New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

We have been asked to by a community member to change our license from Apache 2.0 to MIT #3440

Closed
KevinRansom opened this Issue Aug 15, 2017 · 24 comments

Comments

Projects
None yet
10 participants
@KevinRansom
Contributor

KevinRansom commented Aug 15, 2017

This issue asks for a License change: #1727

We have discussed the matter with our legal types and they have approved us making this change.

For contributors: It will mean a bulk edit of the headers, sorry folks but the headers include the licence the software is released under: see here:

// Copyright (c) Microsoft Corporation.  All Rights Reserved.  Licensed under the Apache License, Version 
2.0.  See License.txt in the project root for license information.

The text of the MIT licence can be found here: https://mit-license.org/

We are inclined to make the change and so we would like to give notice that we will be making the change. Please let us know if the License change will cause difficulties for you.

I propose that we will make the change on September, 1st 2017 to allow you the time to consider this change.

Thanks

Kevin

@eriawan

This comment has been minimized.

Show comment
Hide comment
@eriawan

eriawan Aug 15, 2017

Contributor

This is a good news! The MIT license is in a sense more community friendly.
Thanks @KevinRansom !

Contributor

eriawan commented Aug 15, 2017

This is a good news! The MIT license is in a sense more community friendly.
Thanks @KevinRansom !

@forki

This comment has been minimized.

Show comment
Hide comment
@forki

forki Aug 15, 2017

Contributor
Contributor

forki commented Aug 15, 2017

@alexandru

This comment has been minimized.

Show comment
Hide comment
@alexandru

alexandru Aug 15, 2017

Saw this mentioned on Twitter and I've put some thought in this choice for my own projects, so here are the problems:

  1. for MIT there are multiple variations in the wild, as it has been used by amateurs and whenever I see an MIT license, my alarms go off for booby traps, like the famous JSON license, which isn't OSI compliant
  2. MIT does not have an explicit patents grant with a sane termination clause, Apache 2.0 does

When speaking of MIT, for me the lack of an explicit patents grant is a deal breaker.

Of course, recently the trend is to release code with BSD/MIT + Patents License (e.g. Microsoft and Facebook), but note those patent licenses are usually incompatible with Open Source as well. See for example the Apache Foundation banning Facebook's libraries.

Note that the original issue is mentioning that:

A more permissive license would, in some cases, prevent the scrutiny of legal departments, which can inhibit adoption

To me that doesn't make much sense, since without an explicit patents clause that allows derivative works, legal departments should freak out. Also note that MIT and BSD probably have what is called an implicit patents grant, but AFAIK, that doesn't necessarily hold outside the US or for derivative works.

Apache 2 should be better for the legal departments, because the text is standard and was made by lawyers and you don't have to approve Apache 2 multiple times, whereas you do have to approve MIT + BSD multiple times, because usage depends on extra licenses needed, jurisdiction and threat level.

I am not a lawyer, this is just my 2 cents.

alexandru commented Aug 15, 2017

Saw this mentioned on Twitter and I've put some thought in this choice for my own projects, so here are the problems:

  1. for MIT there are multiple variations in the wild, as it has been used by amateurs and whenever I see an MIT license, my alarms go off for booby traps, like the famous JSON license, which isn't OSI compliant
  2. MIT does not have an explicit patents grant with a sane termination clause, Apache 2.0 does

When speaking of MIT, for me the lack of an explicit patents grant is a deal breaker.

Of course, recently the trend is to release code with BSD/MIT + Patents License (e.g. Microsoft and Facebook), but note those patent licenses are usually incompatible with Open Source as well. See for example the Apache Foundation banning Facebook's libraries.

Note that the original issue is mentioning that:

A more permissive license would, in some cases, prevent the scrutiny of legal departments, which can inhibit adoption

To me that doesn't make much sense, since without an explicit patents clause that allows derivative works, legal departments should freak out. Also note that MIT and BSD probably have what is called an implicit patents grant, but AFAIK, that doesn't necessarily hold outside the US or for derivative works.

Apache 2 should be better for the legal departments, because the text is standard and was made by lawyers and you don't have to approve Apache 2 multiple times, whereas you do have to approve MIT + BSD multiple times, because usage depends on extra licenses needed, jurisdiction and threat level.

I am not a lawyer, this is just my 2 cents.

@cartermp cartermp added the discussion label Aug 16, 2017

@gank-stir

This comment has been minimized.

Show comment
Hide comment
@gank-stir

gank-stir commented Aug 17, 2017

MIT +1

@et1975

This comment has been minimized.

Show comment
Hide comment
@et1975

et1975 Aug 19, 2017

Can someone state clearly which specific problem(s) does the switch solve?
And to add to @alexandru 's point, here's one legal take on MIT license, line by line, quoting:

Lastly, as a result of this mishmash of legal, industry, general-intellectual-property, and general-use terms, it isn’t clear whether The MIT License includes a patent license.[...] More recent permissive open-source licenses, like Apache 2.0, address copyright, patent, and even trademark separately and specifically.

et1975 commented Aug 19, 2017

Can someone state clearly which specific problem(s) does the switch solve?
And to add to @alexandru 's point, here's one legal take on MIT license, line by line, quoting:

Lastly, as a result of this mishmash of legal, industry, general-intellectual-property, and general-use terms, it isn’t clear whether The MIT License includes a patent license.[...] More recent permissive open-source licenses, like Apache 2.0, address copyright, patent, and even trademark separately and specifically.

@realvictorprm

This comment has been minimized.

Show comment
Hide comment
@realvictorprm

realvictorprm Aug 21, 2017

Contributor

I prefer Apache for Visual F# so I'm interested in the issues with it too.

Contributor

realvictorprm commented Aug 21, 2017

I prefer Apache for Visual F# so I'm interested in the issues with it too.

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 24, 2017

Contributor

Following up on your question about dual licensing, here’s what our OSS attorney advised:

We can dual license since we own the code, but it would be very unusual to dual license under the Apache and MIT licenses (I have never seen this done before – normally dual licenses are copyleft and permissive). I would urge the clients to just move to MIT.

Based on the above, it would preferable to change the license from Apache to MIT, assuming you’re still amenable to doing this, rather than dual licensing.

Contributor

KevinRansom commented Aug 24, 2017

Following up on your question about dual licensing, here’s what our OSS attorney advised:

We can dual license since we own the code, but it would be very unusual to dual license under the Apache and MIT licenses (I have never seen this done before – normally dual licenses are copyleft and permissive). I would urge the clients to just move to MIT.

Based on the above, it would preferable to change the license from Apache to MIT, assuming you’re still amenable to doing this, rather than dual licensing.

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 24, 2017

Contributor

This issue asks for a License change: #1727

We have discussed the matter internally and have decided to change the license from Apache 2.0 to MIT.
For contributors: This will mean a bulk edit of the headers, sorry folks but the headers include the license the software is released under: see here:

// Copyright (c) Microsoft Corporation.  All Rights Reserved.  Licensed under the Apache License, Version 
2.0.  See License.txt in the project root for license information.

The text of the MIT license can be found here: https://mit-license.org/
We plan to make the change on September 1, 2017. Please let us know if you have any questions.

Thanks

Kevin

Contributor

KevinRansom commented Aug 24, 2017

This issue asks for a License change: #1727

We have discussed the matter internally and have decided to change the license from Apache 2.0 to MIT.
For contributors: This will mean a bulk edit of the headers, sorry folks but the headers include the license the software is released under: see here:

// Copyright (c) Microsoft Corporation.  All Rights Reserved.  Licensed under the Apache License, Version 
2.0.  See License.txt in the project root for license information.

The text of the MIT license can be found here: https://mit-license.org/
We plan to make the change on September 1, 2017. Please let us know if you have any questions.

Thanks

Kevin

@forki

This comment has been minimized.

Show comment
Hide comment
@forki

forki Aug 24, 2017

Contributor

thanks for asking about dual license. Yes I'm no layer and have no idea what I'm asking.
My naive assumption was: if we dual license then we don't take things away from people. We only append to the rights.

Anyway: thanks for asking. I'm sure the lawers will decide what's best here.

Contributor

forki commented Aug 24, 2017

thanks for asking about dual license. Yes I'm no layer and have no idea what I'm asking.
My naive assumption was: if we dual license then we don't take things away from people. We only append to the rights.

Anyway: thanks for asking. I'm sure the lawers will decide what's best here.

@0x53A

This comment has been minimized.

Show comment
Hide comment
@0x53A

0x53A Aug 24, 2017

Contributor

but it would be very unusual to dual license under the Apache and MIT licenses

I'm no lawyer either, but unusual isn't necessarily bad. are there any actual downsides?

Don't let me stop you, this is more out of curiosity, and with the same reasoning as forki.

Contributor

0x53A commented Aug 24, 2017

but it would be very unusual to dual license under the Apache and MIT licenses

I'm no lawyer either, but unusual isn't necessarily bad. are there any actual downsides?

Don't let me stop you, this is more out of curiosity, and with the same reasoning as forki.

@realvictorprm

This comment has been minimized.

Show comment
Hide comment
@realvictorprm

realvictorprm Aug 24, 2017

Contributor

@KevinRansom well if it's about F# Core I think the situation is different 🤔

I'ld go for Dual then... of course only if it's working fine.

Contributor

realvictorprm commented Aug 24, 2017

@KevinRansom well if it's about F# Core I think the situation is different 🤔

I'ld go for Dual then... of course only if it's working fine.

@alexandru

This comment has been minimized.

Show comment
Hide comment
@alexandru

alexandru Aug 25, 2017

Question: will there be a PATENTS.TXT accompanying the MIT license?

alexandru commented Aug 25, 2017

Question: will there be a PATENTS.TXT accompanying the MIT license?

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 28, 2017

Contributor

@0x53A in terms of the law unusual is unprecedented, and unprecedented is where the risk is. Usual is known and therefore excellent.

@realvictorprm the Lawyer was not enthusiastic about that change. Each License enables our goals for the repo, and so we are happy with either.
Honestly ... I am no Lawyer, and I hate the notion that I may be making legally binding statements, and so ... our Lawyers said to me pick one and live with it. Given that a change to MIT has come up several times in the past, with developers unable to contribute based on their legal Advice, we are okay with making this change.

@forki is a huge and valued contributor, and so I value his opinion highly. I am unable to go with dual, and so is MIT unworkable for you?

@alexandru this is not relevant to the license change from Apache 2.0 to MIT for this repo.
However, I have asked the Lawyers about this ... I will let you know the outcome of that discussion.
Please open a separate discussion for that ask.

Contributor

KevinRansom commented Aug 28, 2017

@0x53A in terms of the law unusual is unprecedented, and unprecedented is where the risk is. Usual is known and therefore excellent.

@realvictorprm the Lawyer was not enthusiastic about that change. Each License enables our goals for the repo, and so we are happy with either.
Honestly ... I am no Lawyer, and I hate the notion that I may be making legally binding statements, and so ... our Lawyers said to me pick one and live with it. Given that a change to MIT has come up several times in the past, with developers unable to contribute based on their legal Advice, we are okay with making this change.

@forki is a huge and valued contributor, and so I value his opinion highly. I am unable to go with dual, and so is MIT unworkable for you?

@alexandru this is not relevant to the license change from Apache 2.0 to MIT for this repo.
However, I have asked the Lawyers about this ... I will let you know the outcome of that discussion.
Please open a separate discussion for that ask.

@forki

This comment has been minimized.

Show comment
Hide comment
@forki

forki Aug 28, 2017

Contributor
Contributor

forki commented Aug 28, 2017

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 28, 2017

Contributor

@forki as far as I can tell there is nothing about the law, that one can safely be naïve about.

Contributor

KevinRansom commented Aug 28, 2017

@forki as far as I can tell there is nothing about the law, that one can safely be naïve about.

@eriawan

This comment has been minimized.

Show comment
Hide comment
@eriawan

eriawan Aug 29, 2017

Contributor

@KevinRansom
I think the decision is clear, MIT license is acceptable. You can close this issue now, imho 🙂

Contributor

eriawan commented Aug 29, 2017

@KevinRansom
I think the decision is clear, MIT license is acceptable. You can close this issue now, imho 🙂

@alexandru

This comment has been minimized.

Show comment
Hide comment
@alexandru

alexandru Aug 29, 2017

@alexandru this is not relevant to the license change from Apache 2.0 to MIT for this repo. However, I have asked the Lawyers about this ... I will let you know the outcome of that discussion. Please open a separate discussion for that ask.

It's not irrelevant given that the biggest difference between Apache 2.0 and MIT is the explicit patents grant.

And if such a change happens, then the change is really not going to be from Apache 2.0 to MIT, but to MIT + PATENTS.txt

If this is intended, then it needs to be communicated explicitly.

alexandru commented Aug 29, 2017

@alexandru this is not relevant to the license change from Apache 2.0 to MIT for this repo. However, I have asked the Lawyers about this ... I will let you know the outcome of that discussion. Please open a separate discussion for that ask.

It's not irrelevant given that the biggest difference between Apache 2.0 and MIT is the explicit patents grant.

And if such a change happens, then the change is really not going to be from Apache 2.0 to MIT, but to MIT + PATENTS.txt

If this is intended, then it needs to be communicated explicitly.

@et1975

This comment has been minimized.

Show comment
Hide comment
@et1975

et1975 Aug 29, 2017

I think the decision is clear

I think the decision has already been made. In fact it looks like it has always been already made.
If the original concern is about legal scrutiny due to patents clause, MIT by itself should be a bigger issue, as already mentioned in that link I posted above.

et1975 commented Aug 29, 2017

I think the decision is clear

I think the decision has already been made. In fact it looks like it has always been already made.
If the original concern is about legal scrutiny due to patents clause, MIT by itself should be a bigger issue, as already mentioned in that link I posted above.

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 29, 2017

Contributor

@et1975. Lawyers will be advising on the request for inclusion of Patents.TXT. I can make no prediction on where or when that will land.

Please note ... that the switch to the MIT license is at the request of the community, and the majority have expressed satisfaction with it.

Contributor

KevinRansom commented Aug 29, 2017

@et1975. Lawyers will be advising on the request for inclusion of Patents.TXT. I can make no prediction on where or when that will land.

Please note ... that the switch to the MIT license is at the request of the community, and the majority have expressed satisfaction with it.

@realvictorprm

This comment has been minimized.

Show comment
Hide comment
@realvictorprm

realvictorprm Aug 29, 2017

Contributor

Thank you for clarifying @KevinRansom

Contributor

realvictorprm commented Aug 29, 2017

Thank you for clarifying @KevinRansom

@alexandru

This comment has been minimized.

Show comment
Hide comment
@alexandru

alexandru Aug 30, 2017

@KevinRansom

@et1975. Lawyers will be advising on the request for inclusion of Patents.TXT. I can make no prediction on where or when that will land.

The reason for concern is that the inclusion of that PATENTS.txt, depending on the text used, can render it incompatible with GPL, Apache-2 or even the OSI definition of Open Source, which is why each license has to be independently submitted to OSI for approval.

Quoting for example straight from the PATENTS.txt of .NET Core:

Microsoft Corporation and its affiliates ("Microsoft") promise not to assert any .NET Patents against you for making, using, selling, offering for sale, importing, or distributing Covered Code, as part of either a .NET Runtime or as part of any application designed to run on a .NET Runtime.
...
".NET Runtime" means any compliant implementation in software of (a) all of the required parts of the mandatory provisions of Standard ECMA-335 – Common Language Infrastructure (CLI); and (b) if implemented, any additional functionality in Microsoft's .NET Framework

Again I am not a lawyer, but I can read English, and what this describes is that the patents grant is limited in scope, not applying to "derivative works" in general. Even more so, by including PATENTS.txt in the repository, the allegedly implicit patents grant of MIT / BSD no longer applies. Given that the "community" has accepted this for .NET Core, I'm guessing that it's fine, if the alternative might have been for .NET Core to not be released at all.

Again, I have no such concerns for Apache 2.0, because Apache 2.0 was reviewed in full by both OSI and the FSF. So when you switch from Apache 2.0 to MIT, you have to clearly communicate what the intent is in regards to publishing a PATENTS.txt or not and what that text will be.

Going back to the "community" asking for this change, these are concerns from the community that aren't being addressed.

alexandru commented Aug 30, 2017

@KevinRansom

@et1975. Lawyers will be advising on the request for inclusion of Patents.TXT. I can make no prediction on where or when that will land.

The reason for concern is that the inclusion of that PATENTS.txt, depending on the text used, can render it incompatible with GPL, Apache-2 or even the OSI definition of Open Source, which is why each license has to be independently submitted to OSI for approval.

Quoting for example straight from the PATENTS.txt of .NET Core:

Microsoft Corporation and its affiliates ("Microsoft") promise not to assert any .NET Patents against you for making, using, selling, offering for sale, importing, or distributing Covered Code, as part of either a .NET Runtime or as part of any application designed to run on a .NET Runtime.
...
".NET Runtime" means any compliant implementation in software of (a) all of the required parts of the mandatory provisions of Standard ECMA-335 – Common Language Infrastructure (CLI); and (b) if implemented, any additional functionality in Microsoft's .NET Framework

Again I am not a lawyer, but I can read English, and what this describes is that the patents grant is limited in scope, not applying to "derivative works" in general. Even more so, by including PATENTS.txt in the repository, the allegedly implicit patents grant of MIT / BSD no longer applies. Given that the "community" has accepted this for .NET Core, I'm guessing that it's fine, if the alternative might have been for .NET Core to not be released at all.

Again, I have no such concerns for Apache 2.0, because Apache 2.0 was reviewed in full by both OSI and the FSF. So when you switch from Apache 2.0 to MIT, you have to clearly communicate what the intent is in regards to publishing a PATENTS.txt or not and what that text will be.

Going back to the "community" asking for this change, these are concerns from the community that aren't being addressed.

@KevinRansom

This comment has been minimized.

Show comment
Hide comment
@KevinRansom

KevinRansom Aug 30, 2017

Contributor

@alexandru, thank you for your comments, we appreciate them, and understand them.

On the internet universal agreement is not very common, I am satisfied, based on this thread and other threads discussing this, that the consensus of the regular contributors and consumers of this repository are satisfied with the license change as proposed.

Contributor

KevinRansom commented Aug 30, 2017

@alexandru, thank you for your comments, we appreciate them, and understand them.

On the internet universal agreement is not very common, I am satisfied, based on this thread and other threads discussing this, that the consensus of the regular contributors and consumers of this repository are satisfied with the license change as proposed.

@KevinRansom KevinRansom closed this in #3517 Aug 31, 2017

@fommil

This comment has been minimized.

Show comment
Hide comment
@fommil

fommil Sep 8, 2017

The expat license (or MIT as you're calling it) is a permissive free/libre software license that is compatible with the GPL. Well done for releasing your software under an FSF approved license!

However, let me summarise what this means for those who may have gotten a bad impression of Apache 2 (which is also a GPL compatible free/libre software license): the MIT license only gives you access to the Software that you received but you must agree to pay royalties to Microsoft for any patents that they lay claim to.

Back when this was Apache 2, Microsoft were giving you the rights to the patents too. And if you file patent litigation against Microsoft claiming that this software infringes your patents, then you lose the rights to the Microsoft patents and have to pay Microsoft to use them. i.e. you'd be in the situation you're in now.

I find this quite funny. I suspect the Microsoft lawyers had a right old giggle to themselves. I recommend the person requesting this change get a lawyer who knows what they are talking about and this whole thing could have been avoided. But then, I wouldn't have been given such a funny thread to read this morning, so thank you!

fommil commented Sep 8, 2017

The expat license (or MIT as you're calling it) is a permissive free/libre software license that is compatible with the GPL. Well done for releasing your software under an FSF approved license!

However, let me summarise what this means for those who may have gotten a bad impression of Apache 2 (which is also a GPL compatible free/libre software license): the MIT license only gives you access to the Software that you received but you must agree to pay royalties to Microsoft for any patents that they lay claim to.

Back when this was Apache 2, Microsoft were giving you the rights to the patents too. And if you file patent litigation against Microsoft claiming that this software infringes your patents, then you lose the rights to the Microsoft patents and have to pay Microsoft to use them. i.e. you'd be in the situation you're in now.

I find this quite funny. I suspect the Microsoft lawyers had a right old giggle to themselves. I recommend the person requesting this change get a lawyer who knows what they are talking about and this whole thing could have been avoided. But then, I wouldn't have been given such a funny thread to read this morning, so thank you!

@alexandru

This comment has been minimized.

Show comment
Hide comment
@alexandru

alexandru Sep 8, 2017

While I agree with what @fommil said above, I believe some extra extra clarifications are needed for this claim:

if you sued Microsoft then you lost the rights to the patents and had to pay Microsoft to use them. i.e. you'd be in the situation you're in now

The Apache 2.0 license is actually healthy in this regard. And I quote:

If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed

So the license says termination happens if you sue Microsoft for their contributions to the project, however you can still sue Microsoft for unrelated projects and the patents grant of this license still holds.

This is actually the criticism of Facebook's PATENTS grant for React, in which they say:

The license granted here under will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: (i) against Facebook or any of its subsidiaries or corporate affiliates ...

So basically if you sue Facebook for anything, they terminate the patents grant they gave you for React. Compare this text with the text from Apache 2.0. The Apache 2.0 license carefully puts that grant and its revocation only in the context of "The Work" being licensed.

Also, I see that this project is now licensed under MIT, but with no PATENTS file. In my mind that's actually better, but another problem is that any PATENTS file can always be added later to the repository and estoppel will no longer apply, the MIT license not protecting users in any way.

Personally I don't understand why some people prefer this over Apache 2.0, but then again it's their choice and I've added my thoughts here only for other people to get informed about what they are getting into, as the choice has been made anyway.

Cheers,

alexandru commented Sep 8, 2017

While I agree with what @fommil said above, I believe some extra extra clarifications are needed for this claim:

if you sued Microsoft then you lost the rights to the patents and had to pay Microsoft to use them. i.e. you'd be in the situation you're in now

The Apache 2.0 license is actually healthy in this regard. And I quote:

If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed

So the license says termination happens if you sue Microsoft for their contributions to the project, however you can still sue Microsoft for unrelated projects and the patents grant of this license still holds.

This is actually the criticism of Facebook's PATENTS grant for React, in which they say:

The license granted here under will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: (i) against Facebook or any of its subsidiaries or corporate affiliates ...

So basically if you sue Facebook for anything, they terminate the patents grant they gave you for React. Compare this text with the text from Apache 2.0. The Apache 2.0 license carefully puts that grant and its revocation only in the context of "The Work" being licensed.

Also, I see that this project is now licensed under MIT, but with no PATENTS file. In my mind that's actually better, but another problem is that any PATENTS file can always be added later to the repository and estoppel will no longer apply, the MIT license not protecting users in any way.

Personally I don't understand why some people prefer this over Apache 2.0, but then again it's their choice and I've added my thoughts here only for other people to get informed about what they are getting into, as the choice has been made anyway.

Cheers,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment