For Approval: Microsoft Reciprocal License

[Matthew Flaschen]

Philippe Verdy wrote:
> Now what I discussed was not stupid: the licence explicitly states this
> restriction in the list of grants:
> 
> (B) No Trademark License- This license does not grant you rights to use any
> contributors' name, logo, or trademarks.

Again, a trademark license isn't necessary.  Fair/nominative use is
sufficient protection. Many OSI-approved licenses lack trademark grants.

> However the last sentence of the licence (absence of warranty) is possibly
> problematic: “The contributors exclude the implied warranties of (…)
> non-infringement (…)” even though the users must still keep the name of
> contributors in the attribution and copyright notice. So, even if Microsoft
> signs the licence, and attributes itself as an author/contributor, Microsoft
> may include some code in its distribution for which it has no right and
> cannot legally grant a patent licence,

This is a common clause in both open source and proprietary licenses.
See
http://www.google.com/search?q=non-infringement+site%3Aopensource.org
for a list of OSI-approved licenses with the word "non-infringement"
The clause means Microsoft is not guaranteeing the code is free of
infringements.  However, they won't deliberately include infringing
code, because that would also make them liable.

> If some downstream user is operating the software from within a
country that is a party to the Bern
> convention, then he is not liable for any infringement,

The end-user would certainly be liable for any patent infringement, and
would probably be liable for any copying they did (if the MS-RL code
infringed third-party copyrights).

> So a malicious downstream user may corrupt the file and its source, without being
> identifiable later, because only the original authors are cited in the
> copyright and attribution notices.
> 
> Such provision is found within the GPL (which includes some wording about
> keeping also the history and adding new records in the history, without
> reattributing the modifications that any downstream user makes to the
> original authors that did not make them).

A GPL-style notice of changes ("You must cause the modified files to
carry prominent notices stating that you changed the files and the date
of any change.") might be useful, but I don't think it's necessary.
Someone falsely attributing bad work to someone else would probably be
liable under other laws (e.g. Lanham Act, fraud, mis-representation,
computer crimes, etc.), so I don't think this is a major issue.

Matt Flaschen