The GPL And Web Applications

eries wrote a good summary of a major problem with the GPL, with regards to web applications. Essentially, since the GPL is about 'Binary Redistrubtion', it doesn't work with web pages where the output is distributed, but the software itself doesn't have to be. Anyway, hit the link to read his comment about it. Definitely an issue that I've thought a lot about wrt Slashcode, but never found a clear solution.

eries writes "We recently ran into some licensing problems for a web-based open-source project. Since our project is an OO package written in PHP (a scripting language) the GPL does not quite apply. The GPL is designed to handle "binary redistribution" for software packages, but ours cannot be distributed in binary form. That means that someone could make a website out of a derivitive work and never have to open or disclose their code - an apparent violation of the spirit of the GPL. Now, we think it might be possible to modify the GPL to construe instances of a website sending HTML to be "executed" on a browser as redistribution (more on this later), but we don't really know how to go about it. Consequently, we are forced to try and find another license. We have looked at the Artistic and the APSL, but these are both pretty dubious. Has anyone else run into problems like this? We want to write to both the OSI and FSF and bring this to their attention, so we'd like to find out of others have run into the same situation. You can also check out this related discussion on the Sourceforge forums page.

IMHO, we need a way of defining, in cases like these, what constitutes a derived work. Clearly, things like your db password and content like graphics, logos, layout, etc. are not derived works. But how can we draw the line in the case of added functionality? How is this handled in more traditional content-delivery systems?

Is the HTML produced by our scripts just output? The more I think about it, the more I am convinced that the application that a user is running when they use our software is not just a series of HTML files. Those files, by themselves, are worthless. Instead, their usefulness depends on an awful lot of "state" - the state of the browser (cookies, javascript), the web server, other scripts which the browser has to reconnect to, and the data in the database. The HTML files are just one component of the general state that our app produces. If you construe this more nebuloous "state" as the "binary" application that our software produces, then distributing it to a user via a web server is a non-sourced distirbution, and hence forbidden by the GPL. What do you think? I have to believe that someone running a mod_x application within an Apache server that gives access to it to tons of users is redistributing it without the source, unless you believe that clicking on "View Source" for this /. page you have access to the Slash source..."

This has got to be the silliest thing...

...I've ever heard. How much sleep are you people willing to lose trying to fix everything that's wrong with the GPL? Any time you release anything as Free or Open Source software, the possibility exists for someone to grab up the code, make changes, and distribute it without releasing their code back. This has become yet another distraction for the Open Source community, which draws people away from code, and into politics. To be perfectly blunt, geeks make shitty politicians, and the more you focus on evangelism, the more you alienate those you try to convert.

If you're going to release your code under a license that fundamentally operates under the theory that people are honorable, you really shouldn't sweat what dishonest people may do with it.

GPL does not cover the ASP model

There are a lot of different applications where you can publicly perform software without distributing it. We need to have the source distribution requirement connected to public performance or making the software available for use rather than distribution.

Bruce

Same Issue, Different Slant

Let me see if I can't clarify the issue that appears to be at hand here, as people seem to be getting mired in minutiae about what constitutes code.

The GPL outlines only those obligations pertaining to redistribution of code. If you redistribute copies of gcc, you're expected to make the source available, along with all your modifications. If you don't redistribute gcc, you're free to hack it up all you want and you don't have to share your changes with anyone.

Now, let's suppose someone decides to open a compiler farm on the net. You send it source code, and it sends back the compiled binaries. Let us suppose further still that the compiler sitting at the server is a version of gcc that has had tons of local modifications made to it to improve the code generator to at least three-fold over what you can get out of stock gcc.

Question: Does this constitute redistribution for the purposes of the GPL? The gcc binary has never left the server farm, yet gcc's output is being distributed everywhere, and the fruits of those highly-desireable gcc modifications are not being shared among the GPL community.

This appears to be the primary issue at hand. Others will no doubt differ with this interpretation, but it seems to me the GPL was intended to "isolate" software hoarders; that you are free to keep your work to yourself so long as the results/output of that work also remain with yourself. For a large class of problems/jobs, this is perfectly reasonable. But as we see, distributing services based on GPL'd software muddies the water.

It's a thorny problem.

Schwab

Re:Why not...

I quote the GPL:

Copyright (C) 1989, 1991 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

GPL allows you to be selfish, just not greedy

The GPL isn't a license for use, it's a license for distribution. If they're not distributing copies of the modified work, then they're not obligated to distribute the source either.

If I'm merely using a piece of GPLed software, that does not entitle me to source code (unless in order to use it, I have been given a copy of my own). If I go to a library and sit down in front of an internet kiosk that uses Linux and Gnome for the UI, do I get a complimentary CD or an URL to an FTP site? No. No one has distributed a copy to me, merely given me access to the software.

If I make changes to a piece of GPLed software for my own use, I can keep those changes private. It's "fair use": the term that everyone throws around -- and rightfully so, IMO -- when it comes to translating a book into Braille for my blind cousin or space-shifting CD recordings by ripping them to MP3 format also applies to software (the source code, at least) that I get under the GPL.

Therefore, if you want to require that someone who is using your software publishes the changes to their code, you're going to have to use a different license. (*BSD won't cut it either, since it expressly allows people to keep their modifications private.)

(Slightly off-topic: An interesting test case for the GPL would be GPLed Java applets; since I am being sent java bytecode (which is "object code" or "executable code" or "binaries" or whatever language the GPL uses) then is the software being "distributed" to me?

That could have some important ramfications for the Java community...)

Jay (=

Okay, now....

You can not prevent internal derivative works. Period.

Ford can't stop consumers from ripping the ugly "Ford" letters from the front of their trucks. Intel can't prevent me from pulling "Intel inside" stickers from my machines. And fscking "copying a CD for your wife to use in her car does not constitute fair use" Hillary Rosen-bitch can't prevent me from singing a duet with Britney and Lars and recording it on a tape recorder for my own use.

The only way you can hope to achieve branding on a product is by forcing your client into an agreement that says "my logos and obnoxious shit
must be included in implementations of my product that you use in your website." .... Only really stupid people would agree to those terms. Smart buisnessmen would simply contract a web firm to build that stuff for them on an hourly basis if it was worth having, anyway.

Quite simply, you are selling a script. A script is code, and can be protected from proprietary redistribution under GPL... as in, if they make changes, they can't simply release it under _another_ liscence. They can release it still under the GPL though, without owing any money to you. That is why GPL doesn't work for you in what you want to do, has nothing to do with binary distribution....
I believe you simply want to "copyright" your source code in this case. As long as it falls into the "fair use" categoties of copyright law, you customers can then do whatever they want to with it up to a certain degree of internal copying. Your customers can go into and make changes for themselves, like inking notes into the margins of a book, but that's about it.
You'll never achieve what you want to do and manage to make any money off of your product.
Quit digging so deep.

Internal Use and ASP use -is- the same thing.....

Unless you get them to sign a contract or enter into a brain-dead liscence. Nobody is going to buy or use a product with the restricitons you want to put on it.
Nobody in their right mind is going to buy a product like yours without making changes internally to fit their needs. In a capitalist system, expect them to either go straight to one of your competitors or they might even hire a contractor.
It's like buying a britney spears album. Under standard copyright law, I would buy it for $18 (rhetorically). But if the packaging said "Hey, you can't make a copy of this CD for any purpose whatsoever, you can't make an MP3 of it, you can't dispose of the jewel case or the packaging, and you sure as hell can't play any part of it in a public setting where more than 2 people are present." You simply won't buy it. Neither will anyone buy your scripts if you are going to bind their hands like that.
Expecting them not to resell your product is reasonable. Expecting them not to change the scripts to fit their needs and desires is out of the question. Do it, they will _NEVER_ buy it.

In fact, you _are_ wrong.

Binary is meant, as far as the GPL is concered, as "executable, compiled, binary machine code."

Binary means MACHINE READABLE.
HTML is HUMAN READABLE. HTML is a human-readable format used to specify document formatting.

I can write down an HTML document on paper as easily as I can type it in a word processor.

The only advantage HTML has on computers is that, when entered in a word processor and passed through a browser, it'll enable me to look at a pretty page and links.

Yes, you can store HTML documents in binary form. But you can do the same with music. That does not mean music is binary data, not anymore than an html formatted document.

As far as "HTML generation" goes in this question, it pertains to a whiny moron who doesn't understand copyright (like most Napster users) and who wants to get a lot of money for doing very little. Most people like that are classified as "marketers"

What constitues derivative works

The GPL [gnu.org] applies to two types of things: the actual program itself, and any work based on the program. They go on to define that in the following way:

a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language.

With that said, I doubt that there's really much cause for concern that Enzyme [sourceforge.net] (or any other web-based application) has any signifigant problems with the GPL, any more than any program in an interpreted language which produces textual output. Basically, you're dealing with three sets of items:

• The actual code which drives the back end of your application (Enzyme's PHP, and raw bits of static HTML), which is protected by the GPL.
• The data that you're archiving using Enzyme, protected by Copyright (or not, depending on who is collecting the information and the terms under which they acquired it).
• The confluence of the code and database, which produces the actual site with published information.

With that said, I do not believe that running a web-based application is equivalent to redistribution-without-source, as you suggest. If I install a program on a remote computer, then open an Xterm window to interact with it on my local workstation, I haven't redistributed the initial app, despite the fact that my workstation and the remote server are exchanging all kinds of information necessary to my interaction with the application. I'm merely accessing it using another means. If that was really redistribution without source, then anyone taking advantage of the Compaq Test Drive [compaq.com] on a Linux server would have caused Compaq to violate the GPL.

Similarly, if I set up an Enzyme driven site and open it up to the world, I haven't redistributed the code, even in binary form. I'm letting people interact with it to produce output specifically tailored for their needs, using an intermediary program (Netscape, Lynx, Mozilla, IE...) of their choosing.

While from a design point of view, it's nice that you can view all of the elements of a web-driven system - database, server, client, network - as a unified whole, it isn't. At least, not as far as the GPL is concerned. Your program rides piggyback on a web server, process requests based on the clients' requests, and transmits information back accordingly. And that's all.

Re:In fact, you _are_ wrong.

I think that the binary vs. textual format you're describing is something of a red herring. It doesn't matter if a program produces HTML, TXT, or XML (all textual), or GIF, JPG, or PNG (binary). The bottom line is that they're all products of the program, not derivative of the program.

Re:TiVo

A similar situation: the TiVo uses GPL'd software, but they don't give you access to the binaries - only the output from them.

They sell you a machine containing the binaries, don't they? Even if it's technically difficult for you to read those files, as far as copyright law is concerned, that's distribution of copyright material. If they didn't give you access to the source, then the FSF's lawyers could call up TiVo and say, "ahem, either share your source code, or don't use our code in the machines that you distribute."

On the other hand, if (say) CBS used a modified version of Linux to produce one of their TV shows, they would not have to offer their source code to anyone who watched the show, since the show does not contain anything derived from GPL'ed software.
--

Re:Where to draw the line?

That depends on your reasons for wanting Open Source, I guess. If it's just curiosity "I want to have the software that's in that coke machine", then I guess you would have to create a license for that.

But *I* use OS software so that I *own* the software on my computer just as strongly as I own the computer itself. Non-OS software has a weak sense of ownership: I can use it, but I can't pass it on or modify it. The coke machine is even weaker, to the point where (I think) it doesn't make sense to say I own the software on the machine. I used it once, but it belongs to someone else.

Think of it this way: You go to your friend's house and play a cool game he has. Should he be required to send you home with the source code? I don't think so.
--

No no no no

Let's say you go to the store and buy a coke. The coke machine runs Linux. Should you get a free CD with every can? No.

The purpose of the GPL is put software back (as far as is possible) to the state of other information. Once you've been given some "information" you are free to tell other people and put any spin on it you want. So you can freely redistribute the binaries (that's the telling other people) and you have to give out the source code (so they can put their own spin on it).

But when I use a website, the only information I'm getting is what's shown on the browser. That's not to say you couldn't create a license that required a licensee to allow users to download the code--but it's not what the GPL is about.
--

Re:GPL does not cover the ASP model

It seems to me that what this requires is another version of the GPL, call it the SGPL or Strong GPL that expands the definition of 'distribute' to include 'deployed on a public webserver'. That would allow people to keep truly private modifications (such as on an Intranet) private.

It would be unfortunate if software written using a GPL tool for public use was automatically required to be distributed in source form. Instead the application could (at the discretion of the developer) be deployed under the SGPL.

What do you think?
--

Take a look at the licence notes for BISON...

Bison has already had to deal with this problem a long time ago. The trick is that Bison's source code is very hard to seperate, both conceptually and actually, from it's output, seeing as it's a parser that parses in input file which serves as a spec for a parser, which is generated by Bison (using a lot of recycled code...)

The intent was to give the Bison program the protection of the GPL, but to allow the output to be used howerer one pleased.

Unfortunately in my half asleep state i don't remember the details of how they pulled it off, so go and check it out before i put my foot in my mouth trying to explain it.

Re:No no no no

Let's say you go to the store and buy a coke. The coke machine runs Linux. Should you get a free CD with every can? No.

But you must have a port in the side of the machine to allow people to download your soda-dispensing software to their laptops =)

Re:breakdown

No, I don't think it's a derivative work.

Say I write a piece of C code, and compile it with gcc. Is the binary a derivative work? No.

I think there should be a new license set up for distributed output applications. The GPL doesn't really apply.

What is the problem?

That means that someone could make a website out of a derivitive work and never have to open or disclose their code - an apparent violation of the spirit of the GPL.

I don't think violates the spirit of the GPL. In fact, it's explicitely allowed. It looks like your program is basically a compiler. It just doesn't generate machine or byte code, it generates HTML. Same difference. And we all know that gcc does NOT produce derived works. Furthermore, I can make all the changes to gcc I want, without having to disclose anything. The spirit of gcc is that I cannot distribute anything without disclosure. But in-house, I can do anything I want.

I am not the biggest fan of GPL, but I don't see the problem here. Well, I do see a problem - but not with GPL. Apparently, you are using a license you are not happy with. In stead of trying to change the license, why don't you pick another license?

-- Abigail

No no no no!

I wasn't going to step in, but after seeing the amount of well-meaning misinformation, I had to say this, even if it may be too late to get moderated up.

The FS does NOT, I'll say it again, does NOT control what is considered a derivative work! This is determined by U.S. Copyright Law. It is impossible to add a clause to the GPL saying that "content generated by this product is a derivative work". It has NOTHING to do with the medium you're sending it through or any of that garbage. It has to do with what copyright law says is a derivative work.

This is really not something to worry about

Because web based applications are not going be a big part of anything. Like the marketeers facination with "push" a few years ago, it just won't catch on.

The whole concept is based on the idea that with many users who only use the service a little bit, you can try for small usage based fees. That will go the same route as web-based email that you pay for, or portals. The barrier to entry is so low that anyone can talk a few mill out of VC and start a service that is "free for now, while we build a customer base." Soon they realize that charging people money instantly destroys all loyalty, and they'll be in the "we're exploring alternative revenue models" phase, and then they will either be bought by Yahoo or Yahoo will add the same service, and the hype will move on. That's if anybody wants to use their tool in the first place.

Web based application columnists come up with a variety of false arguments as to why they might succeed:

1) Customer's local computing power won't be up to the requirements of the software provided over the web.

Yeah, right. The network delay will be roughly equal to the longer execution time. The types of applications put forward as good candidates for this often include photo editing or otherwise require a lot of data transfer. And even the "network computers" are basically fairly powerful PCs.

2) The tasks will be things the user does so infrequently that purchasing the software is not justified, but a small fee might be.

Most of the cost of software, especially Free Software, is in learning how to use it, which you still have to do over the web. If you make it easy to learn to use, someone else will see the improvements and make the GPL'd software it was derived from easier to use.

3) I have a niche market piece of software -- only aqua farmers with seven webbed toes on their right foot will need it once every five years -- so no competition will appear. This market would be impossible for anyone else, but with web I reach every seven toed fish farmer in the world !

There's a reason why no one else will try to compete with you. Think about it. Also think carefully about why you can't reach every seven toed fish farmer with a download site for the software. What advantage does a web based app offer here ?

4) Somebody famous said "the network is the computer" at some marketing seminar I went to. I think his name was Ellison. Everybody was clapping ! He's rich, right ? And I read in Datamation that Microsoft is interested in web based apps !

Get a socially useful job like garbage collection or lettuce picking, there is no place for you in the new economy.

Summary:

Don't screw with the GPL, which is working well and changing the world. Just let these web based application providers compete the hell out of each other and gradually become another selection on yahoo, which will still make money from banner ads. Sure, some people will do nasty things with copies of the software you wrote, and some portion of the brainless masses that also run windows will fall victim to them. Don't worry about it, because those dimwits will give up the practical benefits of free software while entering a business that is completely untenable.

Use a different license

Here's an idea, just use a different license. I know that everbody wants to hop on the GPL bandwagon, but there are a lot of other licenses out there, if none of them satisfy your needs, you could just do like all of the commercial companies do and write your own, heck, if you want it to be open source, that doesn't mean that it has to be GPL. Perhaps this is a good call for an altogether new license, however, it really doesn't have to be just another GPL, it really could be a license tailored to the specific needs of either the application at hand, or of web applications that one would think fall well into the GPL.

Just because it's not GPL'd doesn't make it the end of the world, no offense.

It doesn't matter what generates the HTML

...or XML, or javascript, etc. Look at *BSD. Generally compiled with GCC, a GPL program, but distributed under a different license. Just because the server runs GPL software, doesn't mean that the GPL has to apply to any of the content serves. Heaven forbid the lawsuits if someone decided that they should be able to redistribute copyrighted content served up by Apache.

I don't see where the big dillemma is. We have licenses for server code, and we have plenty of flexibility with copyrighting (or not copyrighting) the content.

Why not...

Just change the GPL you use so that it refers to script as well as binary redistribution? Then you can submit the new GPL back to the GNU foundation. I mean, the GPL itself is Open Source, right? So consider this a bug fix to the GPL and go for it.