NPSL License Improvements

[ulm]

Reporting this issue on behalf of the Gentoo licenses team. It has been brought to our attention that nmap-7.90 and later is distributed under updated license terms. We see several clauses in version 0.92 of the Nmap Public Source License as problematic, to the point where we can no longer consider it as a FLOSS license. Therefore, it is license-masked, i.e., with the default distro-wide settings, Gentoo users won't be able to install the latest version of nmap.

In particular:

• In section 0 (Preamble): "Proprietary software companies wishing to use or incorporate Covered Software within their programs must contact Licensor to purchase a separate license."
  This won't allow "proprietary software companies" to use or incorporate the software within their programs (i.e., create a derivative work), even if the resulting work was distributed under a free software license. Essentially this is a non-commercial restriction and as such directly violates the Open Source Definition, section 6 "No discrimination against fields of endeavor".
• In section 2 (General Terms): "In addition, you agree to the terms of this License by clicking the Accept button or downloading the software."
  This type of language is typically found in an EULA but not in a FLOSS license. If I download the software from a third party (like Github or a distro mirror), I won't enter into any contract with either Insecure.Com LLC or the third party. Therefore nothing forces me to accept the license unless I would do any actions (like redistributing) that are covered by copyright law. Also, in the typical case, I won't even have the chance to read the license before downloading.
• In section 3 (Derivative Works): "To avoid any misunderstandings, we consider software to constitute a 'derivative work' of Covered Software for the purposes of this license if it does any of the following: [...] Reads or includes Covered Software data files, such as nmap-os-db or nmap-service-probes."
  We're aware that this point existed in previous versions of the license, but we still find it somewhat problematic. For example, it would make GNU coreutils a derived work of nmap because its programs can read those files, e.g., "cat /usr/share/nmap/nmap-os-db".

Gentoo bug: https://bugs.gentoo.org/749390
Debian bug: https://bugs.debian.org/972216
Guix discussion: https://lists.gnu.org/archive/html/guix-devel/2020-10/msg00227.html

[fyodor]

Hi Ulrich. Thanks for posting your feedback. We aren't licensing or copyright experts, but we want the NPSL to be an improvement over the previous license (which also had problems). Regarding your three points:

• Section 0 -> That is not the meaning we intended, but I agree that it is poorly worded. The intent is to simply explain that because the NPSL terms do not allow inclusion within proprietary software, "proprietary software vendors" (like anyone else) would have to purchase the Nmap OEM license to include it within their proprietary software. If a "proprietary software vendor" also releases free software in compliance with the NPSL, that is great and we certainly don't want or mean to take away that right from them. We are planning to rewrite this before the next Nmap release. [UPDATE 2021-01-12: We released NPSL Version 0.93 which removes that clause and replaces it with one that is clearly just advisory.]
• Section 2 -> That text is directly from the RealNetworks Public Source License, which has been approved as a free software license by both the Free Software Foundation and the Open Source Initiative. But that doesn't necessarily make it a good clause to have. Maybe we should just remove it. We will think about this more.
• Section 3 -> That is not how we meant or interpret the clause (which existed in previous Nmap versions too). The intent is to stop companies from trying to avoid complying with the Nmap license by reading and parsing and interpreting the Nmap data files directly rather than through Nmap execution. I wouldn't say that "cat" itself reads Nmap data files, even if it can be used to display them if a user specifically requests that. Maybe we can think of better wording here too.

I'm changing this issue title to something more actionable so I can assign it to myself and add it to our ProjectBoard for the next release. If anyone else has comments or suggestions regarding the NPSL, feel free to post them here as well. For the next Nmap release, we at least want to have the Section 0 thing fixed, but we're also considering bigger changes or even move to another license if we find ones that meet our needs well.

[etu]

This is not an attempt at thread hijacking, it's just a question regarding this license change. I'm the one that brought this up for NixOS. But something that I haven't seen discussed anywhere really is if the nmap project actually could change the license to begin with.

1. Does the nmap project collect CLA's?
2. If not: Have you asked all contributors if they approve of the license change?

So I'm questioning both if this new license is free software, just as this thread is about. But I'm also questioning if this license change is legal to begin with.

[fyodor]

Hi @etu . Good question. Yes, we do have more than 100 signed copyright assignment contracts from major developers (everyone we have paid), and those probably represent at least 95% of the code changes in recent years. We don't do signed contracts for one-off small code contributions, but we do make it very clear that we only accept the code on the condition that the contributor is offering us full rights to relicense the code in our work. The text of the previous license included:

By sending these changes to Fyodor or one of the Insecure.Org development mailing lists, or checking them into the Nmap source code repository, it is understood (unless you specify otherwise) that you are offering the Nmap Project the unlimited, non-exclusive right to reuse, modify, and relicense the code...If you wish to specify special license conditions of your contributions, just say so when you send them.

This note is also on the top of every source code file, in the man page, HACKING file, etc. We have been offering Nmap under different licenses to customers for more than 20 years so it has always been important that we can relicense code contributions. This is how we fund the project and pay developers. We have also made many changes to the open source Nmap license over the years.

We also repeatedly discussed and solicited comments on the NPSL on the Nmap development list before it was ever applied to the code. If any Nmap contributor has concerns about the license, we'd be happy to hear their thoughts. Finding the right license is tough.

[ams]

Another problematic section in the license is that it claims that the GNU GPL defines the terms:

Covered Software is licensed to you under the terms of the GPL (Exhibit A), with all the exceptions, clarifications, and additions noted in this Main License Body.

But there are terms that directly conflict with the GNU GPL (some mentioned above), which prohibits adding terms that would put future restrictions on the user of the software. See section 6 of the GNU GPL:

You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

The text is hard to understand which license is applicable (GNU GPLv2 or the NPSL, because it cannot be both).

Wouldn't it be better to choose a plain free software license that is approved by the FSF and the OSI?

[fyodor]

@ams - The GPLv2 section about not adding further restrictions to the GPL means that if you receive code under the GPLv2, you can't add any further restrictions when you redistribute that code. This means, for example, that we can't take GPL code from 3rd parties and put it under the NPSL. So we can't and don't put GPLv2 code from 3rd parties into Nmap. And NPSL code cannot be integrated into GPLv2 programs. They aren't compatible licenses. The FSF does allows people to create new licenses based on GPL text (even if the new licenses aren't GPL-compatible), which is what we have done with the NPSL.

Regarding cases where the NPSL main body license text conflicts with the GPLv2 text in Exhibit A, Section 2 says that "Where the terms in this Main License Body conflict in any way with the GPL, the Main License Body terms shall take precedence." The license also clearly states that it is not GPLv2 compatible.

I agree that it would be cleaner to rewrite the NPSL so it doesn't depend on the GPLv2 Exhibit and has all the key terms in the main body itself. And it would be cleaner still to just use an existing well-written license as you suggest. We will be looking into those options, but we have a lot of other work on our plate too. The NPSL terms are not very different than the previous license (which was also based on GPLv2 but with various exceptions and clarifications which made it not-GPLv2-compatible). I think giving the NPSL its own names makes it more clear that it is under its own GPLv2-incompatible license so there is less confusion. And I think some of the terms are improved from the old license and that we can fix regressions such as the Section 0 problem that @ulm pointed out.

Our main goal with the license, in case it's not clear, is to allow unlimited free use of Nmap by end users (including commercial use), while charging companies who want to build and sell commercial products on top of Nmap through our Nmap OEM program. The goal has been to avoid the much more common tact of having a "free version" with limitations and then a non-free pro version with extra features. So we need to either have a license which supports the current business model, or switch to a different business model, or give up on a business model and lay off the developers who are currently working full time improving Nmap. So we're trying to find the best balance for everyone. We are also hoping to hire another full time developer next year.

I hope this helps. If anyone wants to recommend a great copyright lawyer with open source experience that we could hire to consult on these matters and potentially help draft a new license, please email me at fyodor@nmap.org. Cheers!

[ams]

Regarding cases where the NPSL main body license text conflicts with the GPLv2 text in Exhibit A, Section 2 says that "Where the terms in this Main License Body conflict in any way with the GPL, the Main License Body terms shall take precedence." The license also clearly states that it is not GPLv2 compatible.

I'll leave out the interpretation of section 6, which I do not believe is the correct one here. A more pressing question, I think, is if nmap is free software or not at this point?

Our main goal with the license, in case it's not clear, is to allow unlimited free use of Nmap by end users (including commercial use), while charging companies who want to build and sell commercial products on top of Nmap through our Nmap OEM program.

Does that mean that nmap is intented to be non-free software (www.gnu.org/philosophy/free-sw.html)? Freedom zero means that anyone can use a program for any purpose, including building and selling commercial products with it which seems to conflict with the above.

I hope this helps. If anyone wants to recommend a great copyright lawyer with open source experience that we could hire to consult on these matters and potentially help draft a new license, please email me at ***@***.***

Maybe the FSF License and Compliance Lab could help you: legal@fsf.org

[AI0867]

Modifying the GNU GPLv2 for your own purposes also brings along the possible issue that the license itself is licensed under the "verbatim license":

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

[fyodor]

@AI0867 - That is a good point, but the FSF does allow folks to make modified licenses based on the GPL. It's in their FAQ. Also, the copy of the GPL that we include as Exhibit A in the NPSL is verbatim except that we cut out the "How to Apply These Terms to Your New Programs" section as the FSF requests in their FAQ entry. That section would be confusing in this context.

We have worked closely with the FSF in the past, donationed to them, and greatly respect them. If the FSF ever tells us that they don't want us including the GPL license in the NPSL in this way, we will change it ASAP.

[ams]

@fyodor, could you clarify if the intent of nmap is to be free software or not? GNU/Linux and BSD distribution need clarification on this point because they might or might not be able to distribute nmap anymore or have to recategorize where it resides. The NPSL clearly has terms that make it incompatible with both the Free Software and Open Source Definition, @fyodor also acknowledges this point that the intent is to limit who can use nmap. But nmap advertises it self as a "free and open source", and the license preamble says that it should be "compliant with the Open Source Definition" -- it definitly is not. So this is all confusing and conflicting.

[ams]

@fyodor Would it be possible to get a clarification?

The only choice GNU/Linux have right now is to remove nmap from their distributions or mark it as non-free software.

[L1ghtn1ng]

@fyodor An idea that might be worth trying if feasible is reaching out to the EFF as I'm sure they could help

[micahcowan]

It sounds to me like section 0 (preamble) is the only one mentioned in this bug description that actually prevents this software from being FLOSS, and that it also probably differs from its intended meaning, which I think also likely differs from @fyodor's explanation of its intended meaning. (Perhaps section 3 can be interpreted as "not FLOSS" as well, but at least it's not new and had previously been accepted, so I'm addressing the "what actually turned this license non-FLOSS" question.)

The license speaks about usage by "proprietary software companies", which does sound like field restriction to me (for instance, "proprietary software company" can include software companies that are owned by someone or a body of people (AFAIK, any software company fits this interpretation), or (more reasonably) it could mean a company that creates software and licenses as proprietary, but that only use nmap as part of FLOSS-licensed software they distribute.

Our main goal with the license, in case it's not clear, is to allow unlimited free use of Nmap by end users (including commercial use), while charging companies who want to build and sell commercial products on top of Nmap through our Nmap OEM program.

I'd like to suggest (and @fyodor please correct me if this is mistaken), that what was actually meant here, is "while charging companies who want to build and sell proprietary commercial products". In which case, all that's really needed here AFAICT is clearer language to say the intended thing. Perhaps simply moving the word "proprietary", as: "Proprietary sSoftware companies or authors wishing to use or incorporate Covered Software within their proprietary programs must contact Licensor to purchase a separate license."

I think that phrasing still has a problem with the word "use", though. AIUI a program can't be Free/open if it restricts execution by another program (this is different from linking, of course). But perhaps my understanding there is inaccurate.

[fyodor]

@micahcowan - Thanks for your suggestions. Yes, our intent of that section is to simply explain that because the NPSL terms do not allow inclusion within proprietary software, "proprietary software vendors" (like anyone else) would have to purchase the Nmap OEM license to include it within their proprietary software. If a "proprietary software vendor" also releases free software in compliance with the NPSL, that is great and we certainly don't want or mean to take away that right from them. We do understand how the wording is problematic and we are planning to rewrite this before the next Nmap release.

[patatahooligan]

I believe the "proprietary software vendor" clause is a needless complication. Wouldn't it be simpler to put the code under a normal copyleft license and indicate to interested parties (outside the text of the copyleft license) that they can purchase a proprietary license from you? If you have the right to relicense 100% of the code as stated above, then you can do this dual-license scheme. The end result is that non-proprietary compatibly-licensed copyleft projects can use nmap's code freely, while proprietary projects have to purchase the right from you.

[TechnologyClassroom]

What about GPL-3.0-or-later? Does that license achieve what you are trying to do?

[sluidfoe]

I believe the "proprietary software vendor" clause is a needless complication. Wouldn't it be simpler to put the code under a normal copyleft license and indicate to interested parties (outside the text of the copyleft license) that they can purchase a proprietary license from you? If you have the right to relicense 100% of the code as stated above, then you can do this dual-license scheme.

I agree completely.

The end result is that non-proprietary projects can use nmap's code freely, while proprietary projects have to purchase the right from you.

I don't think this is quite correct, however. Shouldn't "non-copyleft" be substituted for "proprietary?" I don't see that as a problem, but it's an important distinction.

[funnelfiasco]

Fedora has determined NPSL 0.92 is not permitted based largely on the "Proprietary software companies wishing to use or incorporate Covered Software within their programs must contact Licensor to purchase a separate license" text. This constitutes a field of endeavor restriction in our judgment, which is contrary to part 6 of the Open Source Definition.

I understand that this is not the intent. If the text is updated in the future, it can be considered for inclusion in Fedora.

[dnabre]

An issue to consider which likely will make lawyers tell their companies to avoid this software is that "Proprietary software Company" is not a defined term in the License. As there is not widely accepted legal definition of proprietary in this context, "Proprietary software Company" must read no differently than "Software Company".

Use a well established license without modifications or get a lawyer specializing in copyright and software licensing to write it for you.

[RQWorldblender]

What about GPL-3.0-or-later? Does that license achieve what you are trying to do?

I should also mention, are there any authors for nmap that licensed their contributions as GPL-2.0-only? If so, that could make it hard to relicense nmap under GPL-3.0-or-later.

Or as I might suspect, not using GPL-3.0 is likely for making nmap friendlier to companies that avoid GPL-3.0 licensed programs (presumably for its anti-Tivoization clauses).

[stikonas]

I should also mention, are there any authors for nmap that licensed their contributions as GPL-2.0-only? If so, that could make it hard to relicense nmap under GPL-3.0-or-later.

Relicensing under GPL-3.0-or-later can't be any harder than relicensing under NPSL 0.92 which already happened.

[the-maldridge]

Just joining the party here. Void Linux has also made the decision to roll back to the last version that had a clear licensing scheme and to bar further upgrades to the package until this is resolved. Since we roughly track Debian and Fedora for handling of unclear licensing we are prepared to drop the package from our main collection and move it to our nonfree repository if the ultimate decision is to retain the NPSL instead of a recognized copyleft license.

Though we're a smaller project, I believe its worth sharing this as a data point.

My 2c as well as a developer distinct from void is that relicensing is a major change, and was probably worth bumping the left most number, but that's of course a matter of opinion.

[fyodor]

Thanks for all of the feedback. I'm happy to report that we just released Version 0.93 of the NPSL license which rewrites the poorly-worded and problematic proprietary software company clause. Version 0.92 included:

Proprietary software companies wishing to use or incorporate Covered Software within their programs must contact Licensor to purchase a separate license.

While Version 0.93 rewrites that sentence as:

Companies wishing to use or incorporate Covered Software within their own products may find that our Nmap OEM product (https://nmap.org/oem/) better suits their needs.

I also updated the Nmap Changelog to note that we are retroactively offering the previous Nmap 7.90 and 7.91 releases under this newer version of the NPSL so users and distributors can choose to receive Nmap under either license.

There is certainly room for more improvements to the NPSL (or possibly scrapping it altogether and moving to an already established license) and so we're leaving this issue open and will continue evaluating all feedback and suggestions. But we wanted to make this initial change now since that poorly worded clause is causing so many problems for distributors. Cheers!

[ulm]

While Version 0.93 rewrites that sentence as:

Companies wishing to use or incorporate Covered Software within their own products may find that our Nmap OEM product (https://nmap.org/oem/) better suits their needs.

Thanks, that change fixes our (Gentoo's) main concern. I believe we would be prepared to add NPSL version 0.93 to our list of free licenses. However, before doing that, I'd like to hear at least one additional opinion from one of the major distros.

[funnelfiasco]

Thanks for being so responsive. The following change (I think it's a change) in the annotation is still of concern to Fedora:

This license does not allow for redistributing Nmap for use with (or incorporating it's source code within) proprietary hardware. This includes stand-alone software distribution or inclusion on a hardware appliance, docker container, virtual machine, etc.

It is pretty vague and could be interpreted, for example, to preclude Lenovo shipping Fedora Workstation with nmap pre-installed. Most hardware is proprietary to some degree, so this is a pretty broad restriction.

[Conan-Kudo]

Maybe this is just a bit dumb of me, but the usage of "proprietary" isn't defined in the license. The strict definition of "proprietary" doesn't imply anything other than someone holds the copyright on it, which is true even for open source software. I would suggest either explicitly defining the usage of proprietary or using another term here.

[ulm]

The following change (I think it's a change) in the annotation is still of concern to Fedora:

This license does not allow for redistributing Nmap for use with (or incorporating it's source code within) proprietary hardware. This includes stand-alone software distribution or inclusion on a hardware appliance, docker container, virtual machine, etc.

It is pretty vague and could be interpreted, for example, to preclude Lenovo shipping Fedora Workstation with nmap pre-installed. Most hardware is proprietary to some degree, so this is a pretty broad restriction.

This is not part of the license itself, but only an annotation. It existed in version 0.92 already.

Edit: But I agree, the language that is used in several places of the license or its annotation is unfortunate. I am also unhappy about section 2 still saying "you agree to the terms of this License by [...] downloading the software."

[funnelfiasco]

This is not part of the license itself, but only an annotation.

Right, but the annotation is still meaningful in interpreting a license in court.

It existed in version 0.92 already.

I should have checked the wayback machine first. It's possible that the original objection caused my counsel to not pay attention to the annotation. In any case, as you and others have pointed out, more clarity here would be a big help.

[fyodor]

Thanks for being so responsive. The following change (I think it's a change) in the annotation is still of concern to Fedora:

This license does not allow for redistributing Nmap for use with (or incorporating it's source code within) proprietary hardware.

Good point, @funnelfiasco . And that is fairly easy to change since it's just annotation text and not part of the license itself. So I just changed it to:

This license generally forbids selling proprietary software and hardware products that include and depend on Nmap for their functionality.

Is that any better? The goal of the annotations is to provide a high-level summary without getting too bogged down by all the details in the license text itself. The very first annotation notes that "These annotations are not part of the license itself, a legal document, or legal advice. If you need to know exactly what the license requires, you need to read and understand the license itself".

[ams]

This license generally forbids selling proprietary software and hardware products that include and depend on Nmap for their functionality.

You mention that this is an annotation to the license, but here you explicitly state that it is forbidden for some entities from using the software for any purpose. It does not become clearer by using the term "generally" -- what does that mean? The above also conflicts with the "Deriviate Works" section -- where it explicitly is allowed to include nmap in a propietery installer, for example. The above text would also make the nmap neither Free Software or Open Source -- where one of the basic tenants is that _anyone_ can use or run the software, or incorperate it in any way. (Extra terms apply when you re-distribute the software). Is that any better? It is sadly just even more confusing.

[ams]

Here is a thought, since you already offer nmap waiver to free software and open source from these extra terms, or to get a copy under some other e.g., the GNU GPL. These developers/projects can already in turn re-distribute nmap already a license without the extra terms from the NPSL, why not offer nmap under the GPLv3 (for example, the license here isn't the point) from the start?

And for OEM / Proprietary companies, offer them a different license if they wish to incorporate it in ways that are not compatible?

Another way, though maybe less ideal, might be that you would waive the NPSL terms, so that nmap was plain GNU GPL for previous releases.

Your intentions are understandable and commendable in trying to get some bad actors to behave, but I think these clarifications just make it all so very confusing. :-( For example, under https://nmap.org/npsl/npsl-annotated.html, section 3 has this annotation:

The idea here is to prevent companies from using open source Nmap in their proprietary software or appliances. Some have in the past distributed Nmap executables as part of expensive proprietary products and refused to make the source available, claiming a loophole based on strange interpretations of the GPL definition of derivative and collective works. If companies take value from Nmap, they need to contribute back to the project and the open source community by either making their product/project compatible open source or buying a commercial license.

They are not part of the license body, but your intent plays a heavy role in this too. Maybe more so than the license.