5

Does anyone know what the license is for Mondor's MS Captcha? The only information that I could find on their site was:

"License
MS Captcha is free to use in any kind of projects. The software is licensed, not sold."

What would be the equivalent of this statement in terms of the existing Open Source licenses out there?

Official MS Captcha Project Page

7

What you quote is the license.

This is a custom, informal, non-free license.

The first sentence says:

MS Captcha is free to use in any kind of projects.

It says that you can use this software in other software projects, without restrictions on what kind of project it is used for.

Please note that no other rights than the right to use is licensed.

The second and last sentence says:

The software is licensed, not sold.

This is ambiguous. It may just mean that you can go ahead and download the software without paying a fee, or it may impose a non-commercial restriction on use, meaning: "you are not allowed to sell this software". Because the license is unclear on this point, I would strongly advice against selling a product where you use this software.

Is this a free software license? For example: Does it allow you to fork the project by changing the code and making the result publicly available.

Unfortunately, no. This permission to do this is not given in the license. This means that default copyright law (that makes creating adaptations a reserved right) apply.

I doubt that the intent of the author is to make this a non-free license. But since the right to adapt is not explicitly mentioned in the license, this right is technically still reserved, imposing a legal hazard (i.e. you have no guarantee that this omission is unintentional) on users if they choose to treat this as a free software license.

What would be the equivalent of this statement in terms of the existing Open Source licenses out there?

Since this license grants the user almost no freedoms, it cannot be compared to, or expressed in the terms of, existing Open Source licenses.

Personally, I would not even think about using code that are licensed under such unclear, ambiguous terms in any project of mine. YMMV.

5

In addition to what Free Radical has said, there are other issues with this application.

As far as I can tell, this is a binary-only distribution (the zip file contains a Windows DLL and a text file). You not only have no declared rights to modify it, you are prevented from doing so. As such, it can not be considered "Open Source" under any possible interpretation. The closest I might come to a classification is the old Freeware concept.

Combined with the minimal license terms, this is almost an attempt to put it in the public domain. And, as mentioned elsewhere, it almost certainly fails miserably.

Now consider the purpose of this tool. It is often used to verify that a site is being accessed by a human, rather than a bot. But what else is it doing? What other information is it capturing about the user? Without source code, you have absolutely no idea.

There's a reason openssl is one of the most widely used libraries for security functions: widespread expert review. The recent discovery of bugs in openssl may seem to argue against this, but their discovery and the fixes came about precisely because it is open source.

Personally, I wouldn't touch this (Mondor's Captcha) with a 100ft pole.

Finally, the "license" contains no disclaimer of liability. Mondor could find themselves in a world of hurt, legally, if a site "protected" by this was breached by a bot and the site owner could show that the loss was directly attributable to this component.

  • I'm not sure openssl is the shining example of security after the recent debacles that led to libressl – Martijn Jul 28 '15 at 7:48
  • Actually, that makes it the shining example. It's precisely because it is open source that the problems were found and fixed – kdopen Jul 28 '15 at 13:26
2

This software is freeware, and not free/libre software and/or open source software (see What is the relation and/or difference between freeware and free software? for the difference)

Its licensing conditions are unclear, and it is likely that the author of the software didn't know much about licensing issues (which is completely reasonable. They're a developer, Jim, not a lawyer).

The clearest the intention of the licensing is put in the FAQ

Q 1: What kind of licensing is tied to your captcha control?

A: None. Component is freeware and there is no license for it. You are free to use it when, where and how you'd like to. And yes, it is free to use also in commercial projects.

The way that is phrased is legally nonsense. The license is the agreement between you and the publisher of the software of what you can and can't do. If the software doesn't have a license, you're not allowed to do much with it (apart from the implicit license to use the software, which is the clear intent of making it available for download without further conditions)

The statements that "there is no license for it." and "You are free to use it when, where and how you'd like to" are mutually exclusive. But the authors intent is clearly for you to be allowed to use it.

This leads me to believe you are allowed to:

  • Use the component in your software
  • Distribute your software linking against the component, if the end user installs the component themselves.
  • Release your software under a permissive license or the LGPL (with the above distribution style)

It is unclear if you are allowed to:

  • Distribute your software including the component. It certainly seems to be the intention of the author, but if they change their mind, and decide, no, that's not OK, it's unclear how it would stand up in a court of law. I think it's very likely that it would stand up, but I'm a guy on the internet. Would you want to be the person who tells the judge some guy on the internet told you it was probably OK?
  • Reverse engineer and modify the software. See above.

It is certainly not allowed to:

  • Release your software under the GPL. You're linking against a non-free library
1

Additionally to FreeRadicals excellent answer I can say that the FAQ covers this topic shortly and clarifies the authors intent a bit:

Q 1: What kind of licensing is tied to your captcha control?

A: None. Component is freeware and there is no license for it. You are free to use it when, where and how you'd like to. And yes, it is free to use also in commercial projects.

So, you can use it in any project, even commercial ones. But it is freeware not open source, so no forks, you can only use it.

  • 2
    Right! So in addition to having a section headed "License" in bold letters, the FAQ says the licensing is: "None". The guy distributing this library seems to be dead set on providing the maximum confusion for his users. – Free Radical Jul 28 '15 at 11:56
  • 1
    @FreeRadical The confusion is the result, but I doubt it's the intent. It's surprisingly (at least surprising for freetards like myself) common for developers not to know the first bit about licensing, and not being interested in it at all. – Martijn Jul 30 '15 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.