Monday April 18, 2005
Monday April 18, 2005 CDDL - Is it so bad, then, to be misunderstood?
The CDDL open source license certainly seems to be misunderstood by a few vocal critics, although it's also been positively assessed by some respected open source leaders as well.
I led the team that created the CDDL open source license and am simultaneously flattered by all the attention and shocked at some of the ludicrous things that I've read. Geez. Thanks to Andy for correcting some of the misconceptions. The controversy reminds me of the mantra I've written about before - although it makes me want to change it to: "It's not about the license, it's about the community." That it takes a community to build good software is worth repeating. Our success in building the OpenSolaris community will have less to do with the open source license and more to do with our ability to attract developers, to convince the market that OpenSolaris is real and to spread the word about the OpenSolaris innovations. (Perhaps we'll need to get some of those nifty Get Firefox buttons and banners for OpenSolaris to help spread the word...)
The core OpenSolaris team realized early in the planning for OpenSolaris that we needed to use a "true" open source license - a license that complies with the terms of the Open Source Definition and that encourages royalty-free use, modification and distribution.
It took others inside Sun a bit longer. If I were better at recounting stories, perhaps I could tell the then-dramatic (now kind of boring and corporate in retrospect) tale of the OpenSolaris licensing debate that took place inside Sun before CDDL existed. There were some influential and intelligent people who wanted us to use what I call a "half-pregnant" source license, in which the source would only be "open" for non-commercial use and a licensee would have to pay for commercial use of the technology. Ick. (Obviously we did not follow this path...)
There were others inside Sun who pushed hard for GPL. For a brief two week period, I was also one of the GPL lobbyists, until I realized how important it was for us to allow OpenSolaris kernel source files to be compiled and linked with other open source files and even with proprietary source files in the kernel. GPL would not allow this. On Day 1 of OpenSolaris, because some OpenSolaris IP is encumbered by other companies (example - 3rd party drivers), we're going to have some source files in the kernel that will remain proprietary. Hence GPL was out of the running.
We also looked carefully at the BSD family of licenses. After all, Solaris has its roots in BSD source code. Concerns about the lack of an explicit patent grant in the BSD license aside, a few of us strongly felt that if someone makes modifications to OpenSolaris source files and then distributes those modifications, they should "share" the modifications they made to the source files. (Note - if they author new code, in separate source files, and distribute the resulting binaries but want to keep the new source files private, that's fine with us.) The BSD license has few terms, and the requirement to "share" modifications definitely isn't one of them. So, ultimately, BSD was out of the running as well.
The MPL class of open source license (on which CDDL is based) had a number of attractions. First, it does require that the source code for modifications be shared. Second, it allows the covered source files to be mixed with other open source files and with proprietary source files. It also has an explicit patent grant. Keeping in mind that we want businesses and startups and developers to feel comfortable that they don't just have a copyright grant but also a patent grant, this mattered to us.
We also felt that having some kind of "anti-patent litigation" provision (as sometimes seen in the Mozilla class of licenses) was also valuable. My small team couldn't fix the patent problem (although Larry Lessig has called on all of us to speak up and help here, as he lambasted Verizon, Disney and Microsoft for their "war against the freedom to innovate" at the recent OSBC.) But my team could take steps to make sure that the OpenSolaris license discouraged patent litigation. As Danese Cooper aptly described the CDDL "patent peace" provision - "if you pee in the pool, you have to get out." So, if you choose to initiate a patent claim that involves OpenSolaris CDDL software, all the rights you've received to the CDDL OpenSolaris technology from all the OpenSolaris community members is severed - you effectively have to get out of the pool.
Unfortunately, we could not use the MPL for OpenSolaris. Open source licensing has evolved a bit in recent years and we needed to make some adjustments. In doing so, we bent over backwards to craft a license that would be useful not only to OpenSolaris but to the broader open source community - we did not want to create yet another vanity license. Perhaps we could have stayed off the radar screen by simply revising the Sun Public License (our very own vanity license, a clone of the MPL) - but I didn't want other companies to have to create yet another MPL-derived vanity license to fix some of these same issues. Of course, some projects will want to use the respected Apache license, or a BSD license, or GPL - but for those projects that want to use an MPL-class license, well, I wanted CDDL to be an attractive option. Hence we created a common MPL-class open source license, in which the license steward could not change the terms out from underneath a community.
As some members of the open source community will tell you - John Cowan, Chuck Swiger, Rod Dixon and Danese Cooper of OSI, and I would hope even PJ of Groklaw would confirm - we revised CDDL in response to community input last December. And if it turns out that we've overlooked something that requires further improvement in CDDL, do let me know, so that we can deal with it.
In the meantime, "it's not about the license, it's about the community" - so I'm going to focus on that just now rather than let myself be distracted by what Tim Bray calls the bad craziness.
Technorati Tag:OpenSolaris
Technorati Tag:CDDL
(2005-04-18 00:25:30.0) Permalink Comments [10]
Post a Comment:
Comments are closed for this entry.
Err, you do realize this is incorrect, right ? If Sun owns the Copyright on the files they can link with whatever they want and still release under the GPL. It's called dual licensing and is commonly done. I doubt Sun was unaware of it. It seems more like the requirement that "Open" Solaris be deliberately incompatible with Linux that was the driving logic behind Sun's "yet-another-license" license to me, but maybe I'm too cynical :-).
Jeremy Allison
Posted by Jeremy Allison on April 18, 2005 at 10:56 PM PDT #
If someone submits the code than that implies granting of permission without restriction beyond those of the license, thus would be granting BSD term usage to anyone for the patents they are using in the code they submit.
If I have a patent on Foo and write code for it called bar and release it I basically give the rights to use that patent to anyone using my Foo code.
Your CDDL was just a means to prevent people from taking your code and using it elsewhere, keeping all the work in your project.
Posted by Nate Montague on April 18, 2005 at 11:18 PM PDT #
A modern switch from Yet Another Licence happened with the eCos project at Red Hat. They started with the Red Hat eCos Public License (RHEPL). They are now licensed under the GPL, with the following exception clause:
More details about the exception clause and some frequently asked questions can be found on the eCos License Overview page.
Posted by Steve Karg on April 19, 2005 at 03:45 AM PDT #
Posted by The Alethiometer on April 19, 2005 at 08:35 AM PDT #
Hi Claire.
Basically, Sun has disqualified itself from the confidence of the open source community (if such a thing as "the" open source community exists at all), most specifically through statements from Jonathan Schwartz. The tactics seem pretty simple: Sun, on the operating systems field, is loosing market share against Linux. Sun thinks it's because it's Open Source, so, Sun wants to have that "cool" tag on Solaris and makes OpenSolaris, trying to create a community around it.
Now, why doesn't that work ?
- Sun has discredited itself: MS deal, J.Schwartz blatantly criticizing and spreading FUD oder Linux and GPL
- (Open)Solaris has no features Linux is missing (it's actually pretty much the opposite), and why go with OpenSolaris on x86 whereas Linux has established itself as a stable, feature-rich and well performing platform ?
- Sun manoeuvring by creating its own license
Granted, on the other hand, Sun is doing great stuff for the community, be it OpenOffice.org and giving the IT world the best programming language and enterprise platform: Java/J2EE.
The only, really positive thing about OpenSolaris ? err... hmm... maybe... no... myeah, one could say that it's one more thing proving to businesses that Open Source is a serious and competitive way to go (not for everything, of course), because yet another major vendor is turning to it. On the other hand, I'm waiting to see OpenSolaris on E10k to believe that Sun isn't just ditching something in an area where they already lost against Linux: low- to mid-end servers.
OpenSolaris is making me think of Java though: it's "free" (kind of), but it's not OpenSource in a sense comparable to GPL or Apache-style. Why is Java so successful and OpenSolaris not ? Because Java filled a gap in the IT business, but OpenSolaris does not: Linux is already there and pretty well established, continuing to gain ground.
How to do it right ? Well, maybe getting into Linux development for real, contributing code, and using it for mid-range server offerings (I mean, for real, not just doing it so half-heartedly as now).
Oh, and Open-Sourcing Java. Really, I mean it.
And it's definately also about the license, as it sets the ground for having a community behind a project or not.
Want to meet the community for real ? Come to next FOSDEM ;)
just my 0.02€ analysis
Posted by Pascal Bleser on April 20, 2005 at 12:00 AM PDT #
http://slashdot.org/comments.pl?sid=146569&cid=12278928
The poster apparently has concerns that 3rd parties that have patents on technology within OpenSolaris CDDL code could still allow that 3rd party to sue you for patent infringement, since only SUN is granting you patent rights.
Another poster rebutted that argument saying that you couldn't distribute code under CDDL that you didn't have rights for all the patents to. But that was further refuted again by another saying that:
"The licence only appears to protect you from patent claims by the Initial Developer (Sun) and other contributors. Third parties are not mentioned."
Plus some other things:
http://slashdot.org/comments.pl?sid=146569&cid=12279214
I think it's hogwash, but a rebuttal would be
lovely.
Posted by Shawn Walker on April 20, 2005 at 07:33 AM PDT #
Regarding this comment.
Let's look at your points one by one. You say Sun has "discredited itself" with the "MS deal." Do you realize that Sun has been in litigation with MS for years and do you know why Sun sued MS in the first place? This was not just a "deal." It was an end to a law suit. How many other companies do you know of that have the courage and will to go up against the behemoth MS and force MS to pay them billions? Secondly, many of Sun's customers wanted an end to the fighting between Sun and MS and for their products to work together because (what a surprise) customers need both companies' products! Would you have preferred Sun continued pouring dollars into the legal battle with MS?
You claim "J.Schwartz blatantly criticizing and spreading FUD oder Linux and GPL." Where are you to defend Sun when Red Hat, HP, and IBM Execs spread FUD about Solaris?
Next you say "(Open)Solaris has no features Linux is missing (it's actually pretty much the opposite)." This is surprising to hear because most GNU/Linux aficionados are willing to admit Solaris includes many great features lacking in the Linux kernel or GNU/Linux distributions. For example, a unified service management framework SMF, Dtrace, a fault management architecture, Dynamic Reconfiguration, binary compatibility across releases, a modular kernel debugger, integrated cryptography framework, integrated privelege model, mature 64bit support, and there are many more. All of these features are available out of the box, documented, and supported!
And then you say "why go with OpenSolaris on x86 whereas Linux has established itself as a stable, feature-rich and well performing platform?" Well Solaris on x86 is the same code base as Solaris on SPARC. Sun has been building Solaris on x86 for many years. It wasn't widely promoted because Sun was all about SPARC. However, Solaris on x86 is a very stable product and many can attest to that, especially those who have been running it for over 10 years. Also, stability of an OS has a lot to do with the whole OS, not just the kernel. You just mention Linux. Are you referring to a particular distribution of GNU/Linux like Red Hat, Gentoo, Debian? Each of these have different release models. It's hard to compare an OS with a kernel.
And lastly, you criticize Sun for creating its own license based on the Mozilla Public License which you are already using if you use firefox or mozilla! "Sun manoeuvring by creating its own license." Why didn't Linus put the Linux kernel under one of the BSD licenses? Afterall the BSD licenses already existed? Sun has legitimate reasons for using a new license. Have you read the license and do you understand the differences?
Sorry to go so off topic on this blog, but if you want to discuss the license, please discuss the license and refrain from spreading FUD about Sun, Solaris, and the soon to be released OpenSolaris.
Posted by 192.18.42.11 on April 20, 2005 at 02:48 PM PDT #
RE 192.18.42.11
You're 100% right. Sun's biggest challenge, IMO, is a super-huge double standard being served out by the Linux fanboys out there. I don't know what the most effective remedy would be, unfortunately. How do you talk to someone who has already decided to not listen? One way that has a chance would be to trick them such that that their own statements become self-contradictory. Once realizing the abusrdity of their logic, perhaps the steps toward acceptance can activate (denial, anger, sadness,..., acceptance).
Another challenge for Sun goes beyond the double standard, and that is that Sun basically hurt people's feelings by not just giving Linux every last tidbit out of the Solaris kernel. No one likes to be #2, but that is what OpenSolaris forces upon the Linux kernel. For Linux to catch up, its developers actually have to implement the Solaris features for themselves. This is perfectly fair, IMO, but for a community so used to getting _everything_ for free, it really can be like working with a toddler (I am _not_ suggesting that Sun use baby-talk in their next press release).
Posted by Anon on April 20, 2005 at 06:32 PM PDT #
You're correct, as the copyright holder we could release OpenSolaris with both GPL sources and proprietary sources linked together in the kernel.
However, OpenSolaris community members and GPL licensees would not be able to redistribute their modified OpenSolaris kernel, since they would not allowed to to mix the open source GPL kernel code with the proprietary binaries that <span class="moz-txt-underscore"><span class="moz-txt-tag">_</span>they<span class="moz-txt-tag">_</span></span> do not hold copyright to.
Yet, enabling our community members to be able to use, modify and <b class="moz-txt-star"><span class="moz-txt-tag">*</span>distribute<span class="moz-txt-tag">*</span> their innovations based on OpenSolaris code was the whole point (even if they want to keep their innovations and additions proprietary.)
The FSF website does describe an exception that can be used with the GPL to allow the linking of proprietary and GPL open source code. Some people believe we should have pursued this path.
I thought hard about whether to make my blog even longer and explore your question in even greater detail, and perhaps I should have. But, sigh, it was so long already, so I tried to simplify what is a very complex topic.
And at the same time, all the merits I spelled out of the MPL-class license made it attractive to us - hence the choice of MPL as a base.
At the end of the day, I am a big advocate of open source and am thrilled by how the open source communities have changed the dynamics of the software industry. I'm also a big believer in competition and choice - choice among software solutions, operating systems, and even in open source licensing models. Choice and competition spur innovation - and I'm all for that.
Thanks for your comment,
Claire </body> </html>
Posted by Claire Giordano on April 22, 2005 at 11:27 AM PDT #
I'm sorry to hear that you feel that Sun has disqualified itself from your confidence and from the confidence of some others in the open source community. There are a whole bunch of us (an excited, energized hoard to be precise - and not all of us are inside Sun) who are working our butts off to build a community around a technology that we love and which we think has benefits for others in the world. I guess the one question I would ask you to consider (if you're willing to humour someone you've never met, who doesn't go clubbing, who's never heard Ritchie Hawtin's music and who is unabashedly advocating OpenSolaris) is whether you'd be willing to poke around on OpenSolaris.org when we go live and let us know what you think.
We're bound to get some things right and also some things wrong. We will need help and advice from people who have been living the open source collaborative lifestyle far longer than we have in order to fix our mistakes as we evolve - just as every project does, I suppose.
I like what you say about how the OpenSolaris effort further validates the broader Open Source effort. I'd like to think it does. Credit is due to all the open source projects that have paved the way, and to Linus Torvalds and the rest of the community for spurring competition. As I just said to Jeremy in my earlier comment posting - competition and choice are good for all of us.
Oh, and I would like to go to FOSDEM one of these days. Perhaps I'll meet you there?
Thx,
Claire</small>
</body> </html>
Posted by Claire Giordano on April 22, 2005 at 12:31 PM PDT #