-
Notifications
You must be signed in to change notification settings - Fork 440
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Stop calling it Open Source if you only provide Commons Clause license #4
Comments
hi Neal, |
You can call it "source-available" or "disclosed source" or something else. But it is not "open source", and the license you use clearly states that, as I quoted above. You are retaining the right to sue people e.g. for just selling consulting services on how to deploy or use OpenEDR:
You can't add the Commons Clause to a license and still claim that it is open source. It would be like claiming that something is "USDA Certified Organic with added pesticides" |
My understanding is different than yours, in that if someone took the code, created a derivative software and then charged for that derivative software was the issue. Using OpenEDR to offer a service wasn't caught by this license. That is my understanding and will double check it with legal people. (i checked the license again after I wrote the above....) I followed the further discussions linked in the above URL: Found these that explains it further. fossas/commons-clause#4 |
Until these issues are properly resolved, please re-open this issue. Right to sell Open Source is guaranteedThe right to sell e.g. Apache or Linux, or a derivative of them, or consulting around them, is a major reason why people seek out open source software and shun software with entanglements like the Commons Clause. The right to do that with any open source code is explicitly guaranteed by the The Open Source Definition (Annotated) | Open Source Initiative:
So for that reason alone, you must refrain from claiming that OpenEDR is Open Source. Right to offer OpenEDR via SaaS is not granted given the Commons ClauseDespite the reference to allowing others to offer SaaS in your quote above, you also must be clear that no one else is allowed to sell OpenEDR as a service in a SaaS offering. As the FAQ also clarifies:
Right to consult on OpenEDR seems explicitly prohibited by Commons ClauseRe offering consulting services, the FAQ is not a legal interpretation, as even author of the clause, Heather Meeker, says at the "clarifying discussion" link:
Furthermore, that "clarifying discussion" is a GitHub issue entitled Preventing specialized consultants? which is well worth reading very carefully. Despite the fact that the issue was closed, it leaves me, the author of the issue (saibotsivad), and many others very dubious about why the text of the license wouldn't also apply to any consultant. How else could the inclusion of the phrase "consulting/support services " in the text of the license be interpreted? Given that legal uncertainty, if you don't want to cut your product off from the benefits of having others offer consulting around it, Importance of Community to open source software projects, vs Business ModelsOpen Source is about supporting the community. Commons Clause is about giving one particular organization (the copyright holder, Comodo here) broad rights that no one else has. See more clarity on the focus Open Source has on empowering communities, vs various non-open-source attempts to support various business models at We need Sustainable Free and Open Source Communities by Adam Jacob | Sustainable Free and Open Source Communities | Medium |
Thank you for your quick and helpful responses. I am glad to see your movement towards more openness, especially in security-relevant software like yours. I'm an open source and security expert, not a trademark expert. Regardless of the legalities of usage of the term, it has long been clearly understood to mean software that meets the Open Source Initiative definition, and that definition is itself referenced by the Commons Clause FAQ. More particularly, I'm confident that if your intent is to engage the software community, you should abide by the clear statements in the FAQ and by the author of the Commons Clause that you should not describe your software as "open source" while adding the Commons Clause. Given the discussion, it is still my opinion that a different "rider" than the Commons Clause might make sense if your goal is specificially to prohibit selling OpenEDR. The clause text and FAQ also seems quite clear that a SOC or MSSP offering a SaaS service which relies on unmodified software would be "substantially" relying on the value of OpenEDR, thus putting them in legal limbo at best. No offense, but I'd hate to be pulled in front of a judge by some company that might buy out Comodo some day, who has a different sensibility about this, and having defend myself by pointing to unsigned, editable comments in a GitHub issue, even though they are written by someone who appears to be the CEO. Finally, I see no indication of which underlying open source license you are modifying by the Commons Clause, since the latter is the only licensing information noted in the License.md file. |
Thanks for your valuable input Neal, these kind of open discussions are what helps us all improve. "Open sourcing/Open source" vs "Open Source Initiative": Is it your understanding that one can't use the verb "Open sourced" because of the Trademark? If so can you point me to a trademark on that please? I validated with our legal guy that with our Commons Clause a SOC or MSSP can offer SaaS without modifying the OpenEDR software, because they are adding their services. Legally they are not seeing any issues with that and they suggested if you want a clarification, I can send you what I stated publicly that its ok for a SOC or MSSP to use it as is as part of their services without modifying the code on an email (as the CEO of the company confirming that). If you let me know your email address happy to send that email. |
I think this is about clear documentation, avoiding confusion, and putting user's minds at ease. Several issues remain in play:
|
I agree with that statement. Let me talk to the team again to make sure all these issues are addressed. |
https://github.com/ComodoSecurity/openedr/blob/main/LICENSE.md 2 issues remain: for now I put a clarification for SOCs/MSSPs in the above link. (is it good enough in your view? If not what is missing?) |
Thanks for taking care of the underlying license. Re the SOC/MSSP clause: how do you legally define those sorts of organizations? What is there to prevent an arbitrary organization from incorporating those capabilities just in order to compete with you? What is there to reassure the legal team of one of them that they qualify, and you won't change your mind after they have committed to an OpenEDR-based approach? Finally, back to "open source": the consensus use of the term over decades, regardless of the part of speech, has referred to the same set of freedoms that the OSI has codified. It isn't just bad manners to misuse the term. It misleads your users. Just use an accurate term like "Source Available" instead. I also ran across this cautionary tale from the very folks who drove the Commons Clause: Why Open Source Licenses with a Commons Clause May Become Less Common | Finnegan
So that reinforces the other concerns I've shared above. The Commons Clause seems like a bad choice in the first place. |
SOC/MSSP is a fairly well defined term and what they do is fairly clear. As long as you are a SOC/MSSP you can happily use OpenEDR to offer your SOC/MSSP services. If our competitor wants to offer SOC/MSSP services then they can use OpenEDR within the same capacity to operate their SOC/MSSP business. Its just that they can't take the code and sell it as is and make money. We encourage SOCs and MSSPs to build a service around OpenEDR. That's the whole point of OpenEDR. As to "open source": we are aligned, I agree with you. I am aware of the term "Source Available" etc, we are thinking about how to refer to it. Here is a potential dilemma with Open Source as per OSI model: The way OSI has set it causes the following problem and would love to hear your view on it: Company A creates an open source product. So the question is: How would Company A protect itself while Open sourcing? |
From a community perspective, the goal is to have robust, widely supported software. The community benefits when multiple organizations successfully offer, sell, support and collaborate around a body of open source software. Linux is a great example of that. Some companies are great at marketing, some at developing, some at adding nice interfaces, etc. They all contribute to the community by leveraging their own expertise. They compete vigorously, and many make lots of money. Linux would not have revolutionized the industry and created so much value if, like Unix, it had not been fully open source. You've seen how open source itself as a development and community-building strategy has revolutionized the entire software industry. So have your competitors who offer truly open source EDR frameworks. As in all walks of life, developing and executing a business plan in the software and support world is challenging. I appreciate you evolving your plan to involve more openness. But I'm not a business consultant, or expert in the EDR space, so I can't give you good advice on how to best do so. I can simply encourage you to explore the benefits of the kind of fully engaged community you would get by adopting a fully open source route. And if you don't choose that, I can help you describe your plan in ways that are accurate and let your collaborators quickly understand what they can and can't do with OpenEDR. |
Thanks for the answer Neal. |
I recommend more in-depth study of the history and economics of open source and Linux. To the surprise of many, nearly all of present-day LInux has come from for-profit companies, who introduce plenty of innovation and create value based on their investment in it. Huge, innovative, successful companies like Red Hat, Intel, Suse, Samsung, or Oracle. Red Hat turned their Linux expertise into a company valued by IBM at 34 Billion dollars, and last I heard, all of their products (including many applications and frameworks not in the kernel) have always been open source. And I think a very strong case can be made for the net benefits of open source to innovation, by opening the playing field up to everyone from kids at home to big corporations. See e.g.
Hugely successful projects like Raspberry Pi and RISC-V, which bring open source principles to hardware, show how much wider the idea can spread. Again, it may or may not be a fit for your company. But learn and dream some more about the possibilities, and whatever you do, please give your customers the straight story. |
One important thing you are missing is that none of "present-day Linux" could have happened if it wasn't created by Linus in the first place! (which was funded by a "non for profit" and was created a "Hobby"). Here is what Linus wrote on USENET: “I’m doing a (free) operating system (just a hobby, won’t be big and professional like gnu) for 386(486) AT clones.” Again, I am not arguing the "after the fact" affects of open source...once something has been "open sourced". My point is businesses have no incentive to open source. Problem Statement: Note: Raspberry Pi: business model was to sell hardware, that's how they generated income and I believe they were a "non for profit charity" (https://en.wikipedia.org/wiki/Raspberry_Pi ) Two examples of success you point to was "created" (started/initiated) and funded by a "non-for profit" organisations! Which is my point exactly. The OSI model has to change to incentivize businesses/corporations to want to "open source". If what a student coded as a hobby creates such a big industry, now imagine how much more we can achieve if businesses/corporations were also incentivized to open sourcing their code! A thought experiment for you Neal:
Question: Would you open source all that code at day one based on the OSI model? Note: the above thought experiment is a very typical of what any new start up has to go through. It is these start-ups that are changing the world that I would like to incentivize for opening their source code! (unfortunately OSI model blocks that!) |
Look, @ComodoMelih, you simply can't tell OSI what to do, or redefine the common understanding of "open source", for all the reasons I've articulated above. You haven't fixed this bug, so please reopen it. You can, as a separate effort, try to come up with some sort of "source available" license that you think works better for some kinds of businesses. It just isn't part of this particular issue. I recommend working with @BrucePerens, a co-founder of OSI, and an expert in both business and licenses. But again, this bug remains, as Perens himself also notes: they need to stop confusing it with open source! |
@nealmcb **_I thought as a person:
-I wanted you to understand OSI is killing innovation! Was I able to explain it Neal, this is a very sincere question? I genuinely want to engage and exchange ideas and perspectives in an open and frank manner. |
Hi @ComodoMelih, I am co-founder of the Open Source Movement in software, and the main author of the Open Source Definition. First, I would like to correct a fallacy in your summary:
OSI and other Open Source evangelists and promotors are not killing innovation, and can not kill innovation because nobody is compelled to call their software "Open Source". It's just silly to assert otherwise. Please stop. If you want to call your software something related to the license, I suggest "Commons Clause Software", but you are welcome to come up with your own name. The "Commons Clause" is not compatible with the Open Source Definition, for the reasons already stated to you. What it appears you are trying to do is make use of the "Open Source" imprimatur without complying with the definition. Regardless of the trademark status, this really looks to me like deceptive marketing of your software, please stop it until you can apply an unmodified license that is accepted as compliant with the Open Source Definition. As was stated to you, several years ago Monty and I came up with a "Business Source License" for MariaDB (formerly MySQL) which very carefully avoided calling itself "Open Source". I am also working on a "Post Open Source" (until we find a better name) campaign which doesn't have a lawyer-audited license yet, but the goal is supporting software freedom while producing income for the developer where appropriate. This campaign is also careful to point out that it's not Open Source. |
Hi @BrucePerens @BrucePerens would love to hear your views/thoughts on the following use case though please. I come from a thought process of "Nothing is perfect, therefore everything can be improved", including OSI licensing. Therefore thought provoking discussions/brain storming sessions will only help us all improve. Hope you will see this discussion in that light. Usecase:
|
We're going to confuse everyone if we call this the OSI Model. I am working on creating better incentives for revenue-seeking organizations to share their software in a way that sometimes produces revenue. The early draft license, which has not been blessed by a lawyer, is at https://perens.com/wp-content/uploads/sites/4/2020/10/PO_License_Draft.pdf and I discuss my rationale in the video at https://www.youtube.com/watch?v=vTsc1m78BUk Open Source has already been incredibly successful, and through OSS Capital I hold enough interest in firms marketing Open Source products that there must be something viable there. However, invariably these are mixed-model firms. They find some way to mix Open Source and commercial licensing. The most important thing about Open Source is that there is a well-defined set of rights. If someone calls it Open Source, you pretty much know what you are getting. This is not the case with Creative Commons, where the right to read seems to be the only common element among the licenses. It seems to me that there is value in preserving the coupling between the Open Source name and that well-defined set of rights, but it is not necessary for us to be constrained by it. Indeed, if we count Richard Stallman's September 27, 1983 announcement as the starting date, that's 37 years and two months. In that much time we should have learned something about it, and might come up with a successor. But in my thinking about any successor, it has seemed important to preserve "Open Source" in parallel to it, and not change the promise that has worked for so many people for all of that time. I don't have a really well organized and legally sound tent with a motivating trademark for you to get under today. Business Source would not be a bad one. Monty wants you to use the same license they made, if you call it that. |
Thanks, @ComodoMelih, for re-opening the issue again. I'm delighted to hear that you have updated language on the way and hope it resolves this particular issue. Please update us when you have a specific fix, before closing it again. A convenient way to do that is via a pull request. Bruce is right that the stability of the OSD is hugely valuable, and asking them to change is quite out-of-place. I also agree with Bruce that it is silly to suggest that OSI is somehow harming innovation, and I provided plenty of reason to support the opposite conclusion. Please note that I have not claimed that open source is best for all situations, and in that sense I'm not contradicting your claim that for your situation an OSI license might not fit. A proper analysis of that is something that as I've said, I'm not an expert in. But you certainly shouldn't expect me to agree with all your conclusions. I hope you can help Bruce and others frame useful licenses that do in fact improve openness and innovation for additional business contexts. |
Let me give a coding analogy:
Here is a use case that noone is disputing: Once a code is open sourced: Innovation follows as a result. Imagine this: If there were no obstacles for businesses to release their code as open source, then there would be more open source code and more innovation as a result. |
@BrucePerens I very much enjoyed watching/reading the presentation! Begging loggers to plant and protect the trees! Pretty much sums up the issue! Love the analogy btw :) I can see clearly from the presentation that you are very aware of the issues I am raising. Goal: Pay Developers! <------Exactly my point! Question: I believe OSI/Open Source is going through exactly same growth issues as any other product. we should definitely continue the discussion Bruce! OSI needs the line extension! Ps: 48:30 : Typo “Carged” should be “Charged” |
Since post-Open-Source is peripheral to the nomenclature issue, let's take it off of the bug ticket system. Please resolve the nomenclature issue as requested. In talking about serving the general population, the distinction I wanted to make is that a teenager using our software while going to college, and Amazon.com should be treated differently. We don't expect payment from the teenager, but should have a right to expect it from Amazon.com . Serving the developer community is implicit in the whole presentation. It would probably be best to continue this via email to bruce@perens.com, however you are also welcome to call me, US-Pacific time, at 510-4PERENS. It takes a minute to get through the call screener the first time, then it will remember your number. |
I just learned about the Commons Clause because of this issue and that is pretty interesting, basically a protection for the creators so that people can't leverage their code they made (for free, so it could benefit people.... for free) to charge people money to essentially use some form of it. I understand SaaS and the added value a company can offer with what they do with that code, but I do like the idea of the vendor being required to do far more than just re-package it, being required to offer to contribute any improvements they make to the project, etc etc. Commons Clause might not work exactly like that, but I like the idea of what it seems to aim toward. |
Nextcloud is open source and is killing it in terms of innovation. Wordpress is another example. There are other examples as well. I'm a firm believer if you create an open source product that is useful and addresses a need, not only will it be adopted, you will get people to contribute to the project and you can demonstrably profit from it. |
Your README and the press are calling this Open Source software.
But your License.md is the Commons Clause which explicitly says it is not Open Source:
The difference is of course major for anyone who wants to join you in providing OpenEDR as a product.
Please fix your README.
The text was updated successfully, but these errors were encountered: