<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 22/10/24 01:39, Victor Grey via
License-review wrote:<br>
</div>
<blockquote type="cite"
cite="mid:5CB74FBB-0737-43A1-9859-CA5166F0210C@jlinc.com">
<pre wrap="" class="moz-quote-pre">To the OSI community, this is a request for approval for a new special-purpose open source license, as attached. The license is intended for software that provides registration and resolution services for Decentralized Identifiers (DIDs - <a class="moz-txt-link-freetext" href="https://w3c.github.io/did-core/">https://w3c.github.io/did-core/</a>). Such software may be used as a standalone service or incorporated into any other software to provide DID resolution services for any purpose, conditioned on it not being used to violate the privacy rights of end users of the service.</pre>
</blockquote>
<p>From the license text:</p>
<p>
<blockquote type="cite">4.6 Respect for DID subject’s Privacy<br>
You may not use the permissions granted under this License to
infringe, invade, breach, or otherwise fail to protect the
privacy of any DID subject making use of the services provided
by the Work.<br>
<br>
Privacy, for the purpose of this license, means a duty of care
for the protection and confidentiality of any data generated by
the operation of the Work, such as server logs or any other logs
or metadata, that would enable the surveillance or correlation
of the activities of the DID subject or other entities
identified in the DID document by the Receiver or third parties,
unless the Receiver is legally compelled otherwise.</blockquote>
</p>
<p>This is an <b>explicit</b> use condition, which therefore
unambiguously breaches OSD6.</p>
<p><br>
</p>
<p>I'd suggest that a better protection for the intended risk is
reliance on privacy-related law that the licensee is subject to.
This does have some consequences of course:</p>
<ul>
<li>What those rules are varies drastically between developed the
economies and blocs alone — particularly the EU, US, and China,
which jointly account for ~1/4 of the world's population and
most of the world's GDP — let alone the rest of the world.
There's no way to square this circle, different people live
differently and under different laws (indeed different systems
of law); the protections that would be appropriate in one place
are frequently inappropriate in others. It would be harmful to
attempt to impose a one-size-fits-all rule in the context of an
OSS license.<br>
</li>
<li>The good news is that you don't need to worry about it.
Licensees are already subject to the law no matter the text of
the license says. (You do not, for example, need to put text in
about licensees complying with the law; this is implicit in all
contracts and licenses. Indeed, any clause which purports to
authorise illegal activity is simply null and void.)<br>
</li>
</ul>
<p>I've not evaluated the rest of the license text, but with respect
to the use conditions the fix to the text is simple: just remove
them completely.</p>
<p>- Roland</p>
<p><br>
</p>
</body>
</html>