5

TL;DR How can we replace the GPLv3 requirements of source disclosure + explicit license copy with something more subtle like "This work allows the users [...], and any derived work (recursively) allows all that too, independently of explicitly including this license.". Flexibilizing one to, for example, modify my work, compile and upload their binary, and be cool with it. But disallowing they to sue others that use their binary in any way. Does any license do that?

Background: For years, I've enjoyed creating private software projects to tackle my everyday problems, automate processes, and explore various ideas. Recently, I ended up taking an undergraduate course on computer science and got into academic research, which led me to start producing shareable software. However, so far, I have not found a software license that really satisfies my ideals of freedom. And given that I can choose "any" license to my software projects, I want to get the most possible out of it.

I would like to find a license that provides "the highest degree of user freedom", i.e., allowing all users to share, modify, re-sell, and even attempt to reverse-engineer any product or service derived from my software – Ideally, I would like to allow them to do almost anything, with one required exception presented below. Therefore without imposing unnecessary restrictions on them.

And I do see as any other user, a company that modifies my software and re-sells it. Therefore, while I recognize the benefits of open-source and will share the source code of my software projects, I'm not interested in mandating the sharing of source code for such derived works, or including my license file in their distributions, or requiring author credits, unless those very specific restrictions were indispensable for a copyleft license. The companies should be free to do as they please, like other users, with a single exception: The users of the derived work should have the same permissions as the users of the original work. Therefore, the companies (and any other user) should not be capable of restricting this. (copyleft!)

I am keen on exploring alternative legal license options to ensure copyleft but with less restriction to the (intermediate) users in relation to GPLv3/AGPL (e.g. not requiring source disclosure + explicit license copy). And I would like to ideally eliminate as much as possible the legal protections companies might claim over the derived works of my software with the aim of restricting their users. Without any safeguard, my concerns about preserving user freedom would reach only the direct users of my software. One possibility I thought of is expressed in tl;dr above, but I don't know if it really works.

Which existent licenses fit my criteria? I didn't find one in here. The CC0 license is similar to MIT in the sense that it apparently does not have a strong safeguard.

FxMySz
  • 61
  • 1
  • 7
  • You say you want to allow "the highest degree of user freedom" but insist that they also provide this to their downstream users. Why not just release your source to the public domain and be done with it. This would seem to provide the most freedom for users of your work. – Glen Yates Jul 31 '23 at 15:33
  • 1
    @GlenYates That is because of my choice of caring equally about direct and indirect users, the same reason some people have to prefer copyleft licenses over permissive licenses. Of course, absolute freedom is not possible, as pointed out by MadHatter. This is the reason why I tried to be precise in defining what freedoms I wanted for all users. – FxMySz Jul 31 '23 at 17:38

2 Answers2

16

I don't think you'll square this circle. You write

The problem I have with the GPLv3 and AGPL license is how they restrict the intermediate users, while the problem I have with the MIT license is how it allows the intermediate users to restrict the end users.

but in the preamble to the GPL, the authors write

To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.

That is to say, the restrictions placed on intermediate users by copyleft licences (which you say you don't like) are the very reason that intermediate users can't restrict the activities of end-users. Conversely, one of the freedoms given to intermediate users by permissive licences is the freedom to restrict the activities of their end-users (a practice that you also say you don't like).

You can only have one of the two things you want: either the intermediate users are restricted from restricting end-users, or they aren't, in which case at least some of the intermediate users will restrict end-users.

Edit pursuant to comments below: then you have a problem, again. The intermediate users have the right to make derivative works, and the power to do so by virtue of having the source. If the end-users don't have the source of the binary they're using, the right to make further derivatives is useless to them. I think you need to decide that either (a) the end-users should have no such right (in which case, permissive licence), or that they should have both the right and the power (in which case, copyleft licence). Your insistence on giving them a right that they can't use is what's causing the licensing problem.

So if an end-user tries, for example, to reverse-engineer their derivated version of my software, they cannot sue the end-user. Because they have no rights over the derivated work.

Then you have to explicitly forbid the intermediate users from doing this, because otherwise, as joint rightsholders in the work they are distributing, they absolutely do have this right.

It's beginning to sound to me as if you want a licence that prevents intermediate users from acquiring any rights they might otherwise have in a derivative work. But this is not how modern copyright works, so you aren't going to be able to find a copyright licence that achieves it.

Some years ago, we had another question here where the author was, in essence, trying to create a different scheme of copyright, and create a licence that would propagate a little bubble of copyright-that-worked-as-(s)he-wanted-it-to along with his/her code. I didn't think that was possible then, and advised against trying it, and I don't think it's possible now.

MadHatter
  • 48,547
  • 4
  • 122
  • 166
  • Yes, I agree that some restrictions must be placed on intermediate users, and I enumerate such restrictions precisely as those that remove all their legal rights over the derivated works they make over the software ("pure copyleft"). On the other hand, I think GPL adds "unnecessary restrictions", for e.g., demanding the intermediate user to provide the end users with the source code of the derivated works. I think this is highly desirable but excessive. I value their right to modify my code and don't release their work for free more than the right for the end-user to access their whole work. – FxMySz Jul 29 '23 at 08:51
  • Your question focusses heavily on what you don't want to have happen. Let's re-focus the question: what rights do you want your end-users to have? – MadHatter Jul 29 '23 at 08:55
  • The same as the intermediate-users: everything besides any legal rights over derivated works of my software. Simple as that, but putting more words to it: They can do basically whatever they want, but if they publish some derivated version of my software, they cannot expect any end-user to follow their rules. So if an end-user tries, for example, to reverse-engineer their derivated version of my software, they cannot sue the end-user. Because they have no rights over the derivated work. – FxMySz Jul 29 '23 at 09:01
  • See edit above. – MadHatter Jul 29 '23 at 09:05
  • I agree that their right to make further derivatives is useless to them if they don't have the source of the binary they're using. That's why I mentioned that open-source is highly desirable. But this is ok. As long they are not legally forbidden to try that. – FxMySz Jul 29 '23 at 09:08
  • You want to forbid intermediate users who make derivative works, which you have permitted them to do, from acquiring any rights interest in those works. I don't think this is possible. Copyright gives them rights, as creators, just as it does you. The GPL and AGPL, fwiw, don't deprive creators of derivative works of their rights. They just restrict their application. – MadHatter Jul 29 '23 at 09:17
  • I see you mention that creating a licence that would propagate a little bubble of specific copyright is impossible. But this is exactly what GPLv3 does. It enforces their open-source license to appear in and rule all derivated works of the original, removing their rights to sell their work and conceal their source code, among other things. What I do want is a different version of GPLv3. – FxMySz Jul 29 '23 at 09:22
  • (P.S. for further readers: I would also have no suing rights over any derivated work of my software since I would also fall into the user category. To make it clear that I do want equal freedom, not control.) – FxMySz Jul 29 '23 at 09:32
  • 2
    @FxMySz "removing their rights to sell their work and conceal their source code, among other things." Technically you can sell software that is licensed under the GNU GPL. In practice this is more like a commission than a traditional software license. That is, the buyer is entitled to receive the corresponding source and they are allowed to change and redistribute the program as they wish, according to the GPL. But selling itself is allowed. – ecm Jul 29 '23 at 09:52
  • 1
    @ecm Oh, really? I checked, and it is true. I don't know why I did think otherwise, even having a table with the correct information. In this case, GPL approaches a bit near what I would ideally want since I don't want to deprive selling rights. Is there some license exactly like GPL, but that does not enforce the derivated work to provide the source code and, in exchange, enforces the derivated work to allow reverse-engineering? That would go nearer. (I will use GPLv3 if I don't find something better since it is my best option even before your correction.) – FxMySz Jul 29 '23 at 10:00
  • 4
    @FxMySz Indeed, the GPL allows (and the FSF encourages) the sale of GPL'd software. Any license that categorically forbids the sale of the software for profit is not a free/open license under the definitions of the FSF and OSI. (ecm correctly notes that copyleft heavily incentivizes particular business models over others, but the license certainly allows it.) – apsillers Jul 29 '23 at 11:34
  • "I see you mention that creating a licence that would propagate a little bubble of specific copyright is impossible. But this is exactly what GPLv3 does" not so. The cleverness of the GPL is often not fully appreciated, but copyleft works entirely within the existing sphere of copyright to achieve its effects. You're trying to change way copyright works - specifically, you want downstream licensees not to be able to exercise the rights they would otherwise have, but you don't want to do this via a licence that forbids them to do so - you want the rights not to accrue in the first place. – MadHatter Jul 29 '23 at 18:26
  • "You're trying to change way copyright works" @MadHatter. Not exactly. Thanks to your and others' comments/answers, I can now express myself better than previously. I want a copyleft license, period. In that sense, GPL is already acceptable to me. However, my question is really about whether we can do better. There are two things I want to improve. (1) I want to achieve copyleft without enforcing source disclosure. (2) I want to be more cautious about the legal powers I leave open to the companies. Can we improve one? Your argument is that (2) is impossible. But what about (1)? – FxMySz Jul 29 '23 at 23:32
  • (Also, I now see my earlier comments as comments that do not make sense in a macro view. Each of them is timely trying to answer some specific comment, losing the focus of the real problem and sometimes even twisting the true semantics of some concepts. For example, when I mentioned GPL does propagate a bubble of copyright change, I didn't really mean it. I just was trying to follow your metaphor, but what I really meant was that GPL is a copyleft license, nothing else. And what I was trying to say is just that I wanted a license that does the same but with a different approach.) – FxMySz Jul 29 '23 at 23:56
  • As I have already said, (1) is pointless. The right to use software under copyleft is meaningless without the power, which is expressed in access to the source. – MadHatter Jul 30 '23 at 05:46
  • 1
    @MadHatter Sorry, are you claiming that the right to reverse engineer software is meaningless without the source code to that software? Because lots of people would disagree with you, starting with Accolade. – David Schwartz Jul 30 '23 at 08:39
  • @DavidSchwartz many jurisdictions give the right to reverse-engineer anyway - not least in the very judgement you link to - so for a fair bit of the world there's no meaningful benefit to the license granting that right, and thus we don't need to waste our time discussing how to write a licence that grants it without also guaranteeing source access. It is certain that code is easier to reuse when the right to reuse it comes with the source. – MadHatter Jul 30 '23 at 08:41
  • @FxMySz If you don't want to require that downstream users deliver the source code ("the Source form"), why not go with a different license that doesn't require that? For example, the ApacheV2 license is "stronger" than something like MIT, but ApacheV2 does not require releasing source code. – Brandin Aug 01 '23 at 14:45
15

I think another answer has done a good job articulating some philosophical incompatibilities in your requirements. I won't retread those concerns, but I'll make a feasible suggestion that might come close to your needs.

It sounds like you want a copyleft license that will apply to a lineage of derivative works, forever, but which perpetually enforces downstream reverse engineering rather than downstream source availability.

This is an unusual requirement, so I have an unusual suggestion: the Creative Commons Attribution-ShareAlike license (CC BY-SA). ShareAlike terms are extremely close to what you describe:

  • ShareAlike terms must apply to any downstream derivative, so any recipients of any form of the work have the right to modify it and share/sell it under those same terms.
  • ShareAlike terms do not obligate source disclosure, so you may distribute a ShareAlike work without source code.
  • ShareAlike terms (and all Creative Commons licenses) forbid the application of DRM in any way that would prohibit recipients from exercising their right to modify or redistribute the work.
    • The license calls these "Effective Technological Measures" and the term refers to any technical measures whose circumvention would cause legal trouble for the clever person who broke them. (In particular, any DRM that would receive protection "under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.") CC licenses require you to waive your ability to legally punish such circumvention, and neither may you introduce any DRM impediments that rise to this standard.

Note that CC licenses are not recommended for software, but in this case the major issues don't apply:

  • "CC licenses do not contain specific terms about the distribution of source code" -- in this case, this omission is a feature that does precisely what you want
  • "our licenses are currently not compatible with the major software licenses" -- in fact, CC BY-SA 4.0 is an exception to this objection, since it is one-way compatible into the GPLv3.
    • I should warn you this means others might take your software and incorporate it into a GPLv3 work. This doesn't diminish the availability of your software, but does admit the possibility of a fork that forces source disclosure. However, anyone who distributes a CC BY-SA derivative without source code need not worry about this outcome: no one can meaningfully release a fork of their work under the GPL because they cannot offer corresponding source.
  • Their final objection is that it doesn't grant patent rights. This is true: any patentable systems implemented in your code or in any derivative will not be covered by the licenses, so could be used to control downstream distribution and modification.
apsillers
  • 35,995
  • 4
  • 94
  • 131
  • Thank you. CC BY-SA is really a better choice than GPL for me. However, it would be better if the "Attribution" term didn't exist. Is there some legal reason for it to exist? Couldn't we have a license with exactly the same copyleft effects but without demanding appropriate credit, a list of changes made, and a link to the license? Answering additionally this specific point would completely answer all my doubts because it would either explain why CC BY-SA is really the best I could expect legally, or it would allow me to modify it by removing its "Attribution" term (which would be optimal). – FxMySz Jul 29 '23 at 23:44
  • (Also, from the answer you linked, it seemed that a simple modification of CC BY-SA would fix the problem you mentioned concerning patent rights: "[...] Many software licenses also address patent rights [...]". And it would also be simple to fix the problem of GPL incorporation since we can explicitly state that the user can modify their code and distribute it without releasing the source code. Thus, those problems would not really be a problem in the end.) – FxMySz Jul 30 '23 at 00:30
  • 2
    From a purely practical point of view, it seems unlikely that you could assert a right without attribution. If I break the terms of your license, but the original or derived work is not attributed to you, who have I entered into a license agreement with? – Wossname Jul 30 '23 at 01:42
  • @Wossname That's pretty fair and shows that if there was a chain A -> B -> C -> D, with A = myself, sharing the original work with a CC BY-SA license explicitly present; B = someone sharing a derived work without the license explicitly present (as I allowed them); C = someone sharing a derived-derived work without knowing there is a license; and D = some end-user suffering a copyright sue from C. Even if D discovers the chain, C could allege they invested money without knowing the license and therefore retain their right to sue D. So you're absolutely right, and gave me a good explanation. – FxMySz Jul 30 '23 at 02:01
  • And that pretty much answers everything. I would like to ask @apsillers to consider including what you think is relevant from the comments in your answer. I am accepting it since CC BY-SA with appropriate amendments to deal with mentioned problems seems the optimal I could obtain, in terms of a copyleft license with minimal extra requirements. – FxMySz Jul 30 '23 at 02:01
  • 2
    @FxMySz I think "just add patent rights to the set of licensed rights" is not a trivial amendment: copyright and patent function differently, so it's not necessarily a legally sound addition to simply say, "also, all these copyright permissions apply to any patentable mechanisms embodied in the work." To be clear, there are many FOSS licenses that do explicitly ensure patent rights, so this is something you could add, but it should be done by someone knowledgeable in patent law. – apsillers Jul 30 '23 at 02:35
  • 2
    @FxMySz I agree with Wossname that if you don't require preservation of (a link to) the license terms you're inviting a whole mess of downstream confusion. I'd categorize that separately from personal author attribution. In fact, you can waive the requirement to acknowledge you as author by simply not including it in your release; the license only requires downstream distributors "retain the following if it is supplied by the Licensor with the Licensed Material" (so if your material doesn't include a copyright notice, your personal name doesn't have to be preserved). – apsillers Jul 30 '23 at 02:40
  • 2
    @FxMySz from a practical point of view, I think that the requirement for a changelog and build instructions in GPL exist to prevent authors of derivative work from intentionally obfuscating (or downright encrypting) their work and getting away with "I gave you the source code". Take this into consideration. A lot of clauses are there for a good reason, to prevent loopholes you may not have thought of. – MrAnima Jul 31 '23 at 08:40
  • 1
    @FxMySz I will also point out that by using a nonstandard licence, while in theory you will be ensuring more freedom, in practice you will make it a huge pain for others to use your software in their works and thus likely restrict their practical freedom. With CC-BY-SA 4.0 actually being independently confirmed as GPL3 compatible this is mitigated to some degree, but with a custom licence this significant benefit would be lost. See https://opensource.stackexchange.com/questions/1445/how-can-a-crayon-license-be-a-problem – Muzer Aug 01 '23 at 11:29
  • @FxMySz If you read section 3(a)(1)(a) of the Creative Commons license, most of the attribution requirements are optional -- only parts "b" (i.e. a list of changes) and "c" (i.e. to include the license or a hyperlink to it) are required. And then, even those can be "loosened" a bit by reading Section 3(a)(2), which gives you additional flexibility on the manner in which these requirements are fulfilled. It doesn't seem logically possible to remove requirement "c" though -- if users aren't informed that the code is CC licensed, how would they know it's OK to redistribute it at all? – Brandin Aug 01 '23 at 14:46