First Draft of GPL Version 3 Released

njan writes "The first draft of version three of the GNU General Public License was released to the public this afternoon. Major improvements touted in version three include changes designed to mitigate the damage posed by new threats to free software such as software patents. One individual stated about the release: 'It is changes in law, not computer technology, that pose the principal challenges to the free software community. Chief among these changes has been the unwise and ill-considered application of patent law to software. Software patents threaten every free software project, just as they threaten proprietary software and custom software. Any program can be destroyed or crippled by a software patent belonging to someone who has no other connection to the program.'"

Other issues

The slashdot summary does not quite get the proportions right. Yes, the v3 draft does refine how the GPL deals with patents, but that is only one of many issues in this draft. (I've compiled the list below from cursory reading of the new license and the rationale that accompanies it, before it was slashdotted.)

• There is a proposal in it that would discourage or disable the use of GPL software for DRM, by stating that software under the new GPL cannot constitute an "effective technological protection measure". Thus it would always be possible for other programs to get at the same data without falling under the DMCA.
• When it comes to patents, the draft is actually not very aggressive about them. There is no general patent retaliation clause as in some other licenses, because the FSF believes that disallowing an offender to use any free software would not be too much of a deterrent for some.
• Compatibility between the new GPL and other free software licenses will generally be better.
• The idea of what constitutes source code and object code is refined. This, I think, is mostly intended to deal with the case when software is used over the web, rather than downloaded and installed.

Re:Other issues

There is a proposal in it that would discourage or disable the use of GPL software for DRM, by stating that software under the new GPL cannot constitute an "effective technological protection measure".

I'd be curious to see what an objective lawyer has to say about the enforceability of that clause. Being an "effective technological protection measure" seems like a matter that can't be waived, any more than my signing a stipulation that I wasn't born in August affects my birthday.

Re:Other issues

I think I understand what they're trying to do with this. Without the clause, I could (theoretically) take a GPL program, add "pseudo-DRM" to it and then sue whoever removes that DRM from the (GPL) code using the DMCA. With the clause, I'm "forced" (if I want to distribute the program) to state that my stuff isn't an "effective technological protection measure" (which I assume is the phrasing of the DMCA). Would be much harder to defend in a court "Yes, I know we say in the license that it's not an effective technological protection measure, but we for the purpose of this lawsuit, we would like to change our mind...". Anyway, I'm not sure how strong a protection it offers, but I can't see that really hurting anyone.

Re:Other issues

Not quite. What they want to do is make it legal to try and decypt content GPLed code protects. By stating they are not an effective protection method, they are not covered by the DMCA. Therefor, you can try and remove the encryption from any content that the program produced (possibly any content it can read?). As for legality, I'd think its fairly strong- whoever releases it under the GPL license is voluntarily agreeing to this, and thus waiving the rights to sue under the DMCA (remember, breaking the DMCA is not a criminal act, but a civil tort).

Re:Other issues

You're making the incorrect (but common) assumption of "effective" meaning "carrying out its job well". The actual meaning of "effective" in law is "having the effect of". It doesn't have to do its job well, it just has to do its job such that it gives a certain effect.

For example, a cheap padlock out of a Christmas cracker is not "effective" in that it does its job well, because anyone can pick it with a paperclip. But it's "effective" in that if you, say, secure your house with it, then anyone picking the lock to gain entry is automatically guilty of breaking and entering.

That's one of the ironies of the DMCA. Any DRM system doesn't have to do its job well - it's enough for the RIAA to say "this is the intention of the system" and they're covered. That's why it's such a bad law, because it gives total advantage to one group of people (media producers) without requiring any corresponding responsibilities from them.

Grab.

Re:Other issues

I think you're misunderstanding me.

Let us say that Alice makes a DVD encrypted with CSS. Bob makes a different DVD encrypted with CSS, and which is licensed under the GPL. Carol makes and distributes copies of DeCSS. And Dave wants to use Bob's work pursuant to the GPL.

Dave can circumvent CSS in order to decrypt Bob's DVD, per the GPL. He can arguably even make a tool (such as DeCSS) in order to do so, provided that he keeps it to himself. But Carol cannot make or distribute versions of DeCSS because Alice will sue her (and win). This means that if Dave is unable to make his own DeCSS, the fact that he is legally allowed to circumvent CSS is moot because he cannot do so as a practical matter.

Therefore, I suggest that the GPL state that works covered by the GPL may not be DRM'ed at all. This doesn't extend to all the works Bob has made or will make, which is where you seem to have gotten confused. Bob would be free to make one DVD with CSS which is not under the GPL, and free to make another DVD under the GPL, but without CSS.

Since it's not safe to assume that Dave will be able to meaningfully take advantage of his rights under the GPL, vis-a-vis DRM'ed works, I think the appropriate thing to do is to make sure that the GPL and DRM are exclusive of one another.

This also means that if Dave makes his own version of Bob's DVD, he could not add DRM to it (which might block Bob as well as other users).

Fundamentally, I think that allowing GPL'ed works to be DRM'ed is contrary to the goals of the GPL.

Re:Other issues

There is a proposal in it that would discourage or disable the use of GPL software for DRM, by stating that software under the new GPL cannot constitute an "effective technological protection measure". Thus it would always be possible for other programs to get at the same data without falling under the DMCA.

I read that a little differently. Because the license, picked by the original copyright holder, categorically states that it is not a technological protection measure, it can't be used in software that has the protections of the DMCA. This isn't so interesting.

However, when you remember that derivative works are similarly bound, you realise that the end effect is that any organisation who wishes to attack reverse-engineers with the DMCA is forbidden from building their copy protection on top of any GPL 3 software.

I don't think this is about opening things up, I think this is about giving companies an ultimatum - either give up on abusing the DMCA, or you can't have any of our source code.

Re:Other issues

On the issue of distribution, am I the only one bothered by the vagueness of this line:

The output from running it is covered by this License only if the output, given its content, constitutes a work based on the Program.

What in the world is that supposed to mean? Based on the source code of the program? Does inserting XML markup constitute a work based on the program, then? Because those tags were part of the program source code? This is really, really vague in a legally scary way.

I'm also a little bothered by the language that anything with a user interface must have an about box with copyright notice. What if the original didn't? Shouldn't it say that this information must be preserved, rather than saying that it must contain one? It's also a little troubling to think about how this could affect web services, since user interface isn't defined in a way so as to exclude it. This still doesn't explicitly clear up that issue.

I'll stick with the MIT license.

I think I will continue to stick with the MIT license. It has plain, easy to comprehend terms. It's concise.

I appreciate the effort the FSF is making, but things may be getting out of hand. I know of many developers who feel the same as I do. They just want to create software, without having to get bogged down with legalities. Thankfully, licenses like the BSD license and the MIT license work wonderfully well for us.

Re:I'll stick with the MIT license.

Some people don't want their code to be used in any situation. They want to guarantee that anyone trying to profit off their code will basically have to contribute in one way or another - the code can't just be copied and closed.

Personally I use both GPL and BSD for different projects, but saying "the GPL is too complex and that's why people should use BSD/MIT" really ignores the reason why many people use the GPL in the first place. I agree that we could use a simpler version of the GPL - but BSD isn't it.

Re:I'll stick with the MIT license.

"They just want to create software, without having to get bogged down with legalities. "

And thats why they should use the GPL- to make sure it *remains* free, and that changes and additions to it remain free. BSD and MIT may be concise, but it doesn't make this promise. If you're going with them, you may as well just forget the license and go public domain.

Re:I'll stick with the MIT license.

And your copy may be totally irrelevent. See the history of X windows for a great example of how the MIT license totally failed.

Re:I'll stick with the MIT license.

They just want to create software, without having to get bogged down with legalities.

Well, choosing to ignore the complexities of the legal system doesn't guarantee they ignore you. For example the MIT license has no disclaimer of warranty. Nor does it require the licensee to waive any potential claim of damages. In theory, somebody could take your software, modify it in a way that introduces bugs, then disappear, leaving downstream licensees with your name as the only starting point for a lawsuit.

It doesn't matter that it's not your fault. Unless you're like MIT with a substantial legal staff to scare them off, it'll be too bad for you. The BSD license would be a much better choice.

Like software, licenses should be as simple as they need to be to accomplish what you need them to do, but no simpler.

The MIT license ensures you get credit. Period.

The BSD license ensures you get credit, and that nobody claims that you endorse their derivative products, and that everybody uses the software on the condition of releasing you from legal responsibility for damages.

GPL ensures you get credit, that people release you from legal responsibility for damages, and that every downstream recipient gets as many rights as you granted your immediate licensees.

It's too bad that you have to understand any kind of legaleese to be a programmer, but that's life. Licenses are just the start of it. You have to understand a bit about copyrights, patents and trademarks too. If you work with source material that is not public domain, you probably need to have some understanding of contracts. We're not talking law school level stuff, but at least an informed layman's understanding.

If you don't like this, sticking your head in the sand is not a viable solution.

Incomprehensible

The new GPL is, well, "wordy", bit not all that clear. And to be quite frank, I understand that I don't understand it.

The new GPL have the following:

This License gives unlimited permission to privately modify and run the
Program, provided you do not bring suit for patent infringement against
anyone for making, using or distributing their own works based on the
Program.

So patent law mixed with how I use the software, and privately at that. Can I use GPLv3 software in a company (it's not private, usually)? Can I modify it, but not distribute it outside the company? If I don't do this privately, but as a "corporate" person, then it's not private, so I can do what I want (of course not). This is just in the beginning of the new license, and it goes on and on and on and on etc.

Really, why not make a license that I don't need to be a lawyer to understand?

Re:The ISSUES are incomprehensible

Oh not again about the "BSD is bad because MS can steal BSD-licensed code" :((

Here it is again: THAT'S PRECISELY THE POINT! Don't you think people who put their code under the BSD license know it?

The license is liberal because:

• maybe the software is made on an academic institution and it wouldn't be fair to restrict it (as the GPL does)
• maybe the author writes the software for fame not for fortune (mostly closely tied with previous point - academics tend to make software that will increase their academic status [hint: BSD unix] and maybe land them consultant jobs)
• maybe the author is a really good guy
• maybe the author is really optimistic and thinks that if the companies can use quality BSD-licensed code they wouldn't have to develop their own crappy versions (hint: MS)
• ...

Web services?

There's been much debate for and against allowing people to "publish" modified GPLed web applications without releasing the source. For example, phpBB is released under the GPL, and some believe that you should be required to make any changes to it available to your site visitors.

I didn't see any wording in the draft that addresses this issue either way; every time I thought I did, I found the same or similar wording in version 2. So, is it in there? Will it affect how we publish web applications?

Re:Web services?

I asked Stallman about this back in 2001; his reply is here [steve-parker.org]:

ME: I modify GPL code - eg a CGI library - to suit my own needs for use on a publicly-available web server. This code is being run, by the general public, on my web server. Should I, in this case, make the code available? Under the GPL, must I?

RMS: The GPL does not require it. But is not very good for the community when people do this, so I am looking at a way that GPL 3 could require publication in this case.

The conversation and background of it is all documented at http://steve-parker.org/articles/lego/ [steve-parker.org]

Because it's a legal document.

The same reason that code is hard to read by non-programmers, or medical papers are hard to read by people without medical training. The law, like any field, needs precise language to communicate. Many words have special legal meanings that are subtly different from common speech (or not so subtle if language has diverged over time). This is necisarry for the same reason that you can't use plain english to write code - plain english leaves to much open for interpretation. When you write legal documents, you want the judge interpreting your document, should it ever go to court, to read it the way you intended it to be read. The best way to do this is to use the accepted legal terminology.

Re:Cut the "any later version" option

The phrase "or any later version" is not part of the GPL. Rather it is part of the statement in which you specify that the GPL is the license that you are using. The FSF recommends including this phrase but it isn't required by them or by the GPL. You are perfectly free to specify a particular version of the GPL if you wish to.

Re:The slippery slope begins...

No, this draft doesn't limit use in any way. The restrictions are when you want to distribute copies or use the software in derivative works. I quote from the draft:

This License explicitly affirms your unlimited permission to run the Program.

Re:No more GPG encryption

YOu're misreading the legalese. When it says that any GPLed program is not an effective DRM app, it means that by hacking around content protected by a GPL application, you are not breaking the DMCA. Because the DMCA makes it illegal to circumvent a protection device, but the GPLed app is not legally a protection device, as per the GPL. It doesn't mean that you can't use encryption, but that its not illegal to reverse engineer an encryption system it uses.

Re:No more GPG encryption

This just kind of popped into my head- but I wonder. If GPG is not considered an "effective protection devise" or whatever the legalease is- could a company who was using GPG to protect customer information or some such be sued for failing to provide "adequate" protection of customer information.

Re:great; now GPL software is prohibited on Window

Except, ya know, that the license then goes on to say

As a special exception, the Complete Corresponding Source Code need
not include a particular subunit if (a) the identical subunit is
normally included as an adjunct in the distribution of either a major
essential component (kernel, window system, and so on) of the
operating system on which the executable runs or a compiler used to
produce the executable or an object code interpreter used to run it,
and (b) the subunit (aside from possible incidental extensions) serves
only to enable use of the work with that system component or compiler
or interpreter, or to implement a widely used or standard interface,
the implementation of which requires no patent license not already
generally available for software under this License.

Re:Relicense?

One question for OSS projects currently using GPL, will be, should they relicense?

Most GPLed software already gives you the option of choosing to use a later version of the GPL, so no relicensing needs to happen.

For example, should Linux become GPL3'd?

Linux is a special case. It's explicitly GPL version 2 only, and most of the code has been submitted with that understanding. If Linus wanted to switch to this new version, he'd have to get permission from everybody who's got code in Linux.

a diff between version 2 and the draft...

...meight be more useful: have a look [wikimedia.org].