6

I have an Open Source project under the LGPL 3.0 License. This project was created before the official text of the LGPL License used HTTPS in the URL for the Free Software Foundation website. I want to update the license included in the project to the new text, so it matches verbatim.

Do I need to seek approval from all contributors to the project in order to update the URL to use HTTPS instead of HTTP, if that is the only change made to the license?

Improve this question
3
  • 1
    Do you know if the FSF made any statement on the license update? As far as I can tell from the Wayback Machine, it happened sometime between 2017-09-15 and 2017-10-11.
    – Philip Kendall
    May 14 at 8:59
  • 1. Is your proposal to change only "http" to "https" and keep the rest of the license text as is, or are you proposing to update the latest LGPL 3.0 (which might have other differences). 2. Does the license of the existing project include the "or any later version" clause which says that you may update the license?
    – Brandin
    May 15 at 6:54
  • @Brandin For 1, there are no other differences. For 2, I thought about including that in my answer but eventually decided against it because of the clause that states "Each version is given a distinguishing version number." - without a new version number, this is not a new version of the license (at least as the license sees it).
    – Philip Kendall
    May 15 at 12:50

1 Answer 1

Reset to default
7

Personally, I'd just make the update: this kind of "administrative change" is clearly within the spirit of both the the license and the open source philosophy, in that it ensures that people reading the license can get information about the license in a secure manner.

At least in the UK, I believe a court would look very scathingly at anybody who tried to argue this kind of thing was a license violation.

Improve this answer
2
  • If the site operator did not implement redirection to HTTPS, then your statement about "ensuring secure access" would be technically valid. However, this is the FSF we're talking about, and I'm 99% confident that FSF will continue provide a redirection to HTTPS on supported browsers (or a redirection to a different protocol in the future, if appropriate) for as long as that site operates. Personally I would not oppose changing to "https://" though -- users of old browsers nowadays can be expected to know that they need to type http:// if they specifically opt for the non-HTTPS version.
    – Brandin
    May 15 at 6:46
  • 1
    @Brandin Agreed on the FSF's intention; the possibility I was more considering was something like a DNS poisoning attack on fsf.org.
    – Philip Kendall
    May 15 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.