Facebook won't change React.js license despite Apache developer pain Facebook's decided to stick with its preferred version of the BSD license despite the Apache Foundation sin-binning it for any future projects. The Foundation barred use of Facebook's BSD-plus-Patents license in July, placing it in the “Category X” it reserves for “disallowed licenses”. Facebook's BSD+Patents license earned …
The modified BSD license is not bad, as lax permissive licenses go, though the Apache 2.0 license is preferable. However, it is risky to recommend use of “the BSD license”, even for special cases such as small programs, because confusion could easily occur and lead to use of the flawed original BSD license. To avoid this risk, you can suggest the X11 license instead. The X11 license and the modified BSD license are more or less equivalent.
However, the Apache 2.0 license is better for substantial programs, since it prevents patent treachery.
From here
This really has nothing to do with the BSD license, but everything to do with the + Patents slapped on top of it.
It essentially means that if you sue (or countersue) Facebook or partners for any patents breaches, also if completely unrelated to the software licensed, you loose your grant. That is a severe handicap to anyone dependent on e.g. React or any of its libraries. This will of course also be a problem if you depend on a library or program that depends on them (e.g. an Apache project, which is why ASF is marking it Cat-X).
The critical point is that the revocation goes down the chain. If the project you depend on runs afoul of the incredibly broad +PATENTS clause, you end up dragged into the fun and games because you're now dependent on a copyright-infringing project, so probably copyright infringing yourself.
The broadness of the +PATENTS clause is particularly concerning for the ASF because of the number of Silicon Valley-employed professional developers it has. It is entirely possible for someone to be a contributor to a project, a Member of the ASF (i.e. Foundation shareholder) and an Employee (and probably shareholder) of a commercial company very likely in competition with Facebook.
The potential for one of these entities coming into conflict with Facebook is high, and the potential knock on effect for the ASF and everyone who depends on the ASF is overwhelming.
It's also complete and utter bullshit. The rocksDB team, also out of Facebook, were the ones who triggered this Cat X process. They managed to relicense the project to dual Apache/GPL2.0 within 36 hours of it being flagged.
Both the Apache and GPL licenses contain robust protections against patent litigation. Including the +PATENTS clause is vindictive nonsense crafted by legal types with no understanding of the open source world.
It's a pity, because this will likely kill React as a commonly used framework.
Lets cut to the chase.
The BSD License + Patents says that if you use this code, then you lose the right to use the code if you ever sue Facebook for Patent infringement.
This is a trojan horse. Facebook wants to push this code out to everyone so that it becomes a key critical component in their ecosystem. At that point, Facebook could ignore any and all software patents because if you sue them, you lose the ability to use any code that they may have donated to Open Source which you now rely on. Even if you don't directly use the code in your products, if you purchased a product that uses their code, you could potentially lose the ability to use that product.
Corporate companies love Apache licenses because it allows them to re-license the code or do pretty much whatever they want with the code free from any major restrictions.
"The BSD License + Patents says that if you use this code, then you lose the right to use the code if you ever sue Facebook for Patent infringement."
No, actually, it doesn't. Only the clause granting access to the patent is revoked, and actually the Apache and GPL licenses both contain very similar clauses. The difference is those clauses are very narrowly defined to concern only the software being licensed. It's this more broad definition of the patent revocation scenario that causes the issue at the ASF.
"The BSD License + Patents says that if you use this code, then you lose the right to use the code if you ever sue Facebook for Patent infringement."
No, actually, it doesn't. Only the clause granting access to the patent is revoked, and actually the Apache and GPL licenses both contain very similar clauses. The difference is those clauses are very narrowly defined to concern only the software being licensed. It's this more broad definition of the patent revocation scenario that causes the issue at the ASF.
-=-
From the article.
The patent grant says that if you're going to use the software we've released under it, you lose the patent license from us if you sue us for patent infringement.”
You do realize that if you lose the rights to use the patent, it means you lose the rights to use the code for which the patent was granted. Right?
In simple terms, you will be infringing on their patent and they can then lob a sue ball at you for suing them.
Here's how it could play out...
Facebook code gets in to an Apache project which IBM uses and builds in to their product and re-licenses it. (Which you can do with Apache code under the terms of APL) You buy the IBM product. You sue FB. You lose the rights to the code that FB granted to Apache that IBM used in the product they sold you.
FB then counter sues you for patent infringement because you've lost the rights that they granted to you thru IBM and Apache.
Got it?
That's the key thing. Everyone else is ok, until they decide to sue Facebook for patent infringement. In short it has the potential to make them bullet proof.
"You do realize that if you lose the rights to use the patent, it means you lose the rights to use the code for which the patent was granted. Right?"
Well, wrong actually. A patent is not a license to use. The BSD part of the license grants you an irrevocable right to *use* the code, and within the bounds of copyright law modify and redistribute it. The +PATENTS part provides a mechanism by which you may be prevented from utilising the patent. Reusing someone else's freely released work is not infringing on their patent in any way, shape or form. (Although this is arguably debatable; most schools of thought assume a patent license to be implicit in the license as a whole. Facebook obviously disagree, but then this is software patents so it's all bullshit anyway)
You're not suddenly going to lose the right to use the code but you may well lose the right to do anything else with it - this is where Apache's Universal Donor principal comes in. What you might* lose is the ability to modify and re-ship certain parts of React's implementation without Facebook being able to sue you and only then when you're dealing with specific implementations of specific claims of granted patents.
This is very much a hypothetical risk. That asterisk up there? We're talking about software patents. A fucking ludicrous idea to start with, that's why not much of this is concrete and why Facebook's use of +PATENTS as a defensive measure is particularly insidious. Big companies can tolerate uncertainties. Small ones cannot.
Which is kind of the point. This is intended to give Facebook a stick with which to beat small patent trolls. Or small competitors. Or small anyones. Decoupling an app from React is potentially a huge investment and Facebook know it. Abusing FOSS like that is very much Not Ok.
@AC,
No shit.
You lose the right to use the patented code.
If I revoke your rights to use the patented code, then I have the right to sue you for patent infringement.
If you want to make it simple. Suppose you're a startup. You use Apache code that has the js code in it.
You then sue FB because they stole your billion dollar idea that you just won a patent on.
They will then sue you for patent infringment on their code because they revoked the patent.
Even if you don't modify the code or enhance it. Just the use of it is enough.
You will be sued.
Note: They could actually sue the end user in my example above and while its a stretch, it would be a legal tactic that FB would have no problem doing just that.
We both agree that this action taken by FB is not good.
You have to appreciate the subtlety of this because while they claim its against patent trolls, its really against everyone who may in the future find the need to sue them.
In addition, any code donated that isn't donated under APL should be rejected outright because of the clauses in the submission process. If you included FB's code that was released under BSD+Patent, you would be on the hook since you are indemnifying Apache.
BTW, you said hypothetical risk.
Its not that 'hypothetical'. FB has been sued over the appropriation of tech.
"If I revoke your rights to use the patented code, then I have the right to sue you for patent infringement."
Well, no, you don't. You might do in certain interpretations, you almost certainly don't. That's why this is hypothetical. There is a concept called an "implied license".
Let's talk about physical things for a second. Let's say I'm Ford. I'm not, but I could be. I loan you a car. I hold many patents on the operation of that car. I make no mention of the patents but we sign an agreement letting you use the car.
Patent agreements never come into it. The use of the patents is implied by the use of the product. What is not implied is a license to modify and reuse. Patent infringement doesn't happen through use, it happens through production, sale and "imitation".
Now of course software isn't physical and that's one of the many reasons why software patents are bullshit. But the core concept is the same. Your BSD rights do not go away. You still have, under copyright law, the right to do pretty much whatever you want with the software.
What Facebook are saying is that they reserve the right to sue you for patent violations (as distinct from copyright) if you ever come into conflict with them. Whether or not they actually have the right to sue you and whether or not they would be successful is moot. They're a $500bn or whatever company threatening you with a big fucking stick. Abusing FOSS to do that is not OK, which is why the ASF has banned the approach for its project.
Predictions of doom are hyperbole driven by poor misreading of other people's poor analysis.
This is the quote from the Facebook's explanation [https://code.facebook.com/posts/112130496157735/explaining-react-s-license/] of their BSD+Patents license:
"The patent grant says that if you're going to use the software we've released under it, you lose the patent license from us if you sue us for patent infringement. "
My understanding is that "losing the patent license" means you cannot use the patented technology (here ReactJS) in your product to make profit. Yes you can use/buy another product that uses the patented license legally.
So if you sue Facebook, you has to stop using ReactJS in your products, but you may still use products from others who use it legally.
Does that make sense?
Here's a better example to show you the dangers...
Suppose Google did this, and had a patent on their Google Web Page Analytics.
You know that little java script that every major web site has embedded which feeds back to google your web page's data.
Now suppose they had a patented license in place where they granted you free use unless you sue them over patent infringement where you then lose the rights to their patented code/process.
Now you sue google. They send a nasty lawyer-gram telling you to stop using their google analytics js code.
You have no choice but to edit all of your web pages and to not use Google's javascript.
What this means is that while you're suing them, they have effectively dropped you lower in terms of page rankings because you're not running their code on your web site.
Now while this is hypothetical, its a good example of what could happen. You may win your lawsuit, however you've lost the right to use their javascript (js) and thus you've hurt yourself in terms of e-commerce and web searches.
That's the danger of it.
Your Google analytics example is good in principle.
Excuse my pedanticness...
You have to remove all google analytics code from your websites, which is usually done by editing the site template and re-publishing it.
Then there is a gap in your web company's web analytics until the legal action with Google is resolved, and with any luck you are allowed to use their analytics again.
This gap is a considerable degradation of the usefulness of the analytics historically and in the future. For example year-on-year comparisons will all be broken.
It is possible to implement a replacement analytics solution from another provider, but this still breaks year-on-year comparisons.
This should not have any impact on a company's google search rankings. If anything they could improve because the page swill load a bit faster.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
