For people who still believe the GPL influences corporations in a meaningful way:

When I was at Microsoft, I worked on a product that used Linux. The product was cancelled for largely unrelated reasons before it shipped, so the exact details are irrelevant but anything that links Linux needs to loop in lawyers, so I spent a lot of time talking to them.

Maybe 10% of the total time was spent with the technicalities of the GPL. The fact that the GPL is ambiguous and poorly written and the Linux syscall exemption is even worse made me expect long discussions about the legalese. But instead the conclusion of the GPL-focused discussions was basically:

No one really knows what the GPL can actually enforce and half of the stuff that's done with Linux is technically in violation. Microsoft ships Linux images for Azure that come with a click-through license that prohibits running them on any other cloud and no one cares. We can make a convincing argument that this is okay. Only a handful of companies can afford a protracted legal battle with Microsoft and none of them are sufficiently motivated to take us to court over this, so it's unlikely to come up.

The remaining 90% of the discussions were around how the product would be perceived by Linux maintainers, the wider Linux community, and the broader F/OSS ecosystem. Microsoft had put a lot of effort into the 'Microsoft <3 Linux' marketing things. The Ballmer-era alienation of the most active developer communities had cost the company a lot of ecosystem market share. The risk of pushing developers away from Microsoft products and platforms was something that the lawyers regarded as a huge risk. If two of the senior Linux maintainers had said 'we think this is not an acceptable use of Linux' then that would have torpedoed the project instantly.

The moral of this story is that, if positive engagement with your community is perceived as valuable, you have an enormous amount of leverage over big companies. At the time, Microsoft was (by market cap) the largest company in the world. The legal text, in contrast, isn't worth the paper it's written on when your adversary can afford to outspend you in court by six orders of magnitude. When they happen to be aligned, the legal text may look as if it's working, but that's a coincidence.

@david_chisnall IANAL but I have gotten the impression over the years that most licenses suffer the same problem. No one really knows what various licenses can actually enforce.

Everything is almost unknown unless the situation has been argued in court to show a legal precedence.

If you are into gaming, the OGL suffers the same issues, for example.

@randomwizard @david_chisnall yeah, licenses are mostly just for the small people and for theatrics in the open source space - this is why one should just have fun and uses random licenses which might or might not be enforcable which put funny constraints on the code

some ideas:

• full moon license, the code is only allowed to be compiled and run under a full moon
• no true scotsman license, only true scotsmen are allowed to use the code
• bowl of soup license, every time you compile or run the code you need to make a bowl of soup and give it to somebeing

@16af93 @randomwizard

Russel’s license: only people prohibited from using this code are authorised to use this code.

@david_chisnall @randomwizard Göddel's license: the code can only be run on a system which implements a complet system of mathematics

@david_chisnall My [possibly wrong ianal] understanding is also that the walls of a corporation create a loophole around much of the GPL even if you were to respect every line of it. Because while the GPL can't force you to release a fork you worked on yourself (and rightly so), Microsoft can shit-can something employees worked on because access for an employee under NDA isn't "distribution" (correct me if I'm wrong, but this is my perception).

@thomasjwebb

It probably could but generally use inside a company doesn’t count as distribution so the employee has no specific distribution rights, they may exercise the rights the corporation has. Loopholes like the NVIDIA one are more obvious.

The GPL actually was an obstacle for this project because we wanted to share early releases with customers under NDA to get performance data and couldn’t (the early versions had know security holes, so we didn’t want the reputational hit if someone shared it with Microsoft copyright). When I worked with Arm on their CHERI variant, we had a similar issue with QEMU. Arm didn’t want the prototype architecture shared publicly so distributed it under NDA. I think there were three independent QEMU implementations from Arm and two other partners as a result. None of the code was shared.

@david_chisnall @thomasjwebb With confusing proprietary stuff the conversation tends be similar
- what is the risk
- do we make more money than the risk
- can we plausibly claim we were not a deliberate knowing infringer

if it's cheaper to take the risk and just buy someone to shut them up then that's what capitalism says you should do

Not saying it's specifically what happened in this case (I don't know for sure) but there lots that read the same

https://www.cnet.com/culture/nvidia-buys-out-3dfx-graphics-chip-business/

@david_chisnall I've been in companies big and public, and small and closely held - and always the GPL was a worry because of the risk of accidentally getting hooked by the viral aspects of the GPL.

In my company now, any use of any GPL code requires my personal approval. I usually give it for toolchains and utilities. But libraries are a concern.

When we wanted to do Linux kernel modules, we got quite concerned because we did not want to label our modules as GPL-compliant.

So we changed our platform to FreeBSD rather than Linux. We haven't looked back.

@karlauerbach

Yup. If you actually want to comply with the license, the GPL adds a lot of overhead. If you don’t care but have deep pockets, you can ignore it.

We have 30 years of examples of this, yet somehow the narrative persists that GPL and similar licenses protect the underdog against big business.

@david_chisnall This actually aligns fairly well with how I've seen the kernel community deal with the GPL. @torvalds once gave me some real grief for suggesting in a talk that a bit more licensing-infringement litigation might be a good thing; his point was that exclusion from the community is a far more potent weapon.

And say what you will, but the kernel community has had a lot of success in (eventually) convincing companies to play along.

But yes, I don't think the GPL has a lot of force when it comes to keeping companies from using any project of mine in proprietary ways.

@david_chisnall

I can ignore the corporations.

I do not need to get involved in copywrite lawsuits.

I do not need to use Cloud.

I have the source code, and I know how to use it.

The fascists can fuck off.

#GPL #EEE #Copyright

@16af93 @dngrs @randomwizard @david_chisnall that does mean it won't be shipped inside a distro, though.

@GyrosGeier we need a better distro
maintained exclusively by true scottish werewolves with respect to moon cycles

@16af93 @dngrs @randomwizard @david_chisnall

@david_chisnall I’m pleased to report that the AGPL3 influences corporations in a _very_ meaningful way.

@leeg

Yes, it makes them avoid the project. Including those that would normally wish to act as good-faith members of the community. This perception is changing because a few have seen how good AGPLv3 at controlling an ecosystem, changing the policy to ‘don’t adopt anyone else’s AGPLv3 code but do release things under AGPLv3’. Some of the VCs that we talked to want us to move from MIT to AGPLv3 because they see AGPLv3 as the license for keeping rigid control over your ecosystem and killing competitors.

If you think this doesn’t work, show me the list of alternative Signal clients for iOS.

@david_chisnall Please, everyone, stop justifying AIs wholesale theft of our property. For all the technicalities you can talk about licensing, it is morally reprehensible.

@khleedril

I’m not sure why you think that’s what I’m doing. I believe the attribution clause of almost any license should be sufficient to prevent LLM training. I also strongly disagree with the EFF’s position that LLM training is transformstive.

I am trying to say three things:

• Community norms in a strong community are far more effective at enforcing behaviour than complex licenses.
• Complex licenses will exclude people from the community, primarily those that wish to follow the rules but can’t afford lawyers and are concerned about risk if they get it wrong.
• Complex licenses will always place the most power into the hands of the people who can afford the most lawyers.

I don’t mind corporations contributing to projects that I also contribute to, but I want them to be incentivised to behave as good community members. I don’t want that incentive to apply to small companies but not big ones because that inevitably leads to big corporations controlling the project.

For all of its talk of freedom, the GPL (along with later licenses inspired in the same way) has become a tool that shifts power towards big companies. And that’s not something that I consider healthy in an ecosystem that I want to be led by communities.

I find it particularly depressing the number of new movements like the ‘small tech’ movement that completely ignore this and think that adopting these licenses will save them, when the evidence is exactly to the contrary.

@16af93 @david_chisnall @randomwizard Schrödinger’s license: You can read the license or the code, but not both.

@david_chisnall But this is true of more or less all legal texts. The law is fundamentally a system for enforcing a system of rules designed to benefit rich on the poor.

The GPL is much more significant as a moral text than as a legal one. Yes, you can get away with breaching it (or any other agreement) if you're rich enough; but a moral actor will not, and any actor who does is revealing themselves as not a moral actor.

@simon_brooke

You are repeating the theory, which is laudable, but does not reflect the practice. I agree 100% with the goals of the GPL and 0% with it as an effective tool for achieving those goals.

When lawyers for poorly-funded good actors (e.g. small companies wanting to be good citizens of the community) read the GPL, they see that complying is complex and exposes them to liability. This pushes them away from the GPL’d project because the risk of litigation (even if they win) is a significant liability that they cannot afford.

When lawyers for well-funded bad actors (e.g. massive corporations wishing to exploit the community) look at the GPL, they see loopholes that they can convincingly argue in court and know that they can afford the long legal battle, whereas most other parties cannot.

The axis of good community participant vs bad community participant is one dimension. The other dimension is large established powerful entity versus individual. This second dimension completely dominates when it comes to how the GPL influences behaviour: it makes less powerful entities change their behaviour (and, often, not in the desired direction: they create a proprietary in-house version of something, or take GPL’d code to use internally but avoid the liability from sending their bug fixes upstream) but it doesn’t change the behaviour of powerful entities.

If your goal is to accelerate the concentration of power, the GPL is a very effective license and successors are even more effective in various ways.

If you wish to change the behaviour of large entities, showing them the benefits of good engagement with the community is a key.

@karlauerbach @david_chisnall I still cannot believe that MIT isn't an acceptible GPL-alike license for kernel modules. I don't care if my terrible code for a 3DS port is stolen by a business, just let me kmalloc, but no, 98% of the kernel is locked off to you if you don't use GPL or a derivative. It's almost literally impossible to write a kernel module without doing so, and even doing a GPL module is a PITA because there's six separate kinds of declaration you need to add or it'll refuse to build the module.

@parzivalwolfram @david_chisnall @karlauerbach

IANAL but I’m pretty confident it is allowed. Technically you have to dual-license it per https://www.kernel.org/doc/html/latest/process/license-rules.html#id1 but that doesn’t mean “everyone has to follow both”, it means “everyone can pick either”. The only real difference between MIT-only and GPL/MIT is that redistributions don’t need to carry both license texts, the GPL alone will also suffice (the attribution is still required).

#id1

@hatzka @parzivalwolfram @karlauerbach

There's a problem with dual licensing in this way and it ends up being a lot more problematic than either license. A court will use a notion of a 'reasonable person' to see what accepting the license would mean. If you have licenses like Apache and GPLv2, which grant different sets of rights, then this concept makes sense. But in the GPLv2 + MIT case, one license grants the person who accepts it a strict superset of the rights that the other provides. As such, it's likely that the court would argue that no reasonable person would accept the GPL in this case (given a choice of receiving set of rights A, or set of rights A+B, for the same cost, why would you accept just A?).

Of course, this has never been tested in court, so this is just the opinion of some lawyers (and, in any discussion about the GPL, you can find lawyers who have different opinions on any specific subject).

@parzivalwolfram @david_chisnall @karlauerbach

Maybe it’s because it’s 3am, but I don’t follow. What exactly is the conflict or loophole here? And in any case, it goes back to what you were saying already: realistically, nobody is going to court over this anyway, so it’s pretty much entirely academic.

@hatzka @parzivalwolfram @karlauerbach

The issue is that, if a court rules that a license doesn't make sense, they may rule that neither license applies.

The legal requirement for a contract to be valid in English common-law countries (including the USA) is evidence that a meeting of minds has occurred. If the contract is written in such a way that it contains contradictions, a court may rule that no part of it is enforceable. This may mean that someone who receives a GPL+MIT piece of code has no rights.

The Linux Foundation's lawyers disagree with this interpretation. Other lawyers I've spoken to raise this as a risk.

@16af93 @randomwizard @david_chisnall this is why all my own software is released under no license. go ahead and use it, i probably won’t sue you if i like what you do with the code :3

@anya @16af93 @david_chisnall @randomwizard
License means permission.

No license is no permission. You are restricting your users to what is allowed under copyright law. Same as you are allowed to if you buy a music cd.

@leeloo @16af93 @david_chisnall @randomwizard No, a license is a legal method of conveying permission. But there are other ways to achieve this effect of giving someone permission. Such as yeeting my code onto the web and not caring what happens to it afterwards.

@anya @16af93 @randomwizard @leeloo

Since the Berne Convention, you have copyright on whatever you create, there is no requirement to register it. Someone else receiving a copyrighted work has no rights to it unless they have an accompanying license. If you 'yeet your code onto the web' then no one downloading it has any rights to it.

If you 'don't care what happens to it afterwards' then you may never assert your rights, but that doesn't mean that go away. If you die, the copyright will pass to your heirs. They may then choose to sue everyone who used it for any purpose.

@david_chisnall it’s part of the reason I’ve always had a gripe about the free software foundation. They’re well intentioned, but their black and white thinking about software and whether it conforms to their agenda is problematic. And they’re basically nothing more than a bunch of hobbyists in a trenchcoat.

@soulfire

I agree. I am 100% aligned with their goals.

I want software that empowers end users and where the power of computers (as general-purpose machines that can be made to emulate any special-purpose machine that has the same I/O capability) is something that should be given to all users of computers, not just to a few.

I completely disagree on every level with their strategy and their tactics.

If you want people to value the FSF's four freedoms then you need to write software that is structured so that it's easy for users to extend, so that sharing those extensions with friends / collaborators / randos on the Internet is desirable because it makes collaboration easier in other contexts and where reading the source code to understand the program is easy.

Instead, they write uncommented C code in big monoliths with no reusable parts (EMACS is about the only counterexample). In this world, the only freedom most end users can exercise is the freedom to use the program for any purpose, and the most value that they perceive is that they don't have to pay for it.

They can conveniently say that the complexity of the GPL doesn't apply to most users because most users don't modify the source code or distribute their changes and ignore the fact that this means that their mission has failed. If most users are not able to exercise the Four Freedoms, most users will not value them and most users will not advocate for them.

If most users do exercise those freedoms, the legal complexities of things like the GPL and successors become impediments. If every time a user wants to share a plugin they made to some trivially extensible program that copies some code from the core, they need to comply with a complex distribution license, then that adds friction. They're more likely to simply not bother sharing it. And maybe not even making the plugin if sharing it is too much effort.

At the same time, if even 30% of end users are actually exercising these rights on a regular basis then the GPL is unnecessary because selling software that isn't extensible / modifiable and which doesn't come with redistribution rights is impossible. Get users used to being able to do things with every program they buy and they won't buy programs that can't do those things.

It's actively harmful to development of a vibrant Free Software ecosystem that is able to displace proprietary software. And it's all based on a belief that licenses do things that licenses don't do, and humans behave in ways that humans don't behave.

I always feel like I’m too harsh on the FSF, but I also feel like they’re taken too seriously at times in contrast to their actual clout

Simply the pet project of a Harvard grad

mood

https://www.youtube.com/watch?v=QXUSvSUsx80

@david_chisnall @16af93 @randomwizard @leeloo Sorry to say but you are copying my words to write a response. i bet there’s also a copy of my full post somewhere on your computer’s cache and definitely in your instance. If you believed that copyright holders would choose to sue everyone who used it for any purpose, you would not break the copyright law so much right?

@anya @16af93 @randomwizard @leeloo

And these all come under 'fair use' in copyright (in the US, in other jurisdictions there are similar concepts. In the UK, it's called 'fair dealings).

Technically, fair use is an affirmative defence, so it is still covered by copyright buy you can argue in court that you had a separate justification. So, in theory, copyright holders could sue (they have standing to do so), but because there's a clear fair-use defence they don't, and if they did they'd probably lose a motion to dismiss in the first hearing.

Most instances have something in their T&Cs about you granting them the right to store and distribute your posts as required to operate the service, but you seem to be on a single-user instance, which makes me wonder if there's something in ActivityPub that grants this.

@david_chisnall if GPL is poorly written, then AGPL is a complete joke in its extremely vague "remote interaction" clause

I mean it's written in a way that suggests the license authors had no clue whatsoever how modern services work

@vriesk

Unfortunately, GPLv2 is written as if the authors did have a very good idea of how the UNIX / C linkage model worked and no understanding that other languages and linkage models existed. GPLv3 is marginally better in this respect.

@david_chisnall Thank you for your insight. One of the reasons for me preferring the BSE license over GPL is the fact that I fully understand the BSE license and it's implications (or at least I think I do).

@wolfstettler

I'm pretty sure a BSE license is something you shouldn't ingest or it can turn your codebase into a CJD licensed problem.

@randomwizard @david_chisnall there is a reason most of us have settled on the MIT which is basically "do what the fuck you want, just don't come back to me if it fails"

@Di4na @randomwizard

And it means that people acting in good faith, whether they merely use the project, or want to actively engage in the community, have an almost zero compliance burden and no need to talk to a lawyer about it. ‘Don’t claim you wrote it, don’t sue me if it doesn’t work’ is easy for anyone to comply with. Except, apparently, LLM vendors, who fail at the first step.

@david_chisnall @randomwizard Tbf, we don't even care that much about the "don't claim you wrote it".

I think our bigger problem (speaking as a maintainer) with the whole LLM shitshow is... that they break the link between the expertise to maintain it and the people using it. Which means that the work we do maintaining it does not flow downstream anymore.

Which means it is going to hurt everyone. As I keep saying, the reason Hobbyists maintainers do FOSS is mostly because you cannot take the engineering out of the engineer.

They don't let us do proper engineering at work, we will do it as a hobby ffs.

And Engineering is, in large part, about having a positive impact into people's life

@david_chisnall For embedded software I like the GPL since companies (at least usually) make source code available on request.
I don't think that would be possible without it.
I guess companies could ignore such requests entirely, but I like that it works usually.

Do you think there is a better way to achieve that? Or is GPL still the way to go in those cases? Mostly curious about your thoughts on that

@tsrberry

Embedded is odd because the linkage model means that it's often impossible to separate out a GPL'd component. This means most embedded vendors completely avoid GPL'd code. I maintain an (MIT-licensed) RTOS and I doubt anyone downstream from us would touch it if it were GPL'd.

It's mostly used in hybrid things like WolfSSL, which releases a GPL'd version as advertising: if you actually want to use it, buy a license. And I really dislike that because it entrenches in the minds of users the idea that Free Software is less valuable than proprietary, which is exactly the opposite of what I want them to believe.

The outlier here is Linux, where people use it for the kernel precisely because of the system call exemption, which means that they don't have to release anything that they consider valuable. But that's at the very top end of embedded, which accounts for well under 10% of deployed devices.

What kind of embedded did you have in mind?

@david_chisnall @simon_brooke how would you modify the GPL to 1) keep its spirit and political goals intact 2) be simpler 3) avoid the legal loopholes you mention?

@laurentgiroud @david_chisnall @simon_brooke

Its probably not possible to create a "perfect" free software license in practice. Given sufficient resources, an adversary will always find a way through/around it in the legal system (leaving aside inherent imbalances favoring large actors already baked in)

The license is in a sense, more useful, when it influences behavior and the license is not tested in court. Against an adversary that favors using the legal system as a weapon, free software licenses are at a distinct disadvantage.

@crouton @laurentgiroud @simon_brooke

My point is that licenses are a distraction.

If you create a strong community and create software where exercising the rights to modification and redistribution is easy and desirable to a large subset of users, the license is irrelevant: no one can sell a proprietary fork because you’ve shown users the value of the Free Software model and any proprietary version is intrinsically less valuable. No company wants to be excluded from your community because they’ve been shown advantages of being part of it, not threatened and forced into it. Worse, a complex license adds friction to good actors wishing to be part of your community and so makes it harder for that community to to grow.

If you don’t create a strong community and your software is effectively a black box that even most programmers can’t modify then you’ve created a set of incentives for people to sell something incorporating it. When you incentivise a certain behaviour, corporations will move towards that behaviour. A license will prevent it only if it has no loopholes (good luck) and you have the resources to enforce it. And every enforcement action will weaken your community by showing that people are appearing to be members of the community only because they are threatened with lawsuits, not because they see advantages in cooperation.