blogs : lxo : draft : gplv3-snowwhite.en

I show you mine, you show me yours

This is probably the first notion that comes to mind in the context of quid pro quo and Free Software licenses. However, when applied to a piece of software, the GPL does not affect any other piece of software that is not derived from it. Based on the GPL, I can't expect you to show me some of your code just because I showed you some unrelated piece of code. There goes the obvious quid pro quo.

I publish my code, you publish your changes to it

Better, but still wrong. Per the GPL, you're not forced to publish anything, even if I chose to publish the code you based your changes on. The license permits you not to distribute your changes at all, effectively refusing to share your changes with anyone else, even myself. Only if you choose to distribute the code must you ensure the recipients are entitled to get the corresponding source code.

I grant you some permissions, you grant them to me

Close, but no cigar. When I license something under the GPL, I'm not demanding anything back to me. I'm demanding you to respect the 4 Free Software freedoms when (if) you modify the work or distribute it to third parties, modified or not.

I respect your freedoms, you respect others'

That's it, with regard to one particular piece of code. That does sound fair indeed, but does it qualify as quid pro quo? There's no payback, only payforward, unless you use a twisted notion of payback that considers the respect for others' freedoms as a payback.

But even this twisted notion doesn't make much sense. The GPL grants permissions without any reciprocation. The constraints it imposes on the exercise of the permissions it grants do not create new obligations, they only delimit the permissions. Copyleft, for example, establishes that the permission to distribute the program and modified versions thereof is limited to the case in which the same license is used, it does not force anyone to distribute the program. Because the GPL does not create obligations, it is not a contract. Its benefits flow in a one-way street.

So the license is fair in that everyone that gets the program has the same freedoms respected. The exception is the copyright holder, that, per copyright law, gets to choose the license. When the chosen license is the GPL, others' freedoms are respected without any payback, reverting at least part of the unfairness imposed by copyright law.

Patent licenses

Consider that the prince wrote a program and distributed it under the GPLv2. The witch, a patent holder, takes the program, adds a feature and then passes on a program that implements one of her patents, along with the same freedoms. Snow White comes up with a great idea and improves on that feature. The witch changes her mind and decides Snow White needs to be stopped, and files suit for patent infringement. The witch is failing the payforward.

Per GPLv2, under some legal systems (not the US, I'm told), the witch is indeed entitled to do just that. Is it fair to permit the witch to stop others from exercising the freedoms she received from the prince under the condition that she would respect them, even after she took advantage of them? Should the fact that such attempt to deny freedoms uses a patent lawsuit matter at all?

This is one of the loopholes in GPLv2 that GPLv3 attempts to fix. It doesn't necessarily affect the US, but it affects other legal systems. Programs distributed under the GPLv3 will carry explicit patent licenses from all contributors on any patents implemented by the program that each contributor distributed, and the licenses can only be terminated along with the copyright license, in case of copyright infringement.

Patents and paysideways

Consider that Sneezy wrote a program and distributed it under the GPLv2. The witch takes the program, adds a feature to it and starts using and modifying this program that implements another of her patents. Grumpy takes the same program written by Sneezy, without any help from the witch (this is the difference from the case above), and adds the same feature. The witch decides Grumpy needs to be stopped, and files suit for patent infringement.

The witch doesn't owe Grumpy anything, but she is required by Sneezy to respect others' freedoms, because the witch did modify the program, and this "translates to certain responsibilities." Enabling her to stop others from exercising the same freedoms she got is unfair, and provisions to avoid this are lacking in GPLv2. In GPLv3, if the witch fails her responsibilities, Sneezy will be able to counteract the failure and stop her from enjoying the freedoms granted by the license, through license termination.

Regenerate infringers

The huntsman almost killed Snow White, but ended up disobeying an order from the queen and lying to her to cover it up. Most people would agree that he did the right thing, but the evil queen might differ and punish him for the deception, even years after not having deceived her again.

As harmful as releasing GPLed software without respecting others' freedoms is, compliance is in general the best remedy a copyright holder can aim for. Although offering the source code and the freedoms to past recipients is the best possible outcome, it isn't always legally possible.

Stopping the unauthorized distribution is the second-best possible outcome. It does nothing to restore the freedoms of those who have already received the program. However, if they felt they needed the program so badly as to accept it under conditions that didn't respect their freedoms, seeking to reverse the effects of past distributions would be a worse remedy than the illness: prohibiting past recipients from even running the software they received would take away the few freedoms they got.

GPLv3 will help past infringers leave their mistakes behind. If sixty days elapsed without any further infringement, and copyright holders didn't put the infringer on notice, the infringer is forgiven for the past infringements.

Furthermore, infringers are forgiven if they rectify the infringement within thirty days after being put on notice for the first time by a copyright holder.

This is fair because it prevents abusive charges for damages, leaving the path clear to compliance, which is what really matters.

Compatibility

Consider that Happy wrote a program and distributed it under the GPLv2. Sleepy wrote another program and distributed it under a license that is incompatible with GPLv2. Happy won't let Sleepy reuse and distribute Happy's code, and Sleepy won't let Happy reuse and distribute Sleepy's code. That's fair, but it's not useful because they can't cooperate.

If Happy licensed the program under GPLv2+ (version 2 or any newer version published by the FSF), and Sleepy's program's license happened to be incompatible with GPLv2, but compatible with GPLv3 (because GPLv3 was designed to be compatible with more Free Software licenses than GPLv2), then Happy can combine and distribute his code with Sleepy's, and Sleepy can combine and distribute his code with Happy's. That's fair and useful.

Sure enough, steps could be taken so as to make GPLv3 compatible with any license whatsoever, and if that's useful as per the argument above, why won't GPLv3 aim at compatibility with all existing licenses?

First, because there are Free Software licenses that are specifically designed to be incompatible with every other licenses: copyleft licenses. It's impossible to achieve mutual compatibility with such licenses while retaining the copyleft requirement. By definition, such licenses require derived works to use the same license, except for explicit relicensing provisions, such as LGPL to GPL, or GPLv3 to Affero GPL version 2. This is why the recommended use of the GPL has been to permit relicensing under newer versions of the license, which enables fairness bugs to be fixed without much of a hassle for anyone involved, except for those who exploit the bug. Retaining the unfairness or forcing people to go through a difficult approval-or-rewriting process for relicensing, so as to fix such bugs, would be unfortunate, if not outright unfair.

Second, because some licenses are designed to impose unfairness, so the GPL can't possibly be faithful to its spirit and be compatible with them. Compatibility with non-Free Software licenses, for example, is ruled out. Only a few additional restrictions, which don't reduce or that increase fairness, are permitted under the GPLv3. Additional restrictions that are not permitted can be taken out, in an attempt to rule out the use of the GPL in non-Free licensing practices. Permitting such practices to be associated with the GPL wouldn't do justice to the GPL.

The few additional restrictions that are permitted are either fairness-preserving or fairness-increasing.

GPLv3 will explicitly permit combination and distribution of works licensed under GPLv3 and an upcoming version of the Affero GPL, that will itself be compatible with the GPLv3. The Affero GPL is a license that enables access to the corresponding source code to be granted to users of the program, even when they use it without receiving it, for example, through web services.

Compatibility with the Apache License version 2.0, one of the original goals of GPLv3, proved to be a difficult target. Although the patent retaliation provisions were brought into the GPL, the idemnification clause in version 2.0 of the Apache License may still be a source of incompatibility with the GPLv3. Hopefully, the FSF and the Apache Foundation may be able to address this issue, by adjusting the GPLv3 and/or the Apache License so as to make them compatible.

The GPLv3 will have provisions that permit the combination with licenses that are compatible except for warranty disclaimers, requirements as to the preservation of legal notices, author attribution and marking of modifications to avoid misrepresentation, or limits of use for publicity of marks or names of licensors or authors. Most of these are aimed at internationalization (see the section below).

Internationalization

In addition to making room for additional no-warranty clauses and credit- and reputation-preserving requirements, GPLv3 is making significant efforts to avoid using terms with established juridic meanings that vary across jurisdictions.

To this end, it defines terms such as propagation, encompassing any activity that requires permission from the copyright holders of a program, except for running, or making private modifications to it, and conveying, a subset of propagation that enables others to make or receive copies, except for sublicensing.

Significant effort went into avoiding explicit references to legislation specific to any country, and to use legal principles from international copyright treaties.

An international license is more likely to be equally applicable all over the world, without favoring any single country, which makes it a much fairer license.

Distribution modes

A number of networked distribution modes have been added to the license, since wide availability of fast networks made it a fair method to satisfy the obligation to offer source code.

In GPLv2, whoever conveyed binaries without sources had to accompany the binaries with a written offer that enabled anyone whatsoever to obtain a copy of the sources on a medium customarily used for software interchange.

GPLv3 will narrow down the offer so as to cover only those who actually obtain the binaries, even if indirectly, but it will permit the requirement to offer source code to be satisfied by means of network access. So, Snow White wouldn't have to write down the recipe of the delicious soup she made to all the seven dwarfs: she could publish it on the Royal Recipe Repository, where it would remain available publicly everafter, or write it down only to the dwarfs who had some of the soup.

GPLv3 will also permit mirrors and peer-to-peer networks to carry binaries without sources, as long as they point at corresponding sources available at no charge elsewhere. No wonder the magic mirror likes GPLv3 better.

Corresponding Sources

In order to create an apple capable of turning Snow White into, erhm, Sleeping Beauty, the witch had to take a regular apple, prepare just the right kind of poison for Snow White, and combine them both into a poisoned apple, according to a scripted procedure. By the way, it's a little-known nearly-irrelevant made-up-as-we-go fictional fact that the poison is only present in the skin of a poisoned apple; the pulp and the core are unaffected.

If Dopey were to take the seeds out of the core and plant them, the produce wouldn't be poisoned apples. The genetic code in the apple seeds is like source code for apples (*). But it's for regular apples, not poisoned ones. It's not the complete corresponding sources for poisoned apples. The poison has its own source code: its recipe. The procedure to combine the poison with a regular apple, so as to form a poisoned apple, is akin to a build script. The apple genetic code, the poison recipe and the procedure to combine them are the corresponding sources of a poisoned apple.

When the witch gave the poisoned apple to Snow White, she couldn't help including the apple's genetic code, but the poison recipe and the procedure to poison an apple were easy to leave out. The witch reasoned that including them could harm her plan, so she withheld these bits of information, even though it would be fairer to enable others to build upon her work, just like she built upon nature's work, the apple. She didn't care for fairness, though. She only wanted her evil plan to work, so the corresponding sources she distributed were incomplete.

(*) Never mind that the seeds don't carry the genetic code for the apple that contains them, but rather for its direct descendants. In the usual case, the difference is not significant, and neither genetic code would produce poisoned apples anyway.

As it turns out, there are companies that sell products including binaries with signatures (poisoned apples) and digital devices that will only run such poisoned binaries. Such products often include corresponding source code for the Free Software programs, but some [signing-]key elements are missing.

Consider a fictitious company Antique Voices, more widely known as AntiVo, and its (in)famous Digital Voice Replayer. The AntiVo DVR runs a small GNU/Linux operating system, but it will only run software that is poisoned with a digital signature that only AntiVo can generate. Like the witch, AntiVo withholds the signing keys (poison recipe) and scripts (poisoning procedure) necessary to generate such signatures and combine them with the binaries.

With the incomplete sources you get from AntiVo (apple genetic code), the binaries you create are like Dopey's apples: they're missing the poison, so they won't do their magic on your DVR (Snow White). They may run just fine on other computers, just like anyone may feed on Dopey's apples, but they won't run on your DVR, because it will only run poisoned software.

It's funny that 'looking dead' is present in both sides of the analogy, but while the witch's poison makes Snow White look dead, AntiVo's poison keeps the DVR from looking dead. This is an irrelevant point for this analogy. The important point is to illustrate the absence of information as to how duplicate an essential element of the distributed object or software.

Technical measures and pro-DRM laws

A bug in the license is exposed whenever someone can successfully explain and justify denying the responsibility that comes with modifying or distributing a program per the spirit of the license. No matter how clever or elaborate the explanation is, denial of freedom is still denial of freedom. It's still a failure to comply with the spirit of the license. GPLv3 attempts to fix several such holes.

The first draft attacked specifically the threat of using DRM to deny the exercise of the freedoms. It didn't prohibit implementing DRM with Free Software, as some have claimed, but rather disrespecting the freedoms using DRM techniques.

The second draft attempts to generalize that, extending the scope to any technical measures whatsoever that one might come up with, and use to stop someone who can run the original program from exercising the freedoms to study it, adapt it or distribute it, modified or not, or run the modified program.

Also, the draft includes an explicit promise by the copyright holders not to use pro-DRM laws to stop the exercise of these same freedoms, somewhat like the patent license case above. Such copyright holders will be a bit like the huntsman told to kill Snow White: he could in theory exercise his power and kill her, but he instead chooses to let her go in freedom.

As a result, if others modified a GPLed program so as to add a feature (or a misfeature such as DRM), and you get that modified program, you can further modify it so as to disable or remove the (mis)feature, and then run your own modified version.

Discriminatory agreements

GPLv2 has wording that prevents you from distributing a program if you have obtained a patent license needed to distribute the program, and you can't pass the patent license on to all downstream users. It would be unfair for the distributor to keep to itself, and possibly also to a subset of downstream users, privileges in the exercise of the freedoms granted by the license.

GPLv3 offers other possibilities to ensure distributor and recipient fairly stand on the same ground: disclaiming the patent license, or having the corresponding sources available somewhere for anyone to copy at no charge.

Now, what if the distributor arranges patent privileges not to itself, but only to some of the recipients of the software? Say, paying customers implicitly get a patent license from a third party, that non-paying downloaders don't. This is discriminatory. If you negotiate a third-party patent license to accompany the software you distribute, but you won't offer this license to everyone who gets software from you, some will get more freedoms over the software than others, and this is unfair.

But it gets worse if the paying customers are not allowed to pass on the patent licenses they've received. If they can't pass them on, then distributing the software would amount not only to patent violation, but also to copyright infringement.

GPLv3 will address this possibility of discrimination by determining that, if you've arranged any sort of patent licensing with a third party in the software distribution business, such that recipients of the program from you would get a license from this third party, but the patent license imposed further restrictions on the exercise of the freedoms the GPLv3 grants, then distribution would be forbidden. I.e., if you won't distribute it fairly, don't distribute it at all.

Furthermore, if you are part of an agreement in which one party distributes the software and another grants a patent license that does respect the freedoms granted by the GPLv3, then the patent license is automatically extended to all recipients of the program, modified or not. This rules out unfair patent-based discrimination.