Okay, I think we're ready to start our next talk.
Let's welcome, Bradley and Khrusov.
So, hello.
So we wanted this to be a panel, and the problem we discovered was there are basically five
people in the entire planet who have the knowledge to be on that panel, and only two of them
were going to be at Fosden.
So you have the two that are actually at Fosden to talk about this really important issue,
and there's been a tremendous amount of things that have happened this year.
But to start off, I'm going to hand it to my colleague, Christof, to talk about what
this clause in GPLv3 is, and any GPLv3 as well, and what it's there for, why it's there,
and what it does.
Okay, thanks a lot.
Hello.
I'm very happy to be here.
My name is Christof Chirvich.
I recently started as the licensing and compliance manager at DFSF.
So this is actually my first public appearance in this position, and I'm very happy to do
this appearance.
So as an introduction, we are going to talk about something that we at DFSF started to
call, for example, confusing licensing or unauthorized alterations to the GPL, which
is...
Let me start by saying that the FFSF designed the GPL as the license that not just gives
users their freedoms, but it also has a mechanism to guarantee this freedom, which is, well,
co-pillift and some other obligations.
And what we have...
So what the FFSF has observed for quite a while is that people are doing different things,
not just using GPL verbatim, as it was intended to be applied, but they try to add some additional
requirements.
And that was addressed in GPLv3.
And in section 7 of the GPL, we have actually at least three different kinds of requirements
that are differently treated.
First of all, you have additional permissions or, let's say, exceptions that you can give,
and I don't think we have to talk about them.
And then there is a list of clauses that you can add that actually restrict what users
can do as compared to the grant of rights that's given in the GPL, let's say the original
GPL.
So there is a limited list of these requirements, restrictions that you can impose.
And if you do more, if you try to restrict further, these are called further restrictions,
and we have the quote from the relevant part of section 7.
It says that if you received the program with any of such further restrictions, you can
remove that term.
So basically, long story short, you do not have to abide by those restrictions.
I don't want to take too much time, so that's this license mechanism that is intended to
protect users in such a situation.
The other protection can come from the FSF itself because we, as the authors of the GPL,
we have copyright on the license terms, and we have also trademarks that are used in the
license.
So, after you apply the license, we want that to be done as intended, and we are not authorizing
users of the GPL that alter it or twist it in the way that it doesn't give freedoms contrary
to what section 7 allows.
So we believe that not...
So this mechanism can be used by users.
There is also another mechanism that we can resort to.
We could rely on our copyright or trademarks to protect the community from people imposing
some further restrictions.
Maybe let me stop here and we can maybe elaborate on that.
Well, yeah, I think it's an excellent summary, and I think one of the points I want to add
is kind of an historical thing because I worked on this years ago.
This clause was invented to handle the problem of...
Which was very common in the early 2000s, that someone say, this is under GPL version
2, but for non-commercial use only.
Well, we all know, but we had a lot of discussion earlier today, you're allowed to do things
under GPL version 2 commercially.
Under V2, the V2 group of licenses, this created just pure ambiguity because there was a statement
that it was under GPL, but then there was a statement that prohibited commercial use
or commercial redistribution.
This clause was specifically designed during the GPL V3 process, and you can actually go
into the drafting history of GPL V3.
I wrote an expert report, which I'm going to talk about in a few minutes, where I did
this in a case that's going on in the US, and find that that's exactly what we were
trying in the drafting of GPL V3 to allow users to do.
There's so much good about the GPL about how it empowers users, and the idea behind this
was to empower the users, just throw that clause away.
That clause shouldn't be there.
You should be able to go back to pure GPL anytime you want, and no one can, anywhere
from the supply chain, all the way from the original license or down to each redistributor
can add an additional restriction on your rights under GPL.
On paper, by design, this looks great.
The scary thing that's happening in the US, and I'm going to briefly summarize it, and
then we're just going to turn it over for questions, is that many companies, particularly
these VC backed open core companies that we talked about in the earlier session, have
really, I think unfairly, I'm going to say this because Crystal probably won't want to
go this far, but I'll say it because I'm not affiliated with the FSAF, they've unfairly
traded on the good name of the GPL, and they've said, oh, we're going to put this, we're
going to say it's under GPL, but then we're going to add some weird further restriction.
Their users are confused.
There was a case with a company called Neo4j, which did this, and a user who was also, by
the way, a contributor to Neo4j, an integrator for Neo4j, saw them do this and said, well,
I found this clause.
I can throw it away.
That's exactly it.
This fellow named John Mark Suhi did exactly what all of us in the old days intended when
this clause got drafted.
He removed the clause, and in response, Neo4j sued him in federal court for a variety of
acclaims, including a DMCA violation and various different damages.
I had the dubious privilege because it was a disturbing thing to watch to attend the
trial, and it really is heart-wrenching to realize that while we had this right on paper,
hit the ground, and somebody was in trouble, it was very difficult for everybody, and John
Mark's lawyers tried very hard to explain to the judge, he did exactly what he was
allowed to do.
We're kind of in a crisis right now about this clause because while Neo4j is just one
incident, the case, which hasn't been fully decided yet, although many of the key parts
of it were decided in summary judgment.
I can explain more if people have questions what that means.
We don't know what the future of this clause is, we don't know how it's going to work out,
and we've got somebody who's been really badly treated by Neo4j and frankly by the
courts for just doing what all of us in the free software world and the copula world in
particular thought he should be allowed to do.
That's a U.S.-centric thing, but I think it has worldwide implications because other
companies will be watching, and their desire to trade on the good name of GPL and say,
this GPL, except we've added this Commons clause thing, except we've added no commercial
use allowed or whatever it is.
We really as a community need to prevent that kind of behavior, and we're in the thick
of trying to make this clause work the way it's supposed to.
So maybe just one or two thoughts.
I think in the simplest terms what we think about it is that when you use the GPL, it
is intended and I think it's usually in this sense to transmit a very strong message that
you grant uses all the freedoms that are there.
So it's very concerning and confusing when someone uses the GPL, someone says, well,
this is under the GPL, but tries to change the result and the message.
So what we really are concerned with and we want to react is to stop this confusion.
And on the other hand, we are really happy and that the licenses are there for that people
are using them.
So it's really, and we even allow people to create new licenses using the terms of the
GPL.
In the FAQ we've written how it's possible, but we then make it very clear how to do it
without confusing, without using the name of the GPL because people may create very different
licenses when they use the term.
So I think that it's a very simple issue that we are concerned with this confusion and it
should be stopped if there is someone who wants to write their own license.
I mean, well, I don't think it's a good idea.
We already have a lot of licenses, but if you really want to please do, just stop, don't
confuse users.
Yeah, I agree completely.
And in that same space, we saw MangaDB do this.
They took almost exactly the text of the FAQ or GPL, but again, I can probably say more
because I can speculate about the FSF as not being affiliated with the FSF.
They didn't, it seems to me, have a trademark problem because they called it something different.
They named it the server-side public license.
It is a horrible license.
There's no question.
It cannot be complied with by anybody on the planet.
Even if MangaDB themselves tried to comply with the SSPL, they could not, but they own
all the copyrights so they don't have to worry about it.
But the, so while it's a toxic and terrible thing that the SS public license exists, it's
actually better than the Neo4j situation because in the Neo4j situation, they're using the
name of a Faro GPL.
They're saying the software is under a Faro GPL, but sneakily at the bottom, they've put
another restriction and they're captiously going after users and saying, aha, I caught
you.
And I have some real scary stories to tell of stuff that came out in trial.
I'll just tell one and then we'll open it to questions.
So during the trial, it turned out that the reason John Mark Suhey, who was a government
contractor in the United States, he was working for our Department of Treasury, he had, and
this is all public because it was publicly, publicly testified at trial, he had packaged
Neo4j with a bunch of other software as a, as basically a system integrator to deliver
a solution to the Department of Treasury.
And then Neo4j, who he'd signed an agreement with to do marketing, because he was a business
person trying to make lots of business relationships, they came to him and said, you have to go
and tell the IRS, the Department of Treasury in the U.S. that they're violating the
affair of GPL.
And he said they aren't.
I wouldn't, I wouldn't deploy the solution if I thought it was in violation.
And they said, no, but you have to tell them that because we want to sell them a license.
But of course, this dissolved quickly the relationship between them.
And it was not too long after that then Neo4j added the Commons clause on and said, well,
they're definitely violating the Commons clause.
And then John Mark came back and said, but I never deployed the Commons clause version
at the IRS in the first place.
So why is it, you know?
And then eventually he just removed the Commons clause.
Then I can't remember if he'd actually deployed that version or not.
But as soon as he started telling the IRS that they could remove the Commons clause
is when Neo4j sued him.
So it's just unbelievably nasty behavior.
And as I said, trading on a good name of a good license for a pure avarice.
So anything else you want to add before we just turn it over to see what people want
to ask?
No, thanks.
Maybe when you have some questions.
So confusing users sounds to me like unfair competition.
So have you looked into using unfair competition law to stop such confusing behavior?
I admit that I had not thought about that angle.
There were some arguments made by, because I've read the entire docket of the Neo4j trial.
John Mark's lawyers made a few arguments of that nature.
The judge was not particularly interested in them, unfortunately.
So I think someone would have to bring a separate claim of some sort for it to be possible.
I don't know exactly how that claim would be structured, at least in the US, but I'm
not a lawyer.
I think you want to address that too?
So I'm not sure if you're asking about confusing in relation to what, okay.
So maybe when I was talking about confusing users, I was talking about the FSF's concern
that someone is using the FSF's license, not as they were intended and confusing about
the scope of their rights.
So as far as I know, in order to invoke unfair competition law, for that we would have to,
that would be the case between FSF and that person who is using.
So I'm not sure that unfair competition laws would apply here, but I also don't want to
bet on that.
I would have to check.
But maybe another case with unfair competition would be between someone who is using licenses
with all these alterations and someone else who was just trying to use the license as,
for example, following section seven and relying on the license without restriction.
I mean, well, no idea, but that's an interesting direction maybe to check.
I have a question.
In American law, is it still possible to file a friend of the court brief in the Neo4j case?
So normally, my understanding, I'm not a lawyer.
This is not legal advice.
My understanding is that you can really only do amicus briefs on appeal.
And I should mention that John Mark is planning to appeal.
He's got most of the negative decisions already because they were done in summary judgment.
Really the only thing left for the judge to decide, and the case just closed a couple
of weeks ago, is how much John Mark has to pay to Neo4j, because Neo4j has asked for
a huge amount of damages.
So the judge is going to decide what that number is.
John Mark is planning to do an appeal, and at that appeal stage is usually when an amicus
brief can come in.
Now you may have heard that there was some sort of appeal already in this case.
That was really misreported, and frankly, there have been a number of people who have
misreported it badly, and it's very unfortunate, because that was only an appeal of a preliminary
injunction.
So John Mark actually, I mean, just everything went wrong for him in the case, because the
judge just really didn't understand the issues that well, in my opinion.
And the judge issued a preliminary injunction saying that John Mark wasn't even allowed
to say that you could remove the comments clause, like that notwithstanding this text
right there in the license.
And he appealed that decision, and he couldn't say that it was open source because it was
not.
He appealed that injunction, basically a gag order.
He lost that appeal.
But that was only a preliminary injunction that was in place while the trial was ongoing.
And so it was really a narrow appeal, and the bigger appeal is what will be coming next.
And I would hope that, I mean, my boss is sitting over there.
I'm hoping that my organization I work for will follow an amicus brief, and I hope we'll
all do a lot more.
I think you'll be hearing a lot more about John Mark's struggle after the decision comes
out.
And so there will be a lot settled in this appeal, and amicus briefs and everything else.
I'm just going to make one quick follow up here.
For context for everyone, I'm assuming, and you'll clarify this, that in this context,
Neo4j has chosen the referral GPL, but it's under what you would call proprietary relicensing.
In other words, they require a CLA.
They're also selling a commercial license.
And was that explained to the court why they did that?
There were a number of conversations during the trial about, it's not a conversation
at trial.
There were a number of questions that flew around of that nature during the trial when
I was there.
The interesting thing about that, because I also filed an expert report, which the judge
basically rejected, sadly, on John Mark's behalf, because you asked about amicus briefs.
There's also expert reports.
I was the expert witness for John Mark's side and the judge throughout my expert report.
So I felt pretty bad about that, but it wasn't surprising with this judge.
But to your question about the relicensing and so forth, nowhere did Neo4j ever establish
that they are the sole copyright holder.
In fact, I went through and looked through the Git history, and they accepted patches
from third parties, and they did not have a CLA in place when they accepted those patches.
Now it could be the case, we don't know.
It could be the case that they carefully went around all those parties privately and collected
copyright assignments.
But those parties actually, in my mind, if they did not later do copyright assignments
or other CLA-like instruments with Neo4j, Neo4j is infringing their copyrights because
at the time, the whole thing was AGPL.
And then later, Neo4j changed the license to this AGPL.
And the answer to the other part of your question is, yes, absolutely.
Their primary business model is selling proprietary licenses and using the license they have to
scare people into buying such licenses.
So I'm not exactly sure why anyone is actually really surprised about this.
Because I mean, this whole license flushing has been going on for quite some time right
now.
I mean, we probably all remember the case of some company that distributed the kernel
code and basically told its customers, if you redistribute the source for that, then
we are not going to do business with you anymore.
So yeah, I mean, this is kind of the logical consequence now.
That was more or less my question too.
I think that now restricts redistribution of the source code further and that seems
to be in direct contradiction of this term.
So if their distribution contains source under this license, it looks to me like it's in
direct contradiction.
What are your thoughts on that?
We had a time-backs panel on that issue a little earlier and I don't want to turn this
into another discussion of the Red Hat thing.
The one thing I'll say that, I'll see if Christophe wants to add anything, but I'm
not aware of Red Hat ever suing someone for, suing an individual sole proprietor for damages
because of something they did with RHEL.
The Neo4j's behavior is beyond the pale.
I compared it to MongoDB before.
I've never heard of MongoDB suing somebody in this way.
So the fact that they went after just this guy who's a government contractor, he started
a small business to do government contracting with open source and free software and they're
coming after him in this aggressive way to get financial damages from him.
It's really beyond the pale and I think there's really no comparison to what's happening in
Neo4j to anything I've seen with regard to this whole area of proprietary licensing and
so forth.
Okay.
My question was to say that it's a price in the Red Hat situation, not that they're
concerned or would not dream of saving their company.
Do you want to?
Well, okay.
Maybe I did not understand the question as well, but I just wanted to say that either,
whatever way you take, either you are the user who wants to rely on Section 7 and just
ignore the restrictions or if it's like the case of the FSF that we want to use our copyright
and trademarks to start compliance actions with different people.
And I'm not saying going to the court in the first place, but trying to talk to people
and then make them realize that they're confusing users and they might breach our exclusive rights.
Both of these require that actually someone gets involved and initiates this legal action
or negotiation.
So there are tools available.
They have to be used, but that requires effort and I think that was already mentioned in
the rail discussion before that requires effort and using the legal tools.
And just a point of order.
Obviously we could have had an entire like half day just talking about the rail thing.
I really want to be respectful of how we time boxed it.
We made the decision to only make that an hour because it could just go on forever.
So I'd really like to not get too deep into rail while we're talking about this other
issue.
So zooming out a bit for the moment, if you take a broader look at the AGPL and sort of
what it has become in practice, that it's become a sort of like submarine license type,
like submarine patent type thing.
Bradley, could you give your idea, your way forward, your roadmap, how you see the AGPL
going forward because I see it mostly as something that is used to coerce companies into licensing,
right?
Like a slightly weaker form of the SSPL, but still used to gouge and to extort.
So I'm going to put Chris off on the spot here.
So we came up with a solution for this for Copy Left Next, which is called the Copy Left
Equality Clause.
What that does is it disarms Copy Left entirely if you try to do proprietary relicensing.
So what the clause says is if a different license is ever offered for these copyrights,
then the entire Copy Left evaporates and all of it turns into a super permissive MIT-style
license.
I would love to see a Copy Left Equality Clause in an AGPL v4.
Can you give your thoughts on that?
I just wanted to ask for some clarification because I don't understand why you are co-ing
AGPL submarine compared to submarine patents.
So how?
Is it from copyrighted?
Wow, okay.
It's always used like in a VC context where you have this open core type stuff and then
at some point they come like, well, you might not be using...
Or are you publishing this part of the code or you have these extra acknowledgments from
the user and you can't...
For certain types of libraries you can't provide those rights of...
Clearly you violate all the licenses.
Maybe you should just buy like...
Okay, so maybe I will just quickly say that we are looking at different ways people are
trying to add something on top of the GPL and we really want to address it one way or
another.
So yeah.
Thank you.
So without speculating on the intentions of John Marksouie, do you think it is conceivable
for him to initiate legal action against Neo4j for the copyright that he presumably held
in earlier versions which they are still reproducing?
So as it turned out in my analysis, I didn't see any work that John Mark had actually upstreamed
because he was more of a system integrator.
So while there's a lot of people who did contribute, John Mark wasn't one of them.
So I don't know if he actually has a claim or not.
I just don't know.
I didn't see his name in the Git log for the period where it would have been possible
to do that.
But there were a lot of people, I mean like 12 to 15, I guess that's not a lot, but there
were 12 to 15 people that had given a patch that was non-trivial to Neo4j during the period.
And those people I think would have a claim.
It was really a question of resources.
I suspect of trying to get in touch with them.
I emailed a few of them.
They didn't answer.
I wouldn't be surprised if Neo4j has already bullied them either by demanding or offering
money for a copyright assignment or CLA or simply just made them afraid.
Everybody in that space who's done consulting around that code base is terrified because
they're watching John Mark get sued and possibly have huge damages.
And certainly he's spent a tremendous amount on legal fees already just defending himself.
So I think everybody who's in that community is pretty terrified.
I'd like to offer a contrasting opinion on the utility of a GPL v3.
In particular it's used by Signal for its open source software.
And Signal of course is a non-profit.
It's very lucky that it has the funding in order to be able to do that.
But in particular what that requires is that for example corporations like Facebook who
may want to use Signal are actually required to contribute their contributions back even
if they end up using it over a server which allows them to circumvent for example the traditional
GPL.
So I'd like to just make sure that that's kind of in the air as well when we talk about
uses of the A GPL.
Although of course these sorts of restrictions can be used for positive or negative as well.
I wanted to put that I think there was a useful discussion kind of going on here so I don't
want to derail that.
Sorry I kind of just wanted to add on to you just say that this problem that you're discussing
is a very rare problem but it's important.
The reason you're giving it publicity is because you want to make sure that it doesn't happen
not to prevent it from spreading.
It's a very rare problem that we don't want to spread further and I want to think that
the same thing with the A GPL is the vast, vast majority of uses people are given their
rights and freedoms and it works wonderfully.
And so sometimes small problems get expanded because they're newsworthy, they're important,
we don't want them to cause more problems.
I don't know if you have any response to that, it's more of a comment than a question but
would you agree I guess?
Well yeah definitely we shouldn't forget about thousands and thousands of projects licensed
under playing GPL.
I agree with you Ian.
If you look at just in terms of lines of code that are facing this issue, you're absolutely
correct, there's not many lines of code in the world by percentage that are facing an
issue of a further restriction being added that somebody is trying to remove.
I think the reason I think it's more than just a publicity issue is, and it was a personal
experience sitting in the courtroom and watching this testimony go by and John Mark being
who did everything right, he did everything that the FSF in its documents and in the license
told him to do, he did everything our community intended when we designed this clause to go
and do that and then to sit there and be told like basically you're a thief, you're a DMCA
violator, you ripped off Neo4j, all these sorts of things and then be facing in the next couple
of weeks possibly huge damages.
I'm kind of hoping like the judge will do something silly like be like well we find
$100 of damages or something like that, it would be great if that happens, I'm not sure
what he's going to do but they've asked for millions and so and John has already spent
a tremendous amount of legal fees and he doesn't know how to, I'll be frank with you
all, I've talked a lot with him, he doesn't know how to pay for the appeal at this point
and so he's very worried about it because he wants to appeal and he really, I spent
a lot of time with him over the last six months as I was doing the expert report and then
going out for the trial and he's exactly the kind of small business person that is like
the ideal in my mind of what free software consultants should be.
He took a bunch of code including Neo4j, lots of free software stuff, integrated, made a
great solution for the IRS which is actually a system to catch tax cheats as it turns out,
it's kind of like this graph database of like all the tax returns in the US and figure out
who's cheating so they know who to audit which if you don't like tax authorities maybe that
doesn't sound so great but he's doing something that is a useful tool for his client and to
have this come back at him. There was another point in the trial where it was so telling
where, I just learned this because of the trial, apparently it's illegal in the US
to volunteer for, if you're a contractor to the government to volunteer your time to the
government, I guess it's considered like a weird form of bribery, like you're like, oh
I'll give you services for free and so they got him cornered on the stand where they were
like, did you ever receive a call from the IRS for support on Neo4j in the evening and
like he's a gas and like did you give him that support? He said, well yeah my client called
me and the software wasn't working so I fixed it. He's like, did you build him for that time?
And he was like, I think maybe I didn't? And like, were you aware that that's illegal under
government contract rules? And he's like, well yeah but he's like, did you, so you're admitting
here that you committed this thing you're not supposed to do? And he's like, I guess so,
I just a software consultant and when my client calls me I get it done and I figure out the
billing later. But it looks so foolish that they were like just grilling him, this defense
attorney or prosecuting attorney was grilling him over this question when all he was trying
to do was make software work for his client. And that's what free software in my mind is
totally about, like having all the source code and being able to do what you need to do
to make people's problems be solved. And Neo4j's attitude is he shouldn't have been doing that.
What he should have been doing is selling Neo4j proprietary license to the IRS. And he didn't
do that and since he didn't do that he's a bad person. And so watching that was a very heart
wrenching thing for me and that's why I just personally am so worried about how this is gone.
Two quick questions and then we'll wrap up.
So did he relied on third party claims? So if there were outside copyright holders he could
basically use the same argument as in Versata and Simple Bear if I remind the correct president.
So he could basically say I have the third party claim that I have a pure HGPL license
because the Copy Left Clause in HGPLs as you have to license is under this term.
Yeah, his attorneys did argue that and that was in fact a part of the summary judgment decision
was that in fact this clause is not operative, is basically what the ruling holds.
So two fairly quick questions. One is probably a bit speculative but do you think this is why
we haven't seen any community Neo4j and MongoDB forks? Do you think forks are being bullied by
the companies? Because I was wondering that like how is nobody forking that, right? And the second
thing is what happened to Copy Left Next? Is that still a thing? Like I'm, is that a touchy issue
due to the redhead affiliation as well? So I'm just wondering.
Yeah, I probably could have. Yeah, so maybe I could have told more clearly that I don't want to
comment on any particular project or company but yeah, so I won't.
Yeah.
On the Neo4j issue, definitely read, because there was another court case with Neo4j which was
Neo4j versus Graff Foundation. And the Graff Foundation does publish a fork of Neo4j,
but I urge you to read the stipulated judgment in that case because it is disturbing and heart
wrenching. And I think it speaks to your question very closely. As for Copy Left Next,
it's a to it problem and I'll get to it.
All right, let's thank Bradley.