 Yeah, so the next talk is about the GPLv3 discussion about licensing issues and how to better understand the way the licenses have changed. And we've got Bradley Kuhn, who many of you probably already know, and he'll mention his background. But it's great to have him here. Everybody give a round of applause for Bradley. So I've been giving this talk a lot lately. And this is the first time I've given it to a project that's already basically adopted GPLv3. And I'll talk about that on my last slide some more. But first I want to explain who I am. I have this problem that I have way too many affiliations. So this slide has them all. I'm, first of all, president of a thing called the Software Freedom Conservancy. And it's a nonprofit home for open source and free software projects. And I'm also on the board of directors of the Free Software Foundation. A lot of you know me from the early 2000s when I was executive director of FSF. I left in 2005. And now I'm as of this year on the board of directors of FSF, which is the organization that wrote and publishes the GPLv3. I'm also a member of the Genome Foundation. And I'm on the advisory board representing FSF at the Genome Foundation. And I'm also, just to add another hat, employee of the Software Freedom Law Center. So it's basically impossible for me to give a talk that can give the opinions of any one of these organizations and not bleed into others. So just assume that anything I say is my own opinion. And some of them are probably going to be opinions of these organizations. Some of them will be things that these organizations are neutral on. But if you want to know the exact position of any of these organizations, I probably know what it is. So I can probably give it to you in the Q&A. So I think it's true that every human being actually really despises change. I'm sure that there are many times you haven't upgraded your system because you didn't want things to change or things to break. Most of you, I think, run unstable in a churrut these days. And you probably run stable as your default machine. Oh, OK. Maybe this slide's not so true with this group. But I certainly hate change myself. So I wrote this blog post a while back called Back Home with Debian. And I switched back to Debian the end of last year because basically Mbuntu is friendlier and friendlier to proprietary software all the time. And I had switched to Mbuntu for only one reason because I wanted to run Debian stable, but it was too old. And I switched to Mbuntu to get something that could be both a released system and have somewhat newer software. Because generally, I hate change. I prefer to run stable whenever I can. I gave this talk at the GNOME users and developers European conference last week, Gwadak. And I told this story of how once when in, I guess, it was early 2000, I was at a USENIX conference talking to Miguel de Acasa. And I said, well, I'm trying to get the new GNOME running and I can't. And of course, he looks at my machine. He starts to try to get it working. You're not running Woody. And I said, well, no, because Woody's unstable. I'm running stable Debian. He goes, I can't make it no more than this. You're living in the past, dude. So I don't like to upgrade my system that often. I only upgraded Debian stable when stable comes out. And I generally just run stable. Occasionally, I backport a few things. But we don't live in a world where change is something we want. And so I don't think anybody should be forced to upgrade anything, generally speaking. It's annoying to have to upgrade sometimes. But it's really a trade-off that you make between the bugs you want fixed and the new features you want versus a certain sense of stability and able to work every day without something you don't expect to have. So when you finally get sick of the bugs, that's generally when you want to upgrade. And from my point of view, licenses aren't that different that much from the way code works. When we find bugs in licenses, we fix them. And if there's a useful place where a new feature in the license might help out, in the case of GPL, the issues of software freedom, we add those features to the license. And that's really what GPL v3 is about. It's about finding bugs in v2, fixing them, and adding features that the GPL ought to have, but we're not contemplated when GPL v2 was written in 1991. Now, it's easy for me to say that, but the fact is, and anybody who regularly posts, ends or reads, Debbie, in legal, knows that there's a lot of weight put on licenses, a lot more, in some sense, than code, because they have this power over what people can and cannot do with the software. And therefore, it impacts people a lot more than mere software changes. And frankly, thanks to places like Disney and other folks who want to make copyright stronger and stronger and stronger, copyright has become this really powerful tool. The goal of Copy Left was to turn that tool around and use it for good rather than evil. But it's, as Ani DeFranco says, every tool is a weapon if you hold it right. So we never want to end up using copyright as some weapon to hurt people. We want to use it as a way to encourage and inspire more software freedom. So we understand, I think, as GPL advocates, that folks don't want to change right away. And so I see it as my job. And actually, this job should have been done a long time ago. But after GPL v3, no one really wanted to go out and advocate and stump for GPL v3. So I finally started doing it about a year ago. But the first thing, if I'm going to stump and convince you to switch to v3, which of course you guys already have, but maybe you're trying to convince your upstreams to do it, is a question of what bugs are there in GPL v2 that need to be addressed and why is v3 better with regard to the bugs in v2? One of the interesting bugs that is kind of amazing is that distributors of online versions of binaries can actually refuse to give you the source online. They can make you write in for a CD. Most people are really surprised by this. But in fact, under v2, somebody can do that. v2 is incredibly naive about patents. There is this thing called the implicit patent grant that I'll talk about later, although a little bit worried because I have two patent lawyers that I know in the audience. Generally speaking, v2 is much more naive about patents than v3 is. v2 is incredibly US-centric. It uses terms from US copyright law. And it didn't contemplate the idea that GPL will be a worldwide license. By the way, I say the word contemplated that. The lawyers I work with have taught me to use this word way too much, so I apologize in advance. Lawyers love to talk about language contemplating things. So anyway, it doesn't contemplate the international nature. And v2, I'm actually kind of amazed. On this point alone, I would think people would have just ran to v3. v2's termination provision is really nasty compared to v3's. The exception's infrastructure. So if you've heard of things about a GPL exception that you can write, it's incredibly clunky to handle in v2. v3 fixes that. v2 really doesn't consider the idea of embedded software or GPL used for embedded software. v3 does. There's also no web services clause under v2. Now, this was a point of much debate via Faro GPL and Debian Legal. And I'm happy to talk more about that at the end of the talk. So let's talk first about this internet distribution thing. So v2 has this thing where it says a medium customary for software interchange is what you need to provide the source on. Well, that doesn't mean the network. In fact, we really don't want it to mean the network for a variety of reasons. But it means that the way v2 is drafted, that if somebody gives you binaries over the internet, they can say, I'm only going to give you source on CD under v2 saying they want a reasonable copying fee and give you a medium customary for software interchange, i.e. CD. So we've actually seen distributors do this. And we've gotten what would be GPL violation reports saying, I download the binaries from this guy's website. But he's told me I can only get source code if I write in for a CD and I have to pay $15 or $20 for the source code CD. So this is really just a way people have found under v2 to annoy people. So they make some improvements to some v2 program. They give you the binaries online, but then they won't give you the source code unless you write in for a CD. Well, v3 has a much better discussion of internet distribution. It expands the rest of that paragraph that's in GPL v2 about internet distribution into its own set of sections under section 6B and 6D that talks about doing distribution of the software over the network. And in particular, 6D talks about this side-by-side distribution of binaries on the internet with source code on the internet much more detailed. It actually makes what Debin does much clearer as far as you guys are doing it in compliance with the license. Because there's ways you can read v2 that might say, well, the way Debin's source repositories are set up are not compliant. I don't think that's true under v2, but people have argued it. Under v3, you guys are clearly compliant with section 6D. The really important thing, though, is 6B takes care of this sneaky thing with I can give you the binaries online, but you have to ask for source code on a CD. And 6B takes care of that by making sure that basically when you distribute the binaries in one particular medium, be it on the internet or be it on CD or anything else like that, you give the source code on the same type of medium. So that's basically fixing two issues that occurred in v2 that we've run into over the years that are now addressed in v3. I've talked about v3 dealing with patents better. Here's a discussion of why you as developers should worry about patents. So most companies have software patents and most companies, or software companies anyway, are aggressively enforcing them. A lot of them pretend they're not doing that. They don't necessarily go to court and sue somebody for patent infringement, but they're in back rooms shaking people down for patent licenses. This happens a lot. And there are industry-wide initiatives that say that they're going to solve issues with software patents, but they're, first of all, only arguing for patent reform. So they're not really against software patents per se, they're just trying to mostly protect from the bogus software patents and the really good software patents, like the RSA patent that was a pain for us for so many years, those patents should stay around. So these initiatives are not helping free software necessarily. And when they do offer some sort of patent safety, it's only for the lowest level operating system technology. And in that term, I don't mean the Debian way of thinking of operating system. I'm talking about the computer science definition, only the core C library and on down the stack into the kernel. They're not protecting user space applications, generally speaking. So there's not a wide-based industry patent protection for free software out there. And by the way, with regard to patent reform, you should see this old essay because it's a good discussion of why patent reform is not enough for free software. So ultimately, the US patent system in particular can impact the distribution of free software like Debian pretty heavily because you guys are putting stuff out there non-commercialy, so it's unlikely you guys are going to be attacked for patent infringement. But those folks who pick it up and make good use of the universal operating system may be impacted by patents and may turn out to get attacked by some company for software patents. So you guys need to worry about this even though you're non-commercial. V2, I strongly believe, has a pretty good patent provision. The patent attorneys in the room don't necessarily agree with me. It's because of this thing which is often called the magical Section 7 thing. So it's an implicit patent license because Section 7 in V2 says that if there are conditions imposed on you as a distributor that contradict the terms you have to give under GPL, i.e. doesn't allow worldwide distribution, modifications by downstream, et cetera, and so on, all the things GPL requires, if such conditions are imposed on you, you can't distribute it all. It's often called the give my software liberty or give it death clause. It basically makes sure that you can't distribute further if you've been imposed with some condition that would prohibit you from complying with the GPL. So these things that are like this are things like patent judgments and that's in fact what was contemplated by the drafters of V2. They said, basically it was Stalman, said, well, I'm worried about somebody getting a patent judgment against them that says they can no longer operate under GPL. I wanna make sure that they don't go continuing distribute under GPL, knowing full well that the person they give it to will probably also get sued by patent infringement and have to face a similar judgment. So there's things out there that aren't necessarily conditions imposed on you, things like covenants not to sue. There's a question. I've debated this often with a patent attorney in the audience of whether or not it's the case that a condition imposed on you is something you agreed to. So if you agree as a covenant not to sue, is that a condition imposed on you? It's kind of an open question. So we have to err on the side of assuming that it's not, which means V2's patent provision or implicit patent provision, if you will, isn't adequate to defend us from software patents. Fortunately, V3 has an entire section to discuss issues of software patents and making sure that every contributor to a V3 program gives a worldwide, non-exclusive, royalty-free patent license to exercise all the teachings of any patent that happens to read on the software, meaning that if your software necessarily infringes a patent and someone who holds that patent contributes to it, you can be assured that they have given you a patent license to operate under that if either they contribute or if they distribute the software. If they distribute the software, the question of whether they knowingly relied on another patent license. So if someone makes a patent deal to get a patent license for themselves and then relies on that patent license in their distribution of the GPL software, there are various actions that they must take to make sure that the software remains free software. And I won't go through all the detailed options they have, but there are a set of requirements in V3 should they rely on a patent license. This just isn't true under V2. The question under V2 is whether a condition was imposed on them, not whether or not they relied on a patent license. The other thing this V3 patent section has is the somewhat now famous or infamous anti-Novell-Microsoft deal. Now I wasn't too happy that Novell and Microsoft's deal was grandfathered in. I was against that in the V3 process. But at the very least, future deals like that, where people make some sort of back room patent deal to promise somebody else's customers, they'll guarantee them that they won't infringe some patent if they distribute a particular software package with some sort of coupon or whatever this bullshit is that they do in that deal. That kind of arrangement is prevented in future by GPL V3. Everything basically after the date when it first appeared in 2007 in the draft of V3. Another pretty horrible thing about V2 is it's incredible US centricism. V2 talks about copying, modifying, and distributing. These are terms under US copyright law. US copyright law, if you read the statute, talks about all these activities. And they're basically magic words of US copyright law. But there's other terminology that's used around the world for talking about what happens under copyright licenses when you engage in certain activities. And V2 really doesn't consider any of those terms. And so when you have, in fact, the European Union public license, it exists precisely because of European lawyers' concerns about the way V2 talks about copyright law. It doesn't talk about copyright law in a European way. Therefore, it's a problematic license for them to use. Fortunately, we got many of those lawyers involved in the V3 process and we created new terms to refer to various activities. And those terms are defined to include, as much as possible, all the different terminology used around the world for copyright. So you'll find in GPL, it talks about the idea instead of distribution alone, it talks about propagation. Well, propagation includes distribution, especially in the US, but it also includes lots of other terms in its definition that make sure that every possible thing that's like distribution in some other copyright system will be encompassed in the idea of propagate in GPL V3. So, and there's also this idea of conveyance. So one of the problems we had, and the reason there's two terms, is that there were different types of distribution, both of which were distribution under US copyright law, but they acted differently in other countries. So the idea of propagate is when you sort of passively distribute, you give someone access, like a contractor, to software on a computer system that they happen to be using for their work for your company. So you didn't distribute in the normal way that Debian thinks about distribution, but you did give someone legitimate access to the software and its source code. So propagate talks about that. Conveyance talks about the idea of what we normally think of a distribution, what Debian does, where it puts software out in the world and wants it to be taken by someone else. That's conveyance. And both of these terms are defined using all the different types of international terms for these ideas, making sure that we actually encompass the entire world of copyright systems when we talk about GPL. Now this reason alone is a reason for companies to switch to GPL V3. I'm amazed that companies continue to prefer V2 when they have to deal with the very strict termination clause in V2. Basically V2 says if you violate the license even once, even for a second, you lost your rights under copyright law to engage in any activity governed by copyright law. You can't modify the software anymore, you can't distribute anymore, and you're basically stuck from the moment you terminate until you go to the copyright holder and beg them to give you back rights to distribute. And often you can't get all the copyright holders to reinstate your rights necessarily, at least explicitly. You can sort of assume, well, one copyright holder reinstated my rights and they were the main copyright holders, so I'm probably fine. But technically speaking, you could have another copyright holder come along and say you violated a license a long time ago, I never restored your rights. And therefore, I think you have to do something about all these past violations that I've never restored your rights on, and any new violations you perpetrate. So the V3 termination provision is much more friendly. It says that once you stop violating and you never received a complaint from the copyright holder, i.e. you discover yourself, oh, I was in violation for a few days because I forgot to put the source code up on the website, or something of that nature, you have permission under V3 to immediately begin conveying the software again. So under V2, you didn't have any right to distribute once you violated. Here, as long as you come back into compliance, your right to convey is immediately returned to you. And you have to sweat for 60 days seeing if a copyright holder notices. But if a copyright holder doesn't notice in 60 days and contact you, the situation is as if you never violated the licenses at all. So you immediately get forgiveness for the past violation. Companies should be flocking to this, frankly. I don't know why they aren't. The other thing is that if a copyright holder does contact you, you get an extra 30 days to come into compliance and get forgiveness. So once you get that letter from the copyright holder that says you're in violation of the GPL, you've got 30 days to bring yourself into compliance, and then it's as if you never violated again. But you can't use this over and over again. Once you use it once, it sort of times out and does various things. So you can't wait for every copyright holder letter, take your 30 days, and then wait for the next one and so forth. But the first time you do it, and the first time you get contacted by a copyright holder, you're completely able to just start distributing again without doing anything. Another important aspect of V3 is that it actually is compatible with a lot of free software licenses that are not compatible with GPL V2. Now briefly to explain what compatibility is, is it's basically when you have a code base A under some license, and code base B under some license, and you wanna combine those two code bases together and distribute the resulting work, the question of whether you're allowed to do that is a question of compatibility. Is the license of A compatible with the license of B? W and legal has a very strict definition and sort of consensus about what compatibility is, probably stricter than I would believe. But it's certainly true that Apache 2.0, which I think is a great license, it's a permissive license that has a patent protection, and it turns out to be contradictory to GPL V2. So you can't take an Apache 2.0 licensed work, combine it with a GPL V2 only licensed work and distribute the result without contradicting V2 or contradicting Apache, depending on which way you're looking. If you're looking from one way, it looks like the other license is in your way, if you're looking from the other licenses in that one's way. V3, by contrast, puts a tremendous amount of effort into trying to make sure that all the licenses that can be compatible are. So there's a whole section in V3 that considers all the different types of terms you find in various free software licenses and tries to make sure they're accommodated in V3, so that you can take things like artistic 2.0 licensed work and Apache 2.0 licensed works and combine them with V3 works. Another important thing we solved in V3 was regarding exceptions, which is actually a pretty simple idea. The idea is if you have something under GPL, but you decide you're the copyright holder, and you want it to be more permissive than it was, so you want it to give extra permissions V2 or GPL V3 does not, but you don't want to go all the way to LGPL. If you want to be somewhere in between, well, you write an exception to put yourself giving permissions that are more permissive than GPL itself, but not as permissive as LGPL. We wrote plenty of exceptions under V2, and there was a lot of mess with regard to it. When Karen Sandler, who's in the audience, and I sat down to look at rewriting the exception for GCC to make it a GPL V3 exception, Brett Smith helped us find roughly five or six different versions of the GPL V2 exception for GCC that had been added to the code base over time. Now all of them had basically the same intent, but there was a different one for libstandard C++, and there was a different one for libgcc.a, and they all sort of did the same thing. So what V3 allows is giving an exception framework. So you can take exceptions like that, and you can actually make them part of the license text by writing your own exception that explains what you want to be the permissions that are given to the user beyond what permissions they already get from GPL, and basically allows you to hack the license so it's your modified version of V3 that does a particular job that you want to do, as we do with the GCC exception, which I could do a whole talk on that, but you should go and read that if you're interested in seeing what an exception looks like. The nice thing about it though is if you screw up in writing your exception, i.e. you make it more restrictive than GPL, V3 says it can be thrown away by the downstream, and this solves a very classic problem that you guys have run into, I'm sure, as well as pretty much everybody in the free software world has. You get something that says it's GPL, but it says something like, no one in the U.S. military may copy, modify, or distribute the software. Well, that's trivially DFSG non-free, it's trivially not a free software license, it's trivially not an OSI-approved license, has a field of use restriction. The problem is it's confusing because it says it's GPL, then it adds this additional restriction. So you have to rule it as DFSG non-free, because it is, but they sort of told you you could do it under GPL. Well, if they do that under GPL V3, V3 itself says, ah, if an exception is found, it turns out to contradict rights otherwise given by V3, downstream can ignore the exception, throw it away, and distribute under pure V3. So if you find that scenario under V3, you guys in your Debian package can just patch away the incorrect license, and do it, you're allowed to do that. V3 says you're allowed to do that. This amuses the sheesh for some reason. So maybe you've done this under V2, or sheesh, and you aren't supposed to. So the issue of embedded software is one that was probably the most controversial in the V3 process. And most of that controversy, particularly from the Linux developers, was actually about a very early draft of V3. And if you look in the commenting system for GPL, which was, I helped design, called STET, we did this thing where you could do highlighting of text, and then comment on specific sections of text about problems you had with it. And if you look at the early draft in STET, you'll find that the level of highlighting in the section about DRM was the strongest. So we did this intensity highlighting feature where the more people commented on it, the redder it got, well, it's all red in that area. Everybody was concerned about that section, felt that it was too strict. And in the final draft, which was actually released, those restrictions or requirements are incredibly watered down. In fact, from my point of view, they're so watered down, they're almost worthless. I wanted to make them stronger myself. But people listened in the V3 process to those who complained about the DRM provisions and watered down the provisions so that they were compromised with folks who were concerned about them. So first of all, the DRM provisions in V3 is only with regard to consumer products, which are defined in the license as specific products that go to an end user, and you can read the definition. And basically the only thing it requires is the vendor gives you the instructions you need to jailbreak the device. So from a phone perspective, that's basically what it says. You must be allowed to jailbreak something that has GPLV3 software on it so that you can install your own modified version. But it gives the vendor all sorts of powers. First of all, they can void your warranty immediately and say you don't have a warranty anymore because you broke through the DRM on the device and they can also throw you off their network. So if you're talking about a mobile phone, if you modify the software to make trouble on their network, they have permission under GPLV3 to not permit you anymore on their network. So it actually really solves the main concerns that were legitimate from the mobile vendors. And it turns out that people are actually complying with V3 with regard to mobile phones. Now, there's not actually any V3 software on Google's HTC Dream or on their Nexus One, but I got this HTC Dream from Google. They gave it as a gift and I got it and I was able to install my own firmware on it built from scratch, a colleague of mine named Aaron Williamson built a firmware that we installed ourselves on these HTC Dream phones and had Linux in that case been under V3, their distribution would have been completely V3 compliant. We had to void the warranty. In fact, the Nexus One space, if you try to install your own firmware, pops up a little screen and says, do you agree that you void your warranty by doing this and you clicked yes and then you can do it. So the fact that Google is saying we can comply with V3, theoretically speaking, because they don't actually have to comply with V3 with regard to Android, means that the mobile vendors who say they can't comply with V3 are just lying to you. They're saying, oh, FCC is gonna come and shut us down if we have to put V3 software into our devices. Well, FCC hasn't shut down Google for distributing the HTC Dream and the Nexus One throughout Europe and the US. So obviously the regulators, at least in Europe and the US, don't have a problem with allowing users to install their own firmwares. And in fact, pretty much every phone, even the Droid X, which was completely locked down, has been jailbroken as it's come out. So from a basic perspective, what's happening is they're looking for a reason to say they don't want V3 and they're pointing at this, but in fact, this is not a problem for them and they could comply with it if they wanted to. Now it is possible to write an exception. Like I was talking about these exceptions from mobile. It's not something I recommend. I think we should hold steadfast with these mobile guys and say you don't need an exception for mobile because you can do this and Google's already done it so why don't you as well? But frankly, if I were forced to choose between GPL V3 with some sort of exception that allows mobile devices to be locked down versus V2, I'd pick the V3 with the exception. So for example, if we can convince the Linux community that's how they ought to go, I can live with that compromise. I want to, I'm almost to the end of my presentation here and I'll take questions, but the last thing I want to talk about is LGPL V3 because there has been some discussion on Debbie and legal about it in the past. I think there's actually no reason not to switch to LGPL V3 today. I'm aware as everyone is that there's incompatibility between LGPL V3 and GPL V2 only. But that is fully fixable with this destructive license. So if you're in a situation where someone wants to move or an upstream is moving to LGPL V3, simply suggest to them that they dual license it, GPL V2 only or LGPL V3 or later. And that fixes the V2 incompatibility while allowing you to go to LGPL V3. And I actually think this is kind of a soft way to begin GPL V3 adoption in upstream projects. So if you have an upstream project that's LGPL 2.1 or later, you should encourage them to try this license instead as it probably gets their goals done but at the same end solves the GPL V2 incompatibility and gets them towards V3. I think it's particularly important because LGPL V2.1, if you read it is a really, really confusing and problematic license. And I think getting away from 2.1 is probably the most important thing we need to do. LGPL 2.1. So going to this as a solution for the short term might be a really good idea. AGPL V3 is probably my favorite license. I could do a whole talk on it, but I'll say briefly that it adds a network service clause to GPL. So are you saying you're for it or against it? Okay, Lars is for it. So it's not part of V3 proper, which I didn't really like. Initially, the affair clause was supposed to be part of GPL V3, but a lot of people complained. Some people in the Devin community complained, but the big force was Google saying that they were gonna fork every single GPL project if the license had the network services clause in it. So in the end, it's a separate license and as I said, I could do a whole talk about this. The basic idea is that if someone is a legitimate user of a particular software program, they have a right to source code even if they're not distributed to the software, even if they're only using it through a network service. Now, there was a lot of debate on Debian Legal when you guys accepted AGPL, which you did, and I appreciate, about the issues of what happens if we don't do the right thing in Debian package and it's automatically in violation. I think it's true that with almost any license you could construct a Debian package that would automatically be in violation of the license somehow. So I agree that there's a little bit more care that needs to be taken to make sure that an Afaro-GPL program when installed in the system defaults into compliance. I have a, it's more or less a demo package in Debian called Yachto Reader. It's a alpha software Google Reader replacement. And I've tried in that package, it's actually, I'm not a Debian developer, it's maintained by somebody for me, but I've tried in that package to make it AGPL compliant in its default install, and obviously follow bug if you think that it's not, but it may be that's an example of how to do AGPL compliance in a Debian package well if you guys want to package something that's AGPL and they're worried about the, oh, when somebody installs it, are they automatically in compliance or not? And finally, I want to thank Debian because you guys are actually one of the few groups I can talk to that's actually adopted GPL v3 already. And the reason I say you've adopted already because the default GPL and user share common licenses is GPL. So that means that when you distribute under GPL v2 or later, you guys are actually opting to be v3 rather than v2 or later. So I appreciate that you guys did that and I hope that other projects follow your lead and adopt GPL v3. And with that, I'll take questions. So you got to get his attention more than mine because he's got the mic. I was wondering about the network services clause. What legal thing is that based on? Is public performance the- No, it's actually not based on public performance mainly because there's no clear statement that public performance applies to software. So it's based on the usual rights of copying and modifying and distributing. So basically it says that if you modify the work, then you must make sure that this particular feature is maintained. It's not that different from Section 2c in GPL v2 which says that if you program runs interactively and you modify it, you must preserve the feature that tells the warranty disclaimer and copyright notice. Actually, when I came up with the idea, it was based on that idea of preserving a feature when you modify. So if anything, it's based around the requirements of modification under copyright law. It says if you modify the software and then deploy it on a network service, you must make sure all users have the right to receive the source code of that modified software. So if you don't do that, you don't have permission to modify. Therefore, you're violating copyright law. With the exceptions, you were saying that if it was more restrictive, then you could remove an exception. So if it isn't more restrictive, if it's a good exception, does that mean that it can't be removed? No, it can be. But you can always magnet back to v3. So for example, if you get two programs, one of which has an exception that says foo and one of the exception says foo prime and you can't resolve them to be the same license, which could easily happen, you can actually throw both exceptions away and distribute the whole result under v3 only or v3 or later for that matter. And if somebody wants to write an exception, for example, if somebody wanted to make the GPL font exception for document embedding. The GPL, what's your exception? The font exception in the GPL pack. Font, you said? Yep. Then what would be the best way to go about that, getting up that day? So what would you, what does GPL v3 currently prohibit that you want to permit? If you embed a GPL font under the plain GPL in a document, it becomes a combined work. So the whole thing, the text and the images and so on would also have to be a GPL. I see that point, right. So that could be written. I can't write it for you on the fly. But if you wanna talk to me later, we can talk about how to write it. There's somebody has a mic back there. Go ahead, volume. I have a few questions from IRC. Okay. What's the name of the package? Yachto reader, Y-O-C-T-O dash reader. And it's in experimental at least. It may be an unstable too, as well, I think. Okay. The other question is about the 30 day exception. Can it be abused? No, in my view it can't. I guess some people might disagree with me. I'm gonna pull it up so we can actually look at it. I use this as my default copy of GPL, by the way. I always go to user share common licenses. It was really cool the day I discovered you guys have switched to V3, because I used to open user share common licenses, GPL for when I wanted V2. And then I had to switch when you guys switched, which was pretty cool, actually. Why can't I search for the word? Oh, I have ClapsLock on. I'm in a different account than my usual one, so. So somewhere in here, yeah. This is the first time you receive such a notice. So the first time you receive a notice, you get 30 days. The second time you don't get 30 days anymore. So that's what prevents it. Right, but if someone plans to make profit for 30 days and then stops. They could. I mean, they could do it, right? And all the copyright holders could write to them. I think it's pretty hard to build a business where your first distribution happens on the first day of the month and you make enough money by the end of that month that it was worth it to have the entire community screaming at you for 30 days. I think it's unlikely to happen. Yeah, yeah, exactly. Let them do it in front of the audience, says. Who has the next mic? Yep. My question is about the exceptions that you talked about and how they're compatible with things that don't have an exception. So for example, if you write a piece of software that has an exception to link with LibSSL, very common exception, does that mean that you can't link with GPL libraries? Does GPL libraries also have to have the exception? That probably would be correct. If you have an exception, the magnet is always GPLv3. So if you have GPLv3 plus exception and then you have GPLv3 over here, the only license that's common among them is GPLv3, so you have to fall back to V3. Now, this is true with V2 as well. At least it's clear in V3 that's what happens. That's what effectively happened with V2 as well, but it would happen that way with V3, too. Just to amplify that slightly, my sense and the interpretation of my legal team is that adding an exception in effect creates a new license which is incompatible with the original, so. That's true under V2, but not true under V3. It's compatible upwards with the original license under V3. V3 says so explicitly. Yeah, right. And as soon as we have some legal precedent that proves that point, we'll feel more comfortable about it. I mean, I understand what you're saying, Bradley. I mean, it says you can throw the exception away. I mean, I don't know how that could be any clearer. It says you may throw away that exception and distribute under V3. I'm sorry, yes, that's absolutely true, but that's not the case that usually matters to people. The case that usually matters is they care about the exception and now they haven't sort of sussed to the fact that that means they're incompatible with all the other things under that same base license. Yeah, that's his question, he's correct. That if you have two programs, one of which is DPL V3 plus a linking exception for something. So the summary of this discussion is just don't add exceptions and life is simpler. You should say that to mobile people. Say that to Nokia next time you talk to them. Good, thank you. I know they don't listen. Hi, wow. I have some, if this is off topic, just say that you're done. Oh, okay, should I stand to find? If you don't want to answer this, just say so and we can talk about it afterwards, but. I don't want to answer this. Sorry, go ahead, go ahead. Yeah, so with the AGPL web services clause, it sounds like the following would be a compatible use of an AGPL piece of software. One, I deploy it on a server inside my private network. Two, I make a web proxy that relays from the internet. Two, that internal server. And three, I add some awesome JavaScript at that web proxy that doesn't modify the source code of the AGPL program. And I basically add features through middleware that would be a compatible use of AGPL V3ware. I don't think so. We talked about that scenario specifically during drafting and we believe the current draft addresses it. If you think it doesn't, we should talk about it. I'm not saying no licenses have bugs. I started my first slide with licenses have bugs, but I don't think that bug is there. If you think it's there, we should talk about it offline. When will GPL V4 be on the way? I don't know. So we might want to do it quickly because it would probably increase GPL V3 adoption. But I don't think we're gonna do it anytime soon. I have heard no discussion other than joking ones about doing V4. And the reason I make that joke, by the way, is if you look back at the things Lena Storvalds used to say about GPL V2, it was things like, oh, I only picked V2, the GPL, because that's the license of GCC and I sort of respected that project. But if I had it to do it over again, I'd pick the BSD license, picking GPL was a mistake. And the moment the first GPL V3 draft came out, Lena says public statements were, GPL V2 is the best license ever. I love it. I'm so glad I picked it. This new V3 stuff is crap. I prefer V2, right? So this created interest and love of V2. When we released the draft of V3, my colleague Edmund Moglen, who's speaking tomorrow, calls this the perfection theory of GPL V2. Basically, as soon as V3 was released, GPL V2 was seen as perfect. And that's not really true. I think it's a buggy license and V3 is a better release. And V4 will be even a better license. I have a list of bugs already to V3, by the way. No, I'm not gonna show it to you. But I am maintaining. I'm not gonna show it to you. I'm not gonna show it to you. Yeah, so, yeah, I have a list of bugs to V3 already. There are four on the list right now. And again, I'm not gonna name them. When that list gets to 12, I'll probably start pushing for the V4 drafting process to begin. I have no idea when it's gonna get to 12. Yeah, the problem is I know the bugs are there, but the people who want to hurt us may not know they're there. So that's why I don't wanna make them public. And you mentioned on Identica recently that maybe in like 2002, there might have been like a point release to GPL V2. And it didn't happen. Well, you watched the Q&A on my Guatic talk. So yeah, so the first time I sat down to discuss GPL V3 with Richard Stallman was in the beginning of 2002. At the time, he wanted to do a release which was going to be 2.2. It was going to have the aferoclase in the main license. I wish now that I had urged him to do that and said we urged him to do a V3 process instead. I think there will never be a point release now. There's no point, we have V3. Going back and doing a point release would be pointless, pun intended. So I think people should just migrate to V3. Whether or not we do a GPL V3.5 or something, that'll depend on what the bug list looks like and how critical they are. I think if we found a really critical bug really bad for software freedom, we might consider doing a 3.4, 3.5 or something like that. I haven't seen, that bug is not on my list to tell you that much. But if it were to happen, I think maybe a point release would make sense. Yeah, Tom? Yeah, so one of the neat things about V3 is the compatibility with permissive licenses. And I remember during the drafting process, the one that I'm most interested in is Apache 2. And if I recall, and correct me if I'm wrong, the compatibility was leveraging the exception framework. I guess that's a question. No, it wasn't. There's actually a section, extra of the exception framework that basically says certain types of additional requirements you can place. So there's a confined set of additional requirements under V3 that you can place with regard to preservation of copyright notices and other such things that Apache 2.0 does that are permitted as additional requirements you can place. That has already been abused, by the way. People are taking that additional requirements to say things it doesn't, and they're releasing things under GPL V3, saying that you have to do certain things. See Identica Threads with me in Fontana if you wanna see one of those. But yeah, there are people abusing that, but generally that is there to make a very confined set of additional things you can do in a license that remains V3 compatible, but you can also require to preserve whatever Apache asks you to preserve. Okay, so then I guess my follow up is, are there any best practices for combining GPL V3 and Apache 2.0 works that have, for example, if there were any additional language that would have to be added or copyright attributions or those sorts of things. So people get it right, basically. I don't know of anything, a best practices document with regard to Apache specifically. However, we at SFLC did one, which I think was written by me, Karen Sandler, Aaron Williamson, Richard Fontana, called Best Practices for Permissive Copy Left Combinations or something, and that talks about combining BSD style licensed works with GPL works. So most of the stuff in that would probably get you most of the way of doing the right things for Apache as well. There's probably a few little tweaks on the details, but that general document of how to maintain something under the BSD license inside a tree that the overall work is GPL, that you basically do very similar things with Apache. So that's the best thing I know that's out there. More questions? Nobody from Debian Legal's here? I mean, I was expecting like Debian Legal style questions and I haven't had any yet. Well, she says was sort of, but. Are there any changes in copyright law coming that could weaken the GPL law or make it more effective or whatever? Well, so there's this weird thing that happens with copyright law. It keeps getting stricter and stricter because Disney wants it to be and various other entities want it to be. Things like the DMCA in 2000 in the United States. It's now 10 years ago, but that was a great example of copyright law getting incredibly more strict. And what happens is GPL gets stronger by default when that happens. Sometimes it gets stronger in ways that we're not particularly nuts about, right? So the DRM restrictions in DMCA are actually the inspiration of anti-DRM provisions in V3 to some extent. So GPL basically has to, as Jeremy Allison puts it, use this judo move on copyright law all the time and always try to turn its strength into strength for freedom. And that's a difficult balance to have, but I don't see copyright law getting any weaker anywhere. It keeps getting stronger and stronger, unfortunately. I mean, I'm not a fan of stronger copyright law per se, but I want GPL to be able to match it toe for toe. Every time copyright law gets stronger, I want GPL to get stronger because that means the other side has a stronger tool as well. So we have to match it at every step. And so for things like derivative works, when cases come out that make things more derivative, and there are cases coming out all the time that expand what a derivative work is, well, GPL goes as far as derivative works go. So from that point of view, GPL has to get stronger because the other side's getting stronger. You can grab the mic from him there. There's a guy, the green shirt. What are your thoughts about the WordPress themes issue that recently was, but... I figured I'd have to comment on that if it wasn't resolved, but it's resolved. The guy released his themes under his stuff under GPL and all is good, right? Do you think he should have had to do that? Yeah, I mean, if you look at my colleagues, James Vazille's analysis is on the WordPress blog. I can't add anything to his excellent analysis, so I'd refer to that for his requirements to release that stuff under GPL. And I'm glad it's resolved. I thought it was really... Frankly, it's always stupid to go out on a podcast and say, I want you to sue me, which is basically what he did. So he was smart to finally release it under GPL instead of continuing to say, I want them to sue me. Have any of the new stuff in the GPL 3 been enforced? So I haven't seen a lot of GPL v3 enforcement, mainly because, so I work with the Busy Box Project through Software Freedom Conservancy and in conjunction with Software Freedom Law Center doing enforcement. We're primarily enforcing under v2 because Busy Box's older versions are under GPL v2 or later newer versions are under GPL v2 only. So mostly I see enforcement under v2. I have not heard of a v3 project doing serious enforcement. With exception, Status.net did some some enforcement under AGPL for people not doing correct things with the network services clause. And I've actually been involved in a side project I work on called Poker Source, which is also packaged for Debian. We've done some Afaro GPL enforcement for the Afaro clause. But I haven't heard a lot of enforcement being done on GPL v3, mainly because there's this perception in the industry that they like v2 better, which is kind of stupid, as I said, because of termination provisions. So they tend to opt on the v2 side because they don't want the DRM provisions, yet they could get the better termination provisions if they opted v3 side because they have a choice when it's v2 or later. But everybody seems to want to operate under v2 because Lena Storwald's convinced them that v2 was friendlier to them, which it actually isn't, but. Vita, I was shaking your head. You want to chime in? Did I say something you disagree with? It's more about the perceived patent termination loophole in v2 than it is about the DRM stuff. Yeah, I mean, I guess, yeah, Vita is right, that there are a lot of companies that are afraid of the patent provisions, including HP, I know. But from my point of view, I think the v2 implicit patent grant is pretty wide. And I don't think the v3 explicit patent grant is actually wider than what the v2 implicit patent grant is. In my personal opinion. So from my point of view, it's basically writing down in plain text what was already true implicitly in v2. That's my view. I realize you might disagree. It's the other side of it being. The other side of it being. Yeah, we'd have to talk about that offline. I don't know if that's actually true. Yeah, I don't believe it either, but it makes certain intellectual property oriented legal folks in certain corporations believe that there's a safety valve if they ever made a mistake. And they believe that that safety valve was taken away from them in v3 and that's the thing that actually is the sticking point. Not the DRM stuffer, but he understands that can make and can make an easy A&A decision. It's not the other part of the new termination stuffer. But he goes, yeah, okay, we understand what that means. Right. It's losing what they think was a useful safety valve. Yeah, they think there was a patent safety valve there that I don't think is there. So, but yeah, it's, I can see why they have that view. At least, sorry, go ahead. I would have lots of question regarding license for documentation and GPL compatibility. I'm glad to see you're promoting the use of CC-by-SA for speeches and stuff like that. Yeah, yeah, I do. Is there any plan to have better integration between GPL and CC-by-SA documentation because currently that's kind of a pain in the neck because when we have some people contributing, for instance, the wiki and the CC-by-SA on wiki media and we want to reuse those content in package, it's... Yeah, I think if documentation's gonna have code examples, dual licensing, GPL or CC-by-SA is a good option because then you get both licenses as a disjunction. That's actually a pretty reasonable thing to do for wikis that are gonna have both code and documents in them. And then you can take it under CC-by-SA when you need to and you can take it under GPL when you need to and it sort of works it out. It's dangerous to use GPL v3 or later or any type of GPL license for documentation, mainly because what source code is under in a documentation project is complicated and it's not really clear. And as you know, the FDL made some efforts to try to solve this, I don't know if it did all that well, but certainly CC-by-SA is much more focused on other types of works, not software. So I think that dual license is a good way to solve both at the same time. The thing is currently exchange between wikis it's just not going mainly for not just the tools but also for license prison. Typically we can't, under BN wiki if we do a license hit, it means we can't get any content from Wikipedia and then we can't push it in the package. Oh, I see your point. So wikipedia is all CC-by-SA, so if you pulled content from Wikipedia immediately your wiki would have to go the CC-by-SA fork, is that the point? So it's kind of a problem, yes. Yeah, I don't have a solution for you. It's unfortunate. Well, I don't think making doc licenses purely compatible with software licenses is going to be possible, but mainly because software licenses have to talk about things like source code and complete and corresponding source code and binary distribution and all these different things that you can sort of make up in your mind analogies to, well the HTML is the binary because my source was tech or my source was doc book but that's not really true either because they aren't binaries in the traditional software sense. So I think there's just a real impedance mismatch between a doc license and a software license which is why we just need to do a license in those cases. I agree with you Wikipedia if you want to pull content you're stuck in CC-by-SA only but I don't have a solution. And I'm out of time. Get a round of applause for Bradley Kuhn. Thank you.