3

A common desire in the Free and Open-Source Software world is to release some code in a way that approximates two ideals:

  1. The software is in the public domain and its techniques are common knowledge
  2. The software is unusable for corporate purposes

When the shape of the software cannot itself ensure the second property, perhaps because the software is attractive for a variety of commercial applications, then the license is often used instead in order to prevent software misuse. (Indeed, I have found dozens of queries here along these lines.) However, there are two well-known obstacles to a licensing solution; there's the first property I've listed, and there's also the fact that corporations may decide to ignore the terms of a license.

I don't think that anything can be effectively done about this second obstacle; corporate coders will not stop copying code from Stack Exchange anytime soon. However, about the first obstacle, I have heard many tales; which FSF- or OSI-approved licenses technically allow corporate usage but are toxic and forbidden in practice?

  • 2
    What would be achieved if a piece of software is unusable for corporate purposes? – Andrew Grimm May 13 at 11:27
  • The goal, to paraphrase a famous prayer, is to find licensing from which all corporations recoil. As a technicality, I would like to see such licenses which are nonetheless still FSF- or OSI-approved. – Corbin May 13 at 16:43
  • That's easy: they recoil from CC BY-NC-SA. But it's not free, and so off-topic here. – MadHatter May 13 at 17:29
17

Frame challenge: neither the FSF nor OSI have point 2 as a goal. To quote the FSF:

“Free software” does not mean “noncommercial”. A free program must be available for commercial use, commercial development, and commercial distribution. Commercial development of free software is no longer unusual; such free commercial software is very important. You may have paid money to get copies of free software, or you may have obtained copies at no charge. But regardless of how you got your copies, you always have the freedom to copy and change the software, even to sell copies.

The freedom to use software for whatever you like, including corporate uses, is important to the FSF, and the OSI has historically been even more corporate friendly.

The GPL and AGPL sometimes seen as being corporate-unfriendly, since it is difficult for organisations to re-use GPL or AGPL components in software they wish to exercise monopoly rights on. But it's worth noting that some companies choose to licence their products under these licences for precisely this reason (MySQL being one example of this), since it allows them to limit competitors ability to exercise monopoly rights on products containing their components.

One seemingly corporate friendly "licence", that has consequences for businesses, is public domain (which isn't technically a licence, and isn't OSI approved, although the FSF do regard it as free software). SQLite is dedicated to the public domain, but it's also possible to buy a licence from one of the companies that does much of the development work on it. The reason companies feel compelled to do this is that whilst copyright law has been largely standardised internationally, public domain has not, so companies that need to operate internationally prefer to buy a licence, which saves them having to consider the legal implications of releasing a product containing SQLite in all the countries they operate in.

| improve this answer | |
  • I am not looking to portray FSF or OSI as anti-corporate, but to demonstrate that anti-corporate choices are possible in the FLOSS world. – Corbin May 13 at 16:46
  • @Corbin in that case, I may add an extra point to my answer, about public domain – James_pic May 13 at 16:54
  • @Corbin and the problem with that is that they're not. – MadHatter May 13 at 17:26
12

While the question is valid, the broadest ideal of open-source is to make all software open-sourced, including that which is used for profit.

Broadly, some strong-copyleft OSS licenses have a "viral" property, requiring prohibiting anything not under the same license from linking to that component, others are permissive or non-viral. The GPL and AGPL represent extreme virality, the LGPL is mostly non-viral, the MIT is strongly permissive, and public domain is absolutely permissive.

In my experience, the most common use of viral licenses is to dual-license the product. That is, companies will release the product under GPL for free, and also offer a paid commercial license. In some cases, the commercial version even requires per-user licensing. In effect, the GPL version serves as a free trial, protected from production use by its license, rather than some DRM scheme.

I currently architect software that is commercial in function, but, due to its critical nature, we maintain a strict open-source-only policy for all components not created in-house. Not a byte can go in unless we and others can inspect the line it's been compiled from. Having started my coding in the OSS community, I do my best to have this go both ways.

At the same time, the nature of our primary software renders the legal cost of assessing the risks in releasing its code prohibitive. We contribute to libraries and packages that we use, but can't open-source the complete product. In a perfect world we could and would - but there are products that are by their nature only useful to a closed list, like owners of specific hardware (such as aircraft), or entities with a special legal status. In such cases, "herd security" cannot be relied upon to weed out the vulnerabilities, because no external party is interested in reviewing or improving such narrowly-specific code.

This means that industries like ours can use MIT, Apache or LGPL components, but not GPL or AGPL. In all of the cases where we were interested in viral-licensed components, and where the creators were reachable to discuss licensing, they offered a paid license. Some of the times it was worth it, other times we updated non-viral OSS to our standards instead.

So, licenses that restrict corporate usage most often do so in order to sell it, not to prevent it. For that purpose, prohibition in spirit is meaningless if it's not done in letter.

The purpose of promoting open-source software is not always best served by choosing the most extreme copyleft license. The application needs to be considered. Some software exists in millions of copies, other can never possibly have more than one running instance. The most extreme licenses restrict their use cases to only one facet of the software world, while permissive or compromise licenses trade some risk of proprietization for enhanced applicability.

| improve this answer | |
  • 1
    At my previous work we GPL'ed the software that we produced to the client. The software was strategic to the client and they did not want their competitors to get it, so they never published it. Maybe you can do the same? Open Source does not mean the software must be publicly downloadable. Instead it means that if someone got a binary they should be able to get the source, too. Talk to your "closed list" and see if that might be OK. – Ole Tange May 12 at 13:25
  • 1
    @OleTange Different courses, different horses. In our case, some end users have employed third parties to abusively modify the software before (imagine odometer rollback, but on a plane engine), so they're not trusted parties. Security through obscurity is weak, and I work to put better controls where possible, but it does worsen the cost-to-benefit ratio of trying to break the system. – ZOMVID-20 May 12 at 13:42
  • 1
    Would it be a good idea to mention the terms "reciprocal" and "copyleft" in addition to (or instead of) the allegedly loaded term "viral"? – Damian Yerrick May 12 at 15:42
  • 3
    @DamianYerrick I see virality as distinct from copyleft. Some licenses prohibit even linking to a library from software not distributed under the same license, others don't. This is very software-specific and goes beyond the broad copyleft goal of ensuring that modified versions of the original stay under the same license. In an art analogy, the most extreme version of viral copyleft would be like prohibiting a cameo mention of your work in a differently-licensed work. – ZOMVID-20 May 12 at 18:13
  • Could you expand on your perspective? It sounds like, in common with my answer, you're indicating that GPL and AGPL are indeed the sorts of licenses that I'm looking for. Do you have a listing of forbidden licenses that you could share or publish? – Corbin May 13 at 16:48
7

To answer my own question, here is a small sampling of possibilities.

First, there are licenses that are approved by both standards bodies, the FSF and the OSI, but which are often not acceptable in corporate codebases. A gold star goes to Affero GPLv3 (or later), which is banned at Google and almost certainly banned at any place which bans GPLv3.

Speaking of which, GPLv3 is a fine license for this purpose as well; it caused Apple to write their own C++ standard library and stop contributing to GCC. Similarly, GPLv2 is not allowed on Apple's phone app store. The GPL is also why Google wrote their Bionic C standard library; "we want to keep GPL out of user-space".

But let's go beyond the FSF's offerings. Google publishes a handy list of banned licenses. The Common Public Attribution License, CPAL, is on this list. So are versions 1.1 and 1.2 of the European Union Public License, EUPL. These licenses behave like AGPLv3 in various ways, and this "Affero" behavior is what landed them on Google's ban list. Nonetheless, CPAL and EUPL still designate open-source software, and are FSF- and OSI-approved.

Finally, what if we only care about one standards body, but not the other? The FSF considers some public-domain attributions, like Creative Commons Zero, the Do What the Fuck You Want To Public License, WTFPL, as well as the Unlicense, to be reasonable licenses for Free Software, but folks may not see software licensed with them as Open Source, since they are not OSI-approved. Google employees are not, by policy, allowed to contribute to projects using these public-domain-like licenses.

| improve this answer | |
  • 1
    Apple writing Clang is arguably a very good outcome. – curiousdannii May 12 at 5:51
  • 4
    But it is entirely the letter, not the spirit, of the AGPL that causes Google problems, so that can't possibly answer the question as written. This leads me to suspect the question really means "I want a non-commercial free licence even though I know such a thing cannot be". As this answer concludes, you can only do that by torturing the definition of "free" (to embrace things excluded by eg the FSF or DFSG), or including the AGPL, which many corporate entities are fine with, for all that those Sultans of SaaS at Google don't like it. – MadHatter May 12 at 9:23
  • 8
    None of the so-called corporate unfriendly licenses will stop a company who's willing to release their source code from using your software. Companies like Linksys and IBM. They're not really unsuitable for corporate usage only unsuitable for closed-source usage. Basically you're only stopping software companies but not hardware companies – slebetman May 12 at 9:46
  • I do not mean to endorse Google's legal opinions as fact, but to take advantage of their publication of their third-party code usage policy. If other corporations have similar writings, then I would be glad to incorporate them. I searched but couldn't find much. Regarding nitpicks on the wording on the question and premise: Licenses are only letters, without spirit; "the spirit of the law" refers to the commonsense understanding of the intent of the wording. I am looking for licenses which commonly are understood to be unacceptable for corporate use but still FLOSS. – Corbin May 12 at 16:23
  • 2
    @Corbin, what do you mean with "corporate use"? Do you mean using the software as-in within a company making money? Or the practice of selling copies of the software? Or something else? – Bart van Ingen Schenau May 13 at 7:30
4

Don't forget that in the world of contracts and the law, the "spirit" is essentially irrelevant. The "letter" of the contract is everything. When the letter and the spirit of a contract/license differ, that's where courts come into the picture. Courts make decisions and interpretations based on the letter of the law since the parties to the contract aren't mind-readers and can't reasonably know anything that's not explicitly included in the text or in established law.

The license you want will largely depend on what exactly you mean by "unusable for corporate purposes". There are a couple of ways to interpret that:

  • I don't want a corporation to use my software for any purpose
  • I don't want anyone selling verbatim copies of my software
  • I don't want people charging money for software that incorporates my code
  • I don't want anyone to use my code in projects that are not themselves open source
  • I don't want anyone to modify my software without publishing their changes to it

A strict reading of the question sounds like you're talking about the first option, but that's not really something that you can limit with a license. A corporation is simply a legal construct that allows a group of people to act as a collective body. This obviously includes businesses, but can also include things like universities, museums, charity organizations, and even the FSF itself. It also doesn't cover a self-employed consultant acting as an individual person, even when they're doing the sorts of things normally done by a "corporation". The legal definition of a corporation varies from locale to locale, so this would be a very impractical limitation for a license and I'm not sure it would accomplish much. For those reasons, I'm going to assume this isn't what you meant. This sort of restriction is also a probable violation of the FSF's "Freedom 0", which would make it non-free (James_pic gives more detail in his answer).

Regarding the second and third interpretations: I don't think that you can incorporate these restrictions and still have "free software". These specific reasons are given as why the FSF does not consider the Aladdin Free Public License (among others) to be free software.

For the fourth interpretation, you're looking for a strong copyleft license like the GPL. Weak copyleft (like the LGPL) is not sufficient to guarantee this.

For the fifth interpretation, you can achieve this through a number of different licenses (including the GPL). Be aware, though, that most of the time, the modified source code only has to be provided to those who receive a copy of the program. Modifications don't have to be submitted back to the original author (and in many cases, it might not even be possible to do so).

In all of these cases, though, you're not prohibiting "corporate usage" across the board. A strict, viral copyleft like the GPL will probably chase off the largest number of potential users, but corporations can still use the code if they're willing to abide by the restrictions. For example, Red Hat writes a lot of GPL code as part of their enterprise Linux distributions, and hardware vendors often publish fully GPLed Linux drivers for their devices. Many of the GPL's "viral" aspects only take effect when the software is distributed, so a corporation can modify it for internal use and keep those modifications secret (example: modifying gcc to support a custom FPGA core used in the company's products). No matter how "distasteful" you try to make the license conditions, there will always be situations where a corporation finds your license acceptable. The only way to ensure that no corporation ever uses your code is to use a restrictive, closed license, but at that point you're not free at all.

| improve this answer | |
  • Unfortunately, as I covered in the question, even unfree software can still be used in corporate settings, via simply violating the license. Instead, my question aims to find licenses where, if the corporation deigns to care about licensing, then the choice of license will intimidate them. AGPL and WTFPL are both equally forbidding in this way, despite not being at all the same license. – Corbin May 13 at 16:57
  • @Corbin My point is you'll have to explain what specifically you mean by "corporate use" as there are multiple interpretations. What license you want will depend on precisely what you're trying to prevent and how much you're willing to tolerate making it difficult for "non-corporate" entities to use your software as well. Regardless of what license you choose, there will always be "corporate" use cases where that license is perfectly acceptable. – bta May 16 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.