January 27th, 2005
Will Sun's 1600 patents suck the life out of Linux?
Now that people in blogosphere and open-source circles have had two days to let Sun’s OpenSolaris announcement sink in, the commentary is starting to show up. But before touching on that, first a quick review of what happened.
Under the name OpenSolaris, Sun officially announced an open source version of the Solaris operating system that’s largely based on Solaris 10. Several intellectual property barriers remain to open-sourcing all of Solaris 10. As those hurdles are cleared, Sun intends to move more of Solaris 10’s componentry into OpenSolaris’ codebase. To qualify as open source, software must have an Open Source Initiative-approved license attached to it and, in OpenSolaris’ case, that license is the Sun-authored and very recently OSI-approved Common Development and Distribution License (CDDL). During the announcement, both Sun chairman and CEO Scott McNealy and the company’s executive vice president of software John “Johnny-L” Loiacano characterized the CDDL as a license that allays open source licensing confusion by removing ambiguities and “cleaning up” the licensing language. In the end, McNealy concluded, “We’re committed to one word and that’s sharing. “
But in addition to having introduced perhaps even more ambiguity into an already ambiguous environment (more on that in my analysis of the transcribed text below), will Sun’s announcement further compartmentalize an already compartmentalized open source community? Read on.
Perhaps the most interesting among the list of commentators is IBM’s vice president of standards, Bob Sutor, who in his blog entry, commended Sun for embracing the spirit of open source, but then added “As far as I understand it, Sun is not pledging these patents for use in any open source project as [IBM] did.”
In terms of what IBM did, Sutor is referring to the 500 patents that IBM released for unencumbered use by any developer working on open source software that has any OSI-approved license attached to it (as opposed to a specific open source license such as the GNU General Public License). And Sutor’s conclusion, which originally sent this hound on the hunt, is true.
What Sutor is referring to is that, apart from certain academic open source licenses such as the BSD and MIT licenses, most open source licenses, including both the GPL and CDDL, have reciprocal provisions in them that require derivative open source software to bear the same license as the code from which it was derived. What this means is that if code from the CDDL-licensed OpenSolaris were intermingled with code from the GPL-licensed Linux, then the resulting derivative work would technically be required to inherit the licenses from both, which is impossible because certain provisions in each license cancel out the other. (In other words, they’re totally incompatible with each other.)
In fact, the entire open source community is compartmentalized along these licensing lines. For example, code from the Eclipse Project (started by IBM) cannot be intermingled with code from Mozilla because each of the those projects operates under their own, incompatible-with-the-other open source license. The net-net is that when a large company–be it IBM, Sun, or anyone else–donates code (as IBM has with Eclipse, and Sun has with OpenSolaris) to the open source community, the writing (and approval by the OSI) of a one-off license like the Eclipse Public License or the CDDL gives those companies a way to donate their code to the open source community (which in turn can enhance it to the benefactor’s advantage) without that code leaking into a competitor’s product (with a non-reciprocating license) in such a way that it can be used against the benefactor.
Nothing prevents IBM from building a product using CDDL-licensed code. But then, that product, which is technically a derivative of the CDDL-licensed code, must also be available under the CDDL, which then means all of IBM’s contributions to it become available to anything else Sun is building under the CDDL (like OpenSolaris). So, to McNealy’s point that Sun is committed to one word and that one word is “sharing,” yes, Sun is sharing its code. But like a lot of other shared, open source code, that code has a firewall around it. CDDL or unlicensed code that’s ready to take on the CDDL license can get it in, but nothing gets out. In other words, it’s not universal sharing.
From the legal corner of the blogosphere, SCO whipmaster and master-miner of legalese Pamela Jones at Groklaw wrote:
…they are freeing up 1,600 patents, but not for Linux, not for the GPL world. I’m a GPL girl myself. So it’s hard for me to write about this story on its own terms. I am also hindered by the fact that I’ve yet to meet a Sun employee I didn’t like personally. But, despite being pulled confusingly in both those directions at once, in the end, I have to be truthful. And the truth is Sun is now competing with Linux. That’s not the same as trying to kill it, but it’s not altogether friendly either. Yet, at the teleconference, Sun said they want to be a better friend to the community. I feel a bit like a mom whose toddler has written “I LUV MOMMY” on the wall with crayons. Now what do I say?”
Answer? Just tell it like it is PJ. Just remember all is not as it seems.
Then, from across the pond comes a newsletter from the folks at Gentoo, which basically applauds Sun for the move and talks about how Gentoo is embracing OpenSolaris under the Portaris version of its Portage project. Portage, according to an e-mail I received from Gentoo senior manager Pieter Van den Abeele, is a metadata-driven package manager. One thing you can most definitely do with Gentoo is describe a final operating system installation in terms of what it can do (I’ll take a router, a firewall, an Apache Web server, and a browser please) and then stamp out a version of Red Hat that does that. If you don’t like the final work of art, using the same metadata, you can now stamp out a version of OpenSolaris that does the same thing. But, in addition to that, as best as I can tell from Van den Abeele’s e-mail (please correct me if I’m wrong), you can pick and choose best-of-breed parts from any source code (regardless of the license that goes with those parts) and stamp out your own sort of Frankenstein. Said Van den Abeele:
Gentoo declares GPL licensed metadata about various applications and platforms in one big machine-readable, GPL-licensed knowledge base. Our users declare their feature requirements and preferences to our Package Manager “portage,” which in turn using the knowledge base suggests a plan to build or enhance an operating system that will satisfy the user.
If my interpretation of what he’s saying is right, then I’m declaring Gentoo the Napster of Open Source. To the extent that you can create a final package that mixes, matches, and violates every open source license known to man, Gentoo appears to be just the facilitator. This is reminiscent of how JBOSS couldn’t distribute a soup-to-nuts Java-based application server, but it could tell you how to take what it built and merge with something else from Sun (a Java Runtime Environment) to come up with a free app server. Just don’t forget that this sort of Frankenstein merger of code is exactly what SCO sued Autozone for.
And finally, the moment you’ve all been waiting for, a transcription of what was said, and my Between the Lines analysis.
McNealy: We have absolutely done something nobody else in the open source community has done and that is add intellectual property patent indemnification to it. Sun is assigning 1,600 – our 1,600 OS-related patents to the CDDL licensees in a way that allows them to operate in a safe haven environment, a safe harbor from patents, and we all know that the intellectual property patent situation in software is at best confused, certainly arbitrary, and really random to a lot of folks. This allows all of that ambiguity to be taken out of the system with respect to the OpenSolaris code base.
Me:What this could mean (we won’t know for sure until we see the real legal language that goes with the patents) is that developers of CDDL-licensed open source code are not only free to use Sun’s implementations of those patents (found, at the very least, in OpenSolaris), but can come up with implementations of their own (as long as they’re CDDL-licensed). Those developers will not only be free from pursuit by Sun’s legal eagles, but Sun will also protect them from the legal eagles of others. The differences between this and what IBM did with its 500 patents are subtle.
IBM is allowing open source developers under anyOSI-approved license unencumbered access to 500 patents, and would probably use those patents to defend those developers should anyone attempt to sue them for patent infringement. While Sun appears to be offering the same form of patent protection for CDDL-licensed development only, it also looks like the company is making the implementations available under the CDDL as well. (Again, we’ll have to wait for the legalese that goes with the patents and then we also have to see whether all of the code associated with Sun’s implementations of those patents can be found in OpenSolaris’ code base or in other code that Sun has contributed to the open source community under the CDDL.) This is kind of cool because, to the extent that there’s uncertainty associated with the distribution of GPLed code (for example, if it’s an implemenation of someone else’s patent, you could get sued), none of that uncertainty exists with the code that Sun is saying you can use.
McNealy:It’s also going to have some very interesting repercussions around the world for addressing what I call the IP divide. The IP divide is all these developing countries and developing companies that aren’t able to build network-based services solutions equipment and technology because they are so far behind in the software patent race. This allows people to stand on the shoulders of the 1,600 patents that we’re assigning to the CDDL license and taking a core enabling technology called the OpenSolaris enterprise code base and really build some very interesting services or equipment or technology enhancements while getting instantaneous bridging to a huge chunk of IP.
Me:Although I haven’t seen the legal language yet, the phrase “assigning 1,600 patents to the CDDL license” sounds a little bit like doublespeak. Open source licenses like the CDDL are more in the realm of copyrights than patents. The CDDL license can be applied to a particular implementation of a patent (to the extent that the patent can be implemented in software). My sense is that Scott misspoke. What he probably meant to say was “making the 1,600 patents available for unencumbered (and fully indemnified) implementation in CDDL-licensed code including CDDL-licensed code that Sun distributes.” His subsequent comment about the OpenSolaris enterprise code base and what people can do with this supports that conclusion.
McNealy:Nobody else in the open source community is doing what we’ve just done. This is not only doing what everybody else is doing, but leapfrogging it in a very significant way. I’d also like to make the point that unlike a lot of other companies who are out there who are using open source as a way to dispose of end-of-life code, we have taken Solaris 10, the hottest OS on the planet with the latest and greatest features, and committed that to open source. This is not an end of life. This is a supercharging rocket launching way of driving what we think is the best IP in the operating system space today forward.
Me:In totality, McNealy may be right, but I’m not sure. (Feel free to chime in.) The closest that anybody has come to open sourcing such a huge chunk of commercial, previously proprietary code is probably IBM with Eclipse or Computer Associates with Ingres. And, while IBM also created a nice protection racket with its 500 patent move, those patents weren’t necessarily tied to Eclipse or some other chunk of open source code the way Sun is connecting its patent protection with what appears to be an entire operating system. Although we haven’t yet seen Sun’s indemnification language (not all indemnifications are created equal), the company generally offers minimal-strings-attached indemnification. Whereas IBM’s 500 patent donation was cool (download this MP3 for an analysis), this looks like the first time that a code donation, particularly for something like the Ferrari of operating systems that runs on all kinds of hardware, was accompanied by such broad protection (again, for CDDL-based developers).
What this means in the bigger picture is that all of those developers who are risking patent or copyright infringement by participating in largely unindemnified open source operating system projects such as Linux can pursue their passions in the OpenSolaris community without the threat of a legal sledgehammer swinging randomly around their heads. Whether or not OpenSolaris will be like a big vacuum that sucks the developers right out of the Linux community remains to be seen. But, if I were a Linux developer, right about now the grass would be looking awfully green on the other side of the fence. Is it too good to be true? Use our TalkBack (or your own blog with TrackBack) to let me know.
