Bait-and-Switch and Software Licenses
Jack Slocum and the rest of the Ext JS team recently released version 2.1 of their fantastic toolkit. If you’re not familiar with Ext, it’s a user interface library that lets you write rich Internet applications (RIAs) using JavaScript. It’s more than jQuery or Prototype, in that it gives you full-fledged components like dialogs, grids, and trees in addition to the typical animation and language-enhancement features of the other JS libraries. If you develop RIAs and you haven’t tried Ext, I highly recommend you check it out.
That being said, the Ext team slipped in a little surprise with their latest release. Up until version 2.1, Ext was released under a dual-license model, with one option being an LGPL-compatible license and the other a commercial license. From this point forward, they’ve changed the options to GPL (as in, full copyleft) or a commercial license. This means that in order to upgrade to the latest version, all products which had previously relied on Ext will now have to start distributing the source — of not only Ext, but also their own products — in order to remain within license.
As you might imagine, this caused quite a stir within Ext’s already-quite-large user base. First, let me say that I am absolutely a believer in open-source software. Open-source means you can use the code in your own projects, commercial or otherwise. You can read the code and learn from it. You can contribute patches and ideas, furthering the project’s development. However, there is a tremendous difference between what I would call open-source licenses (Apache, BSD, MIT, et al.) and copyleft licenses like the GPL.
(Note: some people will disagree and say that GPL is still open-source, but I’m not trying to debate semantics. This post will refer to the two types of licenses separately.)
Ninject, for example, is open-source (Apache 2.0, actually), and I fully encourage anyone and everyone to use it in as many commercial products as they like. If you make a billion dollars through a product that uses Ninject, I’d appreciate it if you bought me a beer, or maybe my own private jet on 24-hour standby, but otherwise I would be nothing but happy for you. :)
The GPL is fine for things like operating systems and applications, which are essentially standalone. These products aren’t going to be re-used in other products. However, libraries, frameworks, and any sort of middleware should never, ever, ever be released under a copyleft license like the GPL. Copyleft is viral, in that the second it touches any part of your code, you must open its source. Ostensibly, that is perfectly reasonable, but the difference between closed-source and open-source is a business decision, and a very significant one. Your business model determines whether you can or should run your project as open- or closed-source.
Ask yourself: are you really going to build your business model around the license of a library like Ext? My guess is that most people would just find another way, and that discourages adoption of the library. It’s true that if people are making money off of Ext, it’s reasonable they pay the creators, but changing the license of the library after there are a lot of products that already use it is downright unfair. The Ext team is playing dirty, and people have every right to be upset.
There’s nothing wrong with wanting to be compensated for your work, particularly when you create something as widely useful as Ext. However, waiting until version 2.1 to change the license model for your software (not to mention changing it on a point release rather than a full dot-oh) strikes me as a little bit dishonest. Unless we give them the benefit of the doubt, it sure seems like they leveraged the openness of LGPL to get control of market share and build their user base, and then pulled a major bait-and-switch once they locked users in.
Bear in mind, also, that Ext was originally called yui-ext, and was built on top of YUI, the Yahoo! UI Library, a BSD-licensed toolkit. Basically, the Ext team stood on the shoulders of open-source, putting on airs as though they were participating, and then when the time was right they slammed the door shut.
Worse yet, the Ext community has contributed back a large number customized components and enhancements to the library. The Ext team hasn’t explicitly rolled these enhancements into the core, but they have undoubtedly learned from them and enhanced the code library as a result. I’ve also seen several cases where people submit code change suggestions (essentially patches) on the forum, which end up being rolled into the core. It’s not fair to have it both ways — accepting outside ideas means you have a responsibility not to screw the people that contribute those ideas.
At best, this is a terrible blunder on the part of the Ext team, and at worst, it’s a blatant misuse of open-source licenses. This is not what the GPL and the LGPL were created for. Also, it’s cases like this that add to the FUD surrounding open-source. After seeing things like this, I don’t blame businesses being afraid of adopting open-source in their products, for fear of the rug being pulled out from under them. And that’s not fair to real open-source libraries.
Of course, all this nonsense begs the question: how do you GPL a web application, anyway? In a typical website based on Ext, there’s client-side code written in JavaScript, which uses Ext for the user interface, and then there’s server-side code written in any of a myriad of languages which doesn’t come near Ext. Does using Ext on the front-end mean you have to open-source your entire product?
There’s all sorts of gray area there, which Jack desperately tries to explain. His reasoning? If your server-side code generates markup, then yes, you need to open-source it. What if the JSON/XML that I send back to the UI influences the layout? Do I need to open that source also? Now I need to employ a whole legal team to try to decipher whether or not I’m GPL-compliant.
Jack tries to defend the decision thusly:
In the end, we want Ext JS to be open source friendly and still have a good business model in place to grow. The old Ext License was not open source friendly and pretty much killed all options for use in open source projects. That wasn’t our goal so we had to address it.
To be perfectly blunt, that’s a crock of shit. The only reason the old Ext License wasn’t open-source friendly is because it wasn’t really the LGPL and therefore not OSI-approved. Why didn’t they use the LGPL, you ask? They were worried that someone would fork the project. Tell me again that they weren’t planning this all along.
Oh, and by the way, they’re not opening up the project’s Subversion repository. You can download official releases, but you can’t have direct access to the latest builds — unless you buy a commercial license. That’s technically fair, but doesn’t exactly jive with the concept of open-source.
On one hand, I feel for Jack, who has been a target of personal attacks because of this license change. He attempts to defend himself on his blog. However, it’s easy to see why people are upset, and I can’t believe he didn’t see it coming. I understand that you need to protect your intellectual property, but you need to recognize that open-source is a give-and-take (quid pro quo, as the Ext site says) — you give users free access to the library, and in exchange you get community support and good ideas. Changing from LGPL to GPL doesn’t protect the library from being misused by “major companies”, either. Sorry Jack, but they’re still banking on the fact that you don’t have the money to sue them.
To be fair, it does look like they’re considering a FLOSS exception like MySQL has, so non-copyleft open-source projects can continue to use the library. Why even change, then? You’re going to end up with essentially the same outcome as a result.
Using the GPL in this way arguably causes a chilling effect not unlike closing the source completely. By requiring users to release their source, you are shutting out a potential segment of users. It’s very easy to see that if Ext had been licensed under the GPL since inception, it would not have nearly the mind-share it does today.
Since I use Ext in my “day job” in for-profit products, we were happy to buy a commercial license. However, now that it’s licensed under the GPL, its much more difficult for me to consider using it in side work or hobby projects.
My guess is that these guys have provided something of value to the open source community, and the community has failed to support the project financially. The rationales of what has happened in the past and what would happen if . . . they are all mastabatory. In the end, its about a little payback. And I appluade them for taking the stand. Mob rule must not always win-out and people that perform should be rewarded.
John:
I follow your point, but to me it’s more an issue of trust than of defense. They have every right to defend their intellectual property, but the bottom line is that under the GPL, Ext is no better protected than under the LGPL. The switch will not stop the large companies that Jack refers to from using the library out of license — it just means that the smaller operations, including open-source projects, non-profits, or just people that can’t afford the license, that were relying on Ext are now forced to cough up a large amount of money or completely re-engineer their product. A license is a two-way assertion of trust between the publisher and the user, and by switching licenses, the Ext team has violated that trust.
For the record, I have no argument with your core premise, that the Ext JS team kicked over a beehive with their decision, timing, and communication.
“The GPL is fine for things like operating systems and applications, which are essentially standalone. These products aren’t going to be re-used in other products.”
The TiVo isn’t a product? It reuses Linux and other GPL’d code. So have a variety of routers and other hardware devices, mobile phones, and the like. Linux is an operating system; operating systems are embedded in hardware products.
“However, libraries, frameworks, and any sort of middleware should never, ever, ever be released under a copyleft license like the GPL.”
You are welcome to say that you will never release any of the above under the GPL. Not everyone agrees with you. For example, I feel fairly confident that the FSF disagrees with you.
Those who are interested in Free Software will happily put the GPL on whatever they write, regardless of its field of use, with the express intent of using it to encourage others to create GPL’d software. Just because you don’t like it doesn’t mean everyone doesn’t like it or it “should never, ever, ever” be done — others have different values than do you.
“Ask yourself: are you really going to build your business model around the license of a library like Ext?”
Some businesses have: Red Hat, Canonical, Mozilla Corp., etc. are all based on GPL products, to pick three off the top of my head.
“At best, this is a terrible blunder on the part of the Ext team, and at worst, it’s a blatant misuse of open-source licenses. This is not what the GPL and the LGPL were created for.”
Sure it is. The GPL was created to promote the creation of Free Software. Despite popular opinion, that’s not a polar opposite to having a profit motive.
“Of course, all this nonsense begs the question: how do you GPL a web application, anyway?”
Now here you get to the nub of the problem. Using the GPL for middleware, while you feel is inappropriate, at least is fairly clear-cut in terms of boundaries. A GPL’d Javascript library is less so. For example:
“If your server-side code generates markup, then yes, you need to open-source it.”
I challenge anyone to find terms in the GPL (v2 or v3) that supports this notion. By this argument, Microsoft Visual Studio must be released under the GPL, since it is possible for Visual Studio to generate output that can be linked with GPL’d code. Heck, Microsoft Office must be released under the GPL, since it is possible for it to generate output (documents) that link to GPL’d VBA macros.
IANAL, but I did consult for a few years on open source while with CollabNet and have had a fair number of licensing discussions with bigwigs in the open source arena. IMHO, a GPL’d Javascript library would require other Javascript that directly called its functions to be released under the GPL, and that’s it.
But, as you point out, this is a really murky area, and until it gets settled out (the way the GPL/DLL issue got settled out a decade or so ago), it is best to tread warily with GPL’d Javascript code.
Mark:
My point was that the licenses under which software is released directly affects the model under which you can do business. The products you listed are all good examples of systems that use GPL software. However, we’re not talking about Linux or TiVo, we’re talking about websites. That’s a completely different business than operating systems, set-top boxes, or routers — and by changing to a copyleft license, the Ext team potentially did major damage to the businesses that relied on their software.
Obviously, I know my view might differ from others on what should and should not be released under the GPL. I was merely asserting my opinion on the matter. Richard Stallman can disagree if he wants.
If you read my blog you know I’m a stout believer in open-source, but I’m still a software developer by trade, and a capitalist at heart. This isn’t really about supporting open-source or protecting your intellectual property, though. In my opinion, the Ext team just used the GPL as leverage to try to force people who were already locked into the library to buy commercial license of their product, or completely rethink their business model. That is *not* what the GPL or open-source is all about.
Outside looking in, there are many supporters of Ext that welcome the change to the GPL, but only a few (vocal) minorities are pissed that they now have to buy a license. That is shameful and unethical. To make Jack look like a criminal is ridiculous. It is these few individuals that make themselves look bad. The issue is not about the Open Source license. Its about commercial thieves not giving back. The GPL + FLOSS is very community friendly for open source projects.
Furthermore, the difference now with GPL vs the “Ext License” is that its clear, legal, and fair for the open source community. Their old license sucked. Jack even admits it. So give the guy a break.
I think their within their right to do it, but I think it’s bad craftsmanship to do that. Reminds me of the famous JW Flash player (jeroenwijering.com) which did pretty much the same thing, for most of its existence it was open source - use as you wish, for commercial and non commercial use. But with more recent versions has become personal use free, commercial or any site with ads on it requiring a yearly/monthly? license.
They still tout themselves as open source and free, but it’s very much a bait and switch scenario. It’s legal but unethical.
The only thing I think they should have done different was to warn people ahead of time of a pending license change.`
If the product had been previously licensed under LGPL then there would not have been a problem. Users need only create a fork and continue that under the same license. You would lose future contributions from Jack Slocum and the Ext JS team, of course. But that is of course their right to stop working on an open source project, as it is any other contributor’s right to stop work. The problem is the Ext license which, if I understand correctly, does not allow forking. So the moral of this story is: Don’t ever use any product that does not allow forking.