For non-proliferation's sake, Sun asks OSI to retire older open source license

For non-proliferation's sake, Sun asks OSI to retire older open source license

Summary: There's a bit of news on the the open source license non-proliferation front.  Proliferation of incompatible open source licenses has balkanized the open source software community to a point that code isn't nearly as freely shareable as some people perceive it to be.

TOPICS: Open Source

There's a bit of news on the the open source license non-proliferation front.  Proliferation of incompatible open source licenses has balkanized the open source software community to a point that code isn't nearly as freely shareable as some people perceive it to be.  As one of his first moves as Chief Open Source Officer at Sun, Simon Phipps has announced that the company is retiring the Sun Industry Standards Source License (SISSL) in favor of its more recently drafted (and Open Source Initiative-approved)  Common Development and Distribution License (the CDDL, pronounced "cuddle").  Wrote Phipps:

[The CDDL] renders continued cloning of the Mozilla Public License unnecessary. That license - CDDL - may have had a controversial first outing but in fact is a well-received license that makes any future attempt to build yet another MPL-clone vanity license much less likely.... We're taking a practical step today, the first of several I hope, and committing Sun to actually help with the issue [of open source license proliferation]. I'd encourage other companies to do the same.

The announcement by Phipps, which was released on his blog, also discusses the request he submitted to the Open Source Initiative to essentially decomission the SISSL license.  Phipps also siezed the opportunity to tar and feather IBM's Steve Mills and HP's Martin Fink for what Phipps apparently views asirresponsible rhetoric.

Elsewhere on the non-proliferation front, Larry Rosen, the man who literally wrote the book on Open Source Licensing, has now penned his own treatise on the issue of open source license proliferation and posted it on the Open Source Development Labs' Web site.  Wrote Rosen:

License proliferation has become an important problem because software under those different licenses cannot always be played consistently and compatibly everywhere....Imagine a world in which every word processing program created documents in its own internal format that could not be accessed directly by other word processing programs. This is not difficult to imagine. It is done on purpose even today by some proprietary software vendors—and it is enforced by their software licenses.

In his treatise, Rosen outlines some steps that can be taken to trim back the more than 60 open source licenses out there today to a more manageable number.  Leaving me with the sense that the problem of license proliferation is just as much an issue of semantics as it is an issue of anything else, the proposal centers on the standardization of terminology and the normalization of provisions, but also covers other thorny issues such as the impact of geography on open source licensing and how barrier presented to open source developers by patents can be addressed.

Topic: Open Source

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Houston, Do We Have A Problem?

    Is there more to this story than Sun is letting onto? What kind of an impact does this license change hold for, IBM's WorkPlace, and perhaps the real target of this change, the secretly brewing Google WorkPlace?

    Regarding IBM's WorkPlace, that horse has already left the barn is now on the race track. So maybe Sun is trying to put Google in check mate? Inquiring minds want to know. But how the hell are we supposed to sort these things out? was open sourced under a dual LGPL-SiSSL license. The way that works is that licensees have the option of choosing which license they wish to work under, and almost everyone has chosen the LGPL. So now that SiSSL is no more, one would think this no big deal. But au contraire!

    The skinny is that the LGPL allows for commercial distribution without
    affecting derived products in the same way as the GPL. But like the GPL, the LGPL requires that distributed modifications must be publicly disclosed (or, in open source parlance, ?returned to the community?). This is contrary to the SISSL, which did not require all changes to the source to be published and returned to the community.

    This isn't a big deal for users, but one has to wonder about how it will impact developers and cvs contributors? Specifically, how does this impact <a href=?>IBM's WorkPlace</a>, which is comprised primarily of 1.1 components? IBM's innovative effort is also a made to order blueprint for Google WorkPlace.

    IBM has done some magical work here, arranging and reconfiguring those components to architect an entirely new kind of application, the Activity Manager. When people hear nebulous discussions about the Age of Collaborative Computing, and they wonder what the hell is that, all they need do is spend some time with WorkPlace and things will be clear. Crystal clear.

    What i'm wondering about though is how the new licensing situation affects WorkPlace, and all the expected WorkPlace knockoffs? IBM has never returned to the OOo community any of the changes or modifications they made. Which is fine since the SiSSL license they chose to work under was intended to allow for undisclosed modifications. The original idea being to not just allow for WorkPlaces, but even to encourage such efforts. Indeed, WorkPlace is a poster child for the LGPL-SiSSL dual licensing model.

    Given the collaborative computing wonders of WorkPlace, these changes are beyond magnificent. And perhaps that's why it's so painful to see them outside the reach of the community? But there's more.

    As Sun waves good-bye to Joerge Heilig, and braces themselves for a pillaging of their StarOffice workforce by Google, there's little doubt left that a Google WorkPlace is brewing. So maybe this license change is a preemptive strike at Google? A strike that also serves the purpose of trapping IBM if and when they decide to come back into the OOo 2.0 CVS. (Which they would be crazy not to do!)

    These prospects are more than enough to have Sun thinking about GPL'ing the whole thing and get done with it.

    At the recent LinuxWorld, we had a chance to go through some of these issues with the IBM WorkPlace crew. They clearly desire to participate with Sun and the OOo community as good open source citizens, but don't seem to know how to get beyond our troubled past. The current situation isn't good for the OOo community. It isn't good for IBM and Adobe. Sun has been blind sided, and looks to be reeling from a sucker punch. And it's not good for the rapidly evolving community of OpenDocument XML interests. Yet here we all are, poised to challenge Microsoft's desktop productivity dominance. Poised to bring desktops, devices, and server realms to the Open Internet in ways unimagined. Poised to move beyond, taking the world into the age of collaborative computing.

    For the community, the modifications IBM made are revolutionary. Forget about waiting a year or so for the MS Office 12 integrated stack model of collaborative computing - (rumor has it that there will be a MS Office 12 Server added to the current required suite of servers that includes Exchange, SharePoint, Server 2003, and Collaboration Server). WorkPlace delivers it today, and delivers in spades.

    So yes, the OOo community would like the chance to work on a loosely coupled version of WorkPlace - (IBM's version is also an integrated stack model, with hard wired accelerations to WebSphere, Lotus Notes Servers, DB2, and Oracle).

    On the flip side of the mutually benefit coin, because IBM broke from the main CVS tree with OOo 1.1, they missed the extraordinary implementations of XForms, SVG, and SMiL that can be seen in current OOo 2.0 beta release candidates. Modifications are a two way street.

    Here's the thing: As of today, the code will be licensed only under the LGPL, which means that all modifications to the source must be published. While the LGPL is great in that it allows for commercial distribution without affecting derived products in the same way as the GPL, there is this thing about fully disclosing modifications!

    This is in sharp contrast to the SISSL, which did not require all changes to the source to be published and disclosed. IBM's WorkPlace is licensed under SiSSL.

    I have a hard time seeing this recent change by Sun as a slap at IBM. Not that i blame Sun. They have been a magnificent benefactor, and who wouldn't be pissed given all the work Sun has put into developing and deploying the UNO component model for OOo? Without that beautifully conceived and executed componentization of OOo productivity services, i doubt that IBM would have ever been able to pull off WorkPlace.

    When Sun purchased StarOffice it was one of those application suites in the grand traditions of Windows bloatware. Rather than having open interfaces for every discreet and well formed component, as is consistent with the traditions of UNiX command line piping, interoperability in the Windows model has always meant building out the application suite with everything but the kitchen sink. Need a text editor? Build it in because there is no easy way to interoperate with the one users already have.

    StarOffice was unique amongst Windows styled bloatware in that they included the kitchen sink.

    So Sun does all this work on the UNO component architecture, while IBM is busy taking those components to create an entirely new kind of Open Internet application. One that sublimely connects local productivity resources with realms of Open Internet services through the artifice of a highly interactive collaborative work space. The empowering that WorkPlace shifts to the end points is extraordinary. But you can't look at WorkPlace and not see everywhere the herculean effort of Sun engineers.

    Having watched WorkPlace evolve over the past year and a half, i have to say that IBM's attitude towards Sun has definitely changed. It's not the pax romana the OOo community was hoping for, but clearly things have changed. So i'm a bit surprised at the bite in Simon's comments about IBM. If ever there was the right person to seek rapprochement with IBM or anyone else for that matter, it would be Simon Phipps. So to me the bite in his comments is cause for concern.

    All these issues became further complicated when, at the recent LinuxWorld, Sun did not offer to host an OOo booth as they so faithfully had done in the past. Last year Sun put the OOo booth between StarOffice, the Java Desktop, and right next to the star of the show, the incredible Looking Glass demonstration. If ever there was a prime time location, that was the spot. Because of the line to see Looking Glass, i personally got to speak with more than 30 Windows developers looking to replace OutLook, Access, and Exchange, and complete the OOo-Mozilla sweep of the Windows desktop.

    This year Sun cut OOo loose, and did so in a way that precluded the community from being able to hook up with what turned out to be any number of willing sponsors. On the OOo marketing list, where these issues are normally resolved, requests for information about Sun hosting the booth were met with either a stony silence or a we'll look into it dodge.

    I don't think Sun realizes that the community understands the full scope of things. We're not happy about IBM forking off WorkPlace, although in retrospect, this actually will end up hurting IBM more than it helps. (One only has to look at OOo 2.0 to see how this works out). The community also has an emotional attachment to Sun that i think they underestimate. When push comes to shove, we will stand with our benefactor.

    Besides, when it comes to faithfully supporting Open Standards and Open Interfaces, there is no other corporation that can compare to Sun. They have a near 25 year history of building a company based on faithfully and reliably executing in accordance with those two principles. And then there's that thing, ?the Open Internet is the computer? :)

    Sun needs to also understand that when the community looks at such things as IBM's WorkPlace, Novell Office, the Debian ? Ximian CVS, the KDE KOffice implementation of OpenDoc XML, the work Adobe is doing to extend the OpenDoc XML metadata and XForms model, and so much more, we are coming to see our role in all this as less of a co-competitor, and more of an open source community at the hub of a rapidly expanding ecosystem.

    As OOo components and OpenDoc XML implementations continue to show up in new ways that are redefining how information is worked, how information systems are interfaced, and how the Open Internet is being engaged and used, the role of the OOo community is also changing. Maybe we need some advice from the Apache community as to what we need to do to become a successful ecosystem hub? Somehow though we will make this transition. And as we do, we want to be of service to all those WorkPlace developers and users that will in the near future be making one of the most extraordinary transitions to the Open Internet yet seen. And of course, there are all those users, trainers, and solution providers in Massachusetts and the EU who need be welcomed into the OpenDoc XML family, and shown just what it is that Open XML technologies like XForms can do.

    Instead of changing the license model, i would have preferred that Simon first meet with IBM and made every effort possible to get WorkPlace back into either the main CVS, or the Debian-Ximian CVS. Knowing Simon, i'm sure he already tried that. He's probably even met with the Google WorkPlace group. Especially since he already knows everyone :) And no one is as charming, innovative, and disarming an ambassador than Simon.

    So, given that it is Simon who is pulling the trigger on this license change, and that there is so much for so many at stake, let me ask again, ?Houston, do we have a problem??


    Note to Sir Timothy: Put an end to the madness. GPL XML.

    OASIS OpenDocument XML Technical Committee member, representing the community.
    • Re: Houston, Do We Have a Problem?

      Wow! You do have internal knowledge of what's going on.

      So if I understand what you say right, with this change of not making the SISSL a valid (OSS) license anymore, would represent that IBM is left with the only option of licensing WorkPlace with the LGPL? And as such would be forced to disclose and make available whatever modifications they did to OOo?

      I wonder... with this change, does OOo changes from the two license s to be only LGPL or will Sun change SISSL with CDDL? In which case, what would the implications be for IBM?

      Very interesting post, took a while to read, but was well worth it.
      • Cut to the Chase

        The licensing change means that going forward, is under a single LGPL license. There is no CDDL.

        With the ?former? dual license model, contributors could choose to work under either the LGPL or SiSSL. With the LGPL, modifications must be publicly disclosed (or what is otherwise considered as ?returned to the community?). With SiSSL, there is no requirement to disclose modifications.

        IBM chose SiSSL as the operative license to build WorkPlace under.

        The elimination of SiSSL as a licensing choice does not in any way impact IBM's WorkPlace effort ? as it exists outside the main OOo CVS tree of source code. Remember that IBM broke away from the main CVS with version 1.1. There is nothing to prevent them from continuing on their merry way.

        What would impact IBM is if they decided to enter the main CVS, which is now working with OOo source code version 1.9.123. This version is a final release candidate for OOo version 2.0. What that means is that OOo is in the final stages of beta testing the 2.0 release candidate.

        So if IBM decides to enter and contribute to the main CVS tree, where the v2.0 code resides, they would only have one licensing option available for using that code, the LGPL.

        The main reasons why IBM might consider entering the main CVS is that the v2.0 code has an extraordinary implementation of XForms, SVG, and SMiL functionality. I can't stress enough how important XForms was to the European Union. Now maybe IBM will decide to do their own XForms implementation. With the recent acquisition of leading XForms provider PureEdge, they certainly are in position to do so. And do so without going back to the main OOo CVS tree, where the LGPL now hangs like a Damoclean sword.

        There is also the consideration that with the next release of WorkPlace, the ?Hannover? version, the speculation is that IBM will merge the Lotus Notes Client ?intelligent forms? model with a WorkPlace XForms implementation. For anyone who has worked with Lotus Notes, this represents a sea change of mind boggling opportunities. But we probably won't know the facts about this until Hannover is in beta release.

        With this license change, Sun has closed the door on any future WorkPlace like configurations where the code is modified but not returned. IMHO, i think Sun is far more concerned about a Google WorkPlace than with what IBM might do. Think of this, IBM could of come into the 2.0 code base at any time in the past year and half, and punched up their 1.1 code base with new features. They could, but they didn't. That tells me that IBM is committed to their fork of OOo, and really don't intend on coming back ? regardless of the license model!

        At LinuxWorld i heard just the opposite from IBM. Especially when we pointed out to them the rather glaring problem of XForms support. Plus, i truly believe that something is cooking in IBM. While they have a mixed past regarding the Open Internet, Open Standards, and Open XML Technologies, i think they are coming around. But it's difficult to say exactly what is happening. Consider that IBM is a full fledged participant in the Microsoft lead gang of predators who tried to corrupt the W3C Open Standards licensing model. They failed there, and promptly made their way over to OASIS where they succeeded in corrupting the Open Standards process there in ways that are perhaps beyond their wildest hopes and expectations. The corruption is so bad and so complete that i don't know how anyone could ever consider OASIS a legitimate Open Standards consortia. IBM's finger prints are all over this corruption.

        It is also IBM who has partnered with Microsoft on the proprietary and restrictive WS-* standards that are now winding their way towards ratification by OASIS. This is core stuff that will end the Open Internet as we know it if IBM and Microsoft get away with this.

        Having said that though, i have to also say that seems rather agnostic to the whole intellectual property license and control stuff. They love the GPL. They love the LGPL. They love SiSSL. They love the Apache license (which has a patent retribution clause) ? even though Apache vehemently opposes the WS-* proposals. And they love patents, royalty fees, permission based licenses and other encumbrances. Nothing seems to bother them.

        Unable to figure this out, i have come up with a different theory explaining why IBM is doing things in a very certain and well thought out way, but a way that makes no sense to anyone else. I believe that IBM has a set objective to divide and conqueror the WinTel monopoly. I'm not going to go the great lengths it would take to explain it here, but to me, everything is starting to make sense. In fact, i love what they are doing! It's awesome.

        As for Google? Everyone at Sun is well aware that Google is pillaging the StarOffice engineering resources. Now why would they be doing that if not to come up with their own Google WorkPlace? Of course, Google could be positioning OOo components behind the firewall, and exposing their services through a browser based Ajax feed. In that case they could care less about the drop of the SiSSL. With the LGPL, you only have to make public your modifications when you actually distribute them. If all you're distributing are the services produced by those components, there is no need for public disclosure.

        The entire world of open source would love to see the modifications Google, Amazon, Yahoo and eBay have made to community source code. But there is no open source license requirement for them to disclose modifications when all they distribute are service based derivatives. If they distributed actual code it would be a different matter.

        Hope this helps. And yes, lots of this is inside baseball. But probably not anywhere near what you might think.

      • Message has been deleted.

    • New Era Coming

      Microsoft often act as if they are a paranoid corporation. But just because you're paranoid doesn't mean they're not out to get you...

      Although much of the industry chatter is about what will happen to Windows most of us, when we stop to think about it, remember that it is Office that is Microsoft's biggest earner - by a long way - and has been for decades... I am quite sure that this fact does not escape Microsoft's competitors.

      Microsoft must have known for some years now that many of their highest profile users are thoroughly fed up with paying for Office 'upgrades' designed to tie them into the Microsoft 'standards' (particularly proprietary file formats). I am certain that Microsoft's competitors have been working on helping out those same customers for a very long time.

      For many years we have been waiting for the office systems market to open up, in order to see innovation in the collaborative workspace. With the arrival of XML we have a base, open, standard that allows this to happen. In addition our industry is maturing with the commoditization of products, and the big hitters are moving to specialize and to services - a move made easier by open source licensing. I am sure none of us have missed this.

      So, might a rationalization of OS licenses be targetted at creating the best market-entry conditions for one stab at this market [you favored Open (OOo)]?

      It seems unlikely to me that Sun's decision was targetted at the OOo ver. 2 launch. Sun will probably have circulated a memo via e-mail asking if retiring the SISSL will adversly affect people - and the OOo & OpenDoc people will have been on the distribution list, and said "no problemo". But actually target... ?

      Sun's comment that they are " ...taking a practical step today ... and committing Sun to actually help with the issue [of open source license proliferation]" seems perfectly reasonable to me, after all, this proliferation has become a real problem.

      IMHO, you are also correct in your assumption that IBM will be crazy if they do not re-connect their WorkPlace developments to OOo at some point - but only as far as using OOo (and, as they have announced, Firefox) as a free client [NB.: that is 'free' as in free speech, not 'free' as in free beer]. Because it will be a ready made, highly sophisticated, funtionaly rich, very flexible, end-user environment that frees IBM (and every other major ICT Services supplier) from having to work with Microsoft. That is, after all, the whole idea.

      All of the people you mention (the portal companies, and IBM) are probably (though I would like to see more evidence before saying definitely) betting that in 'office productivity' (they really call it that... ) the product-to-service megatrend will see an early test of the new software-as-a-service model of how the industry will be structured in the near future. But, their customers (with Office 11 installed) have something that is 'good enough', most of the time, to allow them to wait and see. 'Good enough', that is, unless one counts license fees...

      Sun simply needs to support OOo long enough for version 2 to be launched (with, as you so rightly point out; "beautifully conceived and executed componentization of OOo productivity services"), and until most Office licenses roll over, to see Office replaced by OOo. They do not need any changes to their licensing (though the good OSI P.R. can't do them any harm either), given OOo ver. 2's current mindshare traction, industry support, and beta-visible functionality.

      As for IBM's possible success with WorkPlace there is an old adage: The market will decide. Given that the market is leaning heavily in the direction of freedom on the desktop (again: no free beer), it seems unlikely that they will trade this for WebSphere proprietary servers, and an OOo fork... But I might be wrong.

      Sun has done the right thing in letting OOo go enough it's own way. They are probably, as you suggest, not 100% happy that a lot of their work will not now generate income through direct product sales - but then Sun appears to be one of the largest ICT suppliers that does not have a substantial software-as-a-service push (I have not worked with them for a long time, so I may be wrong about this too... ). Perhaps OOo will be the re-making of Sun in this regard?

      I think you have the solution to IBM's (and other's) possible take-over of OOo and OpenDoc by supplying best-in-class 'next-level-up' functionality when you say: "Maybe we need some advice from the Apache community as to what we need to do to become a successful ecosystem hub? "


      This is the best thing you could do.

      Do it.
      Stephen Wheeler
  • Message has been deleted.