Please Stop Inventing New Software Licences

I'm not sure the title is the correct response. As in "stop making software licenses" is not the problem.

Clearly any business can license their software any way they like.

What caused the poster some confusion is that it was marketed as an "open source" product. Once he determined it was not an OSI approved license then that should be the end of it. It's not Open Source. period.

By all means call them out on that - lots of people and companies are not licensing experts, and need guidance. I've helped people with this in the past and encouraged them to change to actual Open Source licenses that are compatible with their goals, and the goals of their community.

If anything the real headline should be "stop calling your product open source when it doesn't have an open source license".

[To be clear - I produce commercial software under not-open-source licenses. I've got no objection to folk doing that. I even ship the source with the product, and accept contributions back. But I don't call it "open source" because it's not "Open Source". It's something, sure, but it's not Open Source.]

I will only add that non-standard licenses also hurt adoption, specifically in medium/big businesses/enterprises.

Most organizations understand common open source licenses and there's usually a blank statement that allows teams to use GPL/MIT/whatever-licensed software.

Anything outside that subset of licenses (even if they're permissive, open source or whatnot) requires a legal review and a lot of people won't go through the pain of that process just to use a library/service/app. It's easier to just choose something else.

> The wording still precludes me forking this repo on GitHub.

AFAIK that's irrelevant per GitHub's TOS, which users agree to:

By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content from your repositories in repositories they control).

If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking).

AIUI you therefore always have the right to fork something on GitHub.

https://docs.github.com/en/site-policy/github-terms/github-t...

Agree it's complex, and when attempting to solve a particular problem you end up with yet another license every time.

What businesses in particular want is a "Yes, you can read the code and yes you help if you want to, but you can't use the code to make your own product" source-available license (because they have devs to pay, and being able to keep doing that is the first thing they need to protect).

I think such licenses do sort of exist but they're fragmented.

The root of this particular argument seems to the definition of Open Source meaning unconstrained use of source code, instead of source-available.

I wish there were more standard open-but-not-open-source licenses available. Or open-but-only-for-personal-use or open-but-cannot-distribute.

Something standard and vetted enough that projects like these could adopt instead of having to write themselves.

(2020). Also the very existence of 100+ OSI approved licenses means that there are some reasons (or incentives) to invent new software licenses after all.

Mostly unrelated to the article, but the title stirred up memories.

~20 years ago I stumbled across the "Ё" license, that granted you all rights you can dream of with one condition, you must use the letter "ё" in its right place all the time. It is a Russian story, with some people loving "ё" and whining that outside of children books you can't find it, and other people trolling the first group by arguing that "ё" was a stupid addition from the very beginning, and even more stupid now.

Sadly I cannot google the text of the license now.

I’ve created a non-toy programming language, and at some point I intend on creating a package manager for it. The official repository for packages will require all code to be open source, and I’ve already decided to be opinionated about what that means. I’ll pick a handful of well known, and actual open source licenses (MIT, GPL, BSD, Apache Commons, etc) and require people that want to upload to this repo to select their license from the finite list. If they want to use another license, they are still free to do so, but they’ll have to stand up their own repository, and get users to add the repo to their sources list.

There’s just too many licenses, each with different (sometimes incompatible) requirements, so one advantage to being so opinionated is that you can add automatic checks to ensure you’re in compliance. For instance, if your library is MIT (only), you can’t use GPL dependencies. Most people probably don’t know this, so having tooling that helps enforce this ought to make things more compliant overall.

Almost all of the existing licenses were designed many years ago, before LLMs and enterprise cloud abused the open source model.

Only half jokingly, I wanted a couple months ago to change the license of a Javascript project I made to allow anyone to do anything with it, except train LLMs on it [1]. I couldn't find anything, so I cobbled together something which I'm sure is not in proper legalize. What were my options otherwise?

[1] https://github.com/mciucu/stemjs/blob/master/LICENSE

Cyph cofounder here. To be clear, the primary purpose of the license change was to allow users to validate reproducible builds of our code against the production version of Cyph without fear of technically violating the Ms-RSL license. OP's feedback was appreciated, but mostly unrelated to the license change except insofar as it reminded me to touch base with our counsel on the topic.

If there's an alternative license to the Cyph-RSL that meets our needs, I'd be happy to consider it, but I don't see any particular problem with the fact that we authored our own.

TFA:

> What does "intended" mean here?

I don't understand what problem the author have. We have lots of law and case based on intention.

In other words, please stop pretending you're open source.

This article could be summed up with “many projects are engaging in open source/free software cosplay”.

There are lots of projects that claim to be open source, and either are lying/don’t have free software licenses (CapRover, for example), or don’t work like an open source project is expected to (VS Code, Chromium), denying patches being integrated even if they fit project standards and provide benefit to users.

AFAIKT, even the "Popular/Strong Community" list on https://opensource.org/license all just essentially say you don't have pay for the source code, can't complain to the authors if it goes wrong, and then some variations around not treating it as your own code.

(BTW their filters work funny)

Also worth mentioning that, in the time since this article was written, Signal Messenger is now post-quantum secure [1], and has always been free and actually open source.

[1] https://signal.org/blog/pqxdh/

I checked the Wayback Machine to see how the about page for cyph looked like [1], and it said "open source", not "Open Source". So, I don't get what the beef is about.

[1] https://web.archive.org/web/20200517031524/https://www.cyph....

So many companies try to scam the community, by calling themselves open source but many are not. Great to see you checked and called them out.

We should support and reward the real companies that are actually open source, and who care about the community and transparency!

Reminds me of the old “Standards” xkcd https://xkcd.com/927/

Its almost as if some companies coughElasticcough want the upsides of being open source without having to, you know, actually be open source.

There's nothing wrong with releasing software under a license that allows contributions but disallows commercial use, which is what Cyph was attempting to do:

> We're a small startup with a significant amount of time and money invested into the development of Cyph. We recognize the need for anyone to be able to review the code and verify our production build against it from a security perspective, but at the same time it would be problematic if an unrelated third party could just stand up their own instance of Cyph and directly compete with us at this stage. We would be much more inclined to fully open source Cyph at a later stage of the business.

I disagree with the philosophy of forbidding any contributions just because they are not fully open-source for commercial purposes.

This seems like a very common scenario for software that is almost "open source" except for not allowing commercial deployments. I would be surprised if there is no existing licence to cover this use case, but it will not be fully open source of course. Which again doesn't mean that all contributions need to be forbidden.

Please fit in the exact little box that I have of you in my mind and stop deciding for yourself what you want to do with your stuff.

I beg your pardon!?

Microsoft dropping "open source" licenses into the Open Source ecosystem? Why am I not surprised? The ghosts of their "Linux is Cancer" campaign just cannot die.

This is why I like Fair Source License. It protects the company's IP but gives a community legal ways to contribute & use software for their needs.

https://fsl.software

Going one level up from the title one should want to avoid OSI licenses. Their original purpose was to approve new licenses. MIT, BSD, and the GPLs already existed, so OSI "approving" more was IMHO not very helpful. Anyone not satisfied with those options was usually trying to add some level of control. Even with a well written new license you cause developers problems wondering about "license compatibility" when they try to combine code under different licenses - a practice that is really useful but often overlooked by license creators.

You know what I hate about these days is this is a blog I enjoyed but then I got to the post about hacktoberfest and it occurred to me, what if this was all written to advertise hacktoberfest and the author got paid in some way for this? What bothers me about it isn't whether or not it happened, it's that I questioned the authenticity of the author simply because he posted a link and what if he did so because he was paid to do so as opposed to simply being interested. Which is exactly the internet I want to live in. One where people write interesting things and share links to other interesting things.