The Big Gotcha in Open Source

Most observers of open source think the big issue for 2011 will be patents.

It's true the issue of patents is important, but not just for open source. Innovation can stop if, instead of protecting mousetrap designs, we're protecting the idea of catching mice, which most software patents seem to do. But that is an issue for the entire industry, not just open source.

For CIOs interested in open source, the key point to look at is copyright.

NOTE: I covered open source for ZDNet for over 5 years and would like to get back in the game. Meanwhile I'm producing some essays for this site covering important topics.

During the last decade a host of companies were launched, many with venture capital, building open source software under the General Public License (GPL).

The GPL sits at the bottom of what I call the open source incline. Under the GPL the owner of a project has no more rights to the code than any other user. Any improvements, from any side, are supposed to be contributed back to the commons.

This, it was thought, made the GPL the best license for building vibrant open source communities. A community of people who use software avidly, who report bugs and fix them, and who build enhancements, is vital to an open source project's success. The bigger the community, the more likely you are to get help when you're stuck. Responsibility for growing the code base is shared among many people.

The idea of the venture capitalists backing these GPL companies was that they could benefit from a Tom Sawyer Effect – the community would do the work and the project manager would reap the rewards.

A key to making this work was for the project owner to control copyrights. When a software writer offers code to such a project, they will usually sign a contributors agreement which assigns copyright to the project's “owner.”

For years these were signed and collected without much fuss. Events in 2010 changed that.

After Oracle bought Sun Microsystems, which controlled vital open source projects such as Open Solaris, Java and Open Office, it began using copyright to “take them back,” to bring development in-house and essentially make these products proprietary in all but name.

Under Sun questions of control over the development roadmap had often been kicked down the road. Java began life as a proprietary framework, and Sun brought it under the GPL mainly to reduce the number of Java clones that were appearing under open source licenses

One of the more important of these clones was Apache Harmony, a Java platform used on a variety of Windows and Linux hardware  under the Apache license, rather than the GPL.

Why develop separately? Because the Apache Foundation does not require contributors to assign copyright.  The Apache license is called “permissive” because it permits contributors to profit from their code, selling enhancements or even offering them under a closed-source license.

It's for this reason that Apache was the big story of 2010. Google puts most of its open source offerings under the Apache license. Android is offered under the Apache License.

Note that there is a difference between what the Apache Software Foundation (ASF) chooses to do and the Apache License. You can run a project under an Apache license and demand copyright from contributors if you want. But the ASF itself doesn't roll that way.

And it was this refusal to roll that led to Apache's break with Oracle. Oracle demanded control of the Java development roadmap, control it could enforce through its copyright. The Java community process, known as the JSPA, guaranteed community developers freedom of action. Thus despite being an honored and widely-supported member of the Java community board, Apache resigned these positions last month.

To quote from their resignation:

The Apache Software Foundation concludes that the JCP is not an open specification process – that Java specifications are proprietary technology that must be licensed directly from the spec lead under whatever terms the spec lead chooses; that the commercial concerns of a single entity, Oracle, will continue to seriously interfere with and bias the transparent governance of the ecosystem.

Copyright means control. If you're going to become part of an open source community, look at copyright first.