6

Note: This question is a revision of an earlier question, which MadHatter suggested should be revised into a new more specific question. Note that there is a lot of similarity between the questions; the original question muddied my main concerns by bringing up gripes about the difficulties in supporting scientific software financially--this question focuses more narrowly on the part of my question I actually am seeking an answer to.

I'm a data-scientist in the general field of neuroscience, and, as part of my research, I write a lot of scientific software that is intended to be used and improved by the scientific community. I have traditionally licensed all of this software under the GPL.

Lately, I have been concerned about protecting the scientific integrity of my source code and thus have been reading a lot about the AGPL, the SSPL, the various Creative Commons licenses, and the Commons Clause. This interest is not idle: I'm aware of at least one company that has considered using my software basically verbatim as part of a commercial web-service whose source code is not available for scientific review. For the record, my software has potential uses related to clinical diagnosis, thus a mistranslation or misuse of my software has potentially very serious ethical concerns.

I feel that this is a concern not addressed by the tradiaional FLOSS/open/free license models: If a company that modifies my software then provides it as part of a web-service, other scientists and clinicians cannot guarantee that the company has not broken a scientifically-critical part of my code. The company may be inadvertently providing incorrect scientific conclusions or diagnoses to other clinicians or scientists, possibly endangering lives, and I have inadvertently participated in this tragedy my not adequately protecting my software. My understanding is that if I were to use the AGPL license, the company would at least be forced to make these modifications public so that researchers could determine for themselves if the product they were using was actually equivalent to the software I painstakingly wrote, tested, and published.

To abstract this point a bit: as a scientist, I have a professional and ethical responsibility to ensure, as much as possible, that my scientific work is not misused. This is the same responsibility that forbids me from, for example, doing research on biological weapons or killer AIs: science does not happen in a vacuum, and we all must take responsibility for protecting the integrity of our ecosystem. I see this responsibility as partially competing with the responsibility to make software open/free, and, personally, I see my scientific duty as much more important. A company with an advertising budget is always going to be able to recruit clinicians to their services faster and better than I will be able to alert clinicians to the possibility of misuse (nor would I have any way of knowing that they were misusing it or who they had sold the service to).

All of this leads up to my questions: (1) are there resources that discuss the professional/legal ramifications of these licenses specifically in the context of scientific work? and, (2) given that I don't have funds to have a lawyer write a custom license, how can I ensure that the kind of misuse I've described above is prohibited? I've spent several days reading discussions about the SSPL and related licenses, but I feel that all of the discussion centers around non-scientific software (and mostly around commercial software) and thus miss the mark. My intuition so far is that the least restrictive solution for me would be to license the software under the AGPL, but I'm curious about advantages/disadvantages of other approaches as well.

Also, for the record:

  • I'm looking for general advice as well as specific resources; I do not feel that I've been able to find much discussion of scientific software licenses online.
  • I am not concerned with the relationship between the software and publications; I don't need the license to require co-authorship or citations or anything, I just want commercial companies to use/distribute the software in a scientifically responsible way.
  • I'm aware that relicensing my software does not prevent a company from using previous versions of the software that were licensed under the GPL.
  • I'm looking for discussions about this tangle of issues, not arguments against the existence of an issue. I would consider any answers that doesn't treat the issue of scientific integrity as a meaningful ethical concern relative to the ethical concerns of the open/free software movement to be out of scope.
Improve this question

3 Answers 3

Reset to default
5

Besides the trademark protection that is explained in the answer from @MadHatter, the (A)GPL license also allows you to place certain additional terms.

One of those allowed additional terms is

c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version;

This means that you can add an additional term to the (A)GPL license of your code that states that if modifications are made to (certain parts of) your code, then it must be made clear to users and recipients of the modified code that it no longer implements your peer-reviewed algorithm.

Note that you will need to use the AGPL (and not the GPL) for these restrictions to apply when the software is provided as a service (SaaS) - the GPL does not cover the SaaS case, which was the motivation for the AGPL.

Improve this answer
4
  • Interesting, thanks. Can you elaborate on how this affects a company using my code as part of a SaaS offering? If someone runs a modified version of my code on a server for others but does not distribute it, can I require them to disclose their changes under the AGPL?
    – nben
    Apr 5, 2019 at 19:55
  • If you're one of the users of the service, yes.
    – MadHatter ♦
    Apr 5, 2019 at 20:40
  • 2
    @user16054 Under the AGPL, offering software in a SaaS model counts the same as distribution.
    – Bart van Ingen Schenau
    Apr 6, 2019 at 17:31
  • @BartvanIngenSchenau: Yes, that's an important point. I took the liberty of editing it into your answer; feel free to re-edit.
    – sleske
    Jun 4, 2019 at 9:43
6

If I understand correctly, what you're concerned about is that other people will take your free software, change it in a way that makes it unreliable, and either convey it or provide it as a service to unsuspecting end-users who then assume it works just like the software they know you wrote.

This is a question of brand identity, scientific implications notwithstanding. Licences are not the right tool to address this problem; trademarks are, which is why (as you note) "this is a concern not addressed by the tradiational FLOSS/open/free license models". You can register a trademark for a surprisingly small amount; once you've done so, anyone who takes your software under the free licence under which you are admirably publishing it cannot break it, then redistribute it under the name you have trademarked.

That gets you the best of both worlds. Your software can be free, which helps both open science and the free software development community. But it also avoids the problem of confusion in the minds of end-users who just bought a DVD of (say) Wimblefnoot: user16054's amazing fast fourier transform libraries; they can be confident that they're getting your known-good and peer-reviewed version of the Wimblefnoot libraries, not someone else's unreliably-edited version.

You also sidestep the problem, referred to in my answer to your earlier question, that when you do try to do this with free licences, you make them non-free, or even nonsense.

Many free software projects have freely-available code but a tight trademark policy for exactly this reason. Mozilla, for example, only allow the use of the Firefox name and the associated logos when the software is re-distributed unmodified. For some time, Debian's version of the browser was called Iceweasel, because the control Mozilla exerted over their logo was felt to be incompatible with the DFSG, and removing the logos counted as modification.

Improve this answer
3
  • +1 thanks; this is a useful approach that I had not thought of and that solves a chunk of the problem. However, I disagree that this is fundamentally an issue of brand identity: I am not concerned with protecting my liability/reputation, and I don't expect a corporation to advertise their code as being a version of my code (rather they would probably just cite the paper and pretend like it was their code). As I understand it, this is permissible under GPL for SaaS. TL;DR, I like this answer, but I want to explore answers adjacent to/in the general spirit of FLOSS that are less permissive also.
    – nben
    Apr 5, 2019 at 17:49
  • 1
    Less permissive than what?
    – MadHatter ♦
    Apr 5, 2019 at 18:25
  • Less permissive in terms of "open-/free-ness" than licenses like the GPL. I'm interested both in solutions that keep my software open/free (such as your answer) as well as solutions that keep my software as open/free as possible but with minimal additional restrictions on sharing/modifications/use. A license like the GPL except (for example) that it explicitly requires anyone modifying my software to register their changes with me is a lot less free than the GPL but a lot more free than me retaining all rights (yet such a license would be equally useful to scientists as the GPL).
    – nben
    Apr 5, 2019 at 20:07
2

First, you need to determine if what you want to do would make it non-Open Source or non-Free Software. Fortunately, the Open Source Definition has you covered, specifically item #4, key part italicized -

From https://opensource.org/osd

Integrity of The Author's Source Code - The license may restrict source-code from being distributed in modified form only if the license allows the distribution of "patch files" with the source code for the purpose of modifying the program at build time. The license must explicitly permit distribution of software built from modified source code. The license may require derived works to carry a different name or version number from the original software.

The thing is, I'm not aware of any major licenses (GPLvX, etc) that include that provision. Additionally, while the code could be Open Source it may not be considered Free Software since it puts a restriction on how it can be used to some degree.

From your desires though, it sounds like a combination of the requirements of the AGPLv3 and a clause referencing this part of the definition would do what you want it to do. Unfortunately, to get such a license you'll need to get a good lawyer to write one up for you, and then you have the issue of re-licensing for any code written by others you want to include....

Alternatively, the AGPLv3 and a trademark (or other brand identity protection) on all program names, etc. may do it for you as well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.