if courts deem that the patent rules are incompatible with the GPLv2, then you may ignore them when redistributing this code as part of a larger GPLv2 work"... so I have trouble seeing how it's significantly different from just releasing something under "Apache-2.0 OR GPL-2.0" terms.

Hell, the Rust ecosystem uses "Apache-2.0 OR MIT" because, as long as you care about getting your changes upstreamed, it has the same effect, patent-wise.

From what I understand, it is compatible because it lacks the "litigate against me and your patent grants are revoked" part. It's fully compatible with section 7 of GPLv2.

I'm not a fan of exception notices. As you pointed out, it effectively turns established licenses into dual licenses or new licenses entirely. I think the Rust ecosystem not pushing for MPL-2.0 was a missed opportunity, but if they still really wanted a permissive license, a BSD-3+Patent license would've been perfect. It's a shame they're stuck in dual-licensing hell now.

[RahulSundaram]

The LLVM exception is sort of a grey area since it's effectively saying "if courts deem that the patent rules are incompatible with the GPLv2, then you may ignore them when redistributing this code as part of a larger GPLv2 work"... so I have trouble seeing how it's significantly different from just releasing something under "Apache-2.0 OR GPL-2.0" terms.

Hell, the Rust ecosystem uses "Apache-2.0 OR MIT" because, as long as you care about getting your changes upstreamed, it has the same effect, patent-wise.

One significant difference between dual licensing and effectively similar licensing exception clauses is that dual licensing can lead to license specific forks. Some projects want to avoid that.

[sinepgib]

Dang, you probably right.
That and double citing of "support for kernel TLS", could use some proofreading

That's not a half bad idea TBH. Maybe Michael could give someone a premium account in exchange or something.

A wine brand. I guess they need security too in order to prevent outsiders from stealing their wine-making process

In my country there was a time where someone tainted a batch of wine with methanol, blinding and killing several people before anybody realized it. So yeah, they need security too

[Vistaus]

What's a clinet ?

A wine brand. I guess they need security too in order to prevent outsiders from stealing their wine-making process

[ssokolow]

Too bad they didn't pick something GPLv2 compatible like BSD+Patent. It would be great if a 3-clause BSD+Patent license gets approved by the OSI. I think it would be favored over Apache 2.0 since the vast majority of people only use it as a BSD-3+Patent license anyways.

I don't think a BSD+Patent license that's compatible with the GPLv2 is possible because the patent-related requirements, being not present in the GPLv2, would count as additional restrictions and thus inherently GPLv2-incompatible.

The LLVM exception is sort of a grey area since it's effectively saying "if courts deem that the patent rules are incompatible with the GPLv2, then you may ignore them when redistributing this code as part of a larger GPLv2 work"... so I have trouble seeing how it's significantly different from just releasing something under "Apache-2.0 OR GPL-2.0" terms.

Hell, the Rust ecosystem uses "Apache-2.0 OR MIT" because, as long as you care about getting your changes upstreamed, it has the same effect, patent-wise.

[jabl]

Too bad they didn't pick something GPLv2 compatible like BSD+Patent. It would be great if a 3-clause BSD+Patent license gets approved by the OSI. I think it would be favored over Apache 2.0 since the vast majority of people only use it as a BSD-3+Patent license anyways.

There's also the LLVM exception for the Apache 2.0 license: https://spdx.org/licenses/LLVM-exception.html . Used by at least LLVM and CUPS.

That gives GPLv2 compatibility while keeping the Apache 2.0 that corporate lawyers seem to like.

[orzel]

A typo for "client" I believe.

Dang, you probably right.
That and double citing of "support for kernel TLS", could use some proofreading

[sinepgib]

What's a clinet ?

A typo for "client" I believe.

[fanbelt]

Too bad they didn't pick something GPLv2 compatible like BSD+Patent. It would be great if a 3-clause BSD+Patent license gets approved by the OSI. I think it would be favored over Apache 2.0 since the vast majority of people only use it as a BSD-3+Patent license anyways.