PolyForm Noncompete Licenses | Hacker News Reader

PolyForm Noncompete Licenses

writing.kemitchell.com

29 pointsjoeyespo47 comments

The real problem with the licenses is that they are not open source, but many users of them still seem to think they are doing open source.

The funny thing is that they are trying to protect themselves from Amazon and other competition before it usually exists, and that in reality, they are doing themselves more harm because the big co lawyers are starting to reject these unusual, project specific license. "If it takes more than a few minutes to understand, then I tell the devs No"

To all those would be users of the Faux Pas OSS licenses, why did you make it open source in the first place? If you want to protect your code, why no make it private? Why use one of these licenses?

I had a conversation with a company a few weeks ago about this. What they told me aligned with other things I've heard. Basically they're seeing customers giving preference to open source software and they believe (rightly or wrongly) that using one of these non-compete licenses will give them the marketing advantages of open source without the potential business model downsides.

Of course, they also likely don't get the development model advantages of open source but anecdotally these companies don't much care about that. (And TBH a lot of single-company products/projects don't get a lot of outside contribution anyway.)

Could the company use something like AGPL in these instances? (The developing company ofc wouldn't follow the AGPL, but in this case the code is officially open source.)

It's possible. Although a cloud provider could still potentially run a competing service so long as they made any modifications available to the public. (A cloud provider still might choose not to do so because of uncertainly about how the code interacts with other services in their infrastructure.)

But, yes, "Why doesn't the AGPL solve your perceived problem?" is a reasonable question to ask in the context of these non-compete licenses.

Amazon can host your thing cheaper than you can, and it doesn't have to pay your developers. The AGPL means Amazon won't have better features, but they can still have better economics, better big-company reputation, better one stop shopping, etc.

It's like having your cake, and eating it too!

That doesn't track my experience advising on new licenses in the last few years. Most of the folks who ask me for or about them have been in open source for quite some time, have done their homework on licensing basics, and simply don't care whether anyone in particular tells them they're open source. Open source is at best a means to them, not an end, and not a perfectly effective one when it comes to advancing an activist cause, building a business, or advancing the technical state of the art.

Watch the video of FB head of legal talking at the FOSS conference about licenses.

Success in advising these companies on crafting a license does not imply that the project or their choice to embrace this style of license will result in success. If they still call themselves open source, they are lying. The proper term is "source available."

I've seen the talk. There are many talks.

No license guarantees success in any dimension. Not MIT. Not BSD. Not Apache 2 or GPLv3 or WTFPL or any of the PolyForm terms. Most open source projects, as I suspect you define open source, fail. Very little uptake. Very little outside contribution. Net loss, financially speaking, for the developers.

You're free to argue for or against whatever meaning of "open source" you like. But disagreeing with you, or refusing to accept the brand you'd force on them, does not make anyone a liar.

I was quite doctrinaire about the issue myself, for many years. It wasn't until I got beyond reading what the OSI said about itself---parsing the OSD, reading its history, dealing with the mailing list process, seeing the shifts in FSF position, reading up on the "open" buzzwords wars before 1998---that I realized the "right answer" I was so proud of having wasn't so right and rigorous, after all. I regret how badly I treated others, for the sake of my own feeling of "correctness".

If you think the PolyForm counts as open source, and you want to pervert the meaning of open source, go ahead. You can claim your own meaning for open source and licenses, but there is a governing body that we look to, to decide which licenses do qualify as open source. They have started denying this style license, and until they approve PolyForm as a qualifying license, you will be considered among the liars (people abusing ignorance and marketing for their own benefit) if you promote it as an open source license.

I'd agree with you if "open source" was an OSI trademark, but I'm fairly sure it isn't. While some languages have an official authority for proper usage of general words and phrases, English doesn't. Words in English are defined by their users, and often can have multiple simultaneous definitions that are linguistically correct. Given this, OSI's authority over the definition of "open source" is solely in their ability to convince others.

We do have organizations that observe the actual usage of words and attempt to capture their use descriptively. Here's a fairly well-regarded source: https://dictionary.cambridge.org/dictionary/english/open-sou...

It is inaccurate to call someone a "liar" for something that falls into the realm of opinion.

PolyForm hasn't held the new noncompete licenses out as "open source". Others could, but we don't. I don't know how you jumped to that conclusion.

Personally, I don't care what OSI says, though I do care very much what some of the individuals involved in it say. My clients occasionally care about OSI approval, but far less than you might expect.

I've also been a part of drafting licenses that I suspect nearly anyone would call "open source". The Blue Oak Model License, for example. I won't be submitting those licenses to OSI or FSF. As far as I know, none of the other folks involved in drafting them care to waste their time on that process, either.

It's the crowd consensus around definitions and open source licenses that matter, and if the crowd puts trust in OSI (or another) org, then it gains value and becomes the guiding light so to speak. This is not so far off from how / why Bitcoin has a real world value.

Essentially, it will be an uphill battle for companies using these license to claim they are part of the open source community. Just because you are on GitHub doesn't mean you are COSS. I now consider Microsoft to be the biggest COSS company.

There is no consensus. There are myriad distinct points of view and competing interests. Several schools hold themselves out as the one true reading of the Open Source Definition. Others don't care about OSD at all.

Is CC0 (not OSOI approved) software open source? How about AGPLv3 (approved)? Ethically licensed software (in process)? BSD/MIT (approved) code from standards bodies under separate patent? Adaptive Public License (approved) software that explicitly opts out of patent coverage? NASA's latest license (not approved)? RPL 1.5 (approved by OSI, not by FSF)? Apache 2 (approved) API wrappers that only talk to closed cloud services? WTFPL (not approved)?

I've released noncommercial licenses, avoided calling them "open", had others do so quite despite me, then hear, basically "I know, and I don't care" when I pointed it out. On the other hand, I know people who don't think copyleft counts as open source, or shouldn't any more.

There is a kind of lowest common denominator of sorts around MIT, BSD, Apache 2.0, maybe Artistic 2, assuming no patents. Some would add GPLv2, LGVPLv2.1, and maybe MPLv2 and EPLv2, for copyleft. All of those licenses have well known legal and practical limitations. Some are truly ancient, like MIT and BSD, and wouldn't be considered competently drafted now.

I expect the "ethically licensed" attempt will fail the open source bar. Anything that selects out a group as having different requirements ought to.

Free as in speech, without bias or contempt of others, will win in the end (I hope). This is why FSF "free" software (strong copyleft) is different from "open source" and they have different governing bodies. We are already seeing a pull back from copyleft and the overreaction the other direction (to non-compete) will both lose out to best in class humanity found in truly "open" source ideas.

Genuinely sorry if I offended you.

Definitions are evolving, people will abuse language for personal gain, and the world goes on.

I am personally hopeful that open source will gain a wider and more pure definition beyond software and licensing. Like GitLab, transparency, and their handbook, or the maker movement and DIY / distributed / local production.

My license choice (of BSD-3) was based on the projects I work most closely with. (Golang / Cuelang)

Consensus is really needed, generally speaking, so that the phrase "open source" does not lose meaning and so that the ecosystem avoids fracturing from a gaggle of certifying bodies

I think challenging the consensus is equally needed (and high time in this regard, IMHO). To me, 'open source' lost its meaning a while ago, and I welcome new ideas in this space.

When did it lose its meaning? What did it mean that it no longer does?

Another thing to consider is that we are still in experimentation mode.

- Companies are trying this out, like it's the best way forward, but we don't really know. We are seeing push back now. - Corp lawyers are defaulting to "No," one of the big COSS trying this out reverted after their license denial, Amazon open sourced their ES tools - Google and Microsoft have partnered with the big COSS companies to offer their products as a seamless experience (literally right next to Google products in the GCP UI with the vendor logos) - With the increasing ease with which software is being created, and in particular SaaS platforms, the license and interface defenses may quickly be replaced by open source alternatives. (re: Joe Jacks talking about COSS eating SaaS)

So we will see how this plays out. I am personally staying with BDS-3 Clause for our open source code and keeping other parts private.

Kyle is one of the authors of Polyform and the Polyform website specifically states that these licenses are not Open Source.

> PolyForm is not Open source or free software. There are plenty of existing open source licenses. PolyForm is not a substitute for them, but an alternative for those who want to license source code under limited rights.

Apologies to Kyle, I only skimmed the website and took his stance by comments here and not statements about PolyForm from the PolyForm website.

My opinions still voiced, substituting PolyForm for licenses which are of the offending nature I describe.

Such as?

Such as what? Could you be more specific please?

So I build a thing, and I want to give it away to hobbyists and small, risk-tolerant non-competitors, as a public service and for marketing. I hope to make money later selling it (or selling consulting), probably mostly to big companies.

How is any of what you write above a problem? If the big companies are willing to pay me, then I'll sign whatever commercial license they want--and if they're not, how does it benefit me for them to use it for free?

Big tech companies have done an incredible job of harvesting the value of free software developers working for free. I don't see why a license that makes that harder for them is bad, except for the big tech companies. Perhaps defining "competitive" will be too mushy to make these licenses practical for anyone, but I appreciate the attempt.

You can just use one of the existing licenses that big corps don't like, for example AGPLv3+

AGPL means they can't compete on features, but they might have better hosting economics, better sales and marketing, etc. Or they can offer better features, but split those into a separate closed-source program that talks to yours. The latter is presumably why MongoDB switched away from the AGPL (which was controversial; but I'm always amazed at the entitlement shown by people receiving software for free).

Let's say I work at Giphy and we publish a library with the Defensive license. Then the library is used by the folks at Twitter. Okay, Twitter isn't competing with us and they send lots of traffic our way, our team is cool with that. Then Giphy is acquired by Facebook. Is Twitter in trouble?

This is specific enough that I don't think I can say "not legal advice", address as posed, and truly expect that nobody will jump to some conclusion without consulting a lawyer. You'd really want to have a legal conversation about this kind of scenario, with full freedom to talk confidential details, in order to reach the right practical conclusion.

What I can say is that the Defensive license comes from folks who deal with M&A, noncompetes, and resulting complexities all the time. 1.0.0 has a number of provisions addressed to potential operational and structural changes that could affect scope:

https://polyformproject.org/licenses/defensive-licenses/1.0....

My own personal view is that the 1.0.0 terms will be perfectly well recommendable for a great many companies and use cases starting today. But also, emphatically, that any set of terms can be improved, especially in how they interact with external sources of complexity, like the corporate laws. I hope we'll see 1.0.1s and 1.3.0s and 2.0.0s and beyond for all the PolyForm licenses.

If anyone is or has the gas to contribute to those conversations, please reach out: https://polyformproject.org/contribute/

Alternative, but similar scenario:

Let's say a database gets licensed under the defensive license by $CORPORATION_0. And let's say that $CORPORATION_1 makes many contributions to that database under the same defensive license (where they retain copyright). A little weird, but presumably both companies are comfortable with the situation.

Let's then say that $MEGA_EVIL_DB_CORP buys out the contributor $CORPORATION_1, and now $MEGA_EVIL_DB_CORP owns the copyright and has competing databases.

I'd assume both companies can no longer use the defensive licensed DB. Meaning all Oracle has to do to destroy the competition is buy whichever company is cheaper.

That seems like a bad attack vector.

IANAL but it seems like a non-compete license would need copyright assignment so it's clear who you can't compete with. The dual-licensing bait-and-switch business model also requires copyright assignment so it's not that different.

As an open source developer, I wouldn't contribute to any project that uses these licenses or trust any company that's using them. They're not classified as free software or open source for a reason: it's crucial to be able to fork in the event that the company decides to become hostile. The ability for the other contributors to do this is what keeps them honest. With these licenses, that whole trust aspect gets thrown out.

Joseph Jacks has some interesting ideas for Commercial Open Source Software (COSS) https://coss.media

Though he recently told me that he thinks all OSS should bootstrap and never take investment, which doesn't exactly align with top COSS co spreadsheet he also maintains.

Hey, Tony. :) I believe that COSS companies are extremely successful when they are able to build large and successful positive-sum and inclusive ecosystems around their FOSS core (specifically, that core being FOSS licensed, not source-available license'd). My partner Heather Meeker has written most of these non-compete licenses. They are useful at the crust around the core, not in the core, IMHO.. if they are applied to the core, there is very little distinguishing it from freemium/proprietary which != FOSS. Also, many of the most successful COSS companies never raised a cent of VC to get to scale: Jetbrains, Liferay, Odoo, etc. and the ones that did raise a similar amount of money to get to scale did not really need it, they just accepted it along to way maybe to speed growth a bit, but their commercialization strategies were often working quite well and their customer acquisition costs highly efficient.

Hi JJ.

Steph and I have been breaking things down from our chat, and basically came to the same conclusion, though often favoring closed source where one might GPL/NonC license that crust around the core. Also that outside investment is to add fuel to an existing fire, COSS or fully private makes less difference than showing you've built something people want.

Do you have any new videos or podcasts? Always love to hear your thoughts, you put things very succinctly!

s/complete/compete/

I appreciate attempts to standardize the law, and make it more accessible and cost-effective to rely on.

Hmmm, guess there are issues though

Thanks for the typo fix, which someone also e-mailed to me, as well. The virus has me working from the couch, and despite jacking my font sizes up and wearing my driving glasses, I am making far more typos than usual.

Publication of standardized legal building blocks is a big passion of mine. I think it's essential, both for the good of law clients and for the mental health of their lawyers, that we do a lot more of it. Besides PolyForm, see also:

https://waypointnda.com

https://blueoakcouncil.org

http://www.commondraft.org/

https://commonform.org

The OSS license body is rejecting these non-compete licenses as open source.

To be somewhat pedantic, the Open Source Initiative maintains the open source definition and has a license review process which can lead to a license becoming an OSI-approved license. There are a variety of reasons licenses don't get approved but one of them is that it doesn't meet the open source definition.

I'm not sure any of these "non-compete" licenses have been rejected by the OSI. I'm pretty sure at least some of them haven't been submitted because they almost certainly would fail to be approved.

But to be clear, anyone can claim their license is an "open source license" just not that it's an OSI-approved license if it's not.

I suppose what I am getting at is that, like with many things, humams tend to gravitate towards adopting definitions around the governing body (experts) certification. We can get into problems, like certified organic, when there are too many bodies creating standards. There was actually an analogous conversation in Cuelang about this, w.r.t. user registered builtins, Cue code which can no longer be used with cue, and the worry of fracturing the ecosystem.

https://opensource.stackexchange.com/questions/8367/is-the-t...

This is one of the top results when searching

Let's say a repo on GutHub has the Perimeter license, and I clone it to a public repo. Would I be unable to include any personal changes on the clone I have? Because it'd be a substitute product that's distributed via GitHub?

Are these enforceable in California? California does not like non-compete clauses.

See cal civ code section 16600: "... every contract by which anyone is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void"

I believe copyright law in the U.S. is governed by federal statute and copyright infringement matters would be handled by a federal court.

You might be right about that, but federal courts can consider state laws. I'm not sure how that would play out.

I also found an unpublished opinion from SCO Group, Inc. v. Novell, Inc., that deals with a similar issue that also makes me think that this software license could work:

> The license in the APA and the TLA does not preclude Novell from pursing its business. Rather, the license merely restricts Novell's ability to use SCO's property and is part of an ongoing relationship between the parties. Therefore, the court finds that there is no restraint on trade and the restrictions are not void under Section 16600.

I am not a lawyer, and none of this is legal advice, but these licenses seem SAF (Sketchy As...).

More precisely, using software written with these licenses would be something I would never do, either in an Open Source project or a commercial project.

Consider for example the 'Patent Defense' section of the Polyform Defensive license. If I am reading this right then if you have a patent and use Polyform Defensive licensed software from Example,inc. to the point that stopping using the software is a major hardship, then Example, inc. can infringe on your patent and be safe because you won't risk losing the right to use their software.

Or the 'Sales of Business' section. Let's say Example,inc. is building a blog hosting platform and Open Sources a library for an image carousel under Polyform Defensive. Exemple SA start using it for their Computer Based Training site. Later Example,inc. enters the CBT market. If I am reading this right then Exemple SA now has to either stop using the software, or leave the CBT market - and might not even have a choice about leaving the CBT market.

A lot of work has gone into making useful and effective Open Source licenses that benefit both sides when a company open sources their software (software user and the company making the software). A company has a range of protectiveness they can choose: Affero GPL, GPL v3, BSD, MIT, Apache, EPL are some well known ones [1]. Why do we need the PolyForm licenses, especially when they seem to me to be several steps back toward the dark ages of commercial licenses, and being so ambiguous you need a lawyer to evaluate it every case.

You also have the question of legality in every region. Aren't noncompetes heavily restricted in California.

I also am of the mind that 98% of noncompetes and NDAs are hubris and unnecessary, other than to use as a collar to retain employees. Better to retain through incentivizing than threatening. And also, ideas are a dime a dozen..most people are not going to steal your idea as it's the execution and the funding backing it that will make the difference.

Lastly, a key thing to not is that the Polyform Project itself says these are not Open Source licenses[2]:

  PolyForm is not…
  Open source or free software.  There are plenty of
  existing open source licenses. PolyForm is not a
  substitute for them, but an alternative for those 
  who want to license source code under limited rights.

There are Open Source licenses out there that legal experts state will protect you, whatever your range of needs if you are willing to abide by the Open Source ideals[3]. Why not embrace the Open Source movement, instead of saying mired in the past?

[1] https://en.wikipedia.org/wiki/Comparison_of_free_and_open-so...

[2] https://polyformproject.org/what-is-polyform/

[3] https://opensource.org/licenses/category

It seems the most on-topic comment was downvotes into oblivion.

Reply on news.ycombinator.com