Patents?

[enkore]

Does PATENTS from 4ded9e5 refer to specific patents that are actually used by zstd or is it a generic file added to github.com/facebook projects and zstd doesn't use any patented tech?

Ie. is the "recipient of the software" the developer of a software using zstd (presumably) and/or also the user of a software using zstd?

In the latter case, what does it imply in layman's terms? Would the patent license self-terminate if a company using a software using zstd did anything listed in (i)–(iii) in the second paragraph (line 14)?

Clearing this up would be pretty important I feel before this can be used in other FOSS projects.

Additional Grant of Patent Rights Version 2

"Software" means the Zstandard software distributed by Facebook, Inc.

Facebook, Inc. ("Facebook") hereby grants to each recipient of the Software
("you") a perpetual, worldwide, royalty-free, non-exclusive, irrevocable
(subject to the termination provision below) license under any Necessary
Claims, to make, have made, use, sell, offer to sell, import, and otherwise
transfer the Software. For avoidance of doubt, no license is granted under
Facebook’s rights in any patent claims that are infringed by (i) modifications
to the Software made by you or any third party or (ii) the Software in
combination with any software or other technology.

The license granted hereunder will terminate, automatically and without notice,
if you (or any of your subsidiaries, corporate affiliates or agents) initiate
directly or indirectly, or take a direct financial interest in, any Patent
Assertion: (i) against Facebook or any of its subsidiaries or corporate
affiliates, (ii) against any party if such Patent Assertion arises in whole or
in part from any software, technology, product or service of Facebook or any of
its subsidiaries or corporate affiliates, or (iii) against any party relating
to the Software. Notwithstanding the foregoing, if Facebook or any of its
subsidiaries or corporate affiliates files a lawsuit alleging patent
infringement against you in the first instance, and you respond by filing a
patent infringement counterclaim in that lawsuit against that party that is
unrelated to the Software, the license granted hereunder will not terminate
under section (i) of this paragraph due to such counterclaim.

A "Necessary Claim" is a claim of a patent owned by Facebook that is
necessarily infringed by the Software standing alone.

A "Patent Assertion" is any lawsuit or other action alleging direct, indirect,
or contributory infringement or inducement to infringe any patent, including a
cross-claim or counterclaim.

[JarekDuda]

Here is a discussion about this Facebook "patent" policy for open-source:
https://news.ycombinator.com/item?id=8901357

I wonder how it relates to the fact that many people out of Facebook were and are also involved in development of this project ...

As this policy starts with version 1.0, maybe instead of helping developing here, people not working for Facebook should branch it a bit earlier and focus on developing such independent really free branch - without this potentially dangerous and discouraging policy?

[enkore]

That discussion seems to center on a different version of the patent grant, though.

[FabioPedretti]

The patent is independent from the code. Even if you branch before the patent statement, the patent still apply.
It is also independent of who wrote the code: no matter if it's the same who own the patent or a third party: the patent always apply until expired (~20 years).
The software licence is done by and protects code authors.
The patent is done by and protects who patents the algorithm.

[enkore]

Yes, there are two important questions here: conditions of the patent grant termination and whether there are actually any patents (owned by Facebook, that is, otherwise they could of course not issue a grant for them) covering the zstd algorithm(s).

[JarekDuda]

The patent is independent from the code. Even if you branch before the patent statement, the patent still apply.

I don't think you are right (but I'm not a lawyer).
There was not such clause in the previous version (0.8.1), so I believe people can use it without a legal risk. Eventually, this project has started (January 2015) before Yann was employed by Facebook (~June 2015) - does this clause also affect these earlier versions?
Also there was large contribution from people outside Facebook, especially inikep (Przemysław Skibiński): https://github.com/facebook/zstd/graphs/contributors
Did these people agree for such a clause on also their work?
Would they perform this work if being aware if it?

[jibsen]

There is also the question whether it is still legal to use Zstd in projects licensed under GPLv3 and the Apache License, which contain their own patent clauses?

[JarekDuda]

Here is Facebook explanation: https://code.facebook.com/posts/1639473982937255/updating-our-open-source-patent-grant/
"So over a year ago, we started offering an additional grant which provided rights to any Facebook patents relevant to each given project."
Here is Yann's comment: http://encode.ru/threads/2119-Zstandard?p=49868&viewfull=1#post49868
"The PATENTS grant document says, in lawyer language, that should Facebook have any patent related to Zstandard (irrespective of the fact it really has patents or not),
it will never use them against any user of Zstandard anyway.
The grant is perpetual and legally binding. "

So, as I understand it, it only concerns PATENTs used in a given software, not termination of the BSD license itself(!).
As Zstandard does not use any patent (yet?), this "Additional Grant of Patent Rights" seems currently meaningless (?).

Does ZSTD contain something Facebook could try to patent in this moment? (In US there is a year after publication).

ps. another discussion: https://news.ycombinator.com/item?id=8985541

[ivalylo]

Well, this is why people still use zlib out there and other obsolete technologies. It's a patent war in US, that can put you out of business, which is far more dangerous then a few milliseconds/kilobytes that the users will barely notice. zlib, libpng, jpeglib - this was and continues to be the magic trio... This clause is somewhat dangerous, even if Facebook has of course its reasons:

"For avoidance of doubt, no license is granted under Facebook’s rights in any patent claims that are infringed by (i) modifications to the Software made by you or any third party or (ii) the Software in combination with any software or other technology."

So if you have the misfortune to be sued by someone, you lose also this patent grant. Even the previous case was false, and you get out, you will still infringe this one for sure. I'm not an expert, but the patent has nothing to do with the actual code, but the covered algorithm. Without the new code, you may be even missing the patent grant, since you actually need this document. What was actually patented is probably even not relevant. The existence of any doubt for me is a sentence for this library. I was hoping to see zlib finally replaced, but it will not happen. Compression is the core of any application, if something turns out bad with these patents, imagine any file that you ever created now can't be opened. You must pay whatever Facebook says so you can continue existing.

[JarekDuda]

Patents were the major reason that arithmetic coding was not used for a few decades: https://en.wikipedia.org/wiki/Arithmetic_coding#US_patents
Indeed this "termination of license" here seems scary, and may be the reason people will use e.g. Brotli instead.
Here is a comment from TheRegister: http://www.theregister.co.uk/2016/08/31/facebook_open_source_database/
"Heads up, though. The three-clause BSD license on the Zstandard source includes an extra condition: that you won't sue Facebook for patent infringement, nor countersue if Facebook sues you first, while using the software in your own projects and products."

Fortunately, it seems there are currently no patents used and so this "Additional Grant of Patent Rights" is meaningless - it would be nice if someone experienced in law could really clear it.
And there is still a risk that Facebook is currently trying to patent some solution used in ZSTD ...

[enkore]

Well it can be really hard to tell whether something is covered by patents, and FB owning so many adds to that. Although my guess would be that there are indeed none. A layman's guess is hardly a solid legal foundation for deciding whether to use a library/technology or not.

[Cyan4973]

We’re not able to respond directly to issues regarding patents.

The following basic bullet points can be reminded (nothing surprising, they have already been mentioned) :

• License and patents are orthogonal
• The license is and remains BSD, no matter what, irrespective of any patent issue.
• A BSD license doesn't cover patents.
• The patent grant is an additional set of rights, on top of the BSD license.
• The PATENT file is generic and present within all Facebook Open-Source projects.

For more details, your concerns have also been forwarded to legal team.

[itsnotvalid]

Since this is only added recently, one may try to audit for the additional code added after that point in a fork.

[ivalylo]

Brotli is not Apache licensed any more. It's MIT, so you can be as sure as with zstd I guess... This is a step that most companies do nowadays, since the patent mess. They are too busy protecting their own company I guess, providing you safe patent grant is their last concern. And really, this is something normal considering what is the patent law in US. For example you can even patent good old algorithms, but put in another context/field. Typical example are the quasi monte carlo methods. They are used in physics since the world war. But using them in computer graphics and economy for example is... patented. So who can say what was patented out there? You can even already use something, and someone else decide to patent it and sue you! This is why, I don't believe anyone can give you legal advice, it's one huge mess... I've heard that the best legal advice is - don't research this topic at all. Since this is your only protection - to prove you didn't know. At the end, you will just stop using it if something goes wrong. But imagine you store compressed data. All that data will be unusable without clearing the patent situation...

[ebiggers]

The patent grant is an additional set of rights, on top of the BSD license. It protects more by being there than by not being present.

This may be debatable, due to the concept of implied license: http://en.swpat.org/wiki/Implicit_patent_licence. It can be argued that the BSD license grants an implied patent license, as it says use and redistribution and permitted, without specifying that it means use and redistribution under copyright law only. If this seems strange, note that the BSD license has never been purely about copyright anyway; half the license is taken up by a warranty disclaimer (which arguably isn't really needed, but that's another issue).

Under this argument, the addition of extra language which mentions patents may actually remove or narrow the implied license, not expand it. Logically, most likely to be problematic are statements worded in a way that appears to remove rights rather than add rights, e.g. "For avoidance of doubt, no license is granted ...", or "The license granted hereunder will terminate, automatically and without notice, if you ...".

Still, it is a legal gray area, so some explicit statement on patents will likely be needed either way, otherwise people will complain --- even if there are, in reality, no patents or if nothing relevant is patentable. But it should be worded in a more user-friendly way. An official statement that there are no patents, if there aren't any, may also be valuable to users.

Of course, it's not possible to avoid all problems anyway, such as a third party managing to get relevant patents --- even though that should be impossible, the patent review process is very broken.

Disclaimer: I am not a lawyer, and this is my personal opinion only.

[itsnotvalid]

Please also note the following, retrieved from Facebook's CLA:

3. Grant of Patent License. Subject to the terms and conditions of this Agreement, You hereby grant to Facebook and to recipients of software distributed by Facebook a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that your Contribution, or the Work to which you have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for that Contribution or Work shall terminate as of the date such litigation is filed.

Effectively, this also applies to your contribution to these projects, such that if anyone using your work try to sue you, this protection also applies. I think all these clauses are related to the fact that many people try not to be attacked by patent trolls building upon your work in any way. What I would not comment on is whether "any entity" for the latter part would also include Facebook.

Disclaimer: I am also not a lawyer so all comments here are my personal opinion and are not legal advises, nor could I ever make one.

[ivalylo]

"This may be debatable, due to the concept of implied license"
Would you go to the court to debate it?... How much money you are ready to spend in debating? Especially seeing that this was not really the intention of the owner...
IMO, using such old licenses by patent holders is very stupid thing to do, and just increases the patent mess, by hiding the actual risk from you. This is also the vision here:
http://www.osscc.net/en/bsdl.html
Any patent holder would want some clauses at least to protect himself, so the patent grant and termination clauses must be clearly provided. Facebook didn't do anything bad by adding the new document. It's just that the law complications surfaced... With that said, if the intention was really to promote the library, standard, well understood patent aware license would be much better and popular, not this kind of Frankenstein. For example, even the first line is tricky:

"Software" means the Zstandard software distributed by Facebook, Inc.

If I make a fork for example and distribute it, I guess this patent grant is voided, since it will be no longer "distributed by Facebook, Inc.". And such intent is logical, since Facebook wants to own this technology in some way. It was existing as open source project, long before Facebook bought it. And as the owner, they make the rules. But it's 100% better to list them clearly so everybody can decide if this works for them or not.

[Cyan4973]

Would anyone feel safer if the PATENTS file was simply removed from project repository ?

[tomByrer]

Would anyone feel safer if the PATENTS file was simply removed from project repository ?

No, the information needs to be clear on allowed use & transfer, file names don't matter.

People are afraid of complications if their product can't quickly & cleanly have their ownership transferred to another person/corporation. Simply licensing software "MIT" etc is clear to non-lawyers. BSD seems to be less popular with web devs.
A patent causes confusing & fear that they don't own what they build on top of that code.

[tomByrer]

But if it is patented, & you don't clearly say so, that is worse.

[AlexDaniel]

Would anyone feel safer if the PATENTS file was simply removed from project repository ?

For me, yes. If at some point it turns out that some of Facebook patents apply to zstd, I am sure Facebook will get appropriate reputation for such act. People will immediately switch to something else and that will be it.

With PATENTS file, however, it will mean that this software will live for much longer, and Facebook may eventually get away with it.

Even if you decide that PATENTS file should stay, it should be replaced anyway. Current version is beyond stupid. You lose this grant if you sue Facebook for issues that are not related to zstd. What the?

IANAL, so feel free to disagree with me.

As a side note, it is really sad to see such a good piece of software being associated with a company. No matter how this issue is resolved, I am sure that the whole situation will be a huge barrier for zstd adoption. Sad.

[AlexDaniel]

By the way, isn't this issue solved in Apache 2.0 license? What is the reason to reinvent the wheel?

[juanfra684]

@Cyan4973 Facts:

• You have not patented zstd (I don't see patents issued to your name)
• Facebook have not patented any code or algorithm related to zstd (this is a guess, I didn't search the patents)
• The contributors sign a CLA which includes a perpetual license to patents owned by them and used in zstd to Facebook, the other developers and the users.

There is no point to keep the file. That's confusing and will limit the adoption of zstd without a real reason.

Also, you could add a statement to the README and the web clarifying that zstd doesn't use patented algorithms.

[JarekDuda]

Fresh discussion about Facebook "Additional Grant of Patent Rights": https://news.ycombinator.com/item?id=12692552

[Cyan4973]

There's also a complementary FAQ :
https://code.facebook.com/license-faq

[itsnotvalid]

This FAQ from Facebook seems to agree, that the concerns raised in the article referenced in hacker news are simply unanswered by the FAQ.

It is also worth mentioning that Apache License 2.0 provides some similar protection but doesn't extend them to all claims.

[AlexDaniel]

In addition to what @itsnotvalid said, here is a comment that is spot on:

Does using React give Facebook the right to infringe on any of my patents?

Yes, which is why Facebook's lawyers refuse to answer that question directly and instead obfuscate things by talking about "retaliation".

The Apache 2 license covers, in full, every public goal Facebook legal has stated they have and is 100% ethical. That Facebook refuses to use the Apache 2 license indicates they have additional, private, goals they do not want to own up to publicly.

[ivalylo]

I don't think there is something obfuscated here. It's clearly stated:

will terminate, automatically and without notice,
if you (or any of your subsidiaries, corporate affiliates or agents) initiate
directly or indirectly, or take a direct financial interest in, any Patent
Assertion: (i) against Facebook or any of its subsidiaries or corporate
affiliates

They allow you to counter sue if they have started first. But if you sue them first, you lose the patent grant. This doesn't mean that Facebook can infringe your patents. It means that you will lose their patent grant when you go to defend yourself. This really concerns big companies with a lot of patents, but like stated elsewhere, even startups should be aware, since if they want to sell or merge, this may be a show breaker. The biggest issue is that they ruin software that may not be even related to any patents, just to use it as a shield against patent wars. IMO, this is whole another level of patent insanity. Patent war even without patents... Patent war not just against the big companies, but as a side effect - against the small guys also. It was stated multiple times, that there are exactly 2 ways to really make this library really open:

• show and state officially that there are no patents involved and remove the file (the best option)
• use Apache or other standard patent aware license. It will be also good idea to show which are these patents, so people can check them and even research if Facebook can even grant them to you. Otherwise, you are still not strictly providing any safety to the users, since patents may be held by 3rd parties.

Until then, thanks, but no thanks...

[bmwiedemann]

@Cyan4973 if there are known patents that apply to zstd, it would be useful to include a list of them and if there are none, you could remove the file or replace it with an explicit statement that there are no known patents applying to it, which would help reduce the confusion (that is slowing inclusion in the openSUSE Linux distribution atm).

[jamesgpearce]

If anyone would like to chat to a member of the open source team about this issue, feel free to contact me on jpearce@fb.com

[zoobab]

I have sent several emails to James Pearce, no answer to any of my emails so far.

[Cat-sushi]

@Cyan4973 BSD already grants patent, because BSD is a OSS license certificated by OSI.

[zoobab]

My question to FB was more if they have applied any patent on this.

[Cat-sushi]

Effectively, this also applies to your contribution to these projects, such that if anyone using your work try to sue you, this protection also applies.

@itsnotvalid I'm not sure the contributors are protected, because the clause "(iii) against any party relating to the Software" is quite ambiguous. In addition, other clauses are supplied to protect only Facebook, its subsidiaries, and its affiliates.

[Cat-sushi]

@ivalylo I agree to that any patent holder want to protect himself, but oss license is not appropriate to do so. And, the scope of non-assertion obligations is overly broad and unfairly grant Facebook families a privilege.

[Cat-sushi]

Would anyone feel safer if the PATENTS file was simply removed from project repository ?

@Cyan4973 yes.

[Cat-sushi]

@bmwiedemann It is not important that there are known patents or not. Some patents can be visible only after they are granted, and it is almost impossible to prove absence of patent. It's a devil's proof.

[Cat-sushi]

I've clarified the scope of non-assertion obligation.
Too Broad Non-assertion Obligations of React License --PATENTS-- - Qiita

[bmwiedemann]

On 2017-02-12 01:07, Cat-sushi wrote: @bmwiedemann <https://github.com/bmwiedemann> It is not important that there are known patents or not. Some patents can be visible only after they are granted, and it is almost impossible to prove absence of patent. It's a devil's proof.

you describe the general case, but if Facebook wrote the software and applied for patents on its technologies, it should know - even before being granted. Or are you worried about non-Facebook patents on this?

[Cat-sushi]

@bmwiedemann Yes, I describe some general case in order to show that absence of patent at this point is not so important.

I don't want to discuss about 3rd party patents, because licenses are helpless against 3rd party patents, anyway.

[JarekDuda]

Recent continuation of this discussion: https://encode.ru/threads/2780-ZSTD-license

A year has passed, but searching patents with "facebook compression" suggests no patent application regarding ZSTD has been filled (?): https://www.google.pl/#q=facebook+compression&tbm=pts&tbs=sbd:1
US allows to patent up to a year after the publication, allowing to conclude that ZSTD remains free of patents (?) - suggesting this "The license granted hereunder will terminate, automatically and without notice (...)" from PATENTS file has no legal meaning (?)

However, others are currently trying to patent basic applications of ANS, including Google - if granted, I don't think it could bring any danger to ZSTD (?), but it is not so certain for more recent compressors using ANS: claims and sources, 400+ comments on Reddit.

[luben]

Apache foundation recently banned BSD+Patents clause software (as used by Zstd) from use in any apache project. Other Facebook software was relicensed, e.g. RocksDB switched to Apache2|GPL2 with the explanation that Apache-2 grants the same rights as BDS+Patents clause (they need the GLP2 option in order to integrate with MySQL): https://issues.apache.org/jira/browse/LEGAL-303

Is there a change in the licensing considered to make it again compatible with apache projects?

[Cyan4973]

Wanted to let the community know that we’ve released zstd v1.3.1 earlier today, which adjusts it to be dual licensed as BSD and GPLv2.