Hacker News Reader

Comment by chrismorgan | Hacker News Reader

> SQLite is not open source in the legal sense, as “open source” has a specific definition and requires licenses approved by the Open Source Initiative (OSI).

This is wrong, and harmfully wrong. OSI are not the arbiters of open source. Their Open Source Definition, though generally useful and accepted, is not without legitimate criticism and controversy. As for their approval, that’s a dreadful thing to rely on for any purpose; <https://writing.kemitchell.com/2019/05/05/Rely-on-OSI.html> is a good description of most of what’s wrong with it (it doesn’t really get into the broken politics enough; but some of his other articles contain more), and I like its summary: “The list of OSI-approved licenses reflects OSI’s practical and political history, not any useful, consistently functional category of license terms.”

As for whether SQLite is open source, well, the only reason a public domain dedication doesn’t meet the OSD is that it’s not a license. It’s more open. In a way that is legally mildly uncertain in some jurisdictions, sure, but to call it “not open source in the legal sense” is just wrong.

View on HN

OP is wrong, SQLite does match the requirements outlined in the OSI's definition: https://opensource.org/osd

It's not "open source licensed" simply because it is not licensed. There is no license document for OSI to approve.

Relying on OSI approval does not necessarily make sense, they don't get to all licenses as your link points out. However arguing over their definition seems very foolish. People only do it when they want to pass their all-rights-reserved code as "open source" (e.g. "I can call it what I want"). Having adjectives that mean the same to everyone is very valuable, actually.

> Having adjectives that mean the same to everyone is very valuable, actually.

Yes, and that's precisely why OSI should have invented a brand new term which they could trademark. But instead they co-opted "open source" which already had a clear, generic meaning of "the source code is available", previously without any connotations around specific license terms. And then due to that prior usage of the term, OSI can't trademark it.

OSI created this terminology mess, and personally I don't think it is "foolish" to argue with their historical revisionism campaign around it.

Edit to add: for numerous proven examples of the term being used for many years prior to the OSI's existence, read the link ezekg already posted below, https://dieter.plaetinck.be/posts/open-source-undefined-part...

That is not clear or generic. Source code available isn't that useful and isn't Open Source.

I am saying that describing a code base as "open source" was intuitive and generically understood to mean "source available" prior to 1998, which is when the OSI co-opted the term and conflated it with a much more specific definition involving license restrictions.

As for the pre-1998 meaning not being "clear", that's a matter of opinion. I would counter that OSI choosing to redefine an already existing term, and then falsely claim they invented that term, makes things far less clear.

Please read the link I included above. That post author's findings completely align with my own recollection from discussions on BBS's and newsgroups in the 90s.

The fact that you had to change your use of the term back in the 90s is deplorable but is it really any argument for going back?

I for one like where we are (which is not an endorsement of OSI as an organization, just of their definition). The terms are short and universally understood, there is a wide range of licenses to choose from, some of them even got a yay/nay from lawyers.

I feel that the current status quo around OSI-approved licenses is largely beneficial to incumbents ("big tech" / cloud providers) and is generally harmful for software innovation industry-wide.

A fair number of vocal people in the industry express contempt for anything using a non-OSI license, even though many of these licenses are simply trying to empower a sustainable business model so the work can't be stolen and abused by cloud providers.

If you independently create a truly innovative new infrastructure software product today (or during any other non-ZIRP / non-boom-time period) with the intention of forming a company around it, you are faced with several bad options around licensing and source availability:

* If you adopt an OSI-approved license other than AGPL, and your product is successful, larger incumbents can and will steal your work and capture most of its value. You will either go out of business, or eventually need to re-license, causing mass outrage and accusations of rug-pulling.

* If you choose AGPL, most VC-funded companies won't touch your software and statistically it will almost certainly fail commercially as a result. Additionally there are several concerning theoretical loopholes in the AGPL, as well as conceptual problems with a non-EULA nonetheless trying to enforce restrictions affecting end users.

* If you choose an entirely close-sourced model, your chance of success is very very low, especially for B2B products. You're a small/new vendor, other companies won't trust you.

So the logical conclusion is you should choose a non-OSI license which prevents the cloud providers from stealing the profits from your hard work. But then random people will attack you everywhere for "open washing" and not being "open source", even if you don't use the word "open" anywhere. People have seemingly been trained to have a knee-jerk negative reaction to SSPL, BSL, etc and that's a really bad state of affairs.

It's especially problematic that the OSI is a closed-membership entity, and not an open-membership professional association. There is no democratic way for software engineers to influence its policies. As an industry we've effectively ceded control over what licenses are acceptable to a random small non-profit. And as a result of that, it's harder today to be a successful independent software vendor than it was in the 90s, which is an absurd state of affairs.

Again I understand your point but this has nothing to do with the terminology...

My point was that accepting OSI’s terminology maintains a status quo that is harmful to innovation and harmful to independent software developers. You’re ceding control over what licenses are acceptable to a closed-membership non-democratic entity that isn’t a professional association. I choose not to do that by rejecting their terminology as a necessary first step.

You can easily release something with a shared source/source available license that doesnt make it open source. You can also dual license gpl/proprietary use license

> release something with a shared source/source available license that doesnt make it open source

I already described problems with that approach up-thread. People attack software that uses non-OSI-approved licenses and accuse it of "open washing" even if it avoids the term "open". Or they attack it for not being "open source" and refuse to use it, even if they're not working at a cloud provider or competitor, and are completely unaffected by the extra license terms.

In any case you're repeatedly saying "open source" when you actually mean "OSI-approved", which is the entire thing I'm railing against here.

> You can also dual license gpl/proprietary use license

That solves literally none of the cloud provider problems I've described above.

I understand your point, but I am not sure a new term wouldn't have been co-opted (if it was any good). It would certainly have hurt adoption (if it was not as good).

I also like the current terminology better tbh ("open", "available").

If they had invented a new term, then they could have obtained a trademark for that term, which would properly allow them to enforce their definition and ability to certify licenses as open source. That's usually how this works, for example POSIX is a trademark of the IEEE. (the other possible route is enforcement/certification by a government agency, for example organic food must meet certain farming practices to be called "organic".)

Instead we have a situation where they didn't invent the term but they lie about it and said they did. They don't have a trademark and obviously aren't a government agency, so enforcement is left to random people acting as self-appointed terminology police on their behalf. And then we get huge subthreads like this one, where a bunch of people have to argue about whether one of the most successful open source projects in history is really even "open source" :)

> OP is wrong, SQLite does match the requirements outlined in the OSI's definition:

That is true for most of us, but there are jurisdictions that do not recognise the public domain in the same way. SQLite's license page mentions this and offers licensing for people who need to deal with this. https://www.sqlite.org/copyright.html

> OP is wrong, SQLite does match the requirements outlined in the OSI's definition: https://opensource.org/osd

OSI also says Public Domain is not open source: Public Domain Is Not Open Source https://opensource.org/blog/public-domain-is-not-open-source

I skimmed over both of those links and it seems that there are in fact no aspects of the definition that could be challenged with public domain software. The second one is all over the place (the author even says he's not a lawyer!) but it seems focused on the fact that public domain rights are not recognized the same in every country. SQLite has other licenses you can use for those situations. The idea that this project is not truly open source seems silly.

SQLite did do those additional steps outlined in your link.

I will try to rephrase it and include links to Wikipedia and OSI

> As for whether SQLite is open source, well, the only reason a public domain dedication doesn’t meet the OSD is that it’s not a license. It’s more open.

That's true and I do acknowledge this in the post:

> Instead, SQLite is in the public domain, which means it has even fewer restrictions than any open source license.

[1] https://en.wikipedia.org/wiki/Open_source

[2] https://opensource.org/blog/public-domain-is-not-open-source

Here's another interesting read on "open source" and the OSI: https://dieter.plaetinck.be/posts/open-source-undefined-part...

I'm willing to let OSI own "Open Source", cause why not (do they have a trademark on "Open Source"?), but not "open source". All-lowercase "open source" includes public domain, I don't care what OSI says about it, while "Open Source" is whatever OSI says it is, and if that does not include public domain then so be it.

Quite an interesting rabbit hole to explore. Apparently OSI holds a US trademark for “Open Source Initiative Approved License”, but no trademark for “open source” by itself.

Hardly surprising because the idiomatic usage of "open source" predates OSI.

Apparently not by a lot, but it does indeed.

The term definitely preceded the organization. The term was in use for years before OSI was formed. And OSI was clearly formed in order to provide some clarity to what was meant by “open source”. In other words, if there was no ambiguity in the phrase “open source”, OSI would never have been created.

And the best way to handle this ambiguity is to use "Open Source" when referring to OSI's definition, and "open source" when referring to the colloquial and ill-defined form.

Capital letters are only useful as ECC, not direct signal. (You can't pronounce them, they aren't preserved in many contexts, the lay writer won't respect them, etc).

Your idea is like saying "Google" can be a trademark owned by Alphabet but "google" is just a verb. It seems like a cute linguistic hack but won't be meaningful in the public discourse.

> Capital letters are only useful as ECC, not direct signal. (You can't pronounce them, they aren't preserved in many contexts, the lay writer won't respect them, etc).

In speech I clarify if and when needed, naturally.

> Your idea is like saying "Google" can be a trademark owned by Alphabet but "google" is just a verb. It seems like a cute linguistic hack but won't be meaningful in the public discourse.

You have it exactly backwards. Descriptively "to google" is a verb.

Descriptivism is much better than prescriptivism in natural language. Sure, we need to use prescriptivism when teaching the language, but we do get to evolve the language. That's just how it goes and has gone for the entire recorded history of mankind.

Are you trying to subtly prescribe that descriptivism is better than prescriptivism? :)

A bit, yeah :)

Try pronouncing the word “Polish.”

Or helping your uncle Jack off a horse.

The Polish example only works because it's a different word, and yours only works because of implied but unwritten punctuation.

Neither is pronouncing a capital letter, whatever that means. It's why people have to say things like "capital P Political".

The fact that “Polish” and “polish” are different words is the whole point. The other commenter was saying capital letters aren’t signal, and yet.

The fact that it’s a different word makes it very different situation. It’s not the capital letter that signals this. It’s the context. Polish as a verb and Polish as a noun won’t be mistaken in a sentence. In “Polish my boots, please” we know it’s a verb, even though it starts with a capital letter. The capital letter does not ever signal meaning. That’s because a language is primarily spoken and there are no capital letters there.

Indeed, it seems to me that Public Domain is what Open Source should have been in the first place.

The free as in freedom, but not as in free beer quadrant doesn't work too well, especially for individual developers.

There is an argument that without the copyleft provisions of the GPL (sometimes described as a virus), free software would not be as popular and important as it is today.

Humanity also was described as a virus, see for example The Matrix. Also capitalism, communism, socialism, any political system, religions, philosophies, cultures, and anything you might relate or hate at mental level.

Even the idea that whatever we dislike that gains more than zero popularity should be compared to a virus, this meme spreads like a virus.

You can release a binary as public domain.

Also, I believe that public domain as a concept does not exist in some countries. if i remember correctly the concern is that without a license the original author could change their mind and sue.

But any public domain software also matches the fsf and osi definition of free software and open source respectively. Atleast in jurisdictions where public domain exists.

You may be confusing things with copy-left, which is designed to protect users from developers. The gpl is a copy-left license.

You are 100% correct. Open source has a common definition the vast majority of the world uses, a company can proclaim their own definition, but it doesn't magically change the language. Nobody is thinking about, or even aware of, the OSI, when using the term. The correct term people should be using is "OSI approved", or something similar, although that's no more meaningful or useful as a "bob approved" license, where bob is some random nobody.

The thing is, in many corporate and government settings, OSI is trusted by default as "this is open source", and anything not explicitly covered by OSI will cause you a world of pain with your legal department to get an exception.

And yet sqlite is the most distributed database code on the planet by an order of magnitude.

No one does any due diligence on software. It's a free for all.

It’s distributed in MacOS, Chrome, Firefox, etc. I think these companies do due diligence.

Edge case. In every company on the surface of this continent people import libraries and run software with no idea what is under the hood and whether they are compliant with all the applicable license agreements. Some clumsy attempts are made for major systems in some companies, but again, edge cases.

What part of Public Domain do these legal departments not understand?

It's not that they don't understand; it's that it causes more work for the lawyers, because someone has to review the license if it's not one of the standard boilerplate acceptable licenses.

I once had to go to lawyers to get a license approved on a lib that went something along the lines of "this work is in the public domain; do whatever the fuck you want with it, just don't come crawling to me for help". I'm paraphrasing from ~20-year-old memories here, but I do distinctly remember the profanity. It elicited a chuckle from the lawyer and something along the lines of "I wish all of these were this simple".

JSLint had a standard open source license with an addition that said “The Software should be used for Good, not Evil.”

IBM wanted to use it but their lawyers balked at the added restriction. They wrote to the author to see if it could be removed. The author wrote back with, “I give permission for IBM, its customers, partners, and minions, to use JSLint for evil.”

If you're doing this sort of license analysis, try a license detector I built. It tries to guess which license was used and diff any changes. Lots of licenses are small changes from others, so it usually makes multiple guesses.

https://alexsci.com/which-license/

Sounds like https://en.wikipedia.org/wiki/WTFPL

"DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE"

The US isn't the only jurisdiction, and public domain isn't a concept in all jurisdictions.

But in this jurisdictions without a concept of public domain, who is going to come after you for using software without an explicit license?

I mean, like Germany?

And legal departments don't really like the "but, like, what's the chance they actually use us?" argument.

That’s not enough which is why this page exists:

https://www.sqlite.org/purchase/license

They understand quite well that it's not really something you can just neatly place a piece of work into. Something which is 'public domain' but the copyright has not actually expired on is higher risk to use than something with an explicit open source license.

You commented before reading...Unless the author updated the blog in the meanwhile. Because point 6 says: "Instead, SQLite is in the public domain, which means it has even fewer restrictions than any open source license."

That's the point. It should still be considered open source.

Which is not a thing in my jurisdiction, and so as far as I can tell it’s treated as being proprietary and unlicensed.

Is using SQLite without buying a license [1] really illegal in your jurisdiction?

[1]: https://www.sqlite.org/purchase/license

As far as I can tell, yes. It's a grey zone, because it'd fall under civil law, not criminal; so SQLite's copyright owners would need to bring suit against me for it to matter, which I don't believe they will.

However, on the face of it I have no right to use the software without buying a license.

Would it be possible for someone within a compatible jurisdiction to mirror SQLite3 and provide it under some license such that it could be used by anyone?

I don't see how it could possibly could be illegal in any jurisdiction.

The only part of the US public domain that won't fly in many countries is the waiver of moral rights (mainly the right to attribution). Since my country does not allow this waiver, the authors might be able to sue me in my jurisdiction if I started claiming to be the author of the code, which would have been ok in the US. But the voluntary non-exclusive transfer of usage, modification and distribution rights is surely allowed in every jurisdiction, so there is no reason that that part of the dedication would not be valid.

And if there exists a jurisdiction where the transfer of material rights isn't allowed at all, selling a license also wouldn't fix anything. Unless there's a jurisdiction out there somewhere that allows the transfer only in exchange for money or in a one-on-one contract, but then open source licenses also wouldn't apply there and I feel like I would've heard about it as a fun fact somewhere on the Internet by now...

This is an interesting case to me and thus my questions. Don't feel you need to answer to some stranger on the internet interrogating you.

Public domain is largely a US government concept, I think the was the main reason that sqlite was put "in the public domain" it started and was initially payed for as an internal database for some military contract. So when Dr. H wanted to release it to the public he did it in the normal US government method which was public domain.

Would you legally be able to use nasa papers or programs? these are also in the public domain.

A short essay on public domain, because I am feeling a bit philosophic this morning.

As far as I know public domain is a concept that originated in the US when it was a new country(probably wrong and US centric). The question was who owns works created by a government "of the people", the answer was "the people" so it was formalized that US government works were not protected by copyright[note 1] and were in the "public domain" at first this was just laws, and when government research organizations(nasa etc..) were founded their works, the research they did, was also "public domain"

It really is an open question whether private citizens can also declaim any copyright on a work, declare it "for the public good" and put it in the public domain. Are you allowed to give up your rights?

1. The US government is able to protect it's works through mechanisms other than copyright, think classification levels. top secret etc..

I'm not allowed to give up my rights, no.

As for NASA papers and such... I have no idea. If I were running a company I'd be able to ask a lawyer; as it stands, I'm taking the risk that the SQLite authors don't sue.

Making your work public domain is not "giving up your rights". It would be the exact opposite: practicing your right to transfer your IP. Being able to transfer or sell your IP would be an important right.

Similar to physical property: being able to sell it or to give it to the public is an important right. (Okay, you probably can't give your American land to everyone in the world, but only for practical reasons, and not for some fundamental reason like that would be "giving away your rights". No, that would be the opposite: your land, you do whatever you want with it.)

I think public domain is a much more universal concept, as the state to which works revert to after copyright expires. What's more US-centric is the idea of deliberately placing a work into public domain prematurely.

Over in Australia, the question of whether private citizens can also declaim any copyright on a work is resolved: We can't.

We're allowed to use public domain works, but we cannot declaim the work. Your copyright has a fixed term, which outlives you. Fin. You cannot surrender a right - as that has caused abuse issues in the past.

No right can be surrendered, but some may be suspended temporarily by a narrow set of laws I wish was even narrower.

Unfortunately... This does mean we can't work on Public Domain projects (legally), as we keep our copyright to our changes. Though practically, that has only been contested once in the history of the nation. The intent of the individual tends to be respected by our Common Law system.

i.e. PD is a signal the creator wants a free and boundless reuse of the product, even if it isn't strictly in the public domain.

Reply on news.ycombinator.com