For Approval: Common Public Attribution License (CPAL)

[Ross Mayfield]

Hi Matt --

Thanks again for your feedback, and I didn't get a chance to thank you
for your more constructive feedback on STPL.  We're getting there...

On 6/26/07, Matthew Flaschen <matthew.flaschen at gatech.edu> wrote:
> Ross Mayfield wrote:
>
> > and we do not consider ourselves open source,
>
> I think publicly ceasing to describe your product (and company) as open
> source, pending your use of an OSI-approved license,  was a real
> demonstration of good faith. Thank you.

::smile::

>
> > We have used the Adaptive Public License, which is virtually the sames as the
> > prior attribution provision which was in Exhibit B of the proposed
> > Socialtext Public License,  as the basis for the attribution provision
> > because it was approved after OSD 10 was adopted.
>
> Russ Nelson said, "Do not use the Adaptive Public License as a
> precedent.  It is one of the worst licenses we ever approved."
>
> I still feel that requiring all GUIs to display an arbitrary logo is an
> OSD #10 violation.  Some GUIs can not display arbitrary images at all,
> and others can only display small ones.  I see no evidence that anyone
> considered such OSD #10 issues while APL was under consideration.
> Really, it doesn't look like the license was thoughtfully considered at all.

I think that different individuals have different views about the
approved OSI licenses. Russ has his opinion on APL, but others may
have a different opinion. For example, many  commentators have been
very critical about the GPL.  I don't understand your basis for the
statement that the APL was not thoughtfully considered. I understand
that you do not like the license, but let's give credit to the License
Discuss process.

Your view of OSD 10 is simply not correct. The record would not
reflect consideration of attribution notices and OSD 10, because OSD
10 did not address attribution notices. As Larry Rosen, the General
Counsel of the OSI at the time, noted in a January email about OSD 10
on this issue:

"That isn't historically correct.

OSD #10 was written in response to something entirely different. There were
attempts at that time to propose licenses that mandated "click-wrap" and
similar "I accept the license" interfaces in distributed open source
software. Much of the community thought it was unseemly to force a specific
method of license acceptance onto future software distribution modes,
specifically downstream derivative works that would have to retain
technologically obsolete or interactive code for contract formation
purposes. The OSI Board decided to foreclose such license provisions by
adopting OSD #10. Thereafter, an open source license could require a
"reasonable effort under the circumstances to obtain the express assent of
recipients" (see AFL/OSL 3.0 § 9) but nothing more technologically specific."
http://osdir.com/ml/licenses.open-source.general/2007-01/msg00261.html

> > We have limited the placement requirement for attribution notice to
> > "prominent"rather than a specified size or location. We have also
> > permitted the use of splash screens.
>
> Does this mean that the attribution can be on /only/ the splash screen?

Splash screens is one way of fufilling the requirement.

>  The term "prominent" is frequently used in other OSI
> > approved licenses such as the GPL
>
> This portion of the GPL is referring to source code notices.  It says,
> "You must cause the modified files to carry prominent notices".
>
> The GPL does have a runtime attribution requirement (2.c), but this
> doesn't require a graphic image, URL, or arbitrary phrase.  It also
> doesn't specify form or require prominence.  The interface of GPL
> software (if that clause is taken advantage of) need only have
> summarized copyright and warranty information, with options for the user
> to view details if they want to.

The point is that prominent used in a wide variety of OSI licenses
without problem. The use of prominent to refer to notices in the files
is not analytically different from its use on an interface.  You are
not correct about GPLv3: the copyright and warranty notice are
"Appropriate Legal Notices" and are required to be displayed. The
attribution information, which is optional under Section 7(b), is in
addition to the "Appropriate Legal Notices". The attribution
information is only limited to "reasonable" author attribution and
they do not exclude graphics.

> > and NASA Public License.
>
> I assume you mean NASA Open Source Agreement, which says, "Each
> Recipient must ensure that the following copyright notice appears
> prominently in the Subject Software".  This requires only a copyright
> notice, and it is not even clear that this must be visible during
> runtime (rather than only prominent in the source code).
>
> With CPAL, up to 10 words, an arbitrary graphic, an arbitrary URL, and
> copyright notice must all be prominently displayed on a main interface.
>
> Finally, these licenses don't define prominent as "of sufficient
> duration to give reasonable notice to the user of the identity of the
> Original Developer and (b) if You include Attribution Notice or similar
> information for other parties, You must ensure that the Attribution
> Notice for the Original Developer shall be no less prominent than such
> Attribution Notice or similar information for the other party."
>
> This definition is subjective (doesn't "sufficient duration" depend on
> vision, age, attention, etc.) and at the least, could eventually result
> in a profusion of attribution, slowing the splash screen into a slideshow.
> This is an OSD #3 problem, since it constrains practical modification.

The issue that you raised is whether "prominent" was too vague. We
were pointing that "prominent" is widely used in other OSI approved
licenses and has not been a problem. We agree that the notice
requirements are different.  I am puzzled by your concern about
"sufficient duration" since we were trying to clarify the requirement
to meet your concerns. We agree with Rick Moen on this issue. Please
note that the OSI website has a graphic and phrase relating to the
Creative Commons license very similar to our proposal on every page.

> > Socialtext believes that the application software has special needs as compared
> > to operating systems because of the application software can be used
> > anonymously in large distributions
>
> Again, this argument makes no sense.  First, the OSD is not about
> satisfying "special needs" of any program or company; it is about
> guaranteeing rights to users.  Besides, it is core operating system
> software that is used anonymously.  Again, almost no users know who
> wrote the ls utility or essential kernel drivers.  But I guarantee every
> user of SocialText Enterprise Wiki (and even most users of rebranded
> versions) know who wrote that; a wiki is big software, and it's hard to
> use "anonymously" or ignore the author, even without attribution.
> People do research when they install something as big as a wiki.
>
> Thus, most know MediaWiki is sponsored by the Wikimedia Foundation,
> despite the fact that it requires no branding.

Your premise is incorrect. The OSD is not limited to guaranteeing
rights to users, OSI and the OSD take a much broader approach to
making open source software successful and that goal requires working
with different constituencies, including developers, companies and
users. The OSI notes on its website:

"The Open Source Initiative (OSI) is a non-profit corporation formed
to educate about and advocate for the benefits of open source and to
build bridges among different constituencies in the open-source
community.

One of our most important activities is as a standards body,
maintaining the Open Source Definition for the good of the community.
The Open Source Initiative Approved License trademark and program
creates a nexus of trust around which developers, users, corporations
and governments can organize open-source cooperation."

I appreciate your view of the market, but I would like to understand
the factual basis for it. I am running a software company and my
experience is that, without attribution,  "everyone" will not know who
made our software. OSI is effective because its decisions are based on
the realities of the industry. I am working to make Socialtext
available to the community every day and I know that I need this
flexibility. And I am not alone in this view:  attribution has been
adopted by over 12 application companies. We are seeking to provide a
"template" license to meet this need. We respect OSI and its process:
we have worked with License Discuss for over eight months and have
made numerous changes to our proposed license. I hope that OSI will
show similar respect for our experience and needs.

Ross