Dr. Dobb's | The Controversy Over GPL 3

The Controversy Over GPL 3

The next version of the open source license is dividing the community, and it isn't even out yet

March 17, 2007
URL:http://www.drdobbs.com/open-source/the-controversy-over-gpl-3/198100026

There's a rift developing between camps within the free software movement over the next version of the most popular open source license, known as the General Public License, or GPL. And while that infighting might appear to be little more than a family squabble, its ramifications could be significant for how companies use open source software in the future.

A new version of the GPL, the third overall and the first revision since 1991, was supposed to be released this month. But controversy over several new provisions--and the authors' ambitions to thwart Microsoft's Linux pact with Novell--have delayed it until later this year.

Unless there's a radical reworking of GPL version 3 (GPLv3, in the programmer lexicon), a significant portion of the open source community will reject it, chief among them Linus Torvalds, the creator of Linux. "I will not sign on to GPLv3 if it limits how the code is used," Torvalds says in a lengthy E-mail exchange with InformationWeek.

If popular GPL projects diverge over time into incompatible products--those developed under GPLv3 and those under GPLv2--it will multiply the licensing and compatibility complications that already dog corporate open source adoption.

This at a time when business interest in open source software is taking off. Linux is established as a server operating system--a third of respondents to InformationWeek's most recent IT priorities survey have Linux servers on their 2007 project lists--and it's generating increasing interest as a PC operating system, partly as an alternative to Windows Vista. In Europe, at the current rate of uptake, open source code will represent 32% of all software services delivered by IT by 2010, according to a study by the European Commission.

Terry Barbounist, CTO of the Christian Science Monitor, says his organization's "foray into open source" was primarily an effort to leverage a community of developers. The Christian Science Monitor uses the open source content management system Alfresco, among other open source apps. He's concerned about the controversy over GPLv3 because "any rift in a community that has to police itself is never a good thing."


Bare facts: What's the difference betweekn free and open? Ask Richard Stallman, who wrote the first GPL.

RULE OF CODE
There are many types of open source licenses, but a select few rule most of the code that finds its way into commercial use. The most popular is the GPL, the first version of which appeared in 1989. The GNU GPL, as it's officially known (GNU stands for Gnu's Not Unix, a play on words) was as much a political statement as it was a contract, advocating the free distribution and modification of software source code and railing against its proprietary, commercial exploitation. It was written by Richard Stallman, who founded the Free Software Foundation in 1985.

To call Stallman an interesting character is like describing Dennis Rodman as an interesting basketball player. In the 1980s, Stallman was the embodiment of the hippy programmer ethic: anti-capitalist, anti-authoritarian, a binge programmer in MIT's artificial intelligence lab who slept under his desk and couldn't find a real job. Still, he's considered a prophet by some. Stallman's radical software-wants-to-be-free philosophy, which he called "copyleft," led to the GNU toolset, which includes such invaluable IT tools as the GNU C compiler, then to the GPL, and consequently guided the development of the open source software industry.

To understand the nature of the current controversy, it's important to understand the distinction between free and open source software. Free software advocates want software that's unencumbered by patents or prohibitive, proprietary licenses. Open source software advocates are more practical, accepting commercial products built on top of open source code.

Stallman declined to be interviewed for this story, citing InformationWeek's refusal to refer to Linux consistently as GNU Linux. That demand reflects an old source of tension between the two camps. Torvalds is credited with masterminding the Linux kernel. Stallman says the kernel was based on an unfinished operating system being assembled by the FSF. Torvalds credits the FSF and the GNU tools with contributing to the success of Linux but says he frequently disagrees with the political agenda the FSF represents.

The GPL's most controversial feature--until this point--was a provision that requires anyone who modifies the source code of a free software program, and then distributes that modified version, to make those changes available to the community. Now that "giveback" requirement is seen by many as open source software's most distinctive, and rewarding, feature.

GPLv2 has proved so viable and effective that it covers an estimated 72% of the 143,562 projects under development on the open source hosting site SourceForge. It governs three of the most successful open source applications to find their way into data centers: the Linux operating system, the MySQL database, and the Windows-Linux file sharing system known as Samba.

Other licenses govern open source software differently. For example, the license that covers the Apache Web server, from the Apache Software Foundation, doesn't include the "giveback" provision of GPLv2. Ditto for the Eclipse Foundation's license, which covers projects adding to the Eclipse development environment. Mozilla has its own license, which allows proprietary code to be combined with the open source.

Some developers have migrated their products to take advantage of the GPL's wide acceptance. The Alfresco content management system moved from the Mozilla public license to GPLv2 in February. Matt Asay, Alfresco's VP of business development, says he doesn't agree with some of Stallman's extreme views, "but on balance, the good of what the GPL has done outweighs the political treatise that it can read like."

THIRD TIME, NO CHARM
Stallman is working on GPLv3 with Eben Moglen, a Columbia law professor and chairman of the Software Freedom Law Center (who also declined to be interviewed for this story, at Stallman's direction). They exhibited the first draft in January, 2006, and they ran into objections almost right away.

The first big objection had to do with their proposed prohibition against the use of digital rights management technology in connection with GPLv3 licensed code. DRM technology blocks end users from reproducing copyrighted content. It's a hot-button issue: Besides Stallman and Moglen, others in the computer industry have come out strongly against it, including Apple CEO Steve Jobs, who recently published an essay on Apple's Web site advocating an end to the use of all DRM technology, including his company's own.

	Controversial Aspects Of GPLv3
	DIGITAL RIGHTS MANAGEMENT GPLv3 seeks to bar users from incorporating restrictive technology in GPL-based applications
	PROTECTION AGAINST PATENTS GPLv3 seeks to prevent patent lawsuits against users of GPL code, as well as prevent indemnification agreements for a select group of GPL users, as with the Microsoft-Novell deal
	WEB SERVICES GPLv3 seeks to expand the giveback provision and may require Web service providers to share the code on which their network services are built
	NEW DEFINITIONS To better address international copyright law, GPLv3 seeks to change the words it uses for copy (propagate) and distribute (convey)

Still, application developers who use GPL software objected to being put in a position where they can't include technology that might be demanded by the marketplace or by hardware distributors. A prohibition against DRM technology, while perhaps well intentioned, limits what adopters can do with the code. "I'm against, 'you can't do XYZ with the code,'" says Torvalds. GPLv2 is better because it's simpler, less restrictive. "I absolutely love the GPLv2 because it embodies that 'develop in the open' model," he says.

Another aspect of GPLv3 that makes business users uneasy is the writers' ambition to eliminate all threats from software patents. GPLv3 had been through two drafts when news of the Microsoft-Novell deal broke late last year. In an address shortly afterward to the 5th International GPLv3 Conference in Tokyo, Stallman called the deal "cunning" because the two vendors had found a way to skirt GPLv2's provision against patent litigation. "We're going to make sure that when GPL version 3 really comes out, it will block such deals," Stallman told the conference.

GPLv2 forbids any software distributor from continuing to use the GPL license if the distributor threatens a patent action against a user of GPL code. Microsoft got around that protection by guaranteeing that the customers of Novell's SUSE Linux--and only those customers--would be free from any Microsoft charges of patent infringement. There's an implied threat against non-SUSE users, but Novell still gets to distribute its version of Linux under the GPL because it's not the party threatening patent litigation.

The prospect that GPLv3 will try to block all future patent threats through a series of prohibitions on company behavior has some commercial GPL supporters as worried about that provision as the threat of a Microsoft lawsuit against Linux vendors and users. There's no way for a software license "to anticipate all future circumventions," says Alfresco's Asay. "Trying to do so produces all sorts of unintended consequences." Business users of GPLv3-based software could conceivably find their hands tied if they sought to use their own patent portfolios under any circumstances, he says.

GOOGLE GETS OPEN SOURCED
One of the most controversial aspects of GPLv3, having to do with the famous giveback provision, has already been tempered. Internet powerhouses like Google and Yahoo are big users of GPL code, such as Linux, MySQL, and Samba, which they have modified considerably for their benefit. The giveback provision in GPLv2 doesn't require them to share those changes with the open source community because they don't distribute products based on that code. They do, however, distribute services, such as the ability to search the Web.

Stallman and Moglen see that loophole as an injustice to the free software community, and they want to close it. Language in early drafts of GPLv3 to the effect that Web service providers would be subject to the giveback requirement "was a cause of much unhappiness in corporations that use GPL code," says Mark Radcliffe, digital rights attorney in the Silicon Valley office of DLA Piper. That's because, "in effect, Google gets open sourced," says Doug Levin, CEO of Black Duck Software, which inspects open source code for potential intellectual property violations. And not only Google. When you define a Web service as a GPL distribution, the likely subject of the giveback requirement "is just as much Merrill Lynch or Citibank as Google," says the CTO of an open source software company who asked not to be identified--an indication of how sensitive this topic is in the community.

Radcliffe, who serves as general counsel to the Open Source Initiative, the body that reviews and approves proposals for new open source licenses, says criticism of the new giveback provision pushed the GPLv3 writers toward a less restrictive requirement, one already under consideration known as the Affero provision. Instead of an open-ended definition of Web services, the Affero requirement refers only to GPL code used to build a Web service that, if requested, will automatically download its source code as part of the application. Successor programs, including those used to build other Web services, would need to make their revised code available for automatic download as well.

Black Duck's Levin, who served on one of the GPLv3 review committees, says Google doesn't need to make its current source code available because its software infrastructure was built before GPLv3. But in the future, if it uses GPLv3 code that includes the automated source code download function, Google would have to duplicate that function--and incorporate its modifications to the source code--in systems that underlie its future network services.

If all this seems confusing to you, you're not alone. The Christian Science Monitor wants to contribute to the development of the open source code that it uses, but CTO Barbounist says he also will be careful in how he brings GPLv3 code in-house. "We don't want to inadvertently trigger the giveback provision," he says. And at this point, he can't answer "the in-depth questions of when it kicks in."


	Eben Moglen, who is helping craft GPLv3, wrote a treatise on intellectual property in 2003 called "The dotCommunist Manifest"

CLASH OF THE LICENSES
An overall concern in this debate is how open source developers and users will reconcile two versions of the GPL. It seems clear that Torvalds' Linux kernel will stay under GPLv2. On the other hand, the third-best-known piece of GPL software, the Samba file sharing system, will move to GPLv3 as soon as it's available, says lead developer Jeremy Allison. It's important to maintain unity behind the GPL, he says.

License compatibility always has been problematic in the open source software industry. For instance, using products that combine the Linux operating system, under GPLv2, and code such as the Tomcat Java Servlet engine from the Apache Software Foundation, brings about a clash between the Apache license, which allows proprietary code, and the GPL, which doesn't.

GPLv3 will add rules about what users should do when there's code from more than one license in a GPL program, Torvalds says. But he expects confusion as users are able to create code combinations with an almost endless variety of restrictions. "When you combine two different versions, you get a third version, namely the least permissive reading of either of the ones you combine," he says.

Torvalds' refusal to accept GPLv3 has given others pause, but ultimately it will be up to the developers and users to decide which version will predominate. "We're holding off in order to see how the market responds," says Kaz Arno, VP of community relations for MySQL AG, supplier of the MySQL database. If MySQL customers like the provisions of GPLv3, company officials will embrace it; if there's ongoing controversy and dispute, they might stick to GPLv2 indefinitely, Arno says.

Business users will end up having to track which parts of their open source portfolios are on version 2.0 and which have moved to GPLv3. "The GPL is important to the extent it supports a supply of quality software coming at us," says Michael Prince, CTO at Burlington Coat Factory. "It influences the software that we buy when that software has open source components embedded in it."

Having deliberately missed the March deadline, there's no firm date yet for the completed version of GPLv3. But most users aren't in a hurry. Rather than squabble over GPLv3 later, the Christian Science Monitor's Barbounist says, "it's in the best interest of the community to work these issues out now."

Photo courtesy of Joe Zeff