[License-discuss] a GPLv3 compatible attribution for MIT/BSD?

[Richard Fontana]

On Wed, Feb 01, 2012 at 05:30:54PM -0800, Rick Moen wrote:
> In the last decade, the aforementioned group of Web 2.0 / SaaS 
> hucksters started referring to mandatory runtime advertising as
> 'attribution', too -- a rather propagandistic sleight of tongue, in my
> view -- an approach that reached the pinnacle of absurdity with SugarCRM
> Community Edition 5.x's perversion of GPLv3, using clause 7b to
> re-implement the same obnoxious name-and-graphical-logo on every page
> requirement widely rejected in the openly badgeware licences that they
> claimed were open source.  One of my analyses:
> http://linuxgazette.net/159/misc/lg/sugarcrm_and_badgeware_licensing_again.html
> 
> Quoting:
> 
>    GPLv3 section 7 is _not_ about attribution provisions. It is about
>    required legal notices (e.g., trademark) and other permitted
>    supplementary terms. Clause 7b says that "Requiring preservation of
>    specified reasonable legal notices or author attributions in that
>    material or in the Appropriate Legal Notices displayed by works
>    containing it" are permitted, but I very much doubt that FSF had in
>    mind required, immutable runtime display of trademarked logos and
>    advertising on every user interface screen of the program and all
>    derivatives -- which has the obvious effect of severely impairing
>    freedom of third-party commercial use. 

The only thing I would take issue with is characterizing what SugarCRM
did (at least if you're talking about the initial version that was
released under GPLv3, since I haven't followed it since then) as a
"perversion", because as a matter of historical record it was done
with the FSF's blessing, and through a negotiation with the FSF's
lawyers (which, at the time and for that purpose, was me).

I wrote some of my recollections about this on debian-legal recently,
on a thread that I believe Clark started.
http://lists.debian.org/debian-legal/2011/12/msg00038.html
http://lists.debian.org/debian-legal/2011/12/msg00045.html

I have since had significant misgivings about this relatively late
change to GPLv3, and I've seen how it's been abused. I've also come to
see, as I admit I did not quite see clearly in those days, what was so
fundamentally wrong at a deeper level with badgeware (beyond the mere
typical burdensomeness of the requirement itself). In some ways I see
the badgeware episode as the jumping of the shark moment of that
particular era of experimentation with open source business models.

A key thing which I've seen abused is an elimination of the intended
limited scope of the "Appropriate Legal Notices" requirement. While in
theory a GPLv3 licensee may be subject to this requirement under some
circumstances, the way one implements ALN is up to that licensee, and
cannot be mandated by the upstream licensor. Yes, "reasonable author
attributions", including in some cases graphical logos, may have to be
"preserved", but one could do so in a far more minimalist fashion than
the upstream licensor had done, for example.

The provision was certainly not intended to import the standard
badgeware practices being debated on license-discuss in those
days. Indeed, I was greatly influenced by those discussions when I
worked with the FSF on drafting those changes and articulating what
the limits of their reasonable use were supposed to be. 

> An FSF author involved with the GPLv3 draft speaks to FSF's intent
> (FWIW):  http://gplv3.fsf.org/additional-terms-dd2.html
> 
>   A GPL licensee may place an additional requirement on code for which
>   the licensee has or can give appropriate copyright permission, but only
>   if that requirement falls within the list given in subsection 7b.
>   Placement of any other kind of additional requirement continues to be a
>   violation of the license. Additional requirements that are in the 7b
>   list may not be removed, but if a user receives GPL'd code that purports
>   to include an additional requirement not in the 7b list, the user may
>   remove that requirement.

As it happens I wrote that document, although that was well before the
(for lack of a better term) quasi-badgeware modification was made to
GPLv3's later drafts.

- Richard