RFC: PHP license update

https://wiki.php.net/rfc/php_license_update

by josephwegner • 1 year ago

274 88 1 year ago

wiki.php.net

unethical_ban• 1 year ago

Dang if someone wants to become an expert in software licensing and modifications, this is a page to read.

It's sold to us as non-news, which is good. No change for contributors, no change for end users, rights wise.

dylan6042• 1 year ago

Last time I heard about a non-news update that required no changes or recertification, we learned about 787MAX and MCAS.

michaelt• 1 year ago

Let us hope nobody is writing their aircraft stabilizer trim control software in PHP.

agsnu• 1 year ago

737* :)

sjs3822• 1 year ago

It seems like the only clauses being removed are those that protect PHP and Zend trademarks. Other than that, it's just unifying the two projects under a single license.

Basically, these two clauses (first from PHP, second from Zend) are removed:

The name “PHP” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact group@php.net.

The names “Zend” and “Zend Engine” must not be used to endorse or promote products derived from this software without prior permission from Zend Technologies Ltd. For written permission, please contact license@zend.com.

And replaced with:

Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

Then the following three terms (4-6) are removed from PHP:

4. Products derived from this software may not be called “PHP”, nor may “PHP” appear in their name, without prior written permission from group@php.net. You may indicate that your software works in conjunction with PHP by saying “Foo for PHP” instead of calling it “PHP Foo” or “phpfoo”

5. The PHP Group may publish revised and/or new versions of the license from time to time. Each version will be given a distinguishing version number. Once covered code has been published under a particular version of the license, you may always continue to use it under the terms of that version. You may also choose to use such covered code under the terms of any subsequent version of the license published by the PHP Group. No one other than the PHP Group has the right to modify the terms applicable to covered code created under this License.

6. Redistributions of any form whatsoever must retain the following acknowledgment: “This product includes PHP software, freely available from http://www.php.net/software/”.

And the following three terms (4-6) are removed from Zend:

4. Zend Technologies Ltd. may publish revised and/or new versions of the license from time to time. Each version will be given a distinguishing version number. Once covered code has been published under a particular version of the license, you may always continue to use it under the terms of that version. You may also choose to use such covered code under the terms of any subsequent version of the license published by Zend Technologies Ltd. No one other than Zend Technologies Ltd. has the right to modify the terms applicable to covered code created under this License.

5. Redistributions of any form whatsoever must retain the following acknowledgment: "This product includes the Zend Engine, freely available at http://www.zend.com"

6. All advertising materials mentioning features or use of this software must display the following acknowledgment: "The Zend Engine is freely available at http://www.zend.com"

userbinator• 1 year ago

You may indicate that your software works in conjunction with PHP by saying “Foo for PHP” instead of calling it “PHP Foo” or “phpfoo”

Now "Windows Subsystem for Linux" makes even less sense than it already did.

jt2190• 1 year ago

The background:

https://wiki.php.net/rfc/php_license_update#background

echelon2• 1 year ago

I find these sorts of legal changes fascinating.

The fact that the OSI didn't approve of the PHP License until pressured shows the wayward nature of their "stewardship" of "open source". As does their wonky and rights-eroding definition of "open source AI".

The proposed license does not reduce any user rights or add any new restrictions on the use of code previously licensed under the PHP License, version 3.01,

Yes, it does. Modified BSD Clause 3 (copied below).

3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

I know I'm being pedantic, but this is a narrowing of rights.

Do We Require Permission From All Contributors? The short answer is, “No.”

I think that they can get away with this change since the original license doesn't preclude a narrowing of rights on derivatives.

It would be interesting if a contributor protested the additional burden and headache of having to deal with a torrent of snail mail asking for endorsement.

odo12422• 1 year ago

I mean, PHP license clause 3 & 4 seems to say this already:

  3. The name "PHP" must not be used to endorse or promote products
     derived from this software without prior written permission. For
     written permission, please contact group@php.net.

  4. Products derived from this software may not be called "PHP", nor
     may "PHP" appear in their name, without prior written permission
     from group@php.net.  You may indicate that your software works in
     conjunction with PHP by saying "Foo for PHP" instead of calling
     it "PHP Foo" or "phpfoo"

Edit: there may be more context than I thought

echelon2• 1 year ago

(I've edited my comment slightly, but not in a way that changes the context of your response.)

PHP License Clause 3 & 4 are about protecting PHP branding. Modified BSD Clause 3 is about using the software author's name or likeness as endorsement. For example, it limits putting antirez's face and name on our managed Redis product without obtaining his permission.

samsk2• 1 year ago

IANAL, but the new license applies only to new PHP versions, changing it backwards would require approvals. If you don't contribute under new license, you should be not affected.

zdragnar• 1 year ago

I believe only the rights holders need to approve of the retroactive changes, and so they really only need Perforce (presumably the rights holder as the current owner of the former Zend Technologies) to agree.

jraph7• 1 year ago

The new license covers and applies to all the code, even code that was written before the change.

You can totally change the license of already released code, if the change is compatible with the precious license or if you have permission from all the contributors whose code is still present in significant amount. (However, you can't prevent people from using the released code under the former license)

jraph7• 1 year ago

This clause doesn't allow people to write you, it prevents them from doing stuff without written permission.

And that's the default. Trademark laws and laws that protect individuals already work like this. I'm not even sure this clause is strictly necessary in the BSD license.

I assume they've carefully evaluated this change with a lawyer.

eurleif• 1 year ago

I'm not a lawyer and I haven't studied the relevant laws, but I'm quite skeptical that trademark and publicity rights align with a broad prohibition on using the names of copyright holders to "endorse or promote" without "specific prior written permission". That phrasing could be interpreted to prohibit, for example, giving an interview about your derived work, and making the factual statement: "It's based on software called Foo, which was written by a guy named John Smith." No endorsement is implied, but you are using John Smith's name in an interview which is perhaps intended for promotional purposes.

Even if this restriction does align with US law, I will be flabbergasted if it aligns with the laws of every other country as well.

cma• 1 year ago

The way the clause was in there gives them more rights than a trademark; if their term becomes genericized they could still enforce it on people distributing the code. And other uses of the mark that could normally be allowed could be restricted.

remram2• 1 year ago

I know I'm being pedantic, but this is a narrowing of rights.

No, it's not. Explicitly stating which rights you don't grant is not more narrow than implicitly not granting them, it's just clearer. Copyrights and trademark rights are different.

Supermancho• 1 year ago

is not more narrow than implicitly not granting them

Implicitly not granted? You mean, not mentioned at all? Imagine a world in which the modified BSD license exists in a vacuum. This license restricts how a product can be endorsed/promoted as per the clause. Granted, additional restrictions are removed in regard to "PHP" et al.

The shape is different, not just clearer.

samsk2• 1 year ago

Beautifull, everything regarding PHP licensing and its history in one place, no marketing or AI generated bs in sight - love it ;)

EGreg• 1 year ago

AI generated bs doesn’t add anything new. In fact bs has always existed! So there is nothing to see :)

arp2425• 1 year ago

I suppose my concern with not getting permission from all contributors is that a bad faith contributor could make life hard. For those S signs with a stripe, or just out of spite. For better or worse, in systems like the US anyone can sue anyone for any reason and everyone is expected to carry their own costs, which is why everyone is so paranoid and covers their ass with three tanks worth of metal.

Aside:

"Meanwhile, Richard Stallman, author of the GPL and founder of the FSF, had significant disagreements with the PHP project over their use of the GPL, so the PHP project discontinued the dual-licensing approach, removing the GPL license as an option"

Haha, such classic Stallman.

jraph7• 1 year ago

The PHP Group can do anything they want since they can release a new version of the license without contributor approval because of the "or later" clause.

arp2425• 1 year ago

That is not what the article says. It doesn't mention "or later" at all?

And reading the full license text, I don't see "or later" there either?

mikehall314• 1 year ago

I assume this is the reason they're characterising this as "PHP License V4 will have identical wording to BSD-3" rather than "We will switch license to BSD-3".

It amounts to the same thing, but the former framing means they're covered by the "or later".

graemep3• 1 year ago

Meanwhile, Richard Stallman, author of the GPL and founder of the FSF, had significant disagreements with the PHP project over their use of the GPL, so the PHP project discontinued the dual-licensing approach, removing the GPL license as an option

The main link that cites is primarily about the MySQL license change to GPL and the impact on PHP licensing of tha. I also do not understand why anyone would drop the GPL because Stallman does not like their licensing.

rollcat5• 1 year ago

I also do not understand why anyone would drop the GPL because Stallman does not like their licensing.

Stallman is said to be notoriously difficult to work with, and IMHO he's quite an extremist.

He tried to veto emoji support in Emacs, because at the time it's only been supported on macOS. The reasonable recourse would've been add emoji support on the free platforms, but he seemingly can't see that far. So he's been ousted from the project.

In situations like this, I honestly would prefer to shut him off as well. I have huge respect for his past work, but at this point he's doing more harm than good.

arp2425• 1 year ago

I also do not understand why anyone would drop the GPL because Stallman does not like their licensing.

Because he can be so obnoxious that people want to sever all ties with him and anything that has to do with him so that they never ever have to talk to him ever again in any capacity.

This goes back a long time. For example Keith Packard on why X11 isn't GPL (from https://youtu.be/cj02_UeUnGQ?t=1705):

Richard Stallman, the author of the GPL and quite an interesting individual lived at 5405 DEC square, he lived up on the sixth floor I think? Had an office up there; he did not have an apartment. And we knew him extremely well. He was a challenging individual to get along with. He would regularly come down to our offices and ask us, or kind of rail at us, for not using the GPL.
This did not make a positive impression on me; this was my first interaction with Richard directly and I remember thinking at the time, “this guy is a little, you know, I’m not interesting in talking to him because he’s so challenging to work with.”
And so, we should have listened to him then but we did not because, we know him too well, I guess, and met him as well.

There are many anecdotes like this over the years from many people, often people who in broad lines actually agree with Stallman.

lachlanj• 1 year ago

Can someone that understands the change please ELI5 for me? Is this changing the license for all of php?

thayne• 1 year ago

What do you mean by all of php? This changes the license of the language. That is the interpreter, runtime, and standard library.

burnt-resistor3• 1 year ago

FYI in case anyone were wondering: Meta uses Hack, not PHP. (Hack's packaging, documentation, and availability suck because there's no performance review "impact" to making things better that no one inside Meta sees. Plus, there's job security in knowledge hoarding.)

Licensing: Meta and Google[1], and likely Microsoft, Apple, and most other megacorps explicitly forbid any use of AGPL software because it cannot be proven to be prevented from being invoked according to the vagueness of the "Remote Network Interaction" clause. So if you never want megacorps or anyone who runs a business to ever use your code, choose AGPL.

1. https://opensource.google/documentation/reference/using/agpl...

senko• 1 year ago

In other words, if you're an open source startup and want to avoid being AWS'd, choose dual AGPL + commercial (with IP transfer CLAs).

znpy4• 1 year ago

Which is what Grafana essentially did, and it's going great (as a company and as a suite of products, their stuff is incredibly good).

pjmlp• 1 year ago

That is the only way for anyone that would like to make a living out of open source.

Other than that, younger generations are getting why the old models from shareware and trial demos, source available have made a comeback under apparently new models.

nerdyadventurer2• 1 year ago

Can you please explain how this model works?

dawnerd• 1 year ago

Meta _does_ have some PHP apps. They have a collection of sites running WordPress.

burnt-resistor3• 1 year ago

That's not running on the main site. 99.99999% of it is Hack.

graemep3• 1 year ago

So if you never want megacorps or anyone who runs a business to ever use your code, choose AGPL.

Not "anyone who runs a business" but "any business that uses your software to provide a proprietary network service".

That is the whole point of the AGPL!

Google's reasoning in your link is pretty clear that the problem is that they are a provider of network services. Most non tech businesses wold be completely unaffected by these issues and have no reason to care.

p_l2• 1 year ago

The problem is that the language is vague enough and untested enough a lot of places, including non-technical ones, can be wary of being the test case.

eadmund2• 1 year ago

So if you never want megacorps or anyone who runs a business to ever use your code, choose AGPL.

Plenty of businesses run AGPL software (e.g. Grafana, Mastodon or Mattermost). Fewer run AGPL software for external paying customers.

As a developer, I care about the freedom of my users; I don’t much care about the paranoia of a megacorp who wants to restrict the freedom of its customers.

arccy2• 1 year ago

but you don't care enough to let your users choose to pay some other business to host it for them

mbonnet• 1 year ago

Plenty of big businesses will use AGPL software ... because you can dual license. AGPL lets you claim "open source" while still being able to pretty universally charge for the software's use via your commercial licensing option.

nerdyadventurer2• 1 year ago

I'm confused can you please explain it bit more, are you talking about open core model?

darqis• 1 year ago

I thought it's using Go nowadays. Weren't so many packages rewritten in Go?

pdmccormick• 1 year ago

I remember studying the source code to the PHP Zend Engine 25 years ago, and seeing a triple C pointer for the first time (I think it was `zval***`?) I did a lot of PHP in the following years, including using PHP for a high school programming contest (but my submission was rejected because the PHP language and using it in a standalone CLI context in particular was unfamiliar to the staff). I appreciate what it enabled me to accomplish in that era.

winrid• 1 year ago

That's hilarious considering I did my senior project in Perl.

znpy4• 1 year ago

That's hilarious considering I did my senior project in Perl

Same. Wrote a web application using Catalyst and a client for mobile phones using J2ME.

Writing projects in obscure languages is the best way to avoid dumb professors/examiners ask you stupid questions about your codebase lol.

I remember reading the Wikipedia page of Perl the night before the oral exhibition, just to be sure and guess what... The examiner asked me about the difference between "Perl" (capitalized) and "perl" uncapitalized. Which was one of the first lines in the Wikipedia page.

The guy literally went fishing for stupid and pedantic questions to ask, on Wikipedia, the night before.

rollcat5• 1 year ago

I honestly can't think up a reasonable case for a triple "naked" pointer. Nevermind performance, it's a level of implicit indirection that you simply can't reason about.

Think of what a pointer is. Picture a struct; accessing a member is dereference + offset. It makes sense, you know there's a car, and the car has a steering wheel, and the steering wheel has a horn button. Simple. A struct with one field, that field has an offset of zero - it fits our "naked pointer" case 1:1, but is more readable. The compiler will do the rest.

As my dear friend often noted, "why simple?"

DmitryOlshansky• 1 year ago

Think of page tables this is essentially a table of tables of tables. I also was meh on triple pointers until I found this use case.

snvzz2• 1 year ago

Can't help but wonder why not the much simpler MIT.

Y-bar• 1 year ago

Is https://opensource.org/license/mit really much simpler than https://opensource.org/license/BSD-3-clause to make a meaningful difference to you?

snvzz2• 1 year ago

Yes.

The main issue with BSD is its proliferation of versions, incompatible with each other.

If you're comparing a specific version straight with MIT, this is not evident.

psionides• 1 year ago

Why do people write licenses with whole paragraphs WRITTEN IN ALL CAPS LIKE THIS?

ericras• 1 year ago

Prevents any dispute over the significance of a certain word or phrase being capitalized vs not.

rufus_foreman• 1 year ago

From the Uniform Commercial Code:

"'Conspicuous', with reference to a term, means so written, displayed, or presented that, based on the totality of the circumstances, a reasonable person against which it is to operate ought to have noticed it."

What are some of the ways you can tell if a term in a legal document is conspicuous? One of the ways mentioned in the UCC:

"a heading in capitals equal to or greater in size than the surrounding text"

So apparently the thinking is that if you make everything in the license all caps, it is all a conspicuous term, and thus a court will be convinced that a reasonable person ought to have noticed it.

arp2425• 1 year ago

US law says that warranty/liability disclaimers need to be "conspicuous". Making it ALL CAPS is the easiest way to do that in plain text.

RFC: PHP license update

Related Stories