I count:
* ReasonML - https://github.com/facebook/reason/blob/master/PATENTS.txt
* GraphQL - https://github.com/graphql/graphql-js/blob/master/PATENTS
* react-native - https://github.com/facebook/react-native/blob/master/PATENTS
* PlanOut - https://github.com/facebook/planout/blob/master/PATENTS
* Flow - https://github.com/facebook/flow/blob/master/PATENTS
* Haxl - https://github.com/facebook/Haxl/blob/master/PATENTS
* Flux - https://github.com/facebook/flux/blob/master/PATENTS
Just a few that I found.. Please reply if you know more project that are still BSD+PATENTS licensed.
The complicating factor there is Facebook actually has a patent covering the GraphQL specification (along with the fact that they're applying PATENTS to a specification, vs an implementation): https://www.google.com/patents/US9646028
> As our business has become successful, we've become a larger target for meritless patent litigation. This type of litigation can be extremely costly in terms of both resources and attention. It would have been easy for us to stop contributing to open source, or to do what some other large companies do and only release software that isn't used in our most successful products, but we decided to take a different approach.
Never heard Facebook answer: why didn't they just follow Red Hat's model and make a "Patent Promise"[1]?
Then accumulation of software patents would help deter meritless litigation while staying out of the way of FLOSS developers getting their work done.
The four freedoms and free software solve so many of the problems I see around modern tech-infrastructure. No, free software doesn't solve every issue and has some of it's own, for example I think at the code complexity levels we are at the many eyes theory is starting to crumble, but it doesn't change the core truisms about freedom in computing that are important for us to move forward in a free and open society if we actually want to start solving prolems.
Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt, please take this time to at least consider GPL varients (A/L/GPLv3) for as much of your tooling as you possibly can. (perhaps CC0/CCBY/CCBYSA for content)
In my opinion, MIT/BSD licenses like FB moved to in this case simply aren't good enough to be future-proof, primarily because of the ability of future tivoization of a product that removes freedom from the user (think BSD on playstation).
Remember, either the user controls the program, or the program controls the user.
If the GPL scares you for some reason or you have question about it (commercial sales of gpl software for example), feel free to ask. I've spent enough time wading through just about every license so I think I might be able to cut through some fud.
My own company's lawyers consider the GPLv3 toxic and not allowed at all for company use in any software we create - that's enough for me.
Maybe they don't care because in reality its not a problem?
In the sense that it's not a problem people generally have -- not that nobody ever has had it.
A lot of people worry too much about all kinds of BS eventualities and technicalities, and this could be one of them in most cases.
>Now that we have a concrete example of how picking tooling with bad licensing can bite people in the butt
It only bit FB in the butt (in the sense that some developers complained about their license choice) -- not those using the tooling with FB license.
What are you referring to? Who has been bitten exactly?
I'm sorry but Creative Commons themselves declare that their licensing should not be used for software.
https://creativecommons.org/faq/#can-i-apply-a-creative-comm...
This is a backwards move. Facebook is very good at PR painting this as a win for users.
See http://en.swpat.org/wiki/Patent_clauses_in_software_licences...
an explanation https://opensource.stackexchange.com/a/1890
https://github.com/facebookincubator/gloo/blob/master/PATENT...
I get that there's legal uncertainty: I can imagine some companies, especially larger ones, not wanting to give up their patent-suit option just because one random small team in their org is using React. And barriers to adoption aren't a great idea when one of your goals is wide adoption.
Overall, though, I think making it much harder to file patent suits -- at least for software patents -- is a great thing. Facebook's (and others') implementation of it might have left something to be desired, and they're certainly a large company with a lot of resources behind them, so the power dynamic might be a bit lopsided, but...
Well, let's just say I'm a small company or individual who wants to release some open source code. Doing so under a BSD+Patents-style license gives me some protection from any big players who decide to use my software. How is this a bad thing?
I suppose I hold a pretty strong anti-patents stance, though. I'd be happy if (most?) patent protection just went away entirely.
As an aside, note that it looks like FB is going with straight MIT. So they're not even giving users of their software a patent grant at all anymore[1], and reserve the right to sue you later just for using their software, if they happen to have a patent on something in it.
[1] Yes, there are some legal opinions that the MIT license's language includes an implicit patent grant, but I don't believe that's a settled matter.
1. Software patents are a huge, huge, existential crisis facing our industry.
2. So huge, in fact, that nobody wants to deal with it. We can't realistically figure out if the libraries we are using are covered by patents, and given how broken issuance is, they probably are.
3. So the only practical solution is to use MIT licensed libraries, pretend there's no patent issue, and put our heads in the sand.
4. But Facebook's BSD+Patents license made us think about patents. Nobody stopped and said "can we use Angular? Are there patents on core elements of it?". But people did stop and ask that about React, because Facebook was (accidentally) making people think about patents, and the more you think about patents the more you wish you were a plumber and not a dev so all you'd have to deal with is toilets blocked with shit, and not software patents, which are much worse.
5. Now that it's under an MIT license it's just as dangerous to use React (maybe more) but we can pretend it's safe again.
Notice that Wordpress's decision to switch from React (which probably led to this) was quite clear: They were not switching due to patent concerns about React, they were switching because the non-standard license was stirring up FUD and making people ask them uncomfortable questions. (We know this because they explicitly said so, and also because the leading contender for a new library was Preact, which is strictly more dangerous from a patent point of view than React under every possible circumstance, but has a license that lets your pretend everything is okay easier.)
It's the backlash that was led by people who considered it a realistic possibility that they may, some day, want to sue Facebook for infringing on one of their precious patents.
This.
If the license is not one of the standard ones already in use, and it mentions patents, suddenly legal gets involved and it's a disaster. They're very risk-adverse and no one's really sure what will happen when it gets to court. It doesn't have to make sense - after all, most software patents don't make sense, and most software patent lawsuits don't make sense.
Copyright makes some sense - some entity wrote the code and has (or has not) given explicit permission for others to use it, and under common open-source licenses those terms are reasonably well understood. But patents can come out of left-field and be unrelated to the user or the producer of the code. Being aware of patents (which should not cover what you're doing or should not exist) makes punitive damages worse. Again, best to just put your head in the sand and hope the patents don't notice you. Any language about patents adds complications which no one wants to figure out.
That's... sad.
> Being aware of patents ... makes punitive damages worse.
Sure, but that doesn't have anything to do with a BSD+Patents license. The license doesn't say "you also must do extensive patent research when using our software". You have to actually be aware of the patents that you're infringing to be held liable for extra damages.
Facebook's patent clause disarms all their opponents, but leaves them free to attack. It's actually a wildly aggressive, offensive weapon, surprisingly - just like how nuclear missile defense is one of the more provocative technologies out there that possibly makes nuclear conflicts more probably.
That's why it's totally unpalatable, at least at the big companies.
Sure, not everyone is in that situation. Facebook is big enough though that if you have any patents you have to be _very_ careful about that license.
But on second reading I realize I was wrong (in a good way). Facebook's patent grant specifically says that if they sue you for patent infringement, and you counter-sue with something that is unrelated to the software of FB's that you are using, then your license to use FB's software is NOT terminated. That's actually entirely reasonable and great.
Oracle v. Google?
Using a license that's been in use for a long time, and has the endorsement of major OSS organizations, is pretty much always more comfortable for developers.
I wasn't uncomfortable enough with their licenses to rule out their projects based on the license, but I understand the folks who were. Even if my reading of the license makes me unafraid of it, there was enough uncertainty about how a court, particularly courts that have a history of siding with patent trolls, might interpret the license, for it to make some people nervous.
Also, the belief that the copyrights and patents involved will always belong to a benevolent actor ignores a lot of tech history. See: SCO, Oracle, etc. for examples of a previously decent stakeholder being consumed by a more malevolent and litigious one with a different interpretation of the law and the license. facebook may be a huge, unassailable, force today...can we be certain that in ten years that'll still be true? I'd bet on it, but I also won't be shocked if something dramatic happens. Sun looked pretty unassailable through the 80s and 90s, and then they didn't.
Big companies building big projects have to think about these things if they want to be responsible about the future of their projects. (Again, I agree that in this case, the fear is probably overblown. But, I get where it's coming from.)
As an aside, I realized I read FB's license wrong -- it actually is even better for users of it, and specifically says that the patent termination clause only goes into effect if the user is the aggressor. If FB comes after you for a patent claim, you can counter-sue all you want without losing your license. So FB is actually doing the absolutely correct thing here.
> With MIT nobody knows if you have those grants in the first place because there was never a court precedent. But not our hill to die on
I loved BSD+patent as one of the few potentially successful attacks on the awful software patents regime that we currently live under. This defeat means we are probably stuck with it for the rest of our careers.
Apache is an unethical foundation with shitty lawyers? I admire the goal of eradicating software patents, to me BSD+Patents was an unsuccessful way to do it. It hurt OSS projects more than it hurt private projects.
1. We like React a lot with or without the license.
2. It's not our job to convince the world React's patent license is fine.
3. We're substantially moving away from React, including large rewrites.
...why are they moving away from React? I'm confused, do they believe using React implicitly supports it? They're already vocally supporting it.
I don't have an opinion or a dog in the race with regards to the React and patent license drama, but I legitimately don't understand why this blog post (or the underlying decisions) was written. In my opinion it feels like a huge deal to decide to rewrite a piece of production software, especially if you like the software already. So what am I missing?
Are they concerned that people won't use WordPress because it has React components? Does React's BSD + Patents license extend downstream like that?
EDIT: Thank you for downvoting me twice for asking an honest question folks...
"Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with."
It's one thing to look at the license and guess that it's vanishingly unlikely you'll ever be in an intellectual property fight with FB (and it sounds like the counsel Automattic consulted with came to that conclusion for Automattic).
It's another thing to make that decision for everybody downstream using software that you distribute. Particularly when that's a reaaaally large number of people.
I'm on much less solid ground in speculating about more, but it's often interesting to watch the contents of speech when people are working to assure you of something:
"One nice thing about this apartment is that it's very secure." (That's interesting. Why is it important that this apartment is very secure? Is the neighborhood not so much secure?)
"This guy we're interviewing here is not being interviewed for your position." (That's interesting. Why do I need to know that, manager?)
In the case of this post, between the lines I potentially see something like:
"Hey FB, we don't feel threatened by the license, and you know, he who writes to code makes the rules, like Linus says. You're obviously doing what's right for you, from your point of view, and we're sure you know what's best for you, and if you're doing right by yourself, do you need to even ask if you're doing the right thing?
You do you, bro. And we're sure you won't be mad that we wanna let everybody else be themselves, too."
Not sure it's there, I could be reading more into it than I need to.
> I think Facebook’s clause is actually clearer than many other approaches companies could take, and Facebook has been one of the better open source contributors out there. But we have a lot of problems to tackle, and convincing the world that Facebook’s patent clause is fine isn’t ours to take on. It’s their fight.
My interpretation is that due to the negative publicity that Facebook has garnered with their license, they didn't want to scare people away from using/building on top of their platform by using their library even though they themselves did not have a problem with the license.
It's understandable how that might be the final straw for Facebook when even people who don't have a problem with their license won't use their libraries for that reason.
And yes, the Patents part of that extends downstream to anything using it, that's the dangerous part of patents. It applies to everything that does that — even in independent implementations.
Yes, why would it not?
There's also already a theme that uses React: https://themes.redradar.net/foxhound/
With those two things you could build a pretty good web app. The only thing is you'd be in WordPress land and isn't glamorous.
https://wptavern.com/wordpress-new-gutenberg-editor-now-avai...
In this instance.
I don't think they should be particularly rewarded for this. I think we should keep in mind what it took to get to this point.
And that, absent such pressure, individual organizations and people, and perhaps our collective society, remain at their... "mercy?"
Remain under their thumb. Whether that thumb presses down this year. Or next. Or... we just don't know.
In other words, I'd remain cautious about whether and how far I move under their umbrella -- tech-wise, or other.
FB: "...we know that many teams went through the process of selecting an alternative library to React. We're sorry for the churn. We don't expect to win these teams back by making this change, but we do want to leave the door open."
This can seem like a response to the community at large, but can also be read as a direct response to Wordpress' comments:
WP: Automattic will also use whatever we choose for Gutenberg to rewrite Calypso — that will take a lot longer, and Automattic still has no issue with the patents clause, but the long-term consistency with core is worth more than a short-term hit to Automattic’s business from a rewrite. Core WordPress updates go out to over a quarter of all websites, having them all inherit the patents clause isn’t something I’m comfortable with.
Now if someone (i.e. an Actual, Impartial Lawyer) can explain if changing to MIT actually changes anything.
EDIT:
As others have pointed out, FB reaffirmed its decision to maintain the patents clause on Aug 18th (33 days ago): We recognize that we may lose some React community members because of this decision. [1] But they change their minds 8 days after the Matt published the On React and Wordpress article.
This pretty much proves that the decision to move to MIT was heavily influenced -- or perhaps in direct response to -- Wordpress' decision to ditch React.
[1]https://code.facebook.com/posts/112130496157735/explaining-r...
We have considered possible changes carefully, but we won't be changing our
default license or React's license at this time. We recognize that we may lose
some React community members because of this decision. We are sorry for that,
but we need to balance our desire to participate in open source with our desire
to protect ourselves from costly litigation.
[0] - https://code.facebook.com/posts/112130496157735/explaining-r...
This is very clearly a response to WordPress. Nicely played Matt.
Really? They are doing the minimum possible to prevent an exodus from their stack after a public outcry.
Theorizing, but I suspect FB will begin targeting and picking off IP of apps built entirely on React stacks in a few years.
Please don't go back to them. Just contribute to Vue's ecosystem like crazy. Worst case scenario it'll keep FB in check.
That said, this healthy Vue/Angular/React competition has been great for us devs.
I almost guarantee you none of the devs wanted that weird-ass patent clause in there, but I'm guessing that none of them thought that it was a big deal in the long run, just CYA shit you'd expect from a legal department.
They were proven wrong, and it impacted their market share, they raised a stink about it and they got it changed.
Competing frameworks will now need a new "Reason #1 to use us instead" for their pitch-decks.
What do you expect them to do, shrug and come back? I doubt anyone who left based on concerns with their stack being owned by Facebook is likely to regret weaning themselves off of it.
Am I missing something or does this make zero sense?
https://www.wilmerhale.com/pages/publicationsandnewsdetail.a...
https://copyleft.org/guide/comprehensive-gpl-guidech7.html
Basically, if you sell or license a product that requires a patent to work, courts have generally held that you grant an implied patent license for any patents that the product might require. If you explicitly reference patents within the license, however, then whatever terms you explicitly write into the license supersede this implied patent license. BSD+patents (and Apache 2) have explicit patent language; paradoxically, this makes them more restrictive than licenses like MIT, BSD, or GPL that don't mention patents at all.
So Facebook's idea works fine if you believe that Patents as a Thing are bad (all patents, not just software patents), and should not be asserted under any circumstances, and it's fine for Facebook to arbitrarily violate any patent of any company who has become dependent on React.
React Patent Grant Version 2: https://github.com/facebook/react/blob/b8ba8c83f318b84e42933...
The license granted hereunder will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: (i) against Facebook or any of its subsidiaries or corporate affiliates, (ii) against any party if such Patent Assertion arises in whole or in part from any software, technology, product or service of Facebook or any of its subsidiaries or corporate affiliates, or (iii) against any party relating to the Software.
Apache 2 Section 3: http://www.apache.org/licenses/LICENSE-2.0
If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
GPL 3 Section 10 (See also Section 11): https://www.gnu.org/licenses/gpl-3.0.en.html
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
Edited for spacing
If implicit patent grants are a thing, why have more modern licenses like Apache 2 and GPL 3 made it a point to include explicit patents grants in the language of the license?
Wouldn’t their legal counsel advise them against it if it was redundant?
You may be right that this might actually reduce our rights, however, the MIT license is well known and accepted by many in the developer community. It's been around long enough that developers know what they are agreeing to when they use something with an MIT license. With the BSD+Patents license, the biggest concern was not understanding what you were getting into when using React.
Facebook recognized this and conceded despite still believing in the BSD+Patents license to be better. So in that sense, this makes a lot of sense as it:
* alleviates community concerns
* builds up their standing with developers
* generates a lot of good PR
* draws attention away from alternative solutions which were getting a lot of publicity from all of this (Vue.js, Marko, Preact, etc.)
It would be nice though to have a lawyer chime in on the differences between BSD+Patents and MIT.
Apache 2.0 would have also been acceptable, as it had a better explicit patent grant. I'm actually a little surprised they didn't choose it.
- Explicit patent license specifies why / how it can be revoked.
- Without an explicit patent license, patent infringement case (by Facebook) against a party that uses Facebook's OSS would be become harder, because one may argue that such grant is implied by Facebook open sourcing the software.
That combined with the implied licenses means there was a patent clause causing a ton of unecessary hand-wringing.
The reality is every company of FB's size is patenting every developer's latest dump if it can get through the patent office.
I'm likely oversimplifying, but that's about as much as I understand on licenses
Have you ever worked at a large company with its own legal team? It's not such a large mystery.
I'm not sure how changing course from a direction that could have neutralized patents, to one engineered so patent aggressors aren't hurt, is something that can be considered a win for the open source community.
MIT is like a standard when it comes to OS. At big companies, complicated licencies are very hard to get approval of.
Big organizations require more time and people to reach consensus at different hierarchical levels. Probably the legal department was the bottleneck.
Either way, it's a good move.
Be careful. Facebook hasn’t said they’re removing the patents override completely. All they’ve said here is they’re changing their licensing, not what they’ll do. They may end up with BSD+Different patents grant. Make sure you check the changes next week. I doubt it will be straight BSD or they would have said it.
> This shift naturally raises questions about the rest of Facebook's open source projects. Many of our popular projects will keep the BSD + Patents license for now. We're evaluating those projects' licenses too, but each project is different and alternative licensing options will depend on a variety of factors.
There's a patent: https://www.google.com/patents/US9646028,
and a recent discussion: https://news.ycombinator.com/item?id=15289676
Implied patent licenses:
https://www.wilmerhale.com/pages/publicationsandnewsdetail.a....
https://copyleft.org/guide/comprehensive-gpl-guidech7.html
Basically, if you sell or license a product that requires a patent to work, courts have generally held that you grant an implied patent license for any patents that the product might require. If you explicitly reference patents within the license, however, then whatever terms you explicitly write into the license supersede this implied patent license. BSD+patents (and Apache 2) have explicit patent language; paradoxically, this makes them more restrictive than licenses like MIT, BSD, or GPL that don't mention patents at all.
There is no patent clause now. Assuming some FB patent has crept its way in one of their open source, if a company sues FB for patent infringement, FB would be able to counter-sue for copyright infringement due to the suing company's use of FB's open source.
"As long as you don't sue us, we won't sue you" kind of a deal. If the above scenario is true, it seems there is no de facto change beyond the political one.
Anyone with more legal expertise able to disprove this scenario?
the whole point of mit/bsd/etc is copyright grant. fb can only realistically win a suit wrt infringement if they revoke the mit/bsd license first (not sure if this is possible...not sure if it's even been tried before).
Apache 2.0 has a patent grant from my understanding.
For what it's worth, the software that I'm developing at a Big 4 is released under the Apache 2.0 license.
Why would you have preferred the Apache 2.0 license?
The other thing is that there are many projects that are STILL going to be on the BSD+Patent license. These include widely used projects such as React Native and GraphQL.
This behavior is reminiscent of their strategy of invading their users' privacy and then retracting a bit and then doing it again. Wash, rinse, repeat...
...
React switches to MIT...People still FUD. WTF.
But I very much agree and am puzzled why everyone seems to think this latest move is such a great thing. Removing the patent grant entirely isn't so great.
They replaced BSD with MIT, because the language used in the MIT license is closer to what constitutes a patent grant: https://en.wikipedia.org/wiki/MIT_License#Comparison_to_othe...
Case closed. Could not have picked a better license, thank you Facebook. MIT or bust, I try not to use any other types of licenses in products/libraries I choose for work and personal use.
Case not closed, patents still pose a threat. They could (and arguably should) have picked better license, something with explicit permissive patent grant, such as Apache 2.0. This move can barely constitute even as lip service to appease the masses.
As for people who think the exodus out of React was "imaginary" - I wish FB had actually completely dropped the ball and stayed with the old license. That would have forced Automattic to not merely drop React, but also anoint a competitor which would have probably overtaken React in no time.
The patents grant was irrevocable except under explicitly described conditions. A license change wasn't one of these conditions.
So:
1) Does the patent grant still apply? i.e. is it now MIT + Patents?
2) If yes/no, what about existing users of React? i.e. if you were a user up to the point of the license change, do you get the grant, but new users don't?
3) Doesn't not having the grant make us worse off? Presumably only the Apache 2 license would be an improvement in this regard?
4) Is this all just PR theater?
(IANAL, but this is how relicensing works basically universally)
I'm probably missing something, but: If their BSD+Patents was actually strictly "better" for the user, could they not just dual license under both? Is BSD+Patents ∪ MIT < MIT for some reason?
Another one is tooling, but the recent typescript Compiler can do TSX natively (no webpack config etc required).
The last one is size/performance, but afaik the guy behind inferno is now working on react, this all should union React's "forks" into a single force.
Interesting times we live in, lets hope that facebook does not fail on this.
I would just like to see people evaluate and decide whether to use it based on the actual technology, and not FUD.
BSD+Patents would terminate its patent grants if ever yourself and Facebook entered litigation. Implying Facebook would add a patent suit to their defense/offense.
Now they STILL get too! Buuut they look like a good guys. MIT says nothing about Patents. So they can sue _anyone_ using React for patent violations now.
— —
People should keep the pressure up until they license under Apache2. Then the patent issue is solved.
It would be interesting to see the backlash if a company ever tries that one. They would probably lose a lot of their own developers as well.
It should be noted that there is nothing in the MIT license that actually says it is a copyright license. Here is what it grants you permission to do:
> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions
It is giving you permission to "deal in the Software". What that means is not defined but it gives several examples that it includes: use, copy, modify, publish, distribute, sublicense, and/or sell copies.
Several of those, including use, copy, sell copies and maybe distribute, are things that require patent permission if the software is patented. The plain language of the license says that you have permission to do those things, and the only way you can have that permission is if you have a patent license, so I don't see how a court could read the license as not including a patent grant if the licensor has patents that cover it.
dataloader
draft-js
express-graphql
flux
graphql-js
regenerator
relay
yoga
Was this release date known before now? I can't find it anywhere else on Google or Twitter. Man, talk about burying the lede.
I wonder from a more general sense with open source licenses
Interestingly more people seem blatently annoyed that their employer forbids them to use e.g. React and not about what the license actually means.
I will still not be using React. It's just too heavy, same order of magnitude as jQuery.
Cause I might consider a move now.
This whole patent/license circus is not really a decent advertisement. The original reasoning already wasn't.
The only proper solution to the whole drama is to end handing patents on software, as it pretty much is pointless.
Is there somewhere where anyone has elaborated a case as to what those benefits to users would actually be?
Never thought this would happen
Why not just go with BSD and drop the problematic patent clauses?
But I'll still look for a framework with better separation of view and controller logic. And incremental DOM.