For Approval: NASA Open Source Agreement Version 1.1

[Ben Reser]

First of all general comments.  I see real problems for this license in
cases where the software was written entirely by civil servents.  In
such a case it can't be a bare license.  It'd have to be a contract.
But if it's a contract aren't you trying to create a copyright for the
work through the contract that Title 17 specifically says you can't
have?  Don't you start running into all the privity problems that have
been discussed lately surrounding the GPL?

On Thu, Feb 12, 2004 at 11:28:11AM -0800, Bryan Geurts wrote:
> E. "Larger Work" means computer software that combines Subject
> Software, or portions thereof, with software separate from the Subject
> Software that is not governed by the terms of this Agreement.

> I. A Recipient may create a Larger Work by combining Subject Software
> with separate software not governed by the terms of this agreement and
> distribute the Larger Work as a single product. In such case, the
> Recipient must make sure Subject Software included in the Larger Work
> is subject to this Agreement.

I see this as a problem.  There's no mere aggregation exception here.  A
Linux distribution that included your software on their CD could be
considered as distributing "a single product."  And according to your
license would have to be licensed in its entirety under the NOSA.  I'd
argue that this violates section 9 of the OSD.

> F.  "Modification" means any alteration of, including addition to or
> deletion from, the substance or structure of either the Original
> Software or Subject Software, and includes derivative works, as that
> term is defined in the Copyright Statute, 17 USC 101.  However, the
> act of including Subject Software as part of a Larger Work does not in
> and of itself constitute a Modification.

> C. Each Contributor must characterize its alteration of the Subject
> Software as a Modification and must identify itself as the originator
> of its Modification in a manner that reasonably allows subsequent
> Recipients to identify the originator of the Modification.  In
> fulfillment of these requirements, Contributor must include a file
> (e.g., a change log file) that describes the alterations made and the
> date of the alterations, identifies Contributor as originator of the
> alterations, and consents to characterization of the alterations as a
> Modification, for example, by including a statement that the
> Modification is derived, directly or indirectly, from Original
> Software provided by NASA. Once consent is granted, it may not
> thereafter be revoked.

This seems contradictory to me.  You define "Modification" in a way that
would include things that might not necessarily be considered derivative
works.  But then seem to require people to include a statement
stipulating that their "Modification" is a derivative.  This may not be
your intent here, but it seems someone could read it that way.  Granted
you didn't use the term "derivative work" but rather "derived" as well.

I think the way the GPL handles this better.  Separating the changes
made from the file can create a real mess when creating derivative works
(especially since it's not really clear if you can remove these
notifications under this license, you later note that you can't remove a
copyright notice without specific permission and a statement that its a
derviative would seem to imply a copyright).  I'd say that the
Modifications must be noted in the file and the change log file if one
exists.  That way if the change log file were to get seperated from the
file you'd still have the record.  Or you could just do what the GPL
does and require the notification to be added to the file.  I'll note
though that a lot of projects completely ignore this requirement of the
GPL and use separate change log files.

For that matter I think requiring a written statement of it being a
derivative is unnecessary.  I can just see this huge mess of written
statements in the change log file.  Which would make the change log file
less than useful.  Especially if every change would require such a
declaration.  Incidentally, if NASA accepts contributions then they'd be
bound by these terms as well.

Also while probably OSD compliant, I'll point out that Debian would
probably not consider this as meeting the DFSG.  By requiring
identification of the contributor it would fail their "Chinese
dissident" test.  

> F. In an effort to track usage and maintain accurate records of the
> Subject Software, each Recipient, upon receipt of the Subject
> Software, is requested to register with NASA by visiting the following
> website: ______________________________.  Recipient's name and
> personal information shall be used for statistical purposes only. Once
> a Recipient makes a Modification available, it is requested that the
> Recipient inform NASA at the web site provided above how to access the
> Modification.
> 
> [Alternative paragraph for use when a web site for release and
> monitoring of subject software will not be supported by releasing
> project or Center] In an effort to track usage and maintain accurate
> records of the Subject Software, each Recipient, upon receipt of the
> Subject Software, is requested to provide NASA, by e-mail to the NASA
> Point of Contact listed in clause 5.F., the following information:
> ______________________________.  Recipient's name and personal
> information shall be used for statistical purposes only. Once a
> Recipient makes a Modification available, it is requested that the
> Recipient inform NASA, by e-mail to the NASA Point of Contact listed
> in clause 5.F., how to access the Modification.

I have to agree with previous comments, I don't think this clause
belongs in the license if it isn't intended as a requirement.  

> B. Waiver and Indemnity: RECIPIENT AGREES TO WAIVE ANY AND ALL CLAIMS
> AGAINST THE UNITED STATES GOVERNMENT, ITS CONTRACTORS AND
> SUBCONTRACTORS, AS WELL AS ANY PRIOR RECIPIENT AND SHALL INDEMNIFY AND
> HOLD HARMLESS THE UNITED STATES GOVERNMENT, ITS CONTRACTORS AND
> SUBCONTRACTORS, AS WELL AS ANY PRIOR RECIPIENT FOR ANY LIABILITIES,
> DEMANDS, DAMAGES, EXPENSES OR LOSSES THAT MAY ARISE FROM RECIPIENT'S
> USE OF THE SUBJECT SOFTWARE, INCLUDING ANY DAMAGES FROM PRODUCTS BASED
> ON, OR RESULTING FROM, THE USE THEREOF.  RECIPIENT'S SOLE REMEDY FOR
> ANY SUCH MATTER SHALL BE THE IMMEDIATE, UNILATERAL TERMINATION OF THIS
> AGREEMENT.

I also have to agree with Larry.  I don't like the idea of idemnifying
the United States Government.  Plus this indemnification clause seems to
only apply to the US Government, its contractors and subcontractors and
prior recipients.  If by prior recipients you mean those that passed the
software on to you, then I think its unclear if this indemnification
applies to contributors.  I don't think that's really fair.

> A. Termination: This Agreement and the rights granted hereunder will
> terminate automatically if a Recipient fails to comply with these
> terms and conditions, and fails to cure such noncompliance within
> thirty (30) days of becoming aware of such noncompliance.  Upon
> termination, a Recipient agrees to immediately cease use and
> distribution of the Subject Software.  All sublicenses to the Subject
> Software properly granted by the breaching Recipient shall survive any
> such termination of this Agreement.

This is bad.  You give the right to sublicense.  If someone sublicenses
the software then this termination clause would terminate their
sublicenses if they violated the terms.  This would seem to apply even
if the sublicensors follow the terms of your license.  I think this
would qualify as discrimination of a group or persons, simply on the
basis of whom they received the software from.

Standard disclaimers: IANAL, TINLA

-- 
Ben Reser <ben at reser.org>
http://ben.reser.org

"Conscience is the inner voice which warns us somebody may be looking."
- H.L. Mencken
--
license-discuss archive is at http://crynwr.com/cgi-bin/ezmlm-cgi?3