What Does GPL3 Mean for the Enterprise?
The discussion and debate over the wording of GPL3 has crept into the mainstream tech news, which is a bit surprising. After all, it's just a software license. There are hundreds of software licenses, and in my opinion the ones that should be making the news and generating outrage are the standard EULAs (End-User License Agreements) that infest commercial, closed-sourced software. These EULAs disclaim all responsibility, restrict customer's rights beyond what the law permits, and are often packaged in ways that makes them difficult to find, let alone read or "agree" to. But unlike the closed-source proprietary world, the free and open source software community conducts its business in public. Often noisily, or as I like to say "we will end no whine before its time."
The General Public License, more frequently referred to by its acronym, GPL, has been around for almost two decades. It's remarkable for its simplicity and effectiveness. I give it credit for the abundance, quality and success of free software. (That's, free as in freedom.) And so we have a huge body of excellent community-developed code; thousands of excellent servers, databases, applications, utilities, and hardware drivers, and hundreds of Linux distributions suitable for every occasion, from tiny embedded devices to mondo mainframes.
Although there are many types of free and open source software licenses, the majority of software is licensed under GPL2. Its simplicity is a stark contrast to a typical EULA. In a nutshell, it says if you wish to modify and distribute GPLed code, you must also distribute your modifications, and you must make the complete source code available.
It is important to remember that GPLed code is not public domain. Rather, the GPL is designed to protect the rights of both developers and end users. Developers are assured they will reap the benefits of other developers building on their work. End users are protected from obsolescence, vendor failure, lock-in and shoddiness. When code is open, there is nowhere to hide sneaky evil stuff or cruddy code.
If GPL2 has worked so well for so long, why do we need GPL3? Because it's a different world than it was back in 1989, when GPL1 was released. Back then, there was no Linux and no giant worldwide community of free and open source software. Just Richard Stallman trying to protect his own work and the work of other developers. With GPL3, Mr. Stallman and the Free Software Foundation (FSF) are cleaning up the language, closing loopholes, and trying to address two primary concerns: "Tivoization" and patent threats.
"Tivoization" refers to devices like the Tivo digital video recorder that runs on GPL code and makes source code available just like they're supposed to. But the hardware is locked against user-modified code if the software doesn't have the correct digital signature, the device will not work. So you are left with hardware you own that the vendor controls.
This sets a potentially dangerous precedent the vendor could release hardware that uses GPL kernel drivers but only binaries signed with the secret key work on the device. In this case, publishing the source code for drivers is useless because modified drivers won't work on the device. This is against the spirit of GPL2, if not the letter.
Another, perhaps more serious problem is software patents. It's pretty much undisputed that the patent system in the United States is broken, at least as far as software patents are concerned, and all manner of patents are being granted that should never see the light of day. Unfortunately, it is expensive to fight bogus patents, so we're stuck in a strange limbo where every little trivial line of code is probably a patent violation, and there is much looking-the-other-way among patent holders. But the threat remains, as this quote from Steve Ballmer shows:
And we agreed on a, we call it an IP bridge, essentially an arrangement under which they pay us some money for the right to tell the customer that anybody who uses SUSE Linux is appropriately covered. There will be no patent issues. They've appropriately compensated Microsoft for our intellectual property. In a sense you could say anybody who has got Linux in their data center today sort of has an undisclosed balance sheet liability.
The ink wasn't even dry on the Novell-Microsoft partnership deal, which has been characterized as a clever end-run around GPL2, when Mr. Ballmer emitted threats against the open source world: Buy SUSE Linux and pay that Redmond tax, or else you're going to get a visit from The Boys. Of course the immediate reaction was "show us the infringing code." (Hmm, where have we heard that before?)
I know, they both say there is no patent covenant, but if it walks like a patent covenant, and talks like a patent covenant, well, there it is. Jeremy Allison, one of the lead Samba developers, said:
The intent matters. As I tried to explain in my resignation letter, if you're screwing over some of your major suppliers by following what your lawyers see as the letter of a license, not the good faith intent of the license, then you can't expect those suppliers to say 'well done, you really tricked us on that one.'
So there is language in GPL3 explicitly designed to prevent patent covenants, such as those conveyed in the Novell-Microsoft deal. Section 11 of the current draft covers this.
The Bottom Line on GPL3
GPL3 is still in draft, so things could change. As it stands now, nothing much will be different for end users. They will still benefit from all the great code that is free to use, modify and share, and remain safe from the license police and unrealistic, unenforceable "agreements." Depending on the final wording, GPL3 may also offer extra protection from locked hardware and crazed, power-mad monopolists.
If you develop and distribute GPL code, you'll have a couple of considerations. For original code, the option of using GPL2 remains. If you want to modify and distribute GPL3 code, however, you're stuck with GPL3.
What if you cry yourself to sleep at night because you really really want to have locked hardware and discriminatory patent agreements? No problem knock yourself out. You just can't do it with GPL code.
ResourcesHistory of the GPL
GPL3 information and drafts
Did You Say "Intellectual Property"? It's a Seductive Mirage
CPT's Uniform Computer Information Transactions Act (UCITA) Page contains a lot of great information on EULAs, the legality of "click-wrap" and "shrink-wrap" licenses, and examples of horrid EULAs.