A Software License That's Libre But Not Gratis? 246
duncan bayne writes "My company is developing some software using Ruby. It's proprietary software — decidedly not free-as-in-beer — but I don't want to tie my customers down with the usual prohibitions on reverse engineering, modification, etc. After all, they're licensing the product from us, so I think they should be able to use it as they see fit. Does anyone know of an existing license that could be used in this case? Something that gives the customer the freedom to modify the product as they want, but prohibits them from creating derivative works, or redistributing it in any fashion?"
An incorrect foundation (Score:4, Interesting)
Like many people, you seem to assume incorrectly that copyright law, as defined historically, can be used to artificially control what people do with something they have received and use in their own privacy in the first place. You actually do not have to do anything outside of existing copyright law as it is historically understood and intended to accomplish what you desire. This is why the GNU General Public License, as a copyright license, has to explicitly offer the right to sub-license (distribute) original or derivative works.
Now some evil companies try to attach additional restrictions using common contract law to claim additional rights they do not actually have under copyright to deprive people of their existing and even constitutional rights (and what can in many situations be considered contracts of adhesion), and the results of these bastardizations are what is often called things like eula's.
Re:They're paying for it but can't give it away??? (Score:1, Interesting)
I don't think you're understanding the situation, sounds like they're distributing a product rather than working contractually with a single client. In other words, people are paying them for software that they already wrote.
Re:slashdot legal advice? (Score:4, Interesting)
um, like, hire a real lawyer. really, dude.
^ ^ That. Seriously. But secondly, You're asking about EULAs. The GPL is not a EULA. None of the libre/Open Source licenses are EULAs.
What you want is purely the domain of contract law. The conditions under which you license software you own are between you and the licensee. Plus whatever court has jurisdiction if either of you decides to sue. Hire a lawyer if you're not confident on what provisions are likely to hold up under a judges scrutiny.
immunity (Score:4, Interesting)
You might want to check out Immunity.
http://www.immunitysec.com/ [immunitysec.com]
They sell CANVAS, an exploitation framework. A subscription is pretty expensive (that is, dirt cheap compared to core impact), but it comes complete with python source code, and the licence they use gives full rights to modify any of the code as you need to (sort of a requirement for exploit frameworks).
Re:slashdot legal advice? (Score:5, Interesting)
um, like, hire a real lawyer. really, dude.
That's real brilliant advice, but the problem is there are astonishingly few lawyers who will have the slightest clue how to answer this question.
I would suggest that a techie's best bet is to get as informed as possible before taking this to a lawyer, because it's really treading new ground. Can you tell I've been there?
Slim Devices, and subsequently Logitech, wanted to pursue this kind of license for our firmware, so that we could allow customers to have certain benefits of open source, without enabling competitors to make knock-offs of our hardware products with no effort beyond soldering down the parts.
Ages ago I came up with the Slim Devices Public Source License [slimdevices.com], which later got rolled into the Logitech Public Source License. Only recently did we actually ship a major firmware product based on it, which is the SqueezeOS platform that underlies the (imminently hackable, linux based) Squeezebox Controller. Customers can see the source code, learn how it works, customize it to their needs, etc, but they are not allow to redistribute without permission. It's not "Open Source" by the official definition, but it's a great compromise IMHO which met our business constraints.
I searched far and wide for lawyers who understood these technicalities, and even at a major multi-B corporation with an awesome legal team, this was new ground. So educate yourself and check out as many examples as possible, and then find a good IP specialist to help you craft a license, but be prepared to prescribe exactly what you want that license to do.
Re:No license necessary (Score:5, Interesting)
IANAL, but if you are not imposing a EULA, you shouldn't need any kind of license. End-user licenses restrict what can be done with the copy of the software that is owned. Licenses like the GPL restrict what can be done when redistributing the software, but impose nothing on the end-users. If you are not wanting to permit your end-users to redistribute, simple copyright is enough to protect your rights without the need for an additional licenseIf the software is not being redistributed and you aren't requiring a EULA, then the end-users are free to modify the software as they see fit (or do anything with it, except redistribute) under existing copyright law. So it seems copyright law as-is protects you from redistribution and permits your users the ability to modify the software, without the need of any license.
This is 100% incorrect. Copyright law does not allow some to create a derivative work without the consent of the copyright owner. And when I say derivative, I mean modification. The author of the summary is confused because he or she does not understand that a modification is a derivative work (assuming modification uses the original aspects of the work that the original author created himself.) You are assuming that copyright protects only from redistribution. That is wrong. Here is what the statute says:
15 USC 106. Exclusive rights in copyrighted works
Subject to sections 107 through 122, the owner of copyright under this title has the exclusive rights to do and to authorize any of the following:
(1) to reproduce the copyrighted work in copies or phonorecords;
(2) to prepare derivative works based upon the copyrighted work;
(3) to distribute copies or phonorecords of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending;
(4) in the case of literary, musical, dramatic, and choreographic works, pantomimes, and motion pictures and other audiovisual works, to perform the copyrighted work publicly;
(5) in the case of literary, musical, dramatic, and choreographic works, pantomimes, and pictorial, graphic, or sculptural works, including the individual images of a motion picture or other audiovisual work, to display the copyrighted work publicly; and
(6) in the case of sound recordings, to perform the copyrighted work publicly by means of a digital audio transmission.
http://www.copyright.gov/title17/92chap1.html#106 [copyright.gov]
As you can see, derivative and distribution are two separate rights granted to the copyright holder.
I've seen a few companies do this (Score:3, Interesting)
Obviously Sun used to do something similar with Java.
The Python IDE I use, Wing, also allows you to access their source so you can recompile on various platforms.
Historically, AT&T unixes were distributed with source.
Really, I've always found it weird that proprietary software companies seem to think it's important to keep the source code super secret, as if it were some kind of trade secret. Having the source available for recompile and modification is handy for the user, whereas the risk that someone will copy past your source code is somewhat minimal. After all, integrating different source bases is an enourmous amount of work, and fairly easy to detect after the fact.
Re:slashdot legal advice? (Score:3, Interesting)
That's real brilliant advice, but the problem is there are astonishingly few lawyers who will have the slightest clue how to answer this question.
That's why I'm going back to school for a law degree and focusing on intellectual property. This is clearly a niche that is growing and will continue to grow but definitely lacks enough "experts," or even many trained practitioners. You are very right, and I hope to capitalize on the fact few lawyers have any software knowledge at all, and few have any interest or experience with IP. This is a rapidly evolving field, which is the kind of thing that scares attorneys who are used to being able to refer to their text books for long standing, well-settled precedents. Granted, my own programming abilities are rudimentary, at best, but a good grasp of the basic concepts and issues in question should prove very useful. Being lumped into a category with slimy litigators and ambulance chasers is certainly not appealing, though I don't anticipate finding any shortage of clients once I pass the bar. Professional legal advice is a must for any serious software company, but finding knowledgeable, affordable counsel can be quite difficult.
Re:I've seen a few companies do this (Score:5, Interesting)
> important to keep the source code super secret
The reason will most likely be listed below:
1. End users making their own changes but still complaining about error that may or may not be a result of their unauthorized modifications
2. Afraid that other competitors will 'leverage' your investment in development using legal or illegal means.
3. They don't want anyone to know that they 'leveraged' your investment in development to further their own product using legal or illegal means.
4. They didn't bother to patent anything and they're relying on being hidden to keep their trade secrets safe.
5. They license another developer's code which has the exact same limitation, and instead of negotiating with the upstream dev for source distribution rights or reimplementing the needed functionality themselves, they just choose to do nothing.
Anyways, many development environments/frameworks allow for source distribution because customers want to know why an obscure function 3 stack steps into your API routine is throwing ugly errors at you. With clear-and-open source, a developer could use a debugger and realize that they screwed something up before having to contact support with an obvious (to the original dev) problem.
Outside development libraries/frameworks and free products, a full source dump of any given product is pretty rare, at least from my experience.
Re:No license necessary (Score:3, Interesting)
Every time you load the program into memory, you're creating a derivative work. The copy in memory is NOT an exact binary copy of what's on the disk - in the case of binaries, the loader patches addresses (hence modifying a copy of the "original work"), links to libraries, etc; in the case of scripts, the interpreter creates a modified, derived work when it creates the parse tree from the script, before script execution.
As you can see, you *have* to have the ability to create derived works, or the program is without use or purpose.
Just wanted to point out that not all modifications are also derivations, in the practical sense. This was decided with the Game Genie case, where it was held that the sale of a tool that allowed the user to alter the copy in memory did not in fact violate copyright law [wikipedia.org]:
It's clear that the Game Genie does create a derived work. It's also clear that derived works are not necessarily banned by copyright. Where it would stop is with redistribution of the work (in the case of Nintendo, a bin of the moddede game), as apposed to the Game Genie itself.
That being said, I think this whole discussion is a tempest in a tea-pot. Simply put, you sell them the script along with an agreement saying that it is protected copyright, that the customer has the NON-TRANSFERRABLE right to use the software, as well as create enhancements or modifications for their own internal use, but does not have the right to redistribute the software.
Make sure you make it non-transferrable - with the waves of bankruptcies and amalgamations going around, you don't want to see your work get a "Second Life" well beyond the intended scope of the original agreement.
NDA over the source is what you want. (Score:2, Interesting)
Re:No license necessary (Score:4, Interesting)
And this is why it's not a good idea to get legal advice on slashdot...
let's review:
The exclusive rights granted in copyright law are detailed in 17 USC S 106:
17 USC S 106 Subject to sections 107 through 122, the owner of copyright under this title has the exclusive rights to do and to authorize any of the following: ... (2) to prepare derivative works based upon the copyrighted work;
The statute uses the word prepare. You will be in violation even if you don't distribute your derivative work. For a case dealing with this specific subject, see Walt Disney Productions v Filmation Associates, at 628 F.Supp. 871. Unfortunately I can't seem to find a copy of it online.
IANAL