Re: [Ksummit-discuss] [CORE TOPIC] GPL defense issues

["Luis R. Rodriguez" <mcgrof@kernel.org>]

On Tue, Aug 30, 2016 at 11:25:38AM -0700, James Bottomley wrote:
> On Tue, 2016-08-30 at 11:00 -0700, Luis R. Rodriguez wrote:
> > On Mon, Aug 29, 2016 at 12:04 PM, James Bottomley
> > <James.Bottomley@hansenpartnership.com> wrote:
> > > As a side note: if you own a project you want to open source, 
> > > Apache-2 ends up being practically the worst licence imaginable: 
> > > not only can your competitors make proprietary modified copies of 
> > > your code they don't have to show you, but they also gain rights to 
> > > your patents with which to do it.
> > 
> > I disagree. The benefit that Apache 2 provides not that you hold
> > patents per se, but rather if you want to contribute to the ecosystem
> > you have to also contribute to the patent pool. In today's mobile
> > market place the Apache 2 license seems like a rather *genius* move
> > IMHO for the cases where otherwise you do not care for the gains of
> > copyleft. What I'm trying to say is -- in my experience Android folks
> > barely cared about contributing upstream, it always was an uphill
> > battle. Patents however were a serious problem in every possible
> > little corner in the ecosystem. If a lot of new companies are using
> > permissive licenses for Linux, and you don't care over the copyleft
> > gains the Apache 2 license seems to give you a better edge.
> 
> Basically, no, you've weakened your own patent shield: we keep OIN
> around for defensive measures around the ecosystem.

The value of OIN is only sensible if it has something *you want*. Otherwise its
pointless, provided you have other grounds to cover your other interests. If
you're already a member and OIN doesn't have what you need you are shit out
of luck.

>  Imagine an OIN
> member wishing to defend linux gives OIN access to a set of patents
> which also read on an open project it contributes to under apache-2. 
>  Lets assume these patents are also practised by an evil proprietary
> company that attacks Linux.  OIN defends on the basis of infringing
> these patents but the evil proprietary company claims that it, in fact,
> incorporated code from the open project into its proprietary one and
> thus with the code came the licence to the patents.  End of defence

Understood, however I don't think that's the strategy behind the choice
of the license.

> OIN fortunately does have a stock of patents it owns outright as well
> as cross licences, so the shield doesn't die entirely, but it may lose
> a valuable weapon at the time it's most needed.

Sure, but if OIN *does not* have the patents you really care for, who
cares.

> The problem here is limiting the IP leak.  GPLv2 is easy because the
> patent licence is implied.  GPLv3 works because the patent licence is
> explicit but bounded by the recipient's willingness to release their
> code.  Apache-2 is basically unbounded and this is the problem that has
> a wide range of unintended consequences.

If you are simply leveling the playing field and the bait is contribution, then
what really matters if producing an ecosystem you want people to contribute to.

Its a nice alternative to have. In fact, you can take both approaches.

  Luis