So... I guess I still don't understand what was wrong with BSD+Patents.
I get that there's legal uncertainty: I can imagine some companies, especially larger ones, not wanting to give up their patent-suit option just because one random small team in their org is using React. And barriers to adoption aren't a great idea when one of your goals is wide adoption.
Overall, though, I think making it much harder to file patent suits -- at least for software patents -- is a great thing. Facebook's (and others') implementation of it might have left something to be desired, and they're certainly a large company with a lot of resources behind them, so the power dynamic might be a bit lopsided, but...
Well, let's just say I'm a small company or individual who wants to release some open source code. Doing so under a BSD+Patents-style license gives me some protection from any big players who decide to use my software. How is this a bad thing?
I suppose I hold a pretty strong anti-patents stance, though. I'd be happy if (most?) patent protection just went away entirely.
As an aside, note that it looks like FB is going with straight MIT. So they're not even giving users of their software a patent grant at all anymore[1], and reserve the right to sue you later just for using their software, if they happen to have a patent on something in it.
[1] Yes, there are some legal opinions that the MIT license's language includes an implicit patent grant, but I don't believe that's a settled matter.
1. Software patents are a huge, huge, existential crisis facing our industry.
2. So huge, in fact, that nobody wants to deal with it. We can't realistically figure out if the libraries we are using are covered by patents, and given how broken issuance is, they probably are.
3. So the only practical solution is to use MIT licensed libraries, pretend there's no patent issue, and put our heads in the sand.
4. But Facebook's BSD+Patents license made us think about patents. Nobody stopped and said "can we use Angular? Are there patents on core elements of it?". But people did stop and ask that about React, because Facebook was (accidentally) making people think about patents, and the more you think about patents the more you wish you were a plumber and not a dev so all you'd have to deal with is toilets blocked with shit, and not software patents, which are much worse.
5. Now that it's under an MIT license it's just as dangerous to use React (maybe more) but we can pretend it's safe again.
Notice that Wordpress's decision to switch from React (which probably led to this) was quite clear: They were not switching due to patent concerns about React, they were switching because the non-standard license was stirring up FUD and making people ask them uncomfortable questions. (We know this because they explicitly said so, and also because the leading contender for a new library was Preact, which is strictly more dangerous from a patent point of view than React under every possible circumstance, but has a license that lets your pretend everything is okay easier.)
This. I don't even want to know how many patents we're all infringing on in everything we ship. We all just sort of sweep this under the rug. No one ever does a technical/patent analysis. Is patent check part of your deployment pipeline? I highly doubt it. There's probably tens of thousands of broadly worded software patents out in the wild. The only thing that keeps the industry safe is how difficult it actually is to do that analysis because of the inherent complexity in both software and patent law.
The sad thing is that Facebook's policy was obviously informed by exactly this point of view, that, essentially, software should not be patented.
It's the backlash that was led by people who considered it a realistic possibility that they may, some day, want to sue Facebook for infringing on one of their precious patents.
"and the more you think about patents the more you wish you were a plumber and not a dev so all you'd have to deal with is toilets blocked with shit, and not software patents, which are much worse."
If it's licensed MIT, the Engineers just say "it's MIT license like half of the libraries we already use" and it's a legal non-issue.
If the license is not one of the standard ones already in use, and it mentions patents, suddenly legal gets involved and it's a disaster. They're very risk-adverse and no one's really sure what will happen when it gets to court. It doesn't have to make sense - after all, most software patents don't make sense, and most software patent lawsuits don't make sense.
Copyright makes some sense - some entity wrote the code and has (or has not) given explicit permission for others to use it, and under common open-source licenses those terms are reasonably well understood. But patents can come out of left-field and be unrelated to the user or the producer of the code. Being aware of patents (which should not cover what you're doing or should not exist) makes punitive damages worse. Again, best to just put your head in the sand and hope the patents don't notice you. Any language about patents adds complications which no one wants to figure out.
This is the first time I've seen "put your head in the sand" as an actual recommendation, instead of being characterized as something not to do. And as far as recommendations go, it's more than a little bit nutty.
And at small to medium-sized businesses, they don't have in-house IP attorneys and their in-house counsels (or outside lawyers on retainer) will likely punt such questions to an outside firm or IP specialist. And that will come with an unattractive price.
So, in other words, what you're effectively saying is that everyone's reaction to this is irrational, but understandable. People understand the MIT license (or even just the regular BSD license), but as soon as something brings patents into the mix, even if the clause actually gives you more rights and legal cover, people get scared and don't want to deal with it?
That's... sad.
> Being aware of patents ... makes punitive damages worse.
Sure, but that doesn't have anything to do with a BSD+Patents license. The license doesn't say "you also must do extensive patent research when using our software". You have to actually be aware of the patents that you're infringing to be held liable for extra damages.
The current state of things is that patents are stockpiled as deterrents, kind of like nuclear weapons. All of the big companies know that if they sued one another over some patent claim, the other side would retaliate, and it would be a big mess with no real winners.
Facebook's patent clause disarms all their opponents, but leaves them free to attack. It's actually a wildly aggressive, offensive weapon, surprisingly - just like how nuclear missile defense is one of the more provocative technologies out there that possibly makes nuclear conflicts more probably.
That's why it's totally unpalatable, at least at the big companies.
It seems like people never get tired of not reading the PATENTS file. “Wildly aggressive?” Please. The agreement explicitly forbids Facebook from revoking your patent grant if they are the aggressor. Without the agreement (i.e. just BSD) Facebook is free to sue you for patent infringement. They add a file that says they can’t do that unless you sue them first and suddenly people are out for blood. Salem 2.0.
It's not just big companies necessarily either. Say you are a small startup working on something really innovative and you have a patent on part of your work. Facebook decides to build something similar, violating your patents in the process, and they are going to put you out of business. If one of your core technologies is react under the BSD + Patents license, then you are screwed. You can't sue to save your business because even if you do you have to immediately recall all of your software and replace React.
Sure, not everyone is in that situation. Facebook is big enough though that if you have any patents you have to be _very_ careful about that license.
Yes, I get that, and addressed the power imbalance in my comment...
But on second reading I realize I was wrong (in a good way). Facebook's patent grant specifically says that if they sue you for patent infringement, and you counter-sue with something that is unrelated to the software of FB's that you are using, then your license to use FB's software is NOT terminated. That's actually entirely reasonable and great.
No, they said your license didn't terminate if you had a counterclaim against them. The only event that license terminated was if YOU attacked Facebook.
I think it's more about the complexity of licensing, patents, and the uncertainty a new license presents.
Using a license that's been in use for a long time, and has the endorsement of major OSS organizations, is pretty much always more comfortable for developers.
I wasn't uncomfortable enough with their licenses to rule out their projects based on the license, but I understand the folks who were. Even if my reading of the license makes me unafraid of it, there was enough uncertainty about how a court, particularly courts that have a history of siding with patent trolls, might interpret the license, for it to make some people nervous.
Also, the belief that the copyrights and patents involved will always belong to a benevolent actor ignores a lot of tech history. See: SCO, Oracle, etc. for examples of a previously decent stakeholder being consumed by a more malevolent and litigious one with a different interpretation of the law and the license. facebook may be a huge, unassailable, force today...can we be certain that in ten years that'll still be true? I'd bet on it, but I also won't be shocked if something dramatic happens. Sun looked pretty unassailable through the 80s and 90s, and then they didn't.
Big companies building big projects have to think about these things if they want to be responsible about the future of their projects. (Again, I agree that in this case, the fear is probably overblown. But, I get where it's coming from.)
By that logic we'd never have any new licenses, because everyone would be afraid to use them. We take it on faith now that whenever a new release of the GPL comes out, we won't be afraid of it just because it's new. People had problems with GPLv3 when it came out, but those problems were about specific parts of the license, not "oh god it's new and scary and we don't know how to interpret it". And that's the GPL, a license orders of magnitude more complex than BSD+Patents.
As an aside, I realized I read FB's license wrong -- it actually is even better for users of it, and specifically says that the patent termination clause only goes into effect if the user is the aggressor. If FB comes after you for a patent claim, you can counter-sue all you want without losing your license. So FB is actually doing the absolutely correct thing here.
Unethical developers that work at shitty companies with shitty lawyers were annoyed that they couldn't use React. That's all there is to it.
I loved BSD+patent as one of the few potentially successful attacks on the awful software patents regime that we currently live under. This defeat means we are probably stuck with it for the rest of our careers.
>Unethical fevelopers that work at shitty companies with shitty lawyers were annoyed that they couldn't use React. That's all there is to it.
Apache is an unethical foundation with shitty lawyers? I admire the goal of eradicating software patents, to me BSD+Patents was an unsuccessful way to do it. It hurt OSS projects more than it hurt private projects.
I think you have it backwards. The facebook patent license puts all the power in their hands, and none in yours: they can still sue you for violating their patents, but you can't sue them. It would be a much, much worse patent regime.
That was incredibly unexpected. Facebook may very well end up in the majority's good graces with this move. I wonder how some of the bigger players will react (no pun intended) after their abandonment of React in lieu of Vue or some other framework. Interesting times indeed.
Yeah, we've already settled on Vue (because our lawyers forbade us from using React), but now I'm sure they would approve React. So... do we abandon our work on Vue (which so far is amazing) to switch to React since the React ecosystem is so large, or do we stay the course? Sigh. I wish Facebook had made this change a year ago.
Many things going forward will happen in reacts petri dish. Lots of ideas seeking to get consensus like the evolution of styles, animations, native performance, async scheduler, easy-to-create native renderers. Vue is nice and all, but it's rather complacent, catering to old Angular-like roots and web artefacts. If you believed the hype then Vue was supposed to be the be-all-end-all of frameworks, the reality of course is quite sober: http://www.npmtrends.com/angular-vs-react-vs-vue-vs-@angular...
I... well, I kinda expected it. Facebook wanted their products to be used, but it was obviously their legal department that made them put the patent clause in. The more people who develop using their libraries, the more contributions they get back, and the more benefit they get from it.
I almost guarantee you none of the devs wanted that weird-ass patent clause in there, but I'm guessing that none of them thought that it was a big deal in the long run, just CYA shit you'd expect from a legal department.
They were proven wrong, and it impacted their market share, they raised a stink about it and they got it changed.
> I wonder how some of the bigger players will react (no pun intended) after their abandonment of React in lieu of Vue or some other framework
What do you expect them to do, shrug and come back? I doubt anyone who left based on concerns with their stack being owned by Facebook is likely to regret weaning themselves off of it.
The react ecosystem is massive, and includes impressive projects like the various backends/renderers: react-native, react-sketch.app, react-vr, react-pdf, ink, that have no equivalent in other frameworks (or at least to nowhere near the same level of maturity), so yeah people ditching it may well regret it.
The complicating factor there is Facebook actually has a patent covering the GraphQL specification (along with the fact that they're applying PATENTS to a specification, vs an implementation): https://www.google.com/patents/US9646028
> As our business has become successful, we've become a larger target for meritless patent litigation. This type of litigation can be extremely costly in terms of both resources and attention. It would have been easy for us to stop contributing to open source, or to do what some other large companies do and only release software that isn't used in our most successful products, but we decided to take a different approach.
Never heard Facebook answer: why didn't they just follow Red Hat's model and make a "Patent Promise"[1]?
Then accumulation of software patents would help deter meritless litigation while staying out of the way of FLOSS developers getting their work done.
I've been trying to tell everyone licensing is more important than they realize, but there are so many people who fundamentally misunderstand licensing and therefor just don't care (dwtfyw license for example), or have falsely been trained by subpar instructors at uni and $othertraining about how bsd/mit is the superior license for business because $reasons.
The four freedoms and free software solve so many of the problems I see around modern tech-infrastructure. No, free software doesn't solve every issue and has some of it's own, for example I think at the code complexity levels we are at the many eyes theory is starting to crumble, but it doesn't change the core truisms about freedom in computing that are important for us to move forward in a free and open society if we actually want to start solving prolems.
Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt, please take this time to at least consider GPL varients (A/L/GPLv3) for as much of your tooling as you possibly can. (perhaps CC0/CCBY/CCBYSA for content)
In my opinion, MIT/BSD licenses like FB moved to in this case simply aren't good enough to be future-proof, primarily because of the ability of future tivoization of a product that removes freedom from the user (think BSD on playstation).
Remember, either the user controls the program, or the program controls the user.
If the GPL scares you for some reason or you have question about it (commercial sales of gpl software for example), feel free to ask. I've spent enough time wading through just about every license so I think I might be able to cut through some fud.
>I've been trying to tell everyone licensing is more important than they realize, but there are so many people who fundamentally misunderstand licensing and therefor just don't care
Maybe they don't care because in reality its not a problem?
In the sense that it's not a problem people generally have -- not that nobody ever has had it.
A lot of people worry too much about all kinds of BS eventualities and technicalities, and this could be one of them in most cases.
>Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt
It only bit FB in the butt (in the sense that some developers complained about their license choice) -- not those using the tooling with FB license.
>please take this time to at least consider GPL varients (A/L/GPLv3) for as much of your tooling as you possibly can. (perhaps CC0/CCBY/CCBYSA for content)
I'm sorry but Creative Commons themselves declare that their licensing should not be used for software.
The MIT license does not explicitly mention patents. However, depending on the lawyer, an argument could be made that it contains an implicit patent license. I think that Facebook would have an uphill battle arguing that their relicensing didn't include patents after this kerfuffle.
Sorry, I'm confused, can you help me understand that blog post? I'm getting three messages from it:
1. We like React a lot with or without the license.
2. It's not our job to convince the world React's patent license is fine.
3. We're substantially moving away from React, including large rewrites.
...why are they moving away from React? I'm confused, do they believe using React implicitly supports it? They're already vocally supporting it.
I don't have an opinion or a dog in the race with regards to the React and patent license drama, but I legitimately don't understand why this blog post (or the underlying decisions) was written. In my opinion it feels like a huge deal to decide to rewrite a piece of production software, especially if you like the software already. So what am I missing?
Are they concerned that people won't use WordPress because it has React components? Does React's BSD + Patents license extend downstream like that?
EDIT: Thank you for downvoting me twice for asking an honest question folks...
"Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with."
It's one thing to look at the license and guess that it's vanishingly unlikely you'll ever be in an intellectual property fight with FB (and it sounds like the counsel Automattic consulted with came to that conclusion for Automattic).
It's another thing to make that decision for everybody downstream using software that you distribute. Particularly when that's a reaaaally large number of people.
I'm on much less solid ground in speculating about more, but it's often interesting to watch the contents of speech when people are working to assure you of something:
"One nice thing about this apartment is that it's very secure." (That's interesting. Why is it important that this apartment is very secure? Is the neighborhood not so much secure?)
"This guy we're interviewing here is not being interviewed for your position." (That's interesting. Why do I need to know that, manager?)
In the case of this post, between the lines I potentially see something like:
"Hey FB, we don't feel threatened by the license, and you know, he who writes to code makes the rules, like Linus says. You're obviously doing what's right for you, from your point of view, and we're sure you know what's best for you, and if you're doing right by yourself, do you need to even ask if you're doing the right thing?
You do you, bro. And we're sure you won't be mad that we wanna let everybody else be themselves, too."
Not sure it's there, I could be reading more into it than I need to.
> I think Facebook’s clause is actually clearer than many other approaches companies could take, and Facebook has been one of the better open source contributors out there. But we have a lot of problems to tackle, and convincing the world that Facebook’s patent clause is fine isn’t ours to take on. It’s their fight.
My interpretation is that due to the negative publicity that Facebook has garnered with their license, they didn't want to scare people away from using/building on top of their platform by using their library even though they themselves did not have a problem with the license.
It's understandable how that might be the final straw for Facebook when even people who don't have a problem with their license won't use their libraries for that reason.
4. The license causes Fear, Uncertainty and Doubt for those considering our product. We (WordPress) do better by not causing this FUD for our customers.
They feared that for example the Apache Foundation wouldn't use WordPress, and so with others.
And yes, the Patents part of that extends downstream to anything using it, that's the dangerous part of patents. It applies to everything that does that — even in independent implementations.
Well...now back to writing code and shipping things...we can all put our irrational fantasies of patent litigation and being "unacquirable" startups due to React to rest.
Though I am a bit curious about why WordPress would need React in the first place. It's not like they're building a real-time app. Am I missing something here?
Yes, that React is really convenient for building practically any type of web app, not just real-time apps, and they probably want the slick and seamless user experience they can get by building a progressive web app in React.
Thank them for what? I don't get it. It sounds to me that they just ran away from the problem. The problem in my eyes being software patents not the BSD+Patents license. But sure, thanks for being weenies.
I doubt it was related. The wheels to get this in motion must have started months in advanced, probably around the time ASF started advising against this license (labeling at as Category-X [1])
I disagree. I think it was entirely related. Facebook could likely put up with a few dissenters here and there, but a major defector such as Wordpress is a canary: they likely feared that this would be the first domino to topple React's supremacy.
FB: "...we know that many teams went through the process of selecting an alternative library to React. We're sorry for the churn. We don't expect to win these teams back by making this change, but we do want to leave the door open."
This can seem like a response to the community at large, but can also be read as a direct response to Wordpress' comments:
WP: Automattic will also use whatever we choose for Gutenberg to rewrite Calypso — that will take a lot longer, and Automattic still has no issue with the patents clause, but the long-term consistency with core is worth more than a short-term hit to Automattic’s business from a rewrite. Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with.
Now if someone (i.e. an Actual, Impartial Lawyer) can explain if changing to MIT actually changes anything.
EDIT:
As others have pointed out, FB reaffirmed its decision to maintain the patents clause on Aug 18th (33 days ago): We recognize that we may lose some React community members because of this decision. [1] But they change their minds 8 days after the Matt published the On React and Wordpress article.
This pretty much proves that the decision to move to MIT was heavily influenced -- or perhaps in direct response to -- Wordpress' decision to ditch React.
In a statement from Facebook on August 18th, 33 days ago[0]:
We have considered possible changes carefully, but we won't be changing our
default license or React's license at this time. We recognize that we may lose
some React community members because of this decision. We are sorry for that,
but we need to balance our desire to participate in open source with our desire
to protect ourselves from costly litigation.
Given that they apparently didn't think it was a big enough deal then, and what changed was Wordpress, I don't think it's incorrect to give them some credit.
This is a very smart move by Facebook, and a win for the open source community as a whole. Why it took so long for the license change is a bit of a mystery, but removing the complications of software patents from their licenses will help further drive adoption and remove the precedent they were in danger of setting.
I guess you haven't seen the Facebook projects where the patent grant was dumped after a handfull of people asked nicely. There it was more of a "Yeah sure, why not?" by the maintainer without much input from the legal team as it seems.
I'm not sure how changing course from a direction that could have neutralized patents, to one engineered so patent aggressors aren't hurt, is something that can be considered a win for the open source community.
I suspect it also took time for the mounting discontent and for the number of voices to reach some kind of tipping point which then caused Facebook to begin the internal process of re-evaluating their licensing.
> Why it took so long for the license change is a bit of a mystery
Be careful. Facebook hasn’t said they’re removing the patents override completely. All they’ve said here is they’re changing their licensing, not what they’ll do. They may end up with BSD+Different patents grant. Make sure you check the changes next week. I doubt it will be straight BSD or they would have said it.
Wait, this doesn’t solve anything. They replaced BSD with MIT, which are basically the same license and then they removed any explicit patent grant. So this means the user is actually granted less rights then before.
Am I missing something or does this make zero sense?
Basically, if you sell or license a product that requires a patent to work, courts have generally held that you grant an implied patent license for any patents that the product might require. If you explicitly reference patents within the license, however, then whatever terms you explicitly write into the license supersede this implied patent license. BSD+patents (and Apache 2) have explicit patent language; paradoxically, this makes them more restrictive than licenses like MIT, BSD, or GPL that don't mention patents at all.
Furthermore, suppose you're some company like, say, IBM which figured out some way to say, safely double the energy density and recharge cycles of Lithium Ion batteries, which you have patented. Let's also assume that you are shipping some critical problem which is dependent on React. Facebook could now freely use your patented idea, and violating it left, right, and center, and if you try to sue them for violating that patent, you're completely f*cked.
So Facebook's idea works fine if you believe that Patents as a Thing are bad (all patents, not just software patents), and should not be asserted under any circumstances, and it's fine for Facebook to arbitrarily violate any patent of any company who has become dependent on React.
The license granted hereunder will terminate, automatically and without notice,
if you (or any of your subsidiaries, corporate affiliates or agents) initiate
directly or indirectly, or take a direct financial interest in, any Patent
Assertion: (i) against Facebook or any of its subsidiaries or corporate
affiliates, (ii) against any party if such Patent Assertion arises in whole or
in part from any software, technology, product or service of Facebook or any of
its subsidiaries or corporate affiliates, or (iii) against any party relating
to the Software.
If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
If implicit patent grants are a thing, why have more modern licenses like Apache 2 and GPL 3 made it a point to include explicit patents grants in the language of the license?
Wouldn’t their legal counsel advise them against it if it was redundant?
I'm not well versed enough in the various licenses to compare BSD+Patents and MIT, but in my opinion, this is more of a move to appease the community than anything dealing with the benefits/disadvantages of the license being used.
You may be right that this might actually reduce our rights, however, the MIT license is well known and accepted by many in the developer community. It's been around long enough that developers know what they are agreeing to when they use something with an MIT license. With the BSD+Patents license, the biggest concern was not understanding what you were getting into when using React.
Facebook recognized this and conceded despite still believing in the BSD+Patents license to be better. So in that sense, this makes a lot of sense as it:
* alleviates community concerns
* builds up their standing with developers
* generates a lot of good PR
* draws attention away from alternative solutions which were getting a lot of publicity from all of this (Vue.js, Marko, Preact, etc.)
It would be nice though to have a lawyer chime in on the differences between BSD+Patents and MIT.
That's what all the Facebook & React folks were arguing. Facebook doesn't want to do unconditional patent grants. Plus, they decided that the weak patent retaliation clause in Apache 2 license wasn't strong enough. This new license is strictly riskier for people than the old license, but it's more familiar, so people won't freak out.
If there is an implicit patent grant, we have more rights. I think there is a strong case that the implicit grant exists, and would vastly prefer seeing projects licensed under MIT than under the Facebook license.
Apache 2.0 would have also been acceptable, as it had a better explicit patent grant. I'm actually a little surprised they didn't choose it.
The way I interpret it is, explicit patent license implies _less_:
- Explicit patent license specifies why / how it can be revoked.
- Without an explicit patent license, patent infringement case (by Facebook) against a party that uses Facebook's OSS would be become harder, because one may argue that such grant is implied by Facebook open sourcing the software.
There hasn't been a single patent covering a standard React implementation found yet. Someone found one that might cover a niche case, but the bottom line is no one really knows if any patents of any substance or having broad claims will actually ever issue.
That combined with the implied licenses means there was a patent clause causing a ton of unecessary hand-wringing.
The reality is every company of FB's size is patenting every developer's latest dump if it can get through the patent office.
That's what gets me. There's a very narrow list of packages that they've selected for the MIT treatment. Why isn't the blog post something along the lines of "We're re-licensing all of our open source libraries under the MIT License and removing their patent clauses"? It seems like they're still trying to play games, and are only buckling to the pressure for a tiny number of libraries.
> This shift naturally raises questions about the rest of Facebook's open source projects. Many of our popular projects will keep the BSD + Patents license for now. We're evaluating those projects' licenses too, but each project is different and alternative licensing options will depend on a variety of factors.
The author of this Facebook Engineering post confirmed that React Native's license currently is the same as it's always been: https://twitter.com/dmwlff/status/911348886882607104. I don't want to get into a big discussion about precise details here but pragmatically both the MIT and Facebook BSD+Patents licenses work well for most businesses, in particular those that aren't seeking to claim patent infringement against others.
I may not intend to go suing FB for patent infringement, but if they infringe on one of my patents, or if they sue me for patent infringement, it's really my only recourse.
Yeah, that is a downer. I'm going to wait and see what they decide to do about React Native before asking my company's lawyers if we can use React now.
There have been a few comments on whether or not the MIT license includes an implicit patent license, or is just a copyright license.
It should be noted that there is nothing in the MIT license that actually says it is a copyright license. Here is what it grants you permission to do:
> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions
It is giving you permission to "deal in the Software". What that means is not defined but it gives several examples that it includes: use, copy, modify, publish, distribute, sublicense, and/or sell copies.
Several of those, including use, copy, sell copies and maybe distribute, are things that require patent permission if the software is patented. The plain language of the license says that you have permission to do those things, and the only way you can have that permission is if you have a patent license, so I don't see how a court could read the license as not including a patent grant if the licensor has patents that cover it.
Readit News
I get that there's legal uncertainty: I can imagine some companies, especially larger ones, not wanting to give up their patent-suit option just because one random small team in their org is using React. And barriers to adoption aren't a great idea when one of your goals is wide adoption.
Overall, though, I think making it much harder to file patent suits -- at least for software patents -- is a great thing. Facebook's (and others') implementation of it might have left something to be desired, and they're certainly a large company with a lot of resources behind them, so the power dynamic might be a bit lopsided, but...
Well, let's just say I'm a small company or individual who wants to release some open source code. Doing so under a BSD+Patents-style license gives me some protection from any big players who decide to use my software. How is this a bad thing?
I suppose I hold a pretty strong anti-patents stance, though. I'd be happy if (most?) patent protection just went away entirely.
As an aside, note that it looks like FB is going with straight MIT. So they're not even giving users of their software a patent grant at all anymore[1], and reserve the right to sue you later just for using their software, if they happen to have a patent on something in it.
[1] Yes, there are some legal opinions that the MIT license's language includes an implicit patent grant, but I don't believe that's a settled matter.
1. Software patents are a huge, huge, existential crisis facing our industry.
2. So huge, in fact, that nobody wants to deal with it. We can't realistically figure out if the libraries we are using are covered by patents, and given how broken issuance is, they probably are.
3. So the only practical solution is to use MIT licensed libraries, pretend there's no patent issue, and put our heads in the sand.
4. But Facebook's BSD+Patents license made us think about patents. Nobody stopped and said "can we use Angular? Are there patents on core elements of it?". But people did stop and ask that about React, because Facebook was (accidentally) making people think about patents, and the more you think about patents the more you wish you were a plumber and not a dev so all you'd have to deal with is toilets blocked with shit, and not software patents, which are much worse.
5. Now that it's under an MIT license it's just as dangerous to use React (maybe more) but we can pretend it's safe again.
Notice that Wordpress's decision to switch from React (which probably led to this) was quite clear: They were not switching due to patent concerns about React, they were switching because the non-standard license was stirring up FUD and making people ask them uncomfortable questions. (We know this because they explicitly said so, and also because the leading contender for a new library was Preact, which is strictly more dangerous from a patent point of view than React under every possible circumstance, but has a license that lets your pretend everything is okay easier.)
It's the backlash that was led by people who considered it a realistic possibility that they may, some day, want to sue Facebook for infringing on one of their precious patents.
This.
If the license is not one of the standard ones already in use, and it mentions patents, suddenly legal gets involved and it's a disaster. They're very risk-adverse and no one's really sure what will happen when it gets to court. It doesn't have to make sense - after all, most software patents don't make sense, and most software patent lawsuits don't make sense.
Copyright makes some sense - some entity wrote the code and has (or has not) given explicit permission for others to use it, and under common open-source licenses those terms are reasonably well understood. But patents can come out of left-field and be unrelated to the user or the producer of the code. Being aware of patents (which should not cover what you're doing or should not exist) makes punitive damages worse. Again, best to just put your head in the sand and hope the patents don't notice you. Any language about patents adds complications which no one wants to figure out.
That's... sad.
> Being aware of patents ... makes punitive damages worse.
Sure, but that doesn't have anything to do with a BSD+Patents license. The license doesn't say "you also must do extensive patent research when using our software". You have to actually be aware of the patents that you're infringing to be held liable for extra damages.
Facebook's patent clause disarms all their opponents, but leaves them free to attack. It's actually a wildly aggressive, offensive weapon, surprisingly - just like how nuclear missile defense is one of the more provocative technologies out there that possibly makes nuclear conflicts more probably.
That's why it's totally unpalatable, at least at the big companies.
Sure, not everyone is in that situation. Facebook is big enough though that if you have any patents you have to be _very_ careful about that license.
But on second reading I realize I was wrong (in a good way). Facebook's patent grant specifically says that if they sue you for patent infringement, and you counter-sue with something that is unrelated to the software of FB's that you are using, then your license to use FB's software is NOT terminated. That's actually entirely reasonable and great.
Oracle v. Google?
Using a license that's been in use for a long time, and has the endorsement of major OSS organizations, is pretty much always more comfortable for developers.
I wasn't uncomfortable enough with their licenses to rule out their projects based on the license, but I understand the folks who were. Even if my reading of the license makes me unafraid of it, there was enough uncertainty about how a court, particularly courts that have a history of siding with patent trolls, might interpret the license, for it to make some people nervous.
Also, the belief that the copyrights and patents involved will always belong to a benevolent actor ignores a lot of tech history. See: SCO, Oracle, etc. for examples of a previously decent stakeholder being consumed by a more malevolent and litigious one with a different interpretation of the law and the license. facebook may be a huge, unassailable, force today...can we be certain that in ten years that'll still be true? I'd bet on it, but I also won't be shocked if something dramatic happens. Sun looked pretty unassailable through the 80s and 90s, and then they didn't.
Big companies building big projects have to think about these things if they want to be responsible about the future of their projects. (Again, I agree that in this case, the fear is probably overblown. But, I get where it's coming from.)
As an aside, I realized I read FB's license wrong -- it actually is even better for users of it, and specifically says that the patent termination clause only goes into effect if the user is the aggressor. If FB comes after you for a patent claim, you can counter-sue all you want without losing your license. So FB is actually doing the absolutely correct thing here.
> With MIT nobody knows if you have those grants in the first place because there was never a court precedent. But not our hill to die on
I loved BSD+patent as one of the few potentially successful attacks on the awful software patents regime that we currently live under. This defeat means we are probably stuck with it for the rest of our careers.
Apache is an unethical foundation with shitty lawyers? I admire the goal of eradicating software patents, to me BSD+Patents was an unsuccessful way to do it. It hurt OSS projects more than it hurt private projects.
Really? They are doing the minimum possible to prevent an exodus from their stack after a public outcry.
Theorizing, but I suspect FB will begin targeting and picking off IP of apps built entirely on React stacks in a few years.
Please don't go back to them. Just contribute to Vue's ecosystem like crazy. Worst case scenario it'll keep FB in check.
That said, this healthy Vue/Angular/React competition has been great for us devs.
I almost guarantee you none of the devs wanted that weird-ass patent clause in there, but I'm guessing that none of them thought that it was a big deal in the long run, just CYA shit you'd expect from a legal department.
They were proven wrong, and it impacted their market share, they raised a stink about it and they got it changed.
Competing frameworks will now need a new "Reason #1 to use us instead" for their pitch-decks.
Deleted Comment
What do you expect them to do, shrug and come back? I doubt anyone who left based on concerns with their stack being owned by Facebook is likely to regret weaning themselves off of it.
I count:
* ReasonML - https://github.com/facebook/reason/blob/master/PATENTS.txt
* GraphQL - https://github.com/graphql/graphql-js/blob/master/PATENTS
* react-native - https://github.com/facebook/react-native/blob/master/PATENTS
* PlanOut - https://github.com/facebook/planout/blob/master/PATENTS
* Flow - https://github.com/facebook/flow/blob/master/PATENTS
* Haxl - https://github.com/facebook/Haxl/blob/master/PATENTS
* Flux - https://github.com/facebook/flux/blob/master/PATENTS
Just a few that I found.. Please reply if you know more project that are still BSD+PATENTS licensed.
The complicating factor there is Facebook actually has a patent covering the GraphQL specification (along with the fact that they're applying PATENTS to a specification, vs an implementation): https://www.google.com/patents/US9646028
> As our business has become successful, we've become a larger target for meritless patent litigation. This type of litigation can be extremely costly in terms of both resources and attention. It would have been easy for us to stop contributing to open source, or to do what some other large companies do and only release software that isn't used in our most successful products, but we decided to take a different approach.
Never heard Facebook answer: why didn't they just follow Red Hat's model and make a "Patent Promise"[1]?
Then accumulation of software patents would help deter meritless litigation while staying out of the way of FLOSS developers getting their work done.
[1] https://www.redhat.com/en/about/patent-promise
The four freedoms and free software solve so many of the problems I see around modern tech-infrastructure. No, free software doesn't solve every issue and has some of it's own, for example I think at the code complexity levels we are at the many eyes theory is starting to crumble, but it doesn't change the core truisms about freedom in computing that are important for us to move forward in a free and open society if we actually want to start solving prolems.
Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt, please take this time to at least consider GPL varients (A/L/GPLv3) for as much of your tooling as you possibly can. (perhaps CC0/CCBY/CCBYSA for content)
In my opinion, MIT/BSD licenses like FB moved to in this case simply aren't good enough to be future-proof, primarily because of the ability of future tivoization of a product that removes freedom from the user (think BSD on playstation).
Remember, either the user controls the program, or the program controls the user.
If the GPL scares you for some reason or you have question about it (commercial sales of gpl software for example), feel free to ask. I've spent enough time wading through just about every license so I think I might be able to cut through some fud.
My own company's lawyers consider the GPLv3 toxic and not allowed at all for company use in any software we create - that's enough for me.
Maybe they don't care because in reality its not a problem?
In the sense that it's not a problem people generally have -- not that nobody ever has had it.
A lot of people worry too much about all kinds of BS eventualities and technicalities, and this could be one of them in most cases.
>Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt
It only bit FB in the butt (in the sense that some developers complained about their license choice) -- not those using the tooling with FB license.
What are you referring to? Who has been bitten exactly?
Deleted Comment
I'm sorry but Creative Commons themselves declare that their licensing should not be used for software.
https://creativecommons.org/faq/#can-i-apply-a-creative-comm...
This is a backwards move. Facebook is very good at PR painting this as a win for users.
See http://en.swpat.org/wiki/Patent_clauses_in_software_licences...
an explanation https://opensource.stackexchange.com/a/1890
https://github.com/caffe2/caffe2/blob/master/PATENTS
https://github.com/facebookincubator/gloo/blob/master/PATENT...
[1] https://ma.tt/2017/09/on-react-and-wordpress/
1. We like React a lot with or without the license.
2. It's not our job to convince the world React's patent license is fine.
3. We're substantially moving away from React, including large rewrites.
...why are they moving away from React? I'm confused, do they believe using React implicitly supports it? They're already vocally supporting it.
I don't have an opinion or a dog in the race with regards to the React and patent license drama, but I legitimately don't understand why this blog post (or the underlying decisions) was written. In my opinion it feels like a huge deal to decide to rewrite a piece of production software, especially if you like the software already. So what am I missing?
Are they concerned that people won't use WordPress because it has React components? Does React's BSD + Patents license extend downstream like that?
EDIT: Thank you for downvoting me twice for asking an honest question folks...
"Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with."
It's one thing to look at the license and guess that it's vanishingly unlikely you'll ever be in an intellectual property fight with FB (and it sounds like the counsel Automattic consulted with came to that conclusion for Automattic).
It's another thing to make that decision for everybody downstream using software that you distribute. Particularly when that's a reaaaally large number of people.
I'm on much less solid ground in speculating about more, but it's often interesting to watch the contents of speech when people are working to assure you of something:
"One nice thing about this apartment is that it's very secure." (That's interesting. Why is it important that this apartment is very secure? Is the neighborhood not so much secure?)
"This guy we're interviewing here is not being interviewed for your position." (That's interesting. Why do I need to know that, manager?)
In the case of this post, between the lines I potentially see something like:
"Hey FB, we don't feel threatened by the license, and you know, he who writes to code makes the rules, like Linus says. You're obviously doing what's right for you, from your point of view, and we're sure you know what's best for you, and if you're doing right by yourself, do you need to even ask if you're doing the right thing?
You do you, bro. And we're sure you won't be mad that we wanna let everybody else be themselves, too."
Not sure it's there, I could be reading more into it than I need to.
> I think Facebook’s clause is actually clearer than many other approaches companies could take, and Facebook has been one of the better open source contributors out there. But we have a lot of problems to tackle, and convincing the world that Facebook’s patent clause is fine isn’t ours to take on. It’s their fight.
My interpretation is that due to the negative publicity that Facebook has garnered with their license, they didn't want to scare people away from using/building on top of their platform by using their library even though they themselves did not have a problem with the license.
It's understandable how that might be the final straw for Facebook when even people who don't have a problem with their license won't use their libraries for that reason.
And yes, the Patents part of that extends downstream to anything using it, that's the dangerous part of patents. It applies to everything that does that — even in independent implementations.
Yes, why would it not?
Deleted Comment
Deleted Comment
There's also already a theme that uses React: https://themes.redradar.net/foxhound/
With those two things you could build a pretty good web app. The only thing is you'd be in WordPress land and isn't glamorous.
https://wptavern.com/wordpress-new-gutenberg-editor-now-avai...
In this instance.
I don't think they should be particularly rewarded for this. I think we should keep in mind what it took to get to this point.
And that, absent such pressure, individual organizations and people, and perhaps our collective society, remain at their... "mercy?"
Remain under their thumb. Whether that thumb presses down this year. Or next. Or... we just don't know.
In other words, I'd remain cautious about whether and how far I move under their umbrella -- tech-wise, or other.
[1] https://www.apache.org/legal/resolved.html#category-x
FB: "...we know that many teams went through the process of selecting an alternative library to React. We're sorry for the churn. We don't expect to win these teams back by making this change, but we do want to leave the door open."
This can seem like a response to the community at large, but can also be read as a direct response to Wordpress' comments:
WP: Automattic will also use whatever we choose for Gutenberg to rewrite Calypso — that will take a lot longer, and Automattic still has no issue with the patents clause, but the long-term consistency with core is worth more than a short-term hit to Automattic’s business from a rewrite. Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with.
Now if someone (i.e. an Actual, Impartial Lawyer) can explain if changing to MIT actually changes anything.
EDIT:
As others have pointed out, FB reaffirmed its decision to maintain the patents clause on Aug 18th (33 days ago): We recognize that we may lose some React community members because of this decision. [1] But they change their minds 8 days after the Matt published the On React and Wordpress article.
This pretty much proves that the decision to move to MIT was heavily influenced -- or perhaps in direct response to -- Wordpress' decision to ditch React.
[1]https://code.facebook.com/posts/112130496157735/explaining-r...
[0] - https://code.facebook.com/posts/112130496157735/explaining-r...
This is very clearly a response to WordPress. Nicely played Matt.
Have you ever worked at a large company with its own legal team? It's not such a large mystery.
I'm not sure how changing course from a direction that could have neutralized patents, to one engineered so patent aggressors aren't hurt, is something that can be considered a win for the open source community.
MIT is like a standard when it comes to OS. At big companies, complicated licencies are very hard to get approval of.
Big organizations require more time and people to reach consensus at different hierarchical levels. Probably the legal department was the bottleneck.
Either way, it's a good move.
Be careful. Facebook hasn’t said they’re removing the patents override completely. All they’ve said here is they’re changing their licensing, not what they’ll do. They may end up with BSD+Different patents grant. Make sure you check the changes next week. I doubt it will be straight BSD or they would have said it.
Am I missing something or does this make zero sense?
https://www.wilmerhale.com/pages/publicationsandnewsdetail.a...
https://copyleft.org/guide/comprehensive-gpl-guidech7.html
Basically, if you sell or license a product that requires a patent to work, courts have generally held that you grant an implied patent license for any patents that the product might require. If you explicitly reference patents within the license, however, then whatever terms you explicitly write into the license supersede this implied patent license. BSD+patents (and Apache 2) have explicit patent language; paradoxically, this makes them more restrictive than licenses like MIT, BSD, or GPL that don't mention patents at all.
So Facebook's idea works fine if you believe that Patents as a Thing are bad (all patents, not just software patents), and should not be asserted under any circumstances, and it's fine for Facebook to arbitrarily violate any patent of any company who has become dependent on React.
React Patent Grant Version 2: https://github.com/facebook/react/blob/b8ba8c83f318b84e42933...
The license granted hereunder will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: (i) against Facebook or any of its subsidiaries or corporate affiliates, (ii) against any party if such Patent Assertion arises in whole or in part from any software, technology, product or service of Facebook or any of its subsidiaries or corporate affiliates, or (iii) against any party relating to the Software.
Apache 2 Section 3: http://www.apache.org/licenses/LICENSE-2.0
If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
GPL 3 Section 10 (See also Section 11): https://www.gnu.org/licenses/gpl-3.0.en.html
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
Edited for spacing
If implicit patent grants are a thing, why have more modern licenses like Apache 2 and GPL 3 made it a point to include explicit patents grants in the language of the license?
Wouldn’t their legal counsel advise them against it if it was redundant?
You may be right that this might actually reduce our rights, however, the MIT license is well known and accepted by many in the developer community. It's been around long enough that developers know what they are agreeing to when they use something with an MIT license. With the BSD+Patents license, the biggest concern was not understanding what you were getting into when using React.
Facebook recognized this and conceded despite still believing in the BSD+Patents license to be better. So in that sense, this makes a lot of sense as it:
* alleviates community concerns
* builds up their standing with developers
* generates a lot of good PR
* draws attention away from alternative solutions which were getting a lot of publicity from all of this (Vue.js, Marko, Preact, etc.)
It would be nice though to have a lawyer chime in on the differences between BSD+Patents and MIT.
Apache 2.0 would have also been acceptable, as it had a better explicit patent grant. I'm actually a little surprised they didn't choose it.
- Explicit patent license specifies why / how it can be revoked.
- Without an explicit patent license, patent infringement case (by Facebook) against a party that uses Facebook's OSS would be become harder, because one may argue that such grant is implied by Facebook open sourcing the software.
That combined with the implied licenses means there was a patent clause causing a ton of unecessary hand-wringing.
The reality is every company of FB's size is patenting every developer's latest dump if it can get through the patent office.
Deleted Comment
I'm likely oversimplifying, but that's about as much as I understand on licenses
Deleted Comment
> This shift naturally raises questions about the rest of Facebook's open source projects. Many of our popular projects will keep the BSD + Patents license for now. We're evaluating those projects' licenses too, but each project is different and alternative licensing options will depend on a variety of factors.
It should be noted that there is nothing in the MIT license that actually says it is a copyright license. Here is what it grants you permission to do:
> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions
It is giving you permission to "deal in the Software". What that means is not defined but it gives several examples that it includes: use, copy, modify, publish, distribute, sublicense, and/or sell copies.
Several of those, including use, copy, sell copies and maybe distribute, are things that require patent permission if the software is patented. The plain language of the license says that you have permission to do those things, and the only way you can have that permission is if you have a patent license, so I don't see how a court could read the license as not including a patent grant if the licensor has patents that cover it.