Don't Over-React to the Facebook Patents License
blog.fossa.io
blog.fossa.io
What if Facebook actually breaches your patents? What if they sue you? You can't counter-claim if your tech is based on React, because you'd lose the grants.
The real purpose of Facebook's license is to stop any sufficiently large company (i.e., any company with the wherewithal to sue Facebook) from using their technology.
This is the crux of the problem. I've heard others try to explain this by arguing that "If FB decides to breach your patent, you're SOL anyway. They can out-lawyer you", which is an absolutely horrible defense of the license.
> What if they sue you? You can't counter-claim if your tech is based on React, because you'd lose the grants.
Just to be clear, the license does not terminate in this case (assuming that the patent in question is unrelated to React):
"if Facebook or any of its subsidiaries or corporate affiliates files a lawsuit alleging patent infringement against you in the first instance, and you respond by filing a patent infringement counterclaim in that lawsuit against that party that is unrelated to the Software, the license granted hereunder will not terminate under section (i) of this paragraph due to such counterclaim."
From their FAQ [1]:
> [Q:] Does the additional patent grant in the Facebook BSD+Patents license terminate if Facebook sues me for patent infringement first, and then I respond with a patent counterclaim against Facebook?
> [A:] No, unless your patent counterclaim is related to Facebook's software licensed under the Facebook BSD+Patents license.
It isn't just React -- most of their repos contain the PATENTS file.
It is also interesting that for some libraries like RocksDB and zstd they didn't mind changing the license too much. So some projects are more strategic then others it seems.
Now I am not blaming them or saying they should change the license, it's their code, they can do whatever they want with it. It is just that the idea of it just being boilerplate legalese can be safely ignored from now on.
On what planet is this not a conflict of interest? Why isn't this at the top of the article?
Are there any people out there who don't work for Facebook or use React code who are willing to defend the patent license? I don't think so.
I don't think it's fair to say "she works for facebook", and she's a very honest and reputable person.
If you want to engage on the merits, i'd engage on the merits. Attacking her because she has a ridiculously long client list is silly (she's probably the top open source lawyer in the country in terms of who she has represented).
Yes:
Ariel ReinitzFollow (Former software developer; current patent/IP attorney)
https://blog.cloudboost.io/3-points-to-consider-before-migra...
Dennis WalshFollow (Former Patent / IP Attorney; current Software Developer)
https://medium.com/@dwalsh.sdlr/react-facebook-and-the-revok...
Here's why it matters. In my mind, there are basically three scenarios:
(1) There are no patents. This seems the most likely scenario. Patents are public. As far as I can tell, no one's pointed to an actual React patent yet. If this is the case, then the patent grant is irrelevant. Facebook can't revoke a license for a non-existent patent.
(2) There is a patent (or will be) -- but it covers some relatively new, hyper-specific feature of React. Generally speaking, patent examiners force patent prosecutors to narrow the claimed patent to avoid prior art. So in React's case, you might end up infringing the patent by using React but only if your copy of React comes with JSX, per-component state, context, and the new fibers stuff. So in order to get around the patent, you could fork React and remove per-component state or maybe you pin React to a version prior to the introduction of fibers and use that. This would super annoying for a large code base, but if Facebook actually was infringing your patent (and you thought it was a big enough deal to bring in expensive lawyers), forking React is a (relatively) small price to pay. Remember that Facebook's copyright license isn't subject to patent revocation, so forking to work around a patent is totally allowed.
(3) There is a patent, and it's huge. So huge, that you can't really fork React to work around it without completely destroying what makes React work. But here's the kicker. If such a patent existed -- for the sake of argument here, let's say the patent is for components or shadow DOM -- then it probably also covers Vue.js, Angular, or whatever other framework you might want to use. That's terrible! But it suggests that the real problem isn't Facebook's PATENTS license, but the underlying patent itself (which OSS advocates should be trying to kill). At any rate, this seems unlikely -- there's lots of prior art for React out there.
That seems to be the main point: Do you agree that you shouldn't be able to sue a company whose open source code you use or do you not? Everything else is just .. noise?
The car you bought gets in to a car accident because of software running on the car, which is licensed to you in similarly revocable terms to the shrink wrap currently on the market.
Both this software and React are software licensed to you in this case, should you be legally disallowed from ever purchasing a car from that company again? What if it's a cloud service that powers the car in some fashion which you want to sue over?
If that code were free software? No, that doesn't sound anywhere near reasonable.
So do I have the permission of "redistribution and use" in the BSD license or don't I?
If yes, the patent license was unnecessary, as I've got a license to copy and use the software from the BSD license.
If no, then it isn't the BSD license anymore.
I believe facebook's lawyers intended the latter, the no answer.
So no one can redistribute React under BSD, as they cannot proof the permissions of the BSD license. Therefor React is not BSD licensed.
This is true of BSD licensed software in general, the author can grant the copyright to copy and use it because they own that, but there may be patents that cover the relevant area which they may not own and so they cannot grant a patent license. As far as I know the BSD license is not normally thought to contain an implicit grant of patents that the author holds. If companies thought that it did, they would probably set up separate companies to funnel all their open source contributions through so that there could be no misunderstanding about patent licenses.
Regardless, if I thought I was depending on an implicit patent license that had never been tested in court for some important piece of software my company was using, I'd be more nervous than if that patent license were explicit.
Arguably, Reactjs can be replaced by something else. But a mobile app in the wild cannot be replaced easily or quickly. And more so if you are using something like caffe2go (deep learning on the smartphone).
Or the data and training sets that you build around caffe2.
Author argues that the situation is not that bad and it is still somehow an open licence or even when not then it is still acceptable. I believe that it is neither of them.
(Emphasis mine) yes this is why people are up in arms. This isn't common in the open source ecosystem.
I haven't heard anyone address that scenario yet.
If I am mistaken please show me where it states that only the agreement is restricted to software patents alone.
I am completely fine with Facebook's choice at end of the day it's their hard work and right. However it's important to understand broader implications.
Nice apples-to-oragnes comparison of the WebM PATENTS to the React PATENTS. The only things they have in common is the scope of the grant. The revocation clauses range from fair and sane in the WebM case to extremely overreaching and unpredictable in the React case.
The WebM PATENTS causes revocation for litigation against Google for patents covered under the grant.
The React PATENTS causes revocation for litigation against Facebook for ANY patent, regardless of whether the patent was covered by the grant or not.
The WebM PATENTS causes revocation if "you or your agent or exclusive licensee institute" sue Google. That's pretty much limited to you / your company / a subsidiary of your company using the code.
The React PATENTS causes revocation if "you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion" - this is where the React PATENTS clause shows it's teeth. "Corporate Affiliate" has a wide definition. For example, a shareholder is a "Corporate Affiliate". So if you own Company A as your startup and use React and also own shares in Big Company B as an investment, then if Big Company B sues Facebook, guess what, Company A loses the patent grant. Or more likely, loses the license and is then hit up for license fees or is then sued if they continue using React.
Beside, this is not a matter of law but matter of philosophy.
Interestingly, most of the posters correctly identify the core concern. If you've invested significant resources into developing React projects, have IP, and Facebook infringes your IP, you're in very hot water.
Most businesses aren't competing with Facebook or patenting business critical innovations in spheres Facebook will be operating in. Using React in all of those cases is a non-issue.
For these people, the license's restrictions seem very minimal, so dumping React in the Open Source bucket seems reasonable.
For others, this restriction is an existential threat. This is why other people have an issue with the license being considered open source.
As mentioned, Heather has represented a ridiculously long list of clients, including many strong competitors to Facebook.
If she says it's her personal opinion, you can take that to the bank.
In fact, given how many client she's represented, i'd say she's probably less biased than most folks. She's pretty much seen and dealt with it all.
I've seen this bias arise in senior practitioners with successful practices across industry groups.
In any event, her person is somewhat tangential to the important point: the react license is a substantial issue to a subset of people and organizations.
It seems like you'd have no patents grant then anyway and you'd already in the position you're in now if you sue Facebook for patent infringement (and are using React).
The first is with the OSS appellation, which should rely upon the permissiveness of the corpus of rights surrounding the work. React claims that it is OSS, but functionally the corpus is very restrictive.
The second is that the grant itself removes any question as to whether there's an implied patent license in a typical OSS license. This lowers FB's barriers to litigating against people using react using patents as well as copyright. The multiplication of rights afforded to IP holders is an issue best discussed elsewhere, though.
The third issue is that even if FB would never weaponize their React patent portfolio, prospective coders may avoid using the framework even if it is the best suited to task for fear of FB extending into their industry. This is not efficient for either party.
It would be very helpful to get some clarity about a scenario where many people have concerns: (text copied from another comment)
"What if Facebook actually breaches your patents? What if they sue you? You can't counter-claim if your tech is based on React, because you'd lose the grants."
Facebook could make a definitive statement about this. Or, representing Facebook the author could spell out exactly why this cannot happen. Yes?
While confusion about the license might be behind some or most of the community reaction, the fact that the license refers to litigation over any patent, not just software patents, neutralizes this punchline. Correct me if I'm wrong, but this clause positions Facebook to fight any patent infringement suit with a software patent infringement suit, which is not in the spirit of the opposition to software patents at all.
The article claims that the Facebook patent grant is no big deal because:
(1) Yes, it has defensive termination, but defensive termination is standard.
(2) Even Apache's own Apache 2.0 License has defensive termination.
(3) And while Facebook's defensive termination language is on the broad side, it is similar to IBM's CPL 1.0 (an OSI approved license).
First, IBM's CPL patent grant triggers termination if you sue a project contributor for software patent infringement. Facebook's patent grant terminates if you sue ANYONE if ANY PART of your patent claim relates to ANY product or service of Facebook or ANY of it's corporate affiliates. That's about as broad as you could possibly get.
Does that mean that suing a Facebook shareholder like Microsoft for patent infringement totally unrelated to Facebook could invalidate your React patent grant? Who knows? I bet your lawyer hates you for asking.
Second, the article claims that the "CPL is already approved by the Open Source Initiative as compliant." Using the CPL 1.0 as a point of comparison of what is a normal OSI-approved license is completely silly.
If you check the OSI site, the CPL is technically classified a "Superseded license" which means it's not intended for further use. It was formally replaced by the Eclipse Public License (EPL) about a decade ago. Most notably, the newer Eclipse license has a much less strict patent termination clause.
So why did Eclipse go through all the work to re-write their license and replace CPL? This is important - I'll cut and paste directly from the Eclipse Public License FAQ [1]:
"Why was the EPL written?
[..snip..] it addresses concerns some Eclipse Foundation members had with how the CPL deals with possible patent litigation."
So saying that "Facebook's license is normal" because it's a more broad version of a license that OSI suggests you no longer use is pretty misleading in my opinion.
They added this license for a reason and they will use this leverage as much as they can and if you don't see that you are in denial.
If you cant move away from it, then stick with it. If you can move away or are still building your product just pick another framework and move on.
> Unless a company decides to sue Facebook (or accuse its products), the termination trigger has no actual effect.
Please everyone, don't rely on this advice.
I looked at react during the first hype was alerted to its license terms right here on hn by other people who understand the difference between software with a termination clause for those who sue to gain exclusive/royalty rights to the particular software and software with a termination clause for those who sue a particular party engaged in a significant amount of unrelated activity.
All that has changed recently is that more people are questioning their strange assumption that it doesn't matter since it is incongruent with fb again putting a recent rework and then substantial defense into something that "doesn't matter".
No. Copyright law is concerned with distributing copies and preparing derivative works. Copyright law does not give a creator the tools to forbid anyone from using their copy—that too is within the realm of patents. The way that copyright law can effectively regulate use is indirect; it prevents someone from receiving a non-infringing copy to do anything with. If you are found to violate a license (say because it's a reciprocal license and you didn't provide source code for your own changes), then even a revocation of that license can't revoke your ability to continue using the software, because that is not something regulated by US copyright law. The copy you received was prepared and distributed to you legally. Filing a patent suit, or otherwise running afoul of the license doesn't change that.
There's a really pernicious cargo-culty thing going on where people keep describing a bifurcated situation, where the BSD is your "copyright license" and "PATENTS.txt" is your "patent license".
BSD is a license. It deals with rights reserved for copyright holders—the right to make copies and prepare derivative works. It also deals with (one of the) rights regulated by patent law—the right to use. It grants you both. PATENTS.txt is an additional grant.
Regardless, the distinction in this case is mostly academic, since React is almost always used in client software, which must be distributed.