New GPLv3 draft takes aim at Microsoft/Novell but loosens crypto restrictions

The Free Software Foundation (FSF) released the long-awaited third draft of the GNU General Public License (GPL) today. The draft was due out quite a bit earlier but was delayed after the Novell/Microsoft patent deal:

We offer our apologies to the community for the delay in releasing Draft 3. Our original plan was to publish a third discussion draft in mid-autumn of 2006. The unforeseen agreement between Microsoft Corporation and Novell, Inc., announced in November, presents grave threats to users of free software. It was necessary for us to take the time carefully to develop mechanisms in GPLv3 that would deter agreements of this sort and provide strong defenses against their accompanying dangers.

Patents

Indeed, many of the changes in this draft have to do with both neutralizing the Microsoft/Novell agreement and preventing such agreements in the future. According to the rationale,

Patents threaten free software with a fate worse than death: a patent holder might also try to use the patent to impose restrictions on use or distribution of a free program, such as to make users feel they must pay for permission to use it. This would effectively make it proprietary software, exactly what the GPL is intended to prevent.

(Note the part that verifies what I've always said, that the GPL is intended to prevent charging for permission to use software.) 

Novell and Microsoft have recently attempted a new way of using patents against our community, which involves a narrow and discriminatory promise by a patent holder not to sue customers of one particular distributor of a GPL-covered program. Such deals threaten our community in several ways, each of which may be regarded as de facto proprietization of the software. If users are frightened into paying that one distributor just to be safe from lawsuits, in effect they are paying for permission to use the program.

At some point, the FSF sent its legal team to Novell where they were given "limited access to the terms of the deal under a non-disclosure agreement" (FSF watchers will appreciate the irony here). Then they crafted the provisions of draft 3 specifically to counter those terms that they found onerous. Among the changes is a new paragraph that ensures that any party who distributes GPL-covered programs and makes promises of patent safety limited to some of the recipients but not others, "automatically extends its promises of patent safety to cover all recipients of all copies of the covered works."

Barriers to modification

The second big change in draft 3 concerns "technical barriers to modification". These provisions are aimed at companies like Tivo that distribute GPL-covered programs but don't allow the user to install and run modified versions of those programs. Changes were made to try and address objections brought by Linus Torvalds and others about having to release cryptographic keys along with the source code. Cryptographic keys aren't even mentioned in draft 3.

Instead, draft 3 makes a distinction between two categories devices that can use GPL-covered programs: "User Products", and non-User Products. There's a complex legal definition but intuitively a user product is something that is normally used for personal, family, or household purposes. This would include Tivos, televisions, cell phones, and any other consumer oriented equipment. Under the provisions of draft 3, source code used in user products must be accompanied by enough "installation information" to allow modified versions to be installed and executed on the device. Functionality must not be impaired, but the manufacturer is free to terminate the user's warranty.

GPL-covered programs used in non-user products (for example public kiosks, voting machines, enterprise servers, etc.) are released from this restriction. Code burned into ROM (read-only memory) is also released from the restriction, since nobody (neither the user nor any third party) has the ability to install modified code onto the product.

Objections by cell-phone manufacturers about unvalidated code running on their devices and accessing their networks were taken into account in this draft. The operators are allowed to deny access when the modification "materially and adversely affects the operation of the network", or when the modification "violates the rules and protocols for communication over the network".

Compatibility with other licenses

Unfortunately this draft of GPLv3 remains incompatible with many other open source licenses, most notably the Apache license and the Eclipse Public License (EPL).

We regret that we will not achieve compatibility of the Apache License, Version 2.0, with GPLv3, despite what we had previously promised.

An issue with patent termination has been addressed, but an obscure clause in the Apache License requiring downstream redistributors to indemnify upstream licensors under certain conditions is being interpreted as an "impermissible further restriction on GPL rights". It's possible that future versions of GPL or the Apache license could address this.

Incompatibilities with EPL are more troublesome:

As for the EPL, there remain numerous other features in that license that are incompatible with Draft 3. We could not change that result without abandoning the strong copyleft altogether.

However, the FSF helpfully suggests that the Eclipse Foundation rewrite their license to permit EPL-covered code to be relicensed under the GPL.

Conclusion

Draft 3 of GPLv3 represents a turning point for the FSF. It's apparent from the license changes and the rationale behind them that, for the most part, the FSF is seriously listening to input and making changes to satisfy all sides of the open source community even if they don't entirely agree with them. For example in one section of the rationale it says:

… In making this decision, we were influenced also by the greater comfort some lawyers appeared to derive from the more familiar construct of a patent license, though the basis for that comfort does not seem entirely rational.

But Stallman fans should not despair. His influence and philosophy still permeates the license and the draft process itself. Take this quote, for example:

We considered including medical devices for implantation in the human body in the User Product definition. We decided against this, however, because there may be legitimate health and safety regulations concerning inexpert and reckless modifications of medical devices. In any case, it will probably be necessary to convince medical device regulators to allow user-modifiable implantable medical devices. We plan to begin a campaign to address this issue.

This paragraph demonstrates both the pragmatism that is creeping into the FSF (concerns for "reckless modifications") and the "tin-foil hat" eccentricity that has always been a part of Stallman's free software movement. If nothing else, the activities of the FSF and its colorful leader will continue to give us plenty to talk about in the years to come.