Including a web server isn't necessarily a security concern, it's not running by default. The advantages is that there's a web server included, with privsep, chrooting and a sane default configuration.
The relevant thread[1] from the time may be of use, but a specific message sums it up:
"We've been clear: Their new license contains more stuff, and we do not accept MORE STUFF in licenses."
[0] http://www.openbsd.org/policy.html [1] http://www.monkey.org/openbsd/archive/misc/0406/msg00412.htm...
On the other hand it's absurd to dogmatically oppose MORE STUFF regardless of what the stuff is. The added terms in Apache-2 make sense for a US-based collaborative software project that accepts contributions from businesses that hold software patents. They may be pointless legalese for a Canadian-based project whose contributors are mostly individual developers, but that doesn't make them an assault on developers' freedoms.
We want to make available source code that anyone can use for ANY PURPOSE, with no restrictions.
That's what we call a free gift.
That is one of the project's goals.
You're right, the patent clause might not necessarily be an attack against the OpenBSD developers' freedoms. But they do not care about their own freedoms only; they want it to be free for anyone (this includes corporations who might hold patents, and also individual developers working for such corporations), for any purpose. It is really as simple as that.
You guys keep missing the point really.
We know what a free license should say.
It should say
Copyright foo
I give up my rights and permit others to:
distribute
sell
give
modify
use
I retain the right to be known as the author/owner
When it says something else, ask this:
- is it 100% gauranteed fluff which cannot ever affect anyone?
- is it giving away even more rights (the author right)?
If not, then it must be giving someone more rights, or by the same
token -- taking more rights away from someone else!
Then it is _less_ free than our requirements state!
So why even BOTHER wasting your time trying to understand what they
say?
Who cares if it is legal or not! We're not going to want to go
quibble in a court! We're trying to make it so simple that something
can't even GO to court, because it's free and, anyone can tell that it
is free because the language used to say so is SIMPLE.
Copyrights are essentially about copying. Patents aren't - you can write a clean-room program that's entirely your own work, absolutely guaranteeing that you aren't infringing anyone's copyright, but it could still infringe a patent you've never heard of. Or you could accept code from a friendly company which has a few defensive patents on it, and some years later the friendly company comes under less friendly ownership and the defensive patents turn offensive.
Apache, being based in the US (which has many software patents) and accepting code from many companies that have patents, has to deal with these scenarios. OpenBSD, being based in Canada (with far fewer - but not zero! - software patents), isn't as affected by it so Theo calls it bullshit. But it's not so black-and-white.
Now you can try to "address" software patents e.g. by obligating distributors to grant rights to their patents, but that is a restriction; it might be giving someone more rights, and by the same token is taking more rights away from someone else! More importantly, that would be a restriction imposed by the copyright holder, rather than an external restriction imposed on you by a third entity the copyright holder does not control.
OpenBSD does not want to impose such restrictions on you or anyone else. They make their code free.
You seem to think that OpenBSD or Theo simply disregard patent issues because they hail from Canada. Maybe you should learn about CARP[1][2], or figure out why many of the ports' Makefiles have a line like this:
PERMIT_PACKAGE_CDROM= patents
Patents + OSS is a huge, under-served point that unfortunately Lessig is no longer working on.
I and others that open source tons of code will be the first to wave the FOSS banner all day long, but it's not going change the reality of the present landscape.
As such, open source projects and startup founders repeatedly fail to anticipate the consequences of nonparticipating in the patent scheme. If the other side (a company) holds a (shitty) patent, and a project doesn't... they can still squish them like the cockroaches they are should the project become significant. So there's options: either play the game, fight city hall or get fucked by pretending it doesn't exist. Not choosing an action is still a choice.
Perhaps one of the larger OSS orgs would show leadership on this to help projects manage this tricky minefield.
More likely it was the patent clause of the license that made it so bad that the OpenBSD developers didn't want it. I can sort of see where they're coming from. If some company puts a bit of code into Apache 2, covered by one of their patents, that's okay, anyone using the Apache 2 gets a license. However it's pretty much impossible for anyone to tell which parts of the code is covered by the patent, so you could get in trouble, without knowing it, if you yank out that part of the code an use it elsewhere. The patent could also cover a protocol, an algorithm, whatever, the people using the Apache licensed code don't care, they where given a license for the pattern, but nobody else can do an implementation.
It's not for me to say, but I believe that the OpenBSD developers wanted an http server that came unencumbered by patent and was ensured to be free of any software patent. Instead the Apache 2.0 license presented them they the problem that you can actually tell if a given piece of code was covered under some patent.