License question: Open Software License 2.1

[Lawrence Rosen]

I'm sending this to license-discuss with a bcc to the person who actually
wrote me this question. I hope others will chime in with opinions as well.

/Larry Rosen

*******************************

> Let us assume this software is a modular java servlet web application,
> licensed under the OSL 2.1, distributed as source code with the
> ability to build a binary that can be used by a java servlet/web
> server.  The only external interface to the program is through a web
> browser.

First a caveat: I'm not going to give you (or your customers) legal advice
because we haven't entered into an attorney-client relationship. So please
don't cite this as an official legal opinion, merely as an interpretation
given by the license author.

> Customer A downloads this software, compiles it, and runs it on a
> publically accessable server.  They have made no modifications to the
> source code.  Would they have to include a link to download the source
> code they received from me?

Why can't your customer simply refer people to your website for the source
code? OSL 2.1 requires the distributor to place "a machine-readable copy of
the Source Code in an information repository...." If the information
repository is actually on your website rather than the customer's, shouldn't
that be good enough? But you're right that they have to include a link to
the source code they received from you -- assuming that they have become a
distributor of copies. 

As to the issue of whether merely running the code on a publicly accessible
server is a distribution, see below.

> Customer B downloads this software and has added a custom feature or
> module to the software.  They do not include anyway for an end-user to
> download or interact with that module except through their server (no
> binary download).  Would they have to include a mechanism for
> end-users to download the source code for that modification?

Case 1: Suppose Linux were licensed under the OSL and Google took it,
modified it, and ran their entire search engine on it. People everywhere,
third parties all, use Google. What might Google have to disclose of its
modified source code to Linux? My answer is: Nothing, because Google is
merely delivering information, not delivering software.

Case 2: Of course, if Google distributes its modified Linux system to other
companies for installation on those companies' servers to support searching
of private websites, that would be an obvious distribution under either the
GPL or OSL, and Google would be subject to the reciprocity obligation.

Case 3: Now suppose that Google offers a service by which private companies
can download their internal website information to Google's servers and
those companies' employees can privately search that information. This is an
ASP model that, in effect, accomplishes distribution without physical
distribution. The only difference is: Who actually runs or owns the servers?
Why shouldn't Google in this situation be subject to the reciprocity
obligation?

As to whether the OSL's language effectively treats Case 3 as a
distribution, I certainly intended it to do so. I view both Case 2 and Case
3 as "External Deployment."

I also view this as an appropriate objective. The merely convenient
mechanism of providing a server farm on which third parties can operate
their software shouldn't permit a distributor of software to deny he's
actually a distributor. 

Surely our licenses ought to be clear about when we intend our customers to
disclose their modifications. What you're pointing out is that I haven't
been entirely clear in the OSL. Oh well.... I tried....

/Larry 

Lawrence Rosen 
Rosenlaw & Einschlag, technology law offices (www.rosenlaw.com)
3001 King Ranch Road, Ukiah, CA 95482 
707-485-1242 * fax: 707-485-1243 
email: lrosen at rosenlaw.com