Kyle Mitchell

I follow a few licensing blogs, and I know people are talking about and working on alternatives to Common Clause. As far as I can tell, all will disappoint those who believe the OSI's definition of "Open Source" is the one true open source. My bookmarks: https://katedowninglaw.com/blog/ https://writing.kemitchell.com/ (blog & the blogroll for finding others). See also: https://www.google.com/search?q=site%3Awriting.kemitchell.com+commons+… http://www.blueoakcouncil.org/

You ask a very good question. I'm afraid the very strong rules about confidentiality that apply to me as a California attorney prevent me from answering as I'd like. I can say that I think your experience is typical of large software firms. Most still ban AGPLv3, if not all GPLs or all copyleft licenses, by policy. Even when there are exploitable loopholes, they're typically narrow enough to require very close collaboration between legal and engineering, in the context of a very specific project, especially the first time. It's possible to exploit those loopholes, but not possible to prescribe how to do so by general policy. That used to be true of private changes to GPLv2 and GPLv3 code. We've seen exercises of those intentional gaps in copyleft operationalized as policy in firms that rely on them daily. If you see posts on https://writing.kemitchell.com that you like, you may also find https://blog.licensezero.com worth the candle.

One thing I mention to folks that seem to think AGPL "protects you" against a major corporation incorporating your product into a SaaS product: it mostly doesn't. It isn't written about often, but it's the reason many "open core" companies moved away from AGPL to protect their revenue from larger SaaS/IaaS/PaaS players from eating their lunch. Some writings are: - https://writing.kemitchell.com/2021/01/24/Reading-AGPL - https://katedowninglaw.com/2019/09/08/the-great-open-source-shake-up/ - https://drewdevault.com/blog/Anti-AGPL-propaganda/

It’s a bit disappointing to see MIT and BSD still being recommended in the “permissive license” category for new projects. Their shortcomings are pretty well known by this point, but this is a good summary: https://writing.kemitchell.com/2019/03/09/Deprecation-Notice.html

You might enjoy the writings of /dev/lawer https://writing.kemitchell.com/ He wishes to create such forms, and created PolyForm to try and do so. https://writing.kemitchell.com/2021/06/23/PolyForm-Commercial-Preview

I don't agree fully, I feel operating on conviction & purpose & intelligence has a place, is how many of the best things get built. But absolutely some deep questions about who you are building for are essential. There was a good post yesterday[1] ostensibly about open source, & closed source, but the conclusion was really about assessing not just purpose but audience. [1] https://writing.kemitchell.com/2022/02/12/Devs-Use-Closed-Software.htm… https://news.ycombinator.com/item?id=30536825 (2 points, 14 hours, 1 comments)

This is great! I too have wondered why contracts can't be in plain text since the versioning and back-and-forth between legal and business teams could be handled so much more easily than Word revisions (or worse, PDF comments). You might also want to connect with 'kemitchell[1], also a former software developer who became an attorney. He recently launched a similar initiative to generate license terms for selling software[2]; essentially another initiative towards easier contract automation & management. [1] https://news.ycombinator.com/user?id=kemitchell [2] https://writing.kemitchell.com/2022/01/22/Fast-Path-1.0.0.html

Wikipedia is not the best source of information. There is a difference between "strong" copyleft and "weak" copyleft. An example of "weak" (non-viral) copyleft is the CDDL. In fact, the CDDL's Wikipedia page talks about strong and weak copyleft. You can read [1] for a breakdown of copyleft by an actual lawyer. Suffice it to say that Wikipedia's Copyleft page is woefully inadequate. [1]: https://writing.kemitchell.com/2018/10/24/How-to-Speak-Copyleft.html

In fact the author did later post a follow-up highly critical of the MIT license, recommending their own creation instead: https://writing.kemitchell.com/2019/03/09/Deprecation-Notice.html

For example this? https://writing.kemitchell.com/ ;) (GP is the author - it contains some very good explanations on the subject of licenses, imho of course)

I wonder what your opinion is of Kyle Mitchell https://writing.kemitchell.com/

Also more recently by Kyle: https://writing.kemitchell.com/2019/03/17/License-Utopia.html (Thank you for linking to this site — it is truly fascinating Also thank you to Steve for starting a great and timely debate.)

Fascinating article, and one that matches my recent thinking. I am a part of a large GPL open source project, but am not sure that the GPL made a big difference there, since "distribution" is a loophole large enough to drive a truck through. If you extend & modify software just for your site / your client's site, you have no obligations. Conceptually, a great followup article is Kyle E. Mitchell's "Unhappy Coincidences", published last year: https://writing.kemitchell.com/2018/08/28/Unhappy-Coincidences.html Nowadays, I gravitate towards permissive licenses because I feel that people and companies contribute largely out of self interest, not because a license compels them to.

Kyle Mitchell's blog is an excellent source for the intersection between copyright law and software. Some of his recent interesting posts were on the MIT License[1], his takes on 'open source'[2] and on the ubiquitous LICENSE file[3]. [1]: https://writing.kemitchell.com/2016/09/21/MIT-License-Line-by-Line.htm… [2]: https://writing.kemitchell.com/2016/05/13/What-Open-Source-Means.html [3]: https://writing.kemitchell.com/2016/05/13/License-from-Who.html

Yes, that's the MongoDB variant which codifies it directly, and SF Conservancy and other legal entities promotion FOSS licenses states that the network stack contagion concern does not actually apply for the AGPL. But because AGPL doesn’t dig into the definition of "access", simply defining it as “users interacting with it remotely through a computer network”, nor define clear boundaries for how the "contagious" part of GPLv3 interacts with the rest of the network stack of this clause, it has meant that some lawyers think that a court may overly broadly interpret the definition. So far this contagion concern hasn't actually played out, and big corporations/hyperscalers are often using AGPL software somewhere in their stack if they're using common Linux distros - and nothing thus far has been compelled to be open sourced that isn't AGPL software. This might be insightful about the concerns as well as why lawyers still think it's straightforward: https://www.opencoreventures.com/blog/agpl-license-is-a-non-starter-fo… https://discuss.logseq.com/t/on-the-agpl-license-and-the-idea-to-move-… https://writing.kemitchell.com/2021/01/24/Reading-AGPL (not a lawyer): https://drewdevault.com/2020/07/27/Anti-AGPL-propaganda.html

Those are really good thoughts! Here are a few answers and thoughts. * No, it won't stay AGPL. It will be just my license once a lawyer approves that license. And I have actually four licenses; it will start on the most restrictive, but I will move it to the most permissive over time as this repo becomes established and recognized. In essence, I will explicitly follow the process in [1] that tends to happen over time. * Yay! * Double yay! Thank you! * Yes. This is necessary to implement DSL's in it. (My build system will use a DSL.) Also, it will have better error messages. * Great! This is one thing that Rust is right on: mutation should not be default. * I'm not the biggest fan of it either; that syntax will change to something better. Maybe just `push <expr>: <stack>`. I don't know. Any suggestions? * Technically, they are not built-in; they are a part of the standard library, but point taken: there needs to be a better namespace for those standard library ones. (By the way, this means that yes, your own libraries can add context stacks for client code.) * Function suffixes are weird, yes. I don't know what to do about that. I've waffled a bit between them and having implicit name mangling (as in C++), but that leads to ABI and interoperability issues. But I acknowledge the issue. What can I say? Language design is hard! And to answer, your claim that you're not a language guy, you are. As a user, you are more right than me as to what is good; actual users matter…

I agree that Open Source (and Free Software, so let's go with FOSS) works as designed. However, charging is not an option FOSS supports. At best it's accepting and no one's paying. OpenSSL, for instance, had accepted money for a long time yet the whole internet had to be scared for the money to actually start trickling in and still laughable amounts. Where I don't agree is that FOSS is not to blame. It absolutely is. FOSS is the entrenched default. And FOSS is incompatible with requiring a payment. To require a payment one has to run a tangential business (provide support, integration services, etc.) and all the options are in conflict with the quality of the main FOSS product one way or another. FOSS makes it hard to switch to any other model and it's harder the longer the project lives. The issue of funding is not going to be solved by FOSS because it is not the foal. We need to look past FOSS to find a solution. A good start would be to chose a different license when one starts a project. Like one of PolyForm Licenses [1] or BTPL [2]. These are not FOSS compatible but they align much better with the funding goal. And if one figures it doesn't work for the project it's easy to switch to FOSS. Much easier than the other way around, anyway. [1]: https://polyformproject.org/licenses/ [2]: https://writing.kemitchell.com/2022/01/26/Big-Time-2.0.0

In terms of "antithetical values", the machine learning project ml5js.org actually did something about this. They bound their open-source license to a Code of Conduct¹, which forbids the use of their ML software for (1) discriminating against marginalized communities, (2) building tools that disingenuously manipulate public opinion, (3) building tools of mass surveillance and prediction to repress the rights of people, and (4) building tools that control weapons, including tools that automate the deployment, operation, and targeting of weapons. Reported violations of the Code of Conduct are sent to a Steering Committee, made up of members of the community, who determine if the reported project is in violation of the Code of Conduct. If so, the Committee takes steps to remedy the situation (e.g. realigning project with the Code of Conduct, or removing ml5.js from the project) — and if no resolution is found, the project falls out of compliance with the terms of the software license. It's an interesting experiment.² Software is a tool to help us solve problems and reach desired outcomes. Licenses are also a tool to help us solve problems and reach desired outcomes. When desired outcomes exclude certain things (e.g. discrimination of marginalized communities, manipulation of public opinion, autonomous weapons, values antithetical to that of a community), it seems a Code of Conduct can also be a worthwhile tool to solve problems and support the outcomes that the community…

I didn't say a trademark isn't a form of IP. I said their application for a trademark was rejected due to "open source" being too generic/descriptive, not due to the reason you directly asserted above ("They don't hold the IP, I don't really see any way they could be granted a trademark on it"). You can read more about this at https://opensource.org/pressreleases/certified-open-source.php or https://www.techmonitor.ai/technology/open_source_initiative_gives_up_… among many other sources. Or a much longer blog post from a lawyer who is active on HN: https://writing.kemitchell.com/2020/05/11/Open-Source-Property fwiw, a non-OSI attempt to trademark "open source hardware" was also rejected for the exact same reason. https://opensource.com/law/13/5/os-hardware-trademark-rejected

It already exists: https://polyformproject.org/licenses/small-business/1.0.0/ https://writing.kemitchell.com/2022/01/26/Big-Time-2.0.0

It's certainly confusing as presented, both for MIT-plus-restrictions, and the dual licensing. For a lawyer's opinion on those two things, see: https://writing.kemitchell.com/2022/01/21/MIT-for-Noncommercial https://writing.kemitchell.com/2023/09/10/Two-Kinds-Dual-Licensing

Oh yes, also https://writing.kemitchell.com/2020/10/21/Copyright-Notices (note that that’s copyright notices, not license notices).

You’re certainly entitled to the opinion that an agreement (as in EULA) is distinct from a license (as in GPL, MIT etc). But many legal minds close to this issue have moved to the position that there is no meaningful distinction, at least when it comes to licenses like GPL. For example: https://writing.kemitchell.com/2023/10/13/Wrong-About-GPLs

> https://opensource.google/documentation/reference/using/agpl... If you have some background knowledge of Google's architecture, this explains exactly why the AGPL is banned there: all code is built from one monorepo where everything is linked together. > https://writing.kemitchell.com/2021/01/24/Reading-AGPL This completely agrees with what I said. At it's core, the A part of the AGPL only kicks in if: > “you modify the Program” and > “your [modified] version supports such interaction [remotely through a computer network]” Yes he calls out various potential problems and a potential loophole, but those same problems are also present in the regular GPL!

> I think the English is perfectly clear and understandable. Because you are not a lawyer. The points I’ve made have been cited by actual lawyers. Your opinion as a technologist blinds you to the degree of legal ambiguity. https://opensource.google/documentation/reference/using/agpl-policy https://writing.kemitchell.com/2021/01/24/Reading-AGPL Also, the very fact that these opinions exist shows this license is not safe. There’s never a correct interpretation that will perfectly win the day eventually, only rulings. As the AGPL has never been in court before, things could quickly go sideways. As my second link, written by an actual lawyer, puts it: “Inebriated aliens might as well have beamed it down from space as a kind of practical joke.”

https://writing.kemitchell.com/2023/09/23/Two-Kinds-Relicensing Makes it seem like it would be a legal grey zone in the US. And a reminder, not all of us are American and the ambiguity might be even less favourable in other jurisdictions.

Those are examples of non-commercial licenses, licenses that grant rights, free of charge, but restrict commercial use of software. When I say dual licensing, I am referring to the business model of offering software for free under a non-commercial license, and charging for commercial usage rights. Kyle E. Mitchell calls this Free-and-Paid Dual Licensing. https://writing.kemitchell.com/2023/09/10/Two-Kinds-Dual-Licensing To use such a business model you also need a commercial license. There's no one-size-fits-all solution, and it's normally something that requires input from a legal professional. Kyle has made a couple of recent efforts to improve things. https://fastpathlicense.com/ https://commercial.polyformproject.org/

A good take from the time https://writing.kemitchell.com/2021/05/11/Sell-Babel-8

OSI doesn't own the term "open source" [0] [1] [0]: https://writing.kemitchell.com/2019/05/05/Rely-on-OSI.html [1]: https://writing.kemitchell.com/2021/03/18/You-Can-Still-Use-the-Softwa…