Someone tried to shake our company down once. They posted all this stock imagery on the web, waited for someone to use it with an ambiguously worded attribution policy, then have a third party chase you down and demand $100k but will settle for $5k.
It turns out we did attribute the right way (in our terms of use) and could prove it with logs of when we added the language and when it was removed after we removed the image, but I am sure they nail people all the time with this strategy. This didnt stop them from sending 20 emails, demand lawyers get on the phone, etc.
There are a couple of similar scams like this out there.
Oh that's a classic trick. It's been going on for decades. One example I am particularly familiar with is that of Larry Philpot / User:Nightshooter on Wikimedia Commons. He would upload his photos there with an addendum on how he should be attributed. Any slight impression in the attribution would be followed by legal action. It was obviously a copyright troll mechanism and now all of his photos on Wikimedia Commons have forced attribution affixed by users that warns others that he sues people.
His stuff is so widespread that the consensus on Wikimedia Commons was to keep his photos and add a warning so that no one ends up accidentally using it. Some accused him of sock-puppetry to get his content into a place.
Today, intellectual property maximalism is a much more mainstream position so perhaps modern Internet users will think that he is in the right, but I think it's a bit much.
Could he ever win a case in court? At least the Swedish legal system is based a lot around common sense and good faith and such a trap would likely end up with the one who sued having to pay the legal costs for both parties.
I am honestly flabbergasted that his pictures weren't expunged with great prejudice. what is the value they add to wikimedia that makes being associated with this sort of sleaze okay?
A valid question. These kinds of approaches are a pretty standard attack in the copyleft world. I don't know on what basis the community chooses forced-attribution vs deletion.
So it's a question of the execution of the operation really.
By the way, do you also have the same user handle on Reddit? I have the vaguest memory of you quoting someone else on the subject of denying a person suffering on the street drugs that went something to the effect of not wanting to do it because denying such a man drugs deny him his only escape from such reality or something of the sort.
I never did find that comment again, and it's been at the back of my mind for years (perhaps even a decade) and now I'm not even sure if I've asked you this before.
yes that was me! I love that quote (it's by samuel johnson), so it's really moving to hear it made an impression on someone else too. here it is:
What signifies, says some one, giving halfpence to beggars? they only lay it out in gin or tobacco. "And why should they be denied such sweeteners of their existence (says Johnson)? it is surely very savage to refuse them every possible avenue to pleasure, reckoned too coarse for our own acceptance. Life is a pill which none of us can bear to swallow without gilding; yet for the poor we delight in stripping it still barer, and are not ashamed to shew even visible displeasure, if ever the bitter taste is taken from their mouths."
If you read the discussion, they weren't kept because of their encyclopedic value, or because they were "widespread". I'm not sure why the parent commenter said that.
They were kept to preserve a record of their having been uploaded, and to not create a legal risk for third parties who might be relying on the Commons page as their way to provide attribution.
The original proposal was to keep the image pages with the metadata, but delete the image files. That turned out to have some technical hurdles, so instead the images were overwritten with versions containing big ugly attribution messages, to discourage their use.
I don’t understand why this is sleazy TBH. It’s CC-BY-SA. If attribution isn’t provided it’s a valid case. I once uploaded a map of my state with all the districts in labels in English and my language Tamil to commons under CC-BY-SA. It was used left right and centre, from publications, map sellers to the point I can see them hanging in offices. It’s always pained me, nothing could be done about it. Now I didn’t want money, would have liked the recognition, but would have settled for just seeing the CC-BY-SA logo on it at the least.
CC-BY-SA-4.0 fixes the specific technique of spreading one's work through the commons and then charging for inadequate attribution by allowing for a 30 day cure period on notification. This anti-copyleft-troll clause should likely permit your use-case.
it's sleazy because the intent wasn't to be properly credited, it was to use a loophole in the CC-BY-SA license to sue people for minor typos or mistakes in the exact form of the attribution even when they had clearly intended to give proper attribution.
I was curious about this a few years ago so I took a look around and found another case, the one of Thomas Wolf / User:Der_Wolf_im_Wald, but this guy seems to be getting away with it because he has a 'no-derivatives' box on the image page. He has the same modus operandi:
1. Post the photo to Wikimedia Commons
2. Mark it CC-BY or derivative (say CC-BY-SA etc.)
3. Have a highly precise attribution clause
4. Sue everyone who uses it without the specific attribution
The funny thing about this copyleft troll is that Someone Who Is Not Him creates accounts on Reddit (e.g. this one[0]) that post exclusively about how they made a mistake and the photographer was well within his rights to sue and you should take him very seriously and negotiate the amount.
> We actually violated copyright law before he wrote to us. So it was our mistake and we apologized for that.
I really should create a List page for this on my personal wiki so I can remember all these guys. I find this kind of behavior galling.
But since I don't speak German well enough and inevitably this is going to end up in such a situation where you have to, I think it best I don't pursue deletion here. Hopefully a German speaker will see fit, referencing the other cases here.
His cases that I could find are where the company republishing his photos didn't attribute them to him at all so it seems fair to sue (except when it turned out to be fair use). What is this attribution error you mentioned? CC BY-SA 3.0 is pretty onerous "You must give appropriate credit, provide a link to the license, and indicate if changes were made." All 3 things are required. Maybe every CC-BY photographer should be suing newspapers for stealing their work, shouldn't they?
It seems obvious that this ‘may’ is the ‘may’ used in the sense of granting permission: “you may go to the restroom”, “you may begin eating”, “you may ask questions now”, “you may kiss the bride” etc.
All these are clear. The wedding officiant isn’t saying “You might have permission to kiss the bride! Just try it and we’ll find out! Ha ha!”
To interpret this as saying that you might be licensed is just as nonsensical as that in this context. It’s in a file named “LICENSE.txt” explicitly meant to describe the license terms.
Would ‘are’ be better? I’d say yes, but it’s silly to argue that this isn’t proper English for granting permission.
The counterpoint is that three sentences away, there's a clear "You are licensed to use the source code" for the non-server parts. It can certainly be argued that there's an intentional difference. Extended court cases have been fought over mere punctuation. In any case, the FUD that this creates is enough to make anyone think twice about reusing the server code, especially as they have refused to clarify for many years now.
Also, the ambiguity is not only in the "you may be" part, but also in the "to create compiled versions" part. Open source is more than creating compiled versions of source code.
You may be licensed to use source code to create compiled versions not produced by Mattermost, Inc. in one of two ways:
1. Under the Free Software Foundation’s GNU AGPL v3.0, subject to the exceptions outlined in this policy; or
2. Under a commercial license available from Mattermost, Inc. by contacting commercial@mattermost.com
My read:
We provide you with two options, either:
1. Follow Apache License
2. Pay us and you don't need to follow Apache License terms
This really seems like a dual license situation where they are saying "Let's encourage Open Source, but if you want to just use our work to make yourself rich and not even acknowledge you're using us then fuck you, pay us."
I expect this to become more common as companies routinely infringe on OSS licenses while simultaneously many companies are hesitant to use OSS because of licenses. This at least gives an out for the good actors and allow devs to make money (other than being reliant on donations, because... that's worked out...).
But maybe I'm misunderstanding? If so, I don't know what I'm missing
> But maybe I'm misunderstanding? If so, I don't know what I'm missing
You're apparently missing the two points I made in the post you are replying to, or at the very least you're not responding to them. By which I don't mean to say they are necessarily valid points.
My bad, I was confused given the context of the comment you responded to. Maybe I should quote the next line instead?
You are licensed to use the source code in Admin Tools and Configuration Files (server/templates/, server/i18n/, server/public/, webapp/ and all subdirectories thereof) under the Apache License v2.0.
So I read
Apache (OSS):
|- server/
| |- i18n/
| |- public/
| |- templates/
|- webapp/
Not Apache (pay us/not OSS):
|- api/
|- e2e-tests/
|- server/
| |- bin/
| |- build/
| |- cmd/
| |- enterprise/
| |- scripts/
| |- Makefile
| |- path.go
| |- this is not a complete list but you get the point
|- tools/
Part of the code is open source. Part of the code is source available (source visible).
Again, I am open to misunderstanding but that's my read.
Licenses are not about what things "seem", their text should be clear enough to hold up to legal scrutiny, not just what some person who speaks some local variant of English thinks is obvious.
Even if you're a lawyer, whether it's obvious to you is irrelevant: it has to be obvious to everyone. And if it's not (and it should be abundantly clear that it's not, given the linked discussion), the license needs fixing.
Speaking only for myself here. But I don't have the arrogance to assume that I can interpret legalese the way I interpret English. When shit goes to court, saying here's what I thought "may" means is not going to be a legal defense strategy. There's a reason I hire lawyers for this kind of shit because they are really good at their job and I won't pretend I know their job better than they do.
you'd be surprised how much your command of the english language translates into legalise.
Yes, there's a definite codex of legal terms that have specific legal meaning but sound like "open to interpretation" english, but, those are vanishingly small.
Largely, if you read defensively and try to read what is not said, then you get very very far.
Source: spent about half-a-decade with very expensive swiss lawyers.
> Largely, if you read defensively and try to read what is not said, then you get very very far.
How far is "very, very far"? Is it far enough that, if there were a lawsuit, my liability would truly be capped at €10,000? Because that's how much liability I can afford. If that "very very far" guarantees such a limit, then yes, I agree it is very very far. But my experience tells me that without formal legal training, I cannot be confident that I have interpreted legal language correctly enough to rely on that conclusion.
Open source licenses are often relatively readable, but corporate contracts and other legal texts, including those from companies that market themselves as open source in questionable ways, can contain subtleties and loopholes. As a layperson, it is difficult to know how much exposure I might have if I misunderstand a detail and act in contradiction of the license terms.
Perhaps we are simply on opposite sides of the D-K effect here. Or maybe you simply are good with legalese and I'm being unnecessarily skeptical.
If experience with lawyers matters, I have spent many years working with lawyers across Europe. If that taught me anything, it is to avoid assuming that I can reliably interpret legal language without proper training.
Yes, I can usually grasp perhaps 80 percent of what a contract is saying at a high level. But in every contract we reviewed, lawyers consistently found issues or implications I would not have noticed. They then either refined the contract or advised taking a calculated risk. So I think it is reasonable for me to remain cautious about my own ability to interpret legal language with confidence.
Liability is capped by court (e.g. small claims court) or by specific claim type depending on the legislation of the jurisdiction (e.g. speeding tickets typically have set fines varying by state).
Liability is not capped by your ability to understand the law. If that is your concern, you shouldn't be doing business anywhere, US or otherwise.
> Liability is capped by court (e.g. small claims court) or by specific claim type depending on the legislation of the jurisdiction (e.g. speeding tickets typically have set fines varying by state).
What you are saying is partly true and overly simplified. Are you a lawyer? Do you have legal expertise? If not, I don't understand why you feel compelled to advise on things you understand so little yourself? Are you going to compare my contract with my vendor with speeding ticket? Are you kidding me?
Comparing contractual liability to speeding fines makes me think you have not a clue of what you're talking about. Speeding penalties are statutory and predefined. Commercial liability usually is not. In Europe, most serious business disputes never go near small claims courts. They go to ordinary civil courts or arbitration, where damages depend on the contract, applicable law, and the specific facts. There is often no automatic cap unless the contract explicitly sets one, and even then its enforceability depends on jurisdiction and circumstances.
Small claims limits only restrict which court hears the case, not the total liability. A claimant can often file in a higher court or pursue related claims elsewhere. And in cross-border European business, jurisdiction, governing law, and enforcement become additional risks. Getting this wrong can expose you to far more liability than you expected.
Liability is not limited by your personal understanding of the law. That is why businesses do not rely on guesswork. Contracts are reviewed, liability caps are negotiated, insurance is obtained and lawyers are paid to spot risks that non-lawyers routinely miss.
> If that is your concern, you shouldn't be doing business anywhere, US or otherwise.
Yes, that is my concern. I do business in Europe. By paying actual laywers. And I'll continue to do so. Thank you very much.
> saying here's I thought "may" means is not going to be a legal defense strategy
It is - it might not be successful (the court may rule against you) - but if what you thought "may" meant was close to what a "reasonable person" would have thought, you may be ruled against with no or low penalty.
But it is saying "You may be licensed to use source code..." which is analogous to "You may have permission to kiss the bride" if being licensed means having permission. It could mean that Mattermost may have licensed it to you in one way or the other, or neither, at their discretion. If it was written like a priest, it would have said "You may use the source code..." and this doubt wouldn't exist.
Is the bad publicity worth it with this kind of rug pull to "we are opensource, but not really"? I get that an open source product can get you some free (word of mouth) and good publicity. But in general, open source is also strongly associated with "free" (as in you don't have to pay money for it). So if you do want to make money from a software product, weigh the pros and cons carefully - commercial open source products do tend to be less profitable than commercial closed-source versions. If you are ok with that, go with the open source business model. Otherwise, stick to the closed-source business model from the get go. Be honest from the start - brand damage is really costly to repair.
"...You are licensed to use the source code in Admin Tools and Configuration Files (server/templates/, server/i18n/,
server/public/, webapp/ and all subdirectories thereof) under the Apache License v2.0...."
I can whole heartedly recommend Zulip. They really get open source, allow you to own your data, and their UI despite being a bit quirky is IMO the best out there for handling complex conversations (the ability for admins to retrospectively move mesages between topics like old school forum software being a real standout feature).
I run a Zulip server and it's pretty good. The way they organise channels is extremely convoluted unfortunately (I wish they would just use absolutely standard channels layout like every other chat, and have everyone able to see them on join!) but well, beggars can't be choosers.
People go through all this trouble to host convoluted chat systems, and all this time IRC is right there. There's modern servers like Ergo and modern clients like Halloy (or for the JavaScript addicts: Convos, The Lounge, Kiwi, ...) providing all the multi-device history sharing and emoji reactions you could need. All on top of a super simple, extremely battle tested protocol.
But according to https://ircv3.net/software/clients, none of the clients you mentioned actually support emoji reactions (draft/react), and other features like multi-line messages and image uploads are likewise extremely limited in server/client support. So, for the time being, you can't use these features if you want to actually be interoperable with existing IRC users and their clients. Sounds like if you want decentralized, Matrix is still the better bet.
Yes, if the licensing terms are unclear, to err on the side of caution, it is best to assume "All rights reserved" by the authors of the software so you don't accidentally violate the authors' rights. And then hire a lawyer to sort this matter for you.
> If you didn't mention the license, it was in public domain.
I don't think this has ever been the case. If a license is not mentioned, it is always "All rights reserved" by the authors of the project, by the Berne convention (1886).
However, the United States did not join the Berne Convention until 1988, and prior to 1978 it did not automatically grant federal copyright when a work was created; instead you had to register your work with the Copyright Office in order to receive federal protection. There were also some state-level protections at the time that did not require registration, but apparently they weren't very strong.
While I don't know if license and copyright are the same thing, the film Night of the Living Dead was famously accidentally added to the public domain due to a forgotten copyright notice.
That's because the US was not part of the Berne Convention until 1989, so before that U.S. works often had protection only if certain formalities were met (like registration or notice).
Wow. I didn't know that. Looks like this is a very US thing. I looked up now and TIL that US adopted the Berne convention as late as 1989. I'm surprised. So this movie released in 1966 didn't have default "all rights reserved" due to Berne convention. But most European countries, like 80%, had adopted the Berne convention by 1925. So when software was developed in Europe they automatically got "all rights reserved".
Copyright is a right held over the ownership of a piece of IP. A license is a permission slip that allows you to exercise actions that would otherwise be reserved by copyright. There is no requirement for a license. It's not a state of a piece of IP.
Submitted title was "Mattermost say they will not clarify what license the project is under", which is against the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize." (https://news.ycombinator.com/newsguidelines.html)
I'm open to a different title than "LICENSE: _may be_ licensed to use source code; incorrect license grant", which is obscure enough to qualify as misleading if not linkbait. However, its replacement should be an accurate, neutral title that preferably uses representative language from the article itself (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...).
Re the "don't editorialize" bit in the rules: If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
> at this time we are not entertaining any changes as such.
Always wonder what leads people to write like this. What does "as such" add to the sentence? At least "at this time" is temporally conditional to the future, it has purpose.
Entertaining is posh "thinking about" or "interested in" so had the merit of being one word in place of two but so is "considering"
Well, it means no changes _intended as_ changes [pertaining to the topic at hand]; it implies there may be incidental alterations or differences, eg this issue might be addressed in a blanket legal revamp (whatever that's called) but, at least over this, they aren't pulling over the station wagon to argue with the screaming stakeholders in the back.
It's what we used to call "load-bearing vagueness"
Are you asking why the person who indirectly implied a question about the meaning of an ambiguous statement would leave it to the subtext to suggest they suspected that the unclear motive of the author of an ambiguous license was to leave some room for interpretation?
It's good English, it has actual meaning (your thinking of "at this time" is only one interpretation, it more likely means "We're not entertaining changes of that kind/nature" )
This would lead me to steer away from the project. They clearly like the way it is and that is unclear for everyone apart from maybe them. I am not even sure it benefits them though.
Not clarifying is the right thing to do. If the license is unclear, it should be fixed by a lawyer who knows what they are doing. Nobody else in the company should try to explain what the license actually means. Trying to explain a license creates informal interpretations and a legal paper trail that can confuse things even more and be used against the company later. It can even create a new contract under some jurisdictions.
Mattermost should be aware of the contra proferentem ('interpretation against the draftsman') doctrine of contractual interpretation. Ambiguity works against the party who provided the wording.
Sometimes a license is confusing to a layman but consists of standard, established legal jargon. Don't touch the code until you know what it means from a source that knows what they are talking about. Don't take internet guesses or opinions as fact.
This is why using standard well drafted licenses verbatim is so useful. Legal phrases that have established meanings clear things up for legally even if they confuse the rest of us.
Isn’t the right thing to do is for “the company” to clarify the license it offers its software and code under?
I think we understand that random devs on GitHub aren’t the right ones to resolve it, but I find it hard to believe the correct response is for the company to do nothing.
Legally, (in the US at least,) any ambiguity in the interpretation of a contract will most often be interpreted to benefit of the party that didn't draft the contract. In this case, the interpretation of license would likely benefit the user. But then, I'm only repeating what you've already said. So the ambiguity here doesn't benefit them legally speaking. I do agree, a frontline engineer shouldn't be trying to clarify the legal meaning in a github issue (without the legal expertise a good legal team would contribute). I don't agree that leaving the understanding to be ambiguous, is a solid legal decision.
Then, ethically. If someone ask if the license is trying to trap them, and all you do is shrug. You're not the good guy, ethically speaking.
> This is why using standard well drafted licenses verbatim is so useful. Legal phrases that have established meanings clear things up for legally even if they confuse the rest of us.
This may be pedantically true, but the part that trumps the US doctrine of contra proferentem, is the original intent that both parties likely understood. The legal interpretation, while you say it may be confusing for some people, doesn't override what the parties reasonably understood the contract to state. Or in this case, license, to grant.
That is to say, if you represent your offering as open source, and enjoy the benefits of such. It's a fundamental error to assume the courts will later back you up when you change your mind, and attempt a rug pull. And that's ignoring the ethical implications, which are enough for me to wanna peace out. (I.e. if you're pissing off your users and supporters, it was the wrong decision.)
If the license has been unclear for 8 years and the company hasn't bothered to get a lawyer to fix it then the "I'm just an engineer and don't know about this stuff" excuse doesn't apply. It's obvious that they are deliberately keeping the license vague and confusing to scare users into paying for a commercial edition while also calling their product "open source" for marketing purposes.
I really don’t think it’s unclear. The use of “you may be … in one of two ways” is unambiguous. The fact someone opened an issue is evidence that one person was confused by it, but we don’t know anything about that person. They may not be a native speaker of English. Or they might be trying to pick a fight because the licensing terms don’t agree with their viewpoint.
No, it is great that people bitch about it. These companies need to be called out and shamed. Now I know that I will not waste time evaluating Mattermost.
Are there any instances where a fork of a project has altered the license language for the purpose of reducing this kind of ambiguity?
Either the original license grant is expansive, so the clarification is welcome and the fork will become the standard unless/until the modification is upstreamed, or else the grant is restrictive, so the fork language is invalid, and the grantors face the risk of laches or other equitable defenses if they don't stop the fork from offering the less ambiguous interpretation that grantees rely on.
The last message on that thread before lieut-data responded and closed it was in 2023. Why did they even take action or reply to the issue in the first place? It could have easily gone under the rug.
If you are looking for another self-hostable alternative to Slack, Rocket chat[0] is also worth looking at.
I wasn't involved in any of the Dev Ops aspect when my former employer used them, but the search function actually worked which is better than I can say for Slack.
They want a business of some sort, not AGPL I'd assume. It doesn't look nefarious, just misguided. However a license switch will cause another hellstorm so I suppose they're in a tough spot.
> So, my question is: are the people that are upset with the "ambiguity" people who neither
> (a) want to buy a license nor
> (b) be bound by the AGPLv3?
No and no. People first want to know what the correct licenses are even before deciding which licensing path (including buying a commercial license) to take. You don't just commit to buying a commercial license without first understanding your options and comparing those options. People want to know what those options are.
People are upset that a company cannot get the simple matter of open source licensing right. It's the easiest kind of licensing. But they cannot get it right. These upset people would now never want to do business with this company.
People who would have otherwise been happy to purchase a commercial license would also stay away from the company because messing up open source licensing is a red flag. Who knows what kind of mess would be present in their commercial contracts. Yes, you can hire a lawyer to sort it out but I'd much rather do business with a company where I'm confident that the company is acting in good faith even before lawyers get involved.
> If so, I have no sympathy.
Your sympathy means nothing to me when I am picking vendors for my business. When I'm picking my vendors, I'm going to rely on professional legal expertise available to me, not the sympathies of random strangers on the internet.
I dug around for ~10 minutes and it's probably not an exaggeration to say that Mattermost might have the most confusing licensing of any software product in existence.
> 1. You are licensed to use compiled versions of the Mattermost platform produced by Mattermost, Inc. under an MIT LICENSE
So just the compiled versions, not the source code. Ok, at least that is clear. But - the MIT license explictly allows for modification and redistribution. So can I do that?
The next line.
> See MIT-COMPILED-LICENSE.md included in compiled versions for details
Except this file doesn't exist anywhere in the repo or outside.
> You may be licensed to use source code to create compiled versions not produced by Mattermost, Inc. in one of two ways:
> 1. Under the Free Software Foundation’s GNU AGPL v3.0, subject to the exceptions outlined in this policy; or
> 2. Under a commercial license available from Mattermost, Inc. by contacting commercial@mattermost.com
What does "may be licensed" mean? Do I have to contact them for a license? Or is an AGPL license implied?
> You are licensed to use the source code in Admin Tools and Configuration Files (server/templates/, server/i18n/,
server/public/, webapp/ and all subdirectories thereof) under the Apache License v2.0.
Sure, let's throw another license in there, because there weren't enough already.
> We promise that we will not enforce the copyleft provisions in AGPL v3.0 against you if your application ... [set of conditions]
WTF does a "promise" mean here? Is this actually AGPL or not?
Then they have copy pasted the entire Apache License, even though the project isn't licensed under Apache. Why??
Wouldn't that license also violate the AGPL? I mean, it does say, in section 7:
> All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying
So, my interpretation is that I am free to license it under the AGPL; there is no "well, we might decide to do that", and I can strip all conditions they place upon me and comply only with the AGPL, and legally there is nothing they can do about it.
yes, but that's not what happen here. this part of the AGPL is there to avoid people adding more restrictions, but here mattermost is loosening up the restrictions.
> > We promise that we will not enforce the copyleft provisions in AGPL v3.0 against you if your application ... [set of conditions]
I mean... I don't really see how they are. Technically they are but at the same time they aren't, because the set of conditions make the loosening of the AGPL a conditional thing. Which to me sounds like a violation of the AGPL because it's a further restriction: "We will (not) hold the AGPL against you... As long as you do these things..." I... Really don't think the AGPL was written to be... Abused? That way.
"We promise that we will not enforce" is perhaps a funny way not to grant a license, but making it sound like they do. This seems almost purposefully designed to look open-source to laypeople, while being carefully written in a way that ensures it will be vetoed by any corporate lawyer vetting the license.
This looks like either they are deliberately trying to trick people into thinking it's the MIT license, or have accidentally made the most confusing and nonsensical license ever.
MIT licensed binary in a source code repo does not make any sense.
I suspect that no lawyer checked off on this licensing strategy.
I'm also not so sure a serious business person checked off on annoying and scaring users that aren't but might in the future become customers or otherwise paying users.
If the binaries are licensed under MIT, can I decompile the binaries, clean up the source code and have a clean version of Mattermost for distribution?
It's not AGPL 3.0. The binaries are MIT, the codebase (from where the MIT binaries are built from) is AGPL 3.0, except for the bits of the codebase that are Apache 2.0, and there's some kind of a promise about not enforcing a part of AGPL if you don't link to their platform directly and exclusively use the bits of the code that are Apache 2.0, and also don't make a modified version of the software. And also you can just license it commercially too.
It says you "may be licensed" to use the source code under AGPL v3.0, but never actually makes an unambiguous statement that suchandsuch code is licensed under AGPL v3.0.
The concept of MIT licensing a compiled software artifact, but not the code used to generate the artifact, is also extremely strange.
Right, the correct way here is to simply grant _everyone_ a license to _everything_ under the terms of the AGPL (or whatever). You can then separately license portions under other terms.
You don't need to note the commercial licensing option in the license itself; it's irrelevant to that grant. You just state that elsewhere.
This is not true in the US where everything is automatically copyrighted and protected, so nothing goes directly into the public domain (even if the author wants it). Thus no license means that you have no license to use the code legally.
Correct. That's not true in Europe either. IIRC it's not true in Asia either. I don't understand why so many people who don't have even the most basic understanding or experience of licensing feel they must post their opinion as if they were facts. People are certainly entitled to their opinion. But so many comments here are speaking absolute nonsense about licensing as if they were facts. I genuinely don't understand why people feel compelled to do so.
The license seems perfectly clear in that it's multiply-licensed under AGPL, MIT, and corporate licensing based on different use cases. Maybe this guy has reading comprehension issues, but more likely he's just unhappy with the corporate part and wants to stir drama.
It does create confusion because adding extra clauses onto whether you can use the AGPL kind of defeats the point of the AGPL, and creates a contradiction because the different flavors of the GPL generally all have language that tries explicitly to prevent such a thing, which is a pretty classic piece of confusion (I've had it when negotiating employment contracts and it's shocking how many people seemingly just never read the documents they're offering).
(EDIT: though, having read the whole document, it seems like there is just a trademark carve-out, which is explicitly allowed under the AGPL, so this seems reasonably straightforward, except for the strange 'we promise not to enforce copyleft if you don't modify the code' which seems entirely redundant. Oh, and the 'licensed to use source code to create compiled version' which seems like a very strange phrasing)
You are licensed to use compiled versions of the Mattermost platform produced by Mattermost, Inc. under an MIT LICENSE
- See MIT-COMPILED-LICENSE.md included in compiled versions for details
You may be licensed to use source code to create compiled versions not produced by Mattermost, Inc. in one of two ways:
1. Under the Free Software Foundation’s GNU AGPL v3.0, subject to the exceptions outlined in this policy; or
2. Under a commercial license available from Mattermost, Inc. by contacting commercial@mattermost.com
"Subject to the exceptions" conflicts with the "no exceptions" wording in the GPL licenses, so I don't even see how any of this constitutes a valid license
I read the exceptions as a grant of additional rights to mattermost's copyright (but not to third parties), I don't think that conflicts.
I'm not sure that they actually granted a GPL license at all though. I could see this document being read as an advertisement that one might be for sale instead of a grant...
Licensing should never be left to "reading comprehension". If there is any doubt about the terms, a clarification should be requested. A clarification was requested here. The requested clarification was declined. If this matter was really so simple that simple "reading comprehension" would solve it, the project maintainers could have said so. But they didn't. And that they didn't holds more weightage than what some random stranger has to say about "reading comprehension".
... also some parts are Apache, and the wording around the AGPL bit is very weird:
> ... licensed to use source code to create compiled versions ...
Why's it calling out compiling specifically? Are they trying to imply you can't modify/distribute/etc the source? Presumably that would be a "further restriction" per the AGPL and hence ignorable, but it's sloppy at best and misleading at worse, which isn't great for a license document...
They didn't say you "might" be able to use it under the AGPL, but that you "may" be licensed to use it. Which, as a native speaker of American English, seems to be relatively clear in its meaning along the lines of what the GP poster stated. Of course, the various meanings of "may" in English might be subtle enough that I'd readily believe it's less clear to non-native speakers (or maybe even speakers of a different dialect), and it's unfortunate that Mattermost's lawyers aren't interesting in cleaning up the language.
The reality is licenses are all nonsense and none of it makes any sense. There could be secret patents nobody knows about. That precise wording written by American lawyers might not hold up in Chinese courts. There might be two compatible licenses, but one is 20x the length of the other; obviously some legal expert thought those extra words were needed - but are they? What's going on with linking and derivative works? Do you need to copy-and-paste the full legal blurb into every single file, or not? Why are some sections written in all caps, and does the reason for doing that apply globally? What if someone claimed to have the right to contribute code to an open project but actually had an employment contract meaning the code wasn't theirs to transfer? What's the copyright status of three-line stackoverflow answers?
The truth is nobody knows, and nobody cares. You and I won't get sued, probably, and if we do it's not like we'd have avoided it by reading the license. Might as well ignore it, like people ignore website terms of use and software click-through licenses and other legal mumbo-jumbo.
On the other hand, if you're the kind of gigantic enterprise that has policies on software licenses and a team of in-house lawyers and you can't use this software without greater license clarity? Well, you can get that licensing clarity with the enterprise version of the software.
I have used many open source tools and I have convinced my company to buy the commercial license of the said tools to get the enterprise version and support. Win-win for both parties. I use and improve my skills on the open source version of the tools I love. Our company uses great tools. The project maintainers get paid.
But I don't think I'll ever buy an enterprise version of the software which can't get the simple matter of open source licensing right. It isn't that hard. Thousands of developers are doing it.
If the tool was totally enterprise version only, I'd probably have less qualms about it. But to advertise a tool as open source license but then violate the open source licensing method both in spirit and the letter of the law is just too unprofessional for me that I'd steer clear of them in future and discourage anyone I know from spending their money on them.
It isn't really reasonable though. The word "may" implies possibility, not absolutism. So reading the sentence logically, at least to me, saying that I "may be" able to license it under the AGPL means that I might or might not be able to do that... And I have no way of knowing if I can or can't unless I... What, contact them?
I think in this case it implies choice for the user. There’s an implied “if you want to”. You may use this software if you want to in one of two ways:
That’s pretty clear to me (a native speaker from the UK) - i can’t really see how else it could be interpreted. As another poster said, it’s the same “may” as “you may go to the washroom” or “you may enter now” - which implies consent from the speaker.
Restrictions like this, where your code is only available for use for certain purposes by certain kinds of users, are explicitly rejected by both the open source and free software movements. If a developer wants to license their code this way, they should admit that what they're building is not an open source platform. Then they can simply use one of the licenses like CC NC or SSPL that are designed for that purpose, instead of trying to stitch together an unfree license out of a bunch of free ones.
I don’t think they’re worried about “my business.”
Open source is notorious for being implemented in $$$ COTS and commerce and then contributing $0 in money and then even less in contribs bug fixes or sharing in house tweaks,isn’t this what Wordpress has been melting down over for a year or two now?
And I’m sure many more projects are pissed off or resenting their chains but not making an ugly scene about it.
Something has to give here.
I don’t have a dog in this fight other than to say that what mattermost went with here “is a choice” , and I have “a choice” whether to accept these terms.
I’m interested in watching how it plays out though. They cast their die. Problems have solutions. We could all get into whether this solution is viable or not — doesn’t matter this is what they went with and they made it clear they’re not taking user input on it. I’m not even a user so I expect them to care even less about my thoughts.
Im supportive of anyone trying to find an equitable balance but maybe that’s a situation where they could roll their own license with these clauses and exclusions.
Its not like Microsoft or iTunes user agreements aren’t complete bullshit, yet people click okay and use all that.
Someone tried to shake our company down once. They posted all this stock imagery on the web, waited for someone to use it with an ambiguously worded attribution policy, then have a third party chase you down and demand $100k but will settle for $5k.
It turns out we did attribute the right way (in our terms of use) and could prove it with logs of when we added the language and when it was removed after we removed the image, but I am sure they nail people all the time with this strategy. This didnt stop them from sending 20 emails, demand lawyers get on the phone, etc.
There are a couple of similar scams like this out there.
Oh that's a classic trick. It's been going on for decades. One example I am particularly familiar with is that of Larry Philpot / User:Nightshooter on Wikimedia Commons. He would upload his photos there with an addendum on how he should be attributed. Any slight impression in the attribution would be followed by legal action. It was obviously a copyright troll mechanism and now all of his photos on Wikimedia Commons have forced attribution affixed by users that warns others that he sues people.
His stuff is so widespread that the consensus on Wikimedia Commons was to keep his photos and add a warning so that no one ends up accidentally using it. Some accused him of sock-puppetry to get his content into a place.
Today, intellectual property maximalism is a much more mainstream position so perhaps modern Internet users will think that he is in the right, but I think it's a bit much.
Here's the thread where he's discussed: https://commons.wikimedia.org/wiki/Commons:Administrators%27...
Here's an example forced-attribution photo: https://commons.wikimedia.org/wiki/File:Flaming_Lips.jpg
Could he ever win a case in court? At least the Swedish legal system is based a lot around common sense and good faith and such a trap would likely end up with the one who sued having to pay the legal costs for both parties.
Larry Philpot actually did win a case in court. His case was first dismissed but then on appeal the Fourth Circuit granted him the win: https://law.justia.com/cases/federal/appellate-courts/ca4/21...
I am honestly flabbergasted that his pictures weren't expunged with great prejudice. what is the value they add to wikimedia that makes being associated with this sort of sleaze okay?
A valid question. These kinds of approaches are a pretty standard attack in the copyleft world. I don't know on what basis the community chooses forced-attribution vs deletion.
Marco Verch managed to get his stuff deleted: https://commons.wikimedia.org/wiki/Commons:Deletion_requests...
So it's a question of the execution of the operation really.
By the way, do you also have the same user handle on Reddit? I have the vaguest memory of you quoting someone else on the subject of denying a person suffering on the street drugs that went something to the effect of not wanting to do it because denying such a man drugs deny him his only escape from such reality or something of the sort.
I never did find that comment again, and it's been at the back of my mind for years (perhaps even a decade) and now I'm not even sure if I've asked you this before.
yes that was me! I love that quote (it's by samuel johnson), so it's really moving to hear it made an impression on someone else too. here it is:
What signifies, says some one, giving halfpence to beggars? they only lay it out in gin or tobacco. "And why should they be denied such sweeteners of their existence (says Johnson)? it is surely very savage to refuse them every possible avenue to pleasure, reckoned too coarse for our own acceptance. Life is a pill which none of us can bear to swallow without gilding; yet for the poor we delight in stripping it still barer, and are not ashamed to shew even visible displeasure, if ever the bitter taste is taken from their mouths."
-- Piozzi: Anecdotes
Ha, perfect! Well that's one mystery solved. Thank you.
If you read the discussion, they weren't kept because of their encyclopedic value, or because they were "widespread". I'm not sure why the parent commenter said that.
They were kept to preserve a record of their having been uploaded, and to not create a legal risk for third parties who might be relying on the Commons page as their way to provide attribution.
The original proposal was to keep the image pages with the metadata, but delete the image files. That turned out to have some technical hurdles, so instead the images were overwritten with versions containing big ugly attribution messages, to discourage their use.
ah thanks, that makes a lot of sense.
I don’t understand why this is sleazy TBH. It’s CC-BY-SA. If attribution isn’t provided it’s a valid case. I once uploaded a map of my state with all the districts in labels in English and my language Tamil to commons under CC-BY-SA. It was used left right and centre, from publications, map sellers to the point I can see them hanging in offices. It’s always pained me, nothing could be done about it. Now I didn’t want money, would have liked the recognition, but would have settled for just seeing the CC-BY-SA logo on it at the least.
CC-BY-SA-4.0 fixes the specific technique of spreading one's work through the commons and then charging for inadequate attribution by allowing for a 30 day cure period on notification. This anti-copyleft-troll clause should likely permit your use-case.
Ah! I see. My biggest annoyance was none of the derivatives ever made it back to the commons.
it's sleazy because the intent wasn't to be properly credited, it was to use a loophole in the CC-BY-SA license to sue people for minor typos or mistakes in the exact form of the attribution even when they had clearly intended to give proper attribution.
I get what you are saying now. That does makes a difference and actually hurts the copyleft culture.
I was curious about this a few years ago so I took a look around and found another case, the one of Thomas Wolf / User:Der_Wolf_im_Wald, but this guy seems to be getting away with it because he has a 'no-derivatives' box on the image page. He has the same modus operandi:
1. Post the photo to Wikimedia Commons
2. Mark it CC-BY or derivative (say CC-BY-SA etc.)
3. Have a highly precise attribution clause
4. Sue everyone who uses it without the specific attribution
The funny thing about this copyleft troll is that Someone Who Is Not Him creates accounts on Reddit (e.g. this one[0]) that post exclusively about how they made a mistake and the photographer was well within his rights to sue and you should take him very seriously and negotiate the amount.
> We actually violated copyright law before he wrote to us. So it was our mistake and we apologized for that.
I really should create a List page for this on my personal wiki so I can remember all these guys. I find this kind of behavior galling.
People did bring up this stuff here: https://commons.wikimedia.org/wiki/User_talk:Der_Wolf_im_Wal.....
But since I don't speak German well enough and inevitably this is going to end up in such a situation where you have to, I think it best I don't pursue deletion here. Hopefully a German speaker will see fit, referencing the other cases here.
0: https://www.reddit.com/user/No_Significance7032/
His cases that I could find are where the company republishing his photos didn't attribute them to him at all so it seems fair to sue (except when it turned out to be fair use). What is this attribution error you mentioned? CC BY-SA 3.0 is pretty onerous "You must give appropriate credit, provide a link to the license, and indicate if changes were made." All 3 things are required. Maybe every CC-BY photographer should be suing newspapers for stealing their work, shouldn't they?
Sounds like the creative commons attribution scam as detailed by Cory Doctorow https://pluralistic.net/2023/04/01/pixsynnussija/
It seems obvious that this ‘may’ is the ‘may’ used in the sense of granting permission: “you may go to the restroom”, “you may begin eating”, “you may ask questions now”, “you may kiss the bride” etc.
All these are clear. The wedding officiant isn’t saying “You might have permission to kiss the bride! Just try it and we’ll find out! Ha ha!”
To interpret this as saying that you might be licensed is just as nonsensical as that in this context. It’s in a file named “LICENSE.txt” explicitly meant to describe the license terms.
Would ‘are’ be better? I’d say yes, but it’s silly to argue that this isn’t proper English for granting permission.
The counterpoint is that three sentences away, there's a clear "You are licensed to use the source code" for the non-server parts. It can certainly be argued that there's an intentional difference. Extended court cases have been fought over mere punctuation. In any case, the FUD that this creates is enough to make anyone think twice about reusing the server code, especially as they have refused to clarify for many years now.
Also, the ambiguity is not only in the "you may be" part, but also in the "to create compiled versions" part. Open source is more than creating compiled versions of source code.
This really seems like a dual license situation where they are saying "Let's encourage Open Source, but if you want to just use our work to make yourself rich and not even acknowledge you're using us then fuck you, pay us."
I expect this to become more common as companies routinely infringe on OSS licenses while simultaneously many companies are hesitant to use OSS because of licenses. This at least gives an out for the good actors and allow devs to make money (other than being reliant on donations, because... that's worked out...).
But maybe I'm misunderstanding? If so, I don't know what I'm missing
> But maybe I'm misunderstanding? If so, I don't know what I'm missing
You're apparently missing the two points I made in the post you are replying to, or at the very least you're not responding to them. By which I don't mean to say they are necessarily valid points.
My bad, I was confused given the context of the comment you responded to. Maybe I should quote the next line instead?
So I read Part of the code is open source. Part of the code is source available (source visible).Again, I am open to misunderstanding but that's my read.
how you jump from AGPL to apache?
The commenter doesn’t jump to Apache, the license does…if you scroll down it’s the Apache license not the AGPL.
For anyone that needs the link: https://github.com/mattermost/mattermost/blob/master/LICENSE...
Also note that they have an enterprise license (/server/enterprise/License): https://github.com/mattermost/mattermost/blob/master/server/...
The README on the enterprise directory also links to a page with more detail (FAQ): https://docs.mattermost.com/product-overview/frequently-aske...
Only because they incorporate some apache code in their largely AGPL licensed project.
Licenses are not about what things "seem", their text should be clear enough to hold up to legal scrutiny, not just what some person who speaks some local variant of English thinks is obvious.
Even if you're a lawyer, whether it's obvious to you is irrelevant: it has to be obvious to everyone. And if it's not (and it should be abundantly clear that it's not, given the linked discussion), the license needs fixing.
Speaking only for myself here. But I don't have the arrogance to assume that I can interpret legalese the way I interpret English. When shit goes to court, saying here's what I thought "may" means is not going to be a legal defense strategy. There's a reason I hire lawyers for this kind of shit because they are really good at their job and I won't pretend I know their job better than they do.
you'd be surprised how much your command of the english language translates into legalise.
Yes, there's a definite codex of legal terms that have specific legal meaning but sound like "open to interpretation" english, but, those are vanishingly small.
Largely, if you read defensively and try to read what is not said, then you get very very far.
Source: spent about half-a-decade with very expensive swiss lawyers.
> Largely, if you read defensively and try to read what is not said, then you get very very far.
How far is "very, very far"? Is it far enough that, if there were a lawsuit, my liability would truly be capped at €10,000? Because that's how much liability I can afford. If that "very very far" guarantees such a limit, then yes, I agree it is very very far. But my experience tells me that without formal legal training, I cannot be confident that I have interpreted legal language correctly enough to rely on that conclusion.
Open source licenses are often relatively readable, but corporate contracts and other legal texts, including those from companies that market themselves as open source in questionable ways, can contain subtleties and loopholes. As a layperson, it is difficult to know how much exposure I might have if I misunderstand a detail and act in contradiction of the license terms.
Perhaps we are simply on opposite sides of the D-K effect here. Or maybe you simply are good with legalese and I'm being unnecessarily skeptical.
If experience with lawyers matters, I have spent many years working with lawyers across Europe. If that taught me anything, it is to avoid assuming that I can reliably interpret legal language without proper training.
Yes, I can usually grasp perhaps 80 percent of what a contract is saying at a high level. But in every contract we reviewed, lawyers consistently found issues or implications I would not have noticed. They then either refined the contract or advised taking a calculated risk. So I think it is reasonable for me to remain cautious about my own ability to interpret legal language with confidence.
Liability is capped by court (e.g. small claims court) or by specific claim type depending on the legislation of the jurisdiction (e.g. speeding tickets typically have set fines varying by state).
Liability is not capped by your ability to understand the law. If that is your concern, you shouldn't be doing business anywhere, US or otherwise.
> Liability is capped by court (e.g. small claims court) or by specific claim type depending on the legislation of the jurisdiction (e.g. speeding tickets typically have set fines varying by state).
What you are saying is partly true and overly simplified. Are you a lawyer? Do you have legal expertise? If not, I don't understand why you feel compelled to advise on things you understand so little yourself? Are you going to compare my contract with my vendor with speeding ticket? Are you kidding me?
Comparing contractual liability to speeding fines makes me think you have not a clue of what you're talking about. Speeding penalties are statutory and predefined. Commercial liability usually is not. In Europe, most serious business disputes never go near small claims courts. They go to ordinary civil courts or arbitration, where damages depend on the contract, applicable law, and the specific facts. There is often no automatic cap unless the contract explicitly sets one, and even then its enforceability depends on jurisdiction and circumstances.
Small claims limits only restrict which court hears the case, not the total liability. A claimant can often file in a higher court or pursue related claims elsewhere. And in cross-border European business, jurisdiction, governing law, and enforcement become additional risks. Getting this wrong can expose you to far more liability than you expected.
Liability is not limited by your personal understanding of the law. That is why businesses do not rely on guesswork. Contracts are reviewed, liability caps are negotiated, insurance is obtained and lawyers are paid to spot risks that non-lawyers routinely miss.
> If that is your concern, you shouldn't be doing business anywhere, US or otherwise.
Yes, that is my concern. I do business in Europe. By paying actual laywers. And I'll continue to do so. Thank you very much.
> saying here's I thought "may" means is not going to be a legal defense strategy
It is - it might not be successful (the court may rule against you) - but if what you thought "may" meant was close to what a "reasonable person" would have thought, you may be ruled against with no or low penalty.
> It is - it might not be successful (the court may rule against you)
Exactly what I said.
But it is saying "You may be licensed to use source code..." which is analogous to "You may have permission to kiss the bride" if being licensed means having permission. It could mean that Mattermost may have licensed it to you in one way or the other, or neither, at their discretion. If it was written like a priest, it would have said "You may use the source code..." and this doubt wouldn't exist.
Is the bad publicity worth it with this kind of rug pull to "we are opensource, but not really"? I get that an open source product can get you some free (word of mouth) and good publicity. But in general, open source is also strongly associated with "free" (as in you don't have to pay money for it). So if you do want to make money from a software product, weigh the pros and cons carefully - commercial open source products do tend to be less profitable than commercial closed-source versions. If you are ok with that, go with the open source business model. Otherwise, stick to the closed-source business model from the get go. Be honest from the start - brand damage is really costly to repair.
> But in general, open source is also strongly associated with "free"
In the anglophone world, yes. In many other parts of the world, the gratis/libre distinction is clear in the language used.
I believe they generally refer to themselves as open-core.
From this githubpage:
"Mattermost is an open source platform for secure collaboration across the entire software development lifecycle.. "
But also: "open source" -> "open core" (9 months ago) [1]
[1] https://github.com/mattermost/mattermost/commit/0cc906d07e73...
Ok, their license is pretty strange: https://github.com/mattermost/mattermost/blob/master/LICENSE...
MIT for binaries distributed by Mattermost.
But, if you compile it yourself: GNU AGPL v3.0 XOR Paid-for Enterprise License
Then, for some odd reason, they append the text of Apache License Version 2.0!!!
The frontend parts are explicitly and correctly licensed under the Apache license in the header of the same file.
They also have a FAQ: https://docs.mattermost.com/product-overview/faq-license.htm...
Note that they have multiple licenses. This isn't entirely uncommon. The difference licenses apply to different things.
Ooh, I see it now, right in the middle:
"...You are licensed to use the source code in Admin Tools and Configuration Files (server/templates/, server/i18n/, server/public/, webapp/ and all subdirectories thereof) under the Apache License v2.0...."
I'm already shutting down my private instance of Mattermost, no thank you. I'm thinking of Zulip, at least they aren't pulling this shenanigans.
I can whole heartedly recommend Zulip. They really get open source, allow you to own your data, and their UI despite being a bit quirky is IMO the best out there for handling complex conversations (the ability for admins to retrospectively move mesages between topics like old school forum software being a real standout feature).
I run a Zulip server and it's pretty good. The way they organise channels is extremely convoluted unfortunately (I wish they would just use absolutely standard channels layout like every other chat, and have everyone able to see them on join!) but well, beggars can't be choosers.
Interesting, I've also heard the exact opposite opinion [0] where Zulip’s non-standard approach is seen as its main strength.
[0]: https://chaos.social/@yorgos/115931944888149528
People go through all this trouble to host convoluted chat systems, and all this time IRC is right there. There's modern servers like Ergo and modern clients like Halloy (or for the JavaScript addicts: Convos, The Lounge, Kiwi, ...) providing all the multi-device history sharing and emoji reactions you could need. All on top of a super simple, extremely battle tested protocol.
But according to https://ircv3.net/software/clients, none of the clients you mentioned actually support emoji reactions (draft/react), and other features like multi-line messages and image uploads are likewise extremely limited in server/client support. So, for the time being, you can't use these features if you want to actually be interoperable with existing IRC users and their clients. Sounds like if you want decentralized, Matrix is still the better bet.
I have hosted IRC before but im not about to explain all the nuances to my non technical friends and family. At that point I will just use XMPP.
That seems to be what most slack abandoners end up on.
Isn't this by default unlicensed then? I would avoid it anyway. Absolutely no need for that risk.
Yes, if the licensing terms are unclear, to err on the side of caution, it is best to assume "All rights reserved" by the authors of the software so you don't accidentally violate the authors' rights. And then hire a lawyer to sort this matter for you.
Yes. Also not to be confused with being Unlicense-d [0], because heaven forbid we use reasonable names for anything.
[0] https://opensource.org/license/unlicense
It used to be like that, yes. If you didn't mention the license, it was in public domain. Those times are long gone though.
> If you didn't mention the license, it was in public domain.
I don't think this has ever been the case. If a license is not mentioned, it is always "All rights reserved" by the authors of the project, by the Berne convention (1886).
However, the United States did not join the Berne Convention until 1988, and prior to 1978 it did not automatically grant federal copyright when a work was created; instead you had to register your work with the Copyright Office in order to receive federal protection. There were also some state-level protections at the time that did not require registration, but apparently they weren't very strong.
While I don't know if license and copyright are the same thing, the film Night of the Living Dead was famously accidentally added to the public domain due to a forgotten copyright notice.
That's because the US was not part of the Berne Convention until 1989, so before that U.S. works often had protection only if certain formalities were met (like registration or notice).
Wow. I didn't know that. Looks like this is a very US thing. I looked up now and TIL that US adopted the Berne convention as late as 1989. I'm surprised. So this movie released in 1966 didn't have default "all rights reserved" due to Berne convention. But most European countries, like 80%, had adopted the Berne convention by 1925. So when software was developed in Europe they automatically got "all rights reserved".
I believe that was a forgotten renewal of copyright status.
Copyright is a right held over the ownership of a piece of IP. A license is a permission slip that allows you to exercise actions that would otherwise be reserved by copyright. There is no requirement for a license. It's not a state of a piece of IP.
Unlicensed does not mean public domain
Submitted title was "Mattermost say they will not clarify what license the project is under", which is against the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize." (https://news.ycombinator.com/newsguidelines.html)
I'm open to a different title than "LICENSE: _may be_ licensed to use source code; incorrect license grant", which is obscure enough to qualify as misleading if not linkbait. However, its replacement should be an accurate, neutral title that preferably uses representative language from the article itself (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...).
Re the "don't editorialize" bit in the rules: If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
> at this time we are not entertaining any changes as such.
Always wonder what leads people to write like this. What does "as such" add to the sentence? At least "at this time" is temporally conditional to the future, it has purpose.
Entertaining is posh "thinking about" or "interested in" so had the merit of being one word in place of two but so is "considering"
Are we not entertained?
Well, it means no changes _intended as_ changes [pertaining to the topic at hand]; it implies there may be incidental alterations or differences, eg this issue might be addressed in a blanket legal revamp (whatever that's called) but, at least over this, they aren't pulling over the station wagon to argue with the screaming stakeholders in the back.
It's what we used to call "load-bearing vagueness"
> "load-bearing vagueness"
Stealing this. That's ACE!!
i think it's just meant to add an air of poise and propriety as such
Are you asking why the person who published code with an ambiguous license also answers questions ambiguously?
Are you asking why the person who indirectly implied a question about the meaning of an ambiguous statement would leave it to the subtext to suggest they suspected that the unclear motive of the author of an ambiguous license was to leave some room for interpretation?
Not as such, no. But I would entertain making a claim I was, should I become sufficiently enthused.
It's good English, it has actual meaning (your thinking of "at this time" is only one interpretation, it more likely means "We're not entertaining changes of that kind/nature" )
Ah, so any changes they did entertain, would be changes, but they disclaim making changes such as these for this purpose?
> so any changes they did entertain
I guess, as long as people remember that zero is a possible number in 'any'
> but they disclaim making changes such as these for this purpose?
That's my read
"I know I'm being unreasonable. But the impression I'd like to give is different than that."
This would lead me to steer away from the project. They clearly like the way it is and that is unclear for everyone apart from maybe them. I am not even sure it benefits them though.
Not clarifying is the right thing to do. If the license is unclear, it should be fixed by a lawyer who knows what they are doing. Nobody else in the company should try to explain what the license actually means. Trying to explain a license creates informal interpretations and a legal paper trail that can confuse things even more and be used against the company later. It can even create a new contract under some jurisdictions.
Mattermost should be aware of the contra proferentem ('interpretation against the draftsman') doctrine of contractual interpretation. Ambiguity works against the party who provided the wording.
Sometimes a license is confusing to a layman but consists of standard, established legal jargon. Don't touch the code until you know what it means from a source that knows what they are talking about. Don't take internet guesses or opinions as fact.
This is why using standard well drafted licenses verbatim is so useful. Legal phrases that have established meanings clear things up for legally even if they confuse the rest of us.
Isn’t the right thing to do is for “the company” to clarify the license it offers its software and code under?
I think we understand that random devs on GitHub aren’t the right ones to resolve it, but I find it hard to believe the correct response is for the company to do nothing.
> Not clarifying is the right thing to do.
Legally? Likely not. Ethically, definitely not.
Legally, (in the US at least,) any ambiguity in the interpretation of a contract will most often be interpreted to benefit of the party that didn't draft the contract. In this case, the interpretation of license would likely benefit the user. But then, I'm only repeating what you've already said. So the ambiguity here doesn't benefit them legally speaking. I do agree, a frontline engineer shouldn't be trying to clarify the legal meaning in a github issue (without the legal expertise a good legal team would contribute). I don't agree that leaving the understanding to be ambiguous, is a solid legal decision.
Then, ethically. If someone ask if the license is trying to trap them, and all you do is shrug. You're not the good guy, ethically speaking.
> This is why using standard well drafted licenses verbatim is so useful. Legal phrases that have established meanings clear things up for legally even if they confuse the rest of us.
This may be pedantically true, but the part that trumps the US doctrine of contra proferentem, is the original intent that both parties likely understood. The legal interpretation, while you say it may be confusing for some people, doesn't override what the parties reasonably understood the contract to state. Or in this case, license, to grant.
That is to say, if you represent your offering as open source, and enjoy the benefits of such. It's a fundamental error to assume the courts will later back you up when you change your mind, and attempt a rug pull. And that's ignoring the ethical implications, which are enough for me to wanna peace out. (I.e. if you're pissing off your users and supporters, it was the wrong decision.)
> If the license is unclear, it should be fixed by a lawyer who knows what they are doing.
It's been 7 years and not fixed, apparently.
If the license has been unclear for 8 years and the company hasn't bothered to get a lawyer to fix it then the "I'm just an engineer and don't know about this stuff" excuse doesn't apply. It's obvious that they are deliberately keeping the license vague and confusing to scare users into paying for a commercial edition while also calling their product "open source" for marketing purposes.
I really don’t think it’s unclear. The use of “you may be … in one of two ways” is unambiguous. The fact someone opened an issue is evidence that one person was confused by it, but we don’t know anything about that person. They may not be a native speaker of English. Or they might be trying to pick a fight because the licensing terms don’t agree with their viewpoint.
Counterpoint: https://news.ycombinator.com/item?id=46862339
As I said, nobody should touch unclear license.
Just forget the company and software, there is no reason to bitch about it. 7 years is too long to fix.
No, it is great that people bitch about it. These companies need to be called out and shamed. Now I know that I will not waste time evaluating Mattermost.
This is such a bizarre take man. What are you even on about? Maybe take your own advice.
Are there any instances where a fork of a project has altered the license language for the purpose of reducing this kind of ambiguity?
Either the original license grant is expansive, so the clarification is welcome and the fork will become the standard unless/until the modification is upstreamed, or else the grant is restrictive, so the fork language is invalid, and the grantors face the risk of laches or other equitable defenses if they don't stop the fork from offering the less ambiguous interpretation that grantees rely on.
Fork as legal test case, if you will.
The last message on that thread before lieut-data responded and closed it was in 2023. Why did they even take action or reply to the issue in the first place? It could have easily gone under the rug.
If you are looking for another self-hostable alternative to Slack, Rocket chat[0] is also worth looking at.
I wasn't involved in any of the Dev Ops aspect when my former employer used them, but the search function actually worked which is better than I can say for Slack.
[0]https://github.com/RocketChat/Rocket.Chat/blob/develop/LICEN...
Curious if anyone has worked on just expanding IRC into an internal product? That’s more or less how slack started.
They want a business of some sort, not AGPL I'd assume. It doesn't look nefarious, just misguided. However a license switch will cause another hellstorm so I suppose they're in a tough spot.
I am not a lawyer.
My reading of the license is: either (a) buy a license or (b) be bound by the AGPLv3 -- with _very_ limited exceptions.
So, my question is: are the people that are upset with the "ambiguity" people who neither (a) want to buy a license nor (b) be bound by the AGPLv3?
If so, I have no sympathy.
> So, my question is: are the people that are upset with the "ambiguity" people who neither
> (a) want to buy a license nor
> (b) be bound by the AGPLv3?
No and no. People first want to know what the correct licenses are even before deciding which licensing path (including buying a commercial license) to take. You don't just commit to buying a commercial license without first understanding your options and comparing those options. People want to know what those options are.
People are upset that a company cannot get the simple matter of open source licensing right. It's the easiest kind of licensing. But they cannot get it right. These upset people would now never want to do business with this company.
People who would have otherwise been happy to purchase a commercial license would also stay away from the company because messing up open source licensing is a red flag. Who knows what kind of mess would be present in their commercial contracts. Yes, you can hire a lawyer to sort it out but I'd much rather do business with a company where I'm confident that the company is acting in good faith even before lawyers get involved.
> If so, I have no sympathy.
Your sympathy means nothing to me when I am picking vendors for my business. When I'm picking my vendors, I'm going to rely on professional legal expertise available to me, not the sympathies of random strangers on the internet.
>> So, my question is: are the people that are upset with the "ambiguity" people who neither (a) want to buy a license nor (b) be bound by the AGPLv3?
> No and no.
[...]
>> If so, I have no sympathy.
> Your sympathy means nothing to me
Well, regardless... via the rules of logical implication, you have it.
Hah! I made a logical error. I should have said:
Well, regardless... via the rules of logical implication, you can't be certain that you don't have it.
I would just stay away from Mattermost. Don't host, don't use, don't contribute. Treat as source-available.
I dug around for ~10 minutes and it's probably not an exaggeration to say that Mattermost might have the most confusing licensing of any software product in existence.
From the license page on their repo (https://github.com/mattermost/mattermost/blob/master/LICENSE...):
> 1. You are licensed to use compiled versions of the Mattermost platform produced by Mattermost, Inc. under an MIT LICENSE
So just the compiled versions, not the source code. Ok, at least that is clear. But - the MIT license explictly allows for modification and redistribution. So can I do that?
The next line.
> See MIT-COMPILED-LICENSE.md included in compiled versions for details
Except this file doesn't exist anywhere in the repo or outside.
> You may be licensed to use source code to create compiled versions not produced by Mattermost, Inc. in one of two ways:
> 1. Under the Free Software Foundation’s GNU AGPL v3.0, subject to the exceptions outlined in this policy; or > 2. Under a commercial license available from Mattermost, Inc. by contacting commercial@mattermost.com
What does "may be licensed" mean? Do I have to contact them for a license? Or is an AGPL license implied?
> You are licensed to use the source code in Admin Tools and Configuration Files (server/templates/, server/i18n/, server/public/, webapp/ and all subdirectories thereof) under the Apache License v2.0.
Sure, let's throw another license in there, because there weren't enough already.
> We promise that we will not enforce the copyleft provisions in AGPL v3.0 against you if your application ... [set of conditions]
WTF does a "promise" mean here? Is this actually AGPL or not?
Then they have copy pasted the entire Apache License, even though the project isn't licensed under Apache. Why??
Oh but that's not all.
There's a separate license page at https://docs.mattermost.com/product-overview/faq-license.htm..., which says:
> Mattermost Team Edition (Open Source) - Open Source MIT License.
Uh, what? That goes against everything said in LICENSE.txt. So now we are back to fully open source?
Wouldn't that license also violate the AGPL? I mean, it does say, in section 7:
> All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying
So, my interpretation is that I am free to license it under the AGPL; there is no "well, we might decide to do that", and I can strip all conditions they place upon me and comply only with the AGPL, and legally there is nothing they can do about it.
yes, but that's not what happen here. this part of the AGPL is there to avoid people adding more restrictions, but here mattermost is loosening up the restrictions.
> > We promise that we will not enforce the copyleft provisions in AGPL v3.0 against you if your application ... [set of conditions]
I mean... I don't really see how they are. Technically they are but at the same time they aren't, because the set of conditions make the loosening of the AGPL a conditional thing. Which to me sounds like a violation of the AGPL because it's a further restriction: "We will (not) hold the AGPL against you... As long as you do these things..." I... Really don't think the AGPL was written to be... Abused? That way.
"We promise that we will not enforce" is perhaps a funny way not to grant a license, but making it sound like they do. This seems almost purposefully designed to look open-source to laypeople, while being carefully written in a way that ensures it will be vetoed by any corporate lawyer vetting the license.
This looks like either they are deliberately trying to trick people into thinking it's the MIT license, or have accidentally made the most confusing and nonsensical license ever.
MIT licensed binary in a source code repo does not make any sense.
This is a huge red flag.
Sounds like potentially expensive legal case if they try to enforce it. Opens it up to many arguments in many jurisdictions.
I suspect that no lawyer checked off on this licensing strategy.
I'm also not so sure a serious business person checked off on annoying and scaring users that aren't but might in the future become customers or otherwise paying users.
If the binaries are licensed under MIT, can I decompile the binaries, clean up the source code and have a clean version of Mattermost for distribution?
Yes you can
You should read the license, it seems somewhat insane to be honest: https://github.com/mattermost/mattermost/blob/master/LICENSE...
Looks pretty logical to me...
It is AGPL 3.0, except they give you slightly more rights with a promise not to enforce certain provisions in certain circumstances.
It's not AGPL 3.0. The binaries are MIT, the codebase (from where the MIT binaries are built from) is AGPL 3.0, except for the bits of the codebase that are Apache 2.0, and there's some kind of a promise about not enforcing a part of AGPL if you don't link to their platform directly and exclusively use the bits of the code that are Apache 2.0, and also don't make a modified version of the software. And also you can just license it commercially too.
What do you think about it sounds insane?
It says you "may be licensed" to use the source code under AGPL v3.0, but never actually makes an unambiguous statement that suchandsuch code is licensed under AGPL v3.0.
The concept of MIT licensing a compiled software artifact, but not the code used to generate the artifact, is also extremely strange.
Right, the correct way here is to simply grant _everyone_ a license to _everything_ under the terms of the AGPL (or whatever). You can then separately license portions under other terms.
You don't need to note the commercial licensing option in the license itself; it's irrelevant to that grant. You just state that elsewhere.
I think more software people should be doing that. Just confusing the hell out or lawyers (armchair and proper).
GPL and AGLP both use the word "may" 31 times.
If you aren't comfortable with the word "may", you'll have a lot of trouble with open source languages.
https://www.gnu.org/licenses/gpl-3.0.en.html
https://www.gnu.org/licenses/agpl-3.0.en.html
Go on Zulip or Anytype
if there is no license, then it is public domain if they put code on a website
This is not true in the US where everything is automatically copyrighted and protected, so nothing goes directly into the public domain (even if the author wants it). Thus no license means that you have no license to use the code legally.
Correct. That's not true in Europe either. IIRC it's not true in Asia either. I don't understand why so many people who don't have even the most basic understanding or experience of licensing feel they must post their opinion as if they were facts. People are certainly entitled to their opinion. But so many comments here are speaking absolute nonsense about licensing as if they were facts. I genuinely don't understand why people feel compelled to do so.
Or any country the US has a reciprocal copyright treaty with, which is all but a vanishingly small set of countries.
A work is protected by copyright the moment it's authored, and all rights are reserved unless it's explicitly licensed otherwise.
Not applicable and also incorrect.
The license seems perfectly clear in that it's multiply-licensed under AGPL, MIT, and corporate licensing based on different use cases. Maybe this guy has reading comprehension issues, but more likely he's just unhappy with the corporate part and wants to stir drama.
It does create confusion because adding extra clauses onto whether you can use the AGPL kind of defeats the point of the AGPL, and creates a contradiction because the different flavors of the GPL generally all have language that tries explicitly to prevent such a thing, which is a pretty classic piece of confusion (I've had it when negotiating employment contracts and it's shocking how many people seemingly just never read the documents they're offering).
(EDIT: though, having read the whole document, it seems like there is just a trademark carve-out, which is explicitly allowed under the AGPL, so this seems reasonably straightforward, except for the strange 'we promise not to enforce copyleft if you don't modify the code' which seems entirely redundant. Oh, and the 'licensed to use source code to create compiled version' which seems like a very strange phrasing)
Hopefully I'm not violating copyright by taking this small chunk of their LICENSE.txt, but this appears to be the language that some want clarified:
https://github.com/mattermost/mattermost/blob/master/LICENSE...
----
"Subject to the exceptions" conflicts with the "no exceptions" wording in the GPL licenses, so I don't even see how any of this constitutes a valid license
I read the exceptions as a grant of additional rights to mattermost's copyright (but not to third parties), I don't think that conflicts.
I'm not sure that they actually granted a GPL license at all though. I could see this document being read as an advertisement that one might be for sale instead of a grant...
(Not a lawyer)
AGPL does not say "no exceptions". AGPL explicity allows exceptions:
https://github.com/mattermost/mattermost/blob/master/LICENSE...
https://www.gnu.org/licenses/agpl-3.0.en.html
Licensing should never be left to "reading comprehension". If there is any doubt about the terms, a clarification should be requested. A clarification was requested here. The requested clarification was declined. If this matter was really so simple that simple "reading comprehension" would solve it, the project maintainers could have said so. But they didn't. And that they didn't holds more weightage than what some random stranger has to say about "reading comprehension".
... also some parts are Apache, and the wording around the AGPL bit is very weird:
> ... licensed to use source code to create compiled versions ...
Why's it calling out compiling specifically? Are they trying to imply you can't modify/distribute/etc the source? Presumably that would be a "further restriction" per the AGPL and hence ignorable, but it's sloppy at best and misleading at worse, which isn't great for a license document...
They could simply say that, then, instead of saying you might be able to use it under the AGPL.
They didn't say you "might" be able to use it under the AGPL, but that you "may" be licensed to use it. Which, as a native speaker of American English, seems to be relatively clear in its meaning along the lines of what the GP poster stated. Of course, the various meanings of "may" in English might be subtle enough that I'd readily believe it's less clear to non-native speakers (or maybe even speakers of a different dialect), and it's unfortunate that Mattermost's lawyers aren't interesting in cleaning up the language.
To me, this seems kinda reasonable.
The reality is licenses are all nonsense and none of it makes any sense. There could be secret patents nobody knows about. That precise wording written by American lawyers might not hold up in Chinese courts. There might be two compatible licenses, but one is 20x the length of the other; obviously some legal expert thought those extra words were needed - but are they? What's going on with linking and derivative works? Do you need to copy-and-paste the full legal blurb into every single file, or not? Why are some sections written in all caps, and does the reason for doing that apply globally? What if someone claimed to have the right to contribute code to an open project but actually had an employment contract meaning the code wasn't theirs to transfer? What's the copyright status of three-line stackoverflow answers?
The truth is nobody knows, and nobody cares. You and I won't get sued, probably, and if we do it's not like we'd have avoided it by reading the license. Might as well ignore it, like people ignore website terms of use and software click-through licenses and other legal mumbo-jumbo.
On the other hand, if you're the kind of gigantic enterprise that has policies on software licenses and a team of in-house lawyers and you can't use this software without greater license clarity? Well, you can get that licensing clarity with the enterprise version of the software.
I have used many open source tools and I have convinced my company to buy the commercial license of the said tools to get the enterprise version and support. Win-win for both parties. I use and improve my skills on the open source version of the tools I love. Our company uses great tools. The project maintainers get paid.
But I don't think I'll ever buy an enterprise version of the software which can't get the simple matter of open source licensing right. It isn't that hard. Thousands of developers are doing it.
If the tool was totally enterprise version only, I'd probably have less qualms about it. But to advertise a tool as open source license but then violate the open source licensing method both in spirit and the letter of the law is just too unprofessional for me that I'd steer clear of them in future and discourage anyone I know from spending their money on them.
It isn't really reasonable though. The word "may" implies possibility, not absolutism. So reading the sentence logically, at least to me, saying that I "may be" able to license it under the AGPL means that I might or might not be able to do that... And I have no way of knowing if I can or can't unless I... What, contact them?
I think in this case it implies choice for the user. There’s an implied “if you want to”. You may use this software if you want to in one of two ways:
That’s pretty clear to me (a native speaker from the UK) - i can’t really see how else it could be interpreted. As another poster said, it’s the same “may” as “you may go to the washroom” or “you may enter now” - which implies consent from the speaker.
The AGPL accomplishes the same thing, except there is no ambiguity and you never have to wonder "could I be sued for using this software?"
Restrictions like this, where your code is only available for use for certain purposes by certain kinds of users, are explicitly rejected by both the open source and free software movements. If a developer wants to license their code this way, they should admit that what they're building is not an open source platform. Then they can simply use one of the licenses like CC NC or SSPL that are designed for that purpose, instead of trying to stitch together an unfree license out of a bunch of free ones.
> But nobody will get sued, and that's the only thing that matters.
Do you really want to bet your business on that? Vizio thought the same when using GPL code, and now they are in court. Software Freedom Conservancy sues Vizio for GPL violations - https://www.zdnet.com/article/software-freedom-conservancy-s...
Vizio (and every other embedded vendor) knows they're breaking the GPL and they just don't care. It's not an analogous situation.
I don’t think they’re worried about “my business.”
Open source is notorious for being implemented in $$$ COTS and commerce and then contributing $0 in money and then even less in contribs bug fixes or sharing in house tweaks,isn’t this what Wordpress has been melting down over for a year or two now?
And I’m sure many more projects are pissed off or resenting their chains but not making an ugly scene about it.
Something has to give here.
I don’t have a dog in this fight other than to say that what mattermost went with here “is a choice” , and I have “a choice” whether to accept these terms.
I’m interested in watching how it plays out though. They cast their die. Problems have solutions. We could all get into whether this solution is viable or not — doesn’t matter this is what they went with and they made it clear they’re not taking user input on it. I’m not even a user so I expect them to care even less about my thoughts.
Im supportive of anyone trying to find an equitable balance but maybe that’s a situation where they could roll their own license with these clauses and exclusions.
Its not like Microsoft or iTunes user agreements aren’t complete bullshit, yet people click okay and use all that.