Concerns relating to the FSF and Future Licenses

[Chris Travers]

Hi all;

This email is in response to Chris Dibona's willingness to discuss 
concerns I have with the FSF and the future of Free/Open Souce Software 
licenses. I am not posting this on the GPL v3 thread because I believe 
this is *not* relevant to the approval of that license (despite DiBona's 
view that similar questions are relevant for the approval of Microsoft 
licenses). This is hence more of a set of concerns which I think people 
should be aware of as new licenses are released.

Also, I am not a lawyer. To the extent that this reflects my 
understanding of the law, the purpose is a discourse relating to 
Free/Open Source Software ideals and practices, not any sort of legal 
analysis as a desired end.

As a quick summary, I think that there has always been questions by some 
about the specific loyalties of the FSF to certain aspects of their 
ideals (for example allowing invarient sections in the GFDL in order to 
be able to force the distribution of the GNU manifesto with certain 
other documents-- note that invariant sections are considered non-Free 
by Debian because, quite frankly they aren't Free despite the license 
name) but I have generally given them the benefit of the doubt until I 
became aware of certain trends during the GPL v3 process. I now openly 
question the extent to which the FSF is tied to their ideological 
platform vs the extent to which the organization has become fanatical, 
describing Freedom in tones which relate well to the "War on Terror." I 
will lay out why I feel this way and give others who disagree with me a 
chance to engage me in conversation.

I believe that our response should be no different than for other 
submitters of licenses; Read the license, look for any grounds to reject 
it. Discuss any possible grounds and determine whether or not those are 
grounds for rejection. However, often it is important to see trends in 
order to ask where to look.

In this email is also a case why the FSF should not even bother 
submitting the Affero Public License for approval here.

I: Noble Goals
I personally doubt that anyone on this forum would disagree that the 4 
Basic Freedoms listed by the FSF are valuable to everyone both morally 
and economically. The FSF deserves a great deal of credit for 
articulating these in a simple framework which can be used to show 
people why software freedom is beneficial to everyone.

The 4 Basic Freedoms are commonly used by me to explain to business 
types why software freedom is important and how it benefits business.

II: Historical Questions
There have been a number of historical flaps involving the FSF and their 
president, Richard Stallman over time. While past performance is no 
guarantee of future results, context is helpful.

The GFDL is substantially weaker as a copyleft license than the GPL or 
similar licenses. The reason is the ability to add invarient sections of 
text which cannot be altered by subsequent editors. Thus not all GFDL 
works are Free as a whole (in that all portions of the works are 
modifiable). According to Richard Stallman, the goal of allowing the 
invariant sections was to prevent people from removing the GNU manifesto 
from the EMACS manual. This does raise the question of whether RMS 
equates Freedom in documentation (and political expression within that 
documentation) to Freedom of software as a whole. In short, it raises 
serious questions as to whether political victory is more important than 
the ideals which theis cause is based on. Source: RMS email to 
debian-legal (http://lists.debian.org/debian-legal/2003/08/msg00807.html)

Secondarily, I have been concerned about comments I remember reading 
(sorry, cannot find the source so I could be wrong) a few years ago 
where RMS questioned whether Free versions of Apache really had an 
overwhelming market share due to the possibility of proprietizing the 
software. Given the experience of me and a large number of other people, 
I think his comments while possibly factually accurate on the surface 
(i.e. something to the effect of "nobody can tell me for certain....") 
were *clearly* intended as a means of spreading FUD about licenses 
similar to the BSDL *and* about projects under those licenses. I see 
this sort of thing as an attack of a similar nature (though perhaps not 
quite tot he same level as) comments by Stebe Balmer to the affect that 
"We think Linux infringes on a bunch of our patents but we won't tell 
you which ones. Don't worry-- we currently have no intentions to sue." 
In both cases, the intent is to simply scare people away from using 
products or licenses which are perceived as a threat.

III: AGPL: Copyleft, but Effectual and/or Free?

The Affero General Public License (AGPL) has been marketed as the first 
copyleft license for web services. By the FSF's definition of copyleft, 
it would seem to qualify to some extent but the portions of the AGPL 
which are different from the GNU GPL (referred to here just as 'GPL') in 
version two are probably entirely ineffectual.

Under the AGPL, one is required to provide the source upon request to 
anyone to whome one has supplied binary versions of the software. Mere 
use over a network, as in the GPL, does not qualify as supplying. There 
is an added provision that one may not remove interfaces for downloading 
source code from the program itself when these offer the interfaces as 
part of the program.

However, network users of the software are *not* covered by the same GPL 
rights to receive the source as are those whom object code has been 
distributed to. Hence the AGPL only reqires that the interfaces are left 
intact in the software to allow the user to "request" the source code, 
and in no way precludes either altering those interfaces to deny the 
request, nor does it preclude the use of firewalls to filter out usage 
of such interfaces.

The AGPL v2 thus sacrifices the freedom to modify the code for one's own 
use (and distribution) without offering the users any guarantee of the 
source in return (the users are only guaranteed a right to "request" the 
source). This loophole has been addressed in part or full in the 
discussion drafts of AGPL v3, but this license poses additional problems 
and either leaves similar loopholes or severely curtails *use* not only 
of the covered software but of other network components as well (i.e. 
"Freedom" starts taking on a meaning similar to its use in "War on 
Terror" discussions). In short the attempt to move to copyleft licenses 
which compell sofware-as-a-service models to release code to the 
community is moving the FSF substantially away from the most basic 
software Freedom-- the right to use software as one sees fit (the FSF's 
Freedom 0). For more information on this problem, see the concerns about 
the AGPL v3 below. Because the OSI's OSD is indirectely derived from the 
FSF's 4 Basic Freedoms, I think that this should be heeded as a 
potential warning about problems relating to further licenses.

IV: GPL v3 process: Commitment to Standards of Freedom or Not?

One of the areas where I feel the FSF has substantial room for 
improvement is in the area of fostering dialog about the meaning of Free 
Software and circumstances under which basic Software Freedoms can be 
abridged. There has been little written about the fact that rights to 
use the software (Freedom 0) effectively end when one initiates patent 
lawsuits under licenses such as teh Apache License, the GPL v3, and 
others. While I believe that such clauses are helpful to the community, 
I also think it is important that a position as to where the line is 
drawn is articulated. Something to the effect that "we support these 
clauses because users of Free Software only lose their rights when they 
effectively attack the entire community." Such position statements help 
prevent the erosion of software Freedom by fostering discussion at every 
step of the way.

A serious concern that I held about the GPL v3 process involved the 
ability for anyone to add the AGPL network access clause which I (and 
many others) feel violates basic software freedoms. This was removed on 
discussion draft 3 and replaced with a linking exception. If I were to 
release software under the GPL v3, anyone could add additional 
requirements which would potentially govern the *use* of the software 
and other network components (see below under the AGPL v3 section). This 
has never been justified to my knowledge under Free Software ideas but 
only under copyleft. In other words, early GPL discussion drafts 
violated basic software freedoms (the freedom to use and modify the 
software according to one's own needs) in ways which were justified only 
by copyleft and no discussion was given to the effects on the basic 
software freedoms.

When the offending clause was removed in Draft 3 and replaced with a 
linking exception, the reasoning was simply that the ability to convert 
code to an AGPL-style license simply made the license too complex 
(source: Rationale document of GPL v3 Draft 3). Again, no discussion was 
given to the possible impacts on basic software Freedoms.

I believe that the FSF has become an organization devoted to copyleft at 
great expense to the basic software freedoms they claim to hold dear. I 
do not believe that copyleft is synonymous with software Freedom, and I 
think that the key is to look for balance between these two, often 
competing concepts.

This is not to say that the GPL v3 does not have some good points. The 
software is arguably now compatible with old-style BSD licenses due to 
the possibility of adding section 7b legal notices, it is now compatible 
with the Apache License 2.0 and two (but only two) of the Microsoft 
shared source licenses. In short some issues have been addressed but at 
a high cost to general

V: AGPL v3 Discussion Draft 2: Copyleft, but is it Free?

The AGPL Discussion Draft 2 is the GPL v3 with the following additional 
restriction:

"Notwithstanding any other provision of this License, if you modify the 
Program, your modified version must prominently offer all users 
interacting with it remotely through a computer network (if your version 
supports such interaction) an opportunity to receive the Corresponding 
Source of your version by providing access to the Corresponding Source 
from a network server at no charge, through some standard or customary 
means of facilitating copying of software. This Corresponding Source 
shall include the Corresponding Source for any work covered by version 3 
of the GNU General Public License that is incorporated pursuant to the 
following paragraph. "

A linking exception is also provided to the GPL v3.

There are two possible readings of the above restriction, both are 
potentially very bad as they relate to the balance between software 
Freedom and copyleft.
¶ 
<http://gplv3.fsf.org/comment/agplv3-draft-2.html#agplv3.remotenetworkandgnu.p0> 
→ 
<javascript:getnotes('3555:3556:3560:3563:3564:3566:3567:3568:3569:3570:3571:3572')>

Under a fairly narrow reading of the above requirement, the covered work 
itself must allow for its source code to be downloaded over the same 
network session when required by the provision to the extent that such 
modifications are governed under copyright law. This is not protocol 
neutral, and protocols accustomed to sending small amounts of data back 
and forth (for example, a UDP-only DNS server possibly making it 
problematic for the OSI to approve absent other use restriction concerns 
listed below) would seem run into trouble with this license. However, 
nothing in the license according to this reading precludes the use of 
network firewalls and other network devices from filtering out such 
requests (perhaps sending back appropriate errors to the client). By 
this reading the AGPL offers no guarantees to users beyond that of the 
GPL except that an interface will be available by which they can 
politely request (but not necessarily obtain) the source code. Note 
again that the AGPL v3 specifically states that conveyance requirements 
do *not* apply to use over a network.

The second, and far more pernicious, reading of the AGPL v3 network 
interaction clause is that it creates a contract between anyone who 
modifies the code and the copyright author under which the author of the 
derivative work is *obligated* to provide the source of modifications to 
the user. In this reading, use of other network devices such as 
firewalls to deny source requests would essentially create a breach of 
contract. In this reading the AGPL v3 not only restricts use of any 
derivative works themselves but also restricts use of any network 
components which sit in between the modified software and the user. In 
this reading, while the AGPL is clearly copyleft, it is *very* non-Free. 
If this is the accepted reading, it seems to me that it *is not* 
consistent with any of the following definitions of Free/Open Source 
Software:

1) The FSF's 4 Basic Freedoms
2) Debian Free Software Guidelines
3) OSI OSD.

It is, however, consistent with the definition of copyleft and with 
RMS's view of open source in the sense that one can merely "see the 
source code" without the guarantee of the 4 basic freedoms.

One is reminded of the following Babylon 5 quote from the episode 
"Infection:"

"You forgot the first rule of the fanatic: when you become obsessed with 
the enemy you become the enemy," Commander Jeffrey Sinclair.

VI: My General Concerns about the FSF's Commitment to Software Freedom

My general concern about the FSF is that political victory and 
*compelling people to agree or at least accept* copyleft has become more 
important than defending basic software freedoms even in the terms they 
articulate as their core values. In short, I think that they are no 
longer defenders of the 4 Basic Freedoms but rather have pushed the idea 
of copyleft so far that it only means "you have the right to see the 
source."

The FSF's core philosphy as stated on their site is a noble one. My 
concerns are not about this philosophy but rather about their 
unwillingness to put it before political expedience or short-term 
victory. "Freedom" is a powerful word but those who speak of it are 
*not* always defenders of the core concepts. I believe that while the 
FSF has waivered in the past in this area, the march towards the AGPL 
has cast "Freedom" in the same terms as do many discourses about the 
"War on Terror." In short it has lost any tangible quality and we are 
told that essential aspects must be sacrificed perhaps permanently in 
order for the abstract idea to be preserved.

I believe that the FSF can find a way out if they can start establishing 
objective standards for Freedom, as Debian has had to do. Note that the 
heritage of the OSI OSD largely comes from Debian's Free Software 
Guidelines which are derived from an attempt to build standards of 
Freedom around the FSF's guidelines. It is not correct that the OSD is 
weaker than the FSFs standards because several licenses approved as 
"Free" by the FSF may fail to meet the OSD requirements due to the fact 
that they *fail* to grant users of the software appropriate freedoms.

Best WIshes,
Chris Travers
-------------- next part --------------
A non-text attachment was scrubbed...
Name: chris.vcf
Type: text/x-vcard
Size: 181 bytes
Desc: not available
URL: <http://lists.opensource.org/pipermail/license-discuss_lists.opensource.org/attachments/20070818/ff94070d/attachment.vcf>