Ask HN: Is it safe to use Facebook's open source projects?

https://news.ycombinator.com/item?id=9111849

by kfei • 11 years ago

160 54 11 years ago

news.ycombinator.com

There is a PATENTS file in almost all Facebook's open source projects with statements on "Additional Grant of Patent Rights".

E.g., React (https://github.com/facebook/react/blob/master/PATENTS)

Why Facebook adds this declaration on top of the BSD license of the software? Is it safe to use those projects in my commercial project?

bencollier49• 11 years ago

Hmm, interesting. The grant of rights looks as though it's designed to build a defense against patent claims against Facebook. Get everyone using their stuff, and anyone who does will find it quite difficult to challenge Facebook patents.

powatom• 11 years ago

IANAL, but does this just mean that you can use and amend their work, but you can't create the same basic thing from scratch and claim that you created it?

DougBTX• 11 years ago

IANAL, but shouldn't you be more concerned about open source projects which don't grant you patent rights required to use the software?

pbhjpbhj4• 11 years ago

Do [m|]any open source projects hold patents?

ramchip• 11 years ago

Discussion: https://news.ycombinator.com/item?id=8985541

nostrademons2• 11 years ago

Also here, which IMHO is more informative:

https://news.ycombinator.com/item?id=8901357

stupidcar2• 11 years ago

Yeah, this discussion points out an important point that it's easy to miss if you scan Facebook's patent grant: The license Facebook grants you is invalidated by any action that even alleges that any of Facebook's patents is invalid.

E.g. if you so much as Tweet that one of Facebook's patents, even one entirely unrelated to React, is invalid, you've lost your license.

Compare this with the patent grant in the Apache license, as used in a library like Angular: https://github.com/angular/angular/blob/master/LICENSE

Here the license is only terminated in the event that you institute litigation alleging patent infringement by the software itself. You're still free to challenge shitty patents and call out companies about them. Not so with Facebook's license.

rurban• 11 years ago

It is safer than using SW without those "Additional Grant of Patent Rights". They explictly state that you can use it, other didn't make the effort to check for patents, or simply can screw you later.

lmm• 11 years ago

There is no way to be safe from patents. Anyone could have them, they don't have to declare them, and they're written in deliberately obtuse ways so that you have no way of finding relevant patents before you're sued for infringing them (you don't have to have copied, or even be aware of, any patented thing to violate a patent). It's just a hazard of the software industry.

The BSD license says nothing about patents, so this project is in some sense safer than a "normal" BSD-licensed project (but not an Apache, EPL or GPLv3-licensed project). The grant Facebook is giving you is fairly minimal but that's understandable from their perspective: they don't want to give you any extra patent rights, just enough to use the stuff they're actually trying to release.

It's not safe to use software in a commercial project. Facebook might hold patents on any random library you're using. Companies that aren't Facebook might hold patents on any random library or on React. You could develop a library in-house in a clean room and it could still infringe someone else's patent. Patents really suck that way. But React is in no more danger than any other code you might use.

EDIT: no more danger than any other BSD-licensed code. It would be safer to use code that has a less revocable patent grant, such as that in the Apache License, EPL, or GPLv3.

kibibu2• 11 years ago

As I understand it, you're better off not looking for relevant patents so that you can claim accidental infringement rather than wilful infringement

alandarev• 11 years ago

It would be nice to find and share if React infringes any of the patents.

cma• 11 years ago

Only if your company would survive half-damages and not survive full-damages, or probably a more complex weighted calculation. Doesn't seem too likely, especially if looking can help you do trivial workarounds to avoid infringing at all.

lettergram• 11 years ago

FYI my favorite patent ever is from Facebook:

"A social networking system user may associate an emoji representing the user's emotional reaction with a content item presented by the social networking system. The user is presented with one or more emoji maintained by the social networking system and selects an emoji for associating with the content item."

[1] http://www.google.com.ar/patents/US8918339

That's right folks, they patented using the emoji to respond to content.

throwawaykf052• 11 years ago

Actually, if you RTFClaims (which is the first thing you should read), they patented asking for payment for using emoji to respond to content. Which is ridiculous from a business perspective as well.

vkjv• 11 years ago

"You could develop a library in-house in a clean room and it could still infringe someone else's patent."

IANAL, but, it is my understanding that if that's the case the patent wouldn't hold up to the novel requirement.

Amorymeltzer• 11 years ago

Novelty at the time, perhaps? You might be thinking of "non-obvious" but just because two people invented something doesn't make it obvious. More importantly, though, once the patent is granted it doesn't matter, you're in violation. That it shouldn't have been granted in the first place is a separate issue, and one that almost nobody is going to spend the time and money on to sue for a change.

Igglyboo• 11 years ago

You're thinking of reverse engineering.

pbhjpbhj4• 11 years ago

Patents are granted on who files for the patent first. The invention protected must be non-obvious to the notional skilled practitioner in the relevant arts and should never have been disclosed in public before (novelty).

kibibu2• 11 years ago

It all depends on how the court sees it.

See "Carmack's Reverse" - where John Carmack independently developed an acceleration for robust stencil shadows, documented his discovery and then had to capitulate to Creative Labs who owned a patent on the algorithm from a few months earlier.

pbhjpbhj4• 11 years ago

Anyone could have them, they don't have to declare them, and they're written in deliberately obtuse ways so that you have no way of finding relevant patents before you're sued for infringing them (you don't have to have copied, or even be aware of, any patented thing to violate a patent).

Not "anyone" could have them only people who have their details registered as patentees at the relevant patent office, eg USPTO or WIPO.

Patent claims are written in a legal way as they define the monopoly the patent protects, it's necessary not to use normal language as they must at once be legally precise and also define as broad a field to serve the patentee. Claims are drafted by, or for, the patentee.

The patent description must, in order to comply with the relevant laws, disclose the invention in a way that makes it possible for a skilled worker in the art to repeat the invention. If it does not the application should fail. Patent description must include at least one concrete implementation of the invention but the invention itself can cover many different implementations. The description needs to support the breadth of the claims.

Yes, practically - especially in the USA in the past - so-called submarine patents could surface out of the depths. If you're working in an area of technology you should be using patents both to advance your knowledge of the market and to ensure you're not in breech of other's IPR.

Your parenthetical remarks are entirely correct however.

Patent infringement isn't just a hazard of the software industry it's a part of how all technological industries work in countries that use patents (nearly all countries [may be all established ones?]).

DannyBee3• 11 years ago

"The BSD license says nothing about patents, so this project is in some sense safer than a "normal" BSD-licensed project (but not an Apache, EPL or GPLv3-licensed project). "

As I've mentioned in another common, this is both false and a common misunderstanding, because most engineers are not familiar with implied patent licenses.

BSD normally carries one. So you do in fact, get a implied grant. By doing this you don't, you only get the explicit grant. The implied grant is normally not revokable unless the underlying BSD terms are violated, whereas the explicit grant is revokable for other reasons.

The reason people use explicit patent grants is to avoid getting into some unsettled law. Particularly, the sublicensability of implied patent licenses is not clear. The TL;DR of this is "the answer is clear if you get the software directly from person owning the patents. If you get it through someone else, like say, a linux distribution, it's not clear what happens". The related doctrine of "patent exhaustion" that plays into this is also not settled, and currently the subject of a Supreme Court cert petition by Cisco.

matthewmacleod4• 11 years ago

Of course it is – you've got this back to front. The grant of additional rights to use any patent Facebook may hold is an additional benefit and in no way places any restriction on you.

If you're going to worry about anything, worry about the squillions of open-source projects that don't include any patent grants. But you probably shouldn't worry about that either.

vertex-four• 11 years ago

Most open-source projects' owners and contributors don't have any patents to enforce, thus can't grant anything. The rest tend to be less chilling than the clause that Facebook uses - there's no "we'll only grant you this if you promise never to mention that any of our patents might be invalid".

Are you certain that Facebook doesn't have any patents that cover any of its open-source software?

SixSigma2• 11 years ago

No. The license has a chilling clause that says if you ever suggest that any Facebook patent might be invalid, your license to use their code is automatically revoked.

And in corporate world, that means any comment of any of your employees in an official capacity.

Edit downvotes, well maybe the text of the clause will help

The license granted hereunder will terminate, automatically and without notice, for anyone that makes any claim ... by ... assertion or other action ... alleging .. that any right in any patent claim of Facebook is invalid or unenforceable.
https://github.com/facebook/fbcunn/blob/master/PATENTS

randunel• 11 years ago

So... I think Facebook has at least one unenforceable patent in my country.

There, I may no longer use their code :D

callum85• 11 years ago

Who is downvoting this? Could you comment and explain why?

SixSigma2• 11 years ago

Was probably because I asserted it without citation.

kriro2• 11 years ago

Thanks for sharing this. It brings up some interesting questions. Does this mean React cannot be used by European government agencies since they claim (via law) that patents are not enforcable?

What if I merely live in the EU and thus implicitly agree to the laws in Europw. Does that fall under "other action" or would I have to explicitly state that I think their patents are not enforceable.

What if I have actively participated in the anti software patents movement? Do I have to single out specific Facebook patents for this clause to trigger or is it enough that they are caught in the general umbrella?

Edit: I'm assuming this is found on all the stuff they release and not just fbcunn? At least it's also true for react: https://github.com/facebook/react/blob/master/PATENTS

Denvercoder9• 11 years ago

What if I merely live in the EU and thus implicitly agree to the laws in Europw. Does that fall under "other action" or would I have to explicitly state that I think their patents are not enforceable.

It doesn't matter. If their patents aren't valid where you live, you don't need their patent grant.

matthewmacleod4• 11 years ago

…if you ever suggest that any Facebook patent might be invalid, your license to use their code is automatically revoked.

This is not correct — your license to use any patent of Facebook's that covers the software is revoked. You are still not infringing copyright on the software by using it, but you will no longer be protected by Facebook's patent grant, which is in addition to your license to use the software.

This is a boilerplate patent grant, and it doesn't mean that Facebook holds any patents on e.g. React.

To be clear, this parent grant is in addition to your license to use the software and as a result does not restrict your freedom in any way, versus the license not being granted at all.

stupidcar2• 11 years ago

While it's true that you only lose your license to the patents, not the code, I don't see how you can argue the grant isn't a restriction of your freedom? Surely any license whose conferred rights are predicated on the recipient not being able to take particular actions, up to and including saying particular things, must be considered to be restricting freedoms, even if those restrictions are in exchange for other freedoms granted?

Of course, all free software licenses involve some exchange of freedoms: You give up your ability to publish closed-source modifications of the software in exchange for being able to use and modify it at all. The question is whether the freedoms you are asked to give up are reasonable in exchange for what you gain. A patent grant that restricts your freedom to launch patent infringement litigation against other users of the software seem reasonable to me. Whereas a grant that is invalidated simply by alleging, through any action, that any of the original author's patents are invalid, does not.

guscost• 11 years ago

Are you saying that they could not come after you for simply using React (even if you were to dispute the relevant patents in court), or just that there is no evidence that they could?

loceng2• 11 years ago

So if you ever need to sue Facebook for patent infringement - you'll still be able to use React/React Native once they release it?

mobiplayer• 11 years ago

The best way to stay safe from software patents is to not enter the US market, if you can afford that :)

pretaliationc• 11 years ago

Pardon my ignorance, but isn't this just equivalent to Apache's patent retaliation clause?[0][1]

[0] http://en.swpat.org/wiki/Patent_clauses_in_software_licences...

[1] http://en.wikipedia.org/wiki/Software_patents_and_free_softw...

richardfontana• 11 years ago

The events that trigger Apache License 2.0 patent termination are much narrower: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed."

spacemanmatt• 11 years ago

Yeah, Apache is a little more giving in actual terms, but it's a similar deal.

dutchbrit• 11 years ago

It all boils down to the license - open source means jack all.

jonas21• 11 years ago

Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license.

This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent.

It's ironic that people are freaking out about this. If anything, we should be encouraging more companies to give away patent rights. Sure, it's not as broad as the Apache license, but it's a lot better than the default (nothing), and given some of the ridiculous patent lawsuits that have been brought against Facebook, Google, and others, I can understand why they'd want to avoid restricting their ability to use their patents defensively.

DannyBee3• 11 years ago

"Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license. This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent. "

This is 100% totally and completely wrong :)

The BSD license normally includes an implied patent license.

It says " Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met .. "

This grants an implied patent license to the patents necessary to actually do this, as long as you meet the restrictions.

This is actually well settled law. You don't get to give people stuff unrestricted, and say "you can use this for free", and then say "just kidding, what i meant was, you can use this for free as long as you pay me for the patents"

However, when you do what facebook has done, and give an explicit license, you have overwritten the terms of that implied license, and you get no implied license.

So it is not only "not unambiguously safer", you are not "left with the same rights you had under the bsd license if it is revoked".

This is because if you revoke the explicit grant, you get nothing in terms of patents. But the implicit grant is not revokable unless you violate the copyright license.

So sorry, but this is not "better than the default" and does not in fact, help you.

matthewmacleod4• 11 years ago

This is actually well settled law.

I'm not sure it is, and I'd argue the situation is unclear. I'd be keen to see any examples though – it would be awesome if there was something to fall back on.

All I can find is evidence that it would be at best very risky to rely on an implied patent grant.

For example, it's considered unclear enough that the ClearBSD license was explicitly created to clarify that it doesn't offer patent grants - http://directory.fsf.org/wiki/License:ClearBSD

Even more damning:

In the absence of an explicit patent grant, but considering the word use in the license, can we assume that the BSD license impliedly grants enough of whatever patent rights the Univer- sity of California then owned that a licensee may use the soft- ware as it was originally distributed by the University? Most licensees under the BSD assume it does on the theory that oth- erwise the copyright license would be of no value. What good, they say, is software that can be copied but not used?

Such a conclusion is not based on the law of licenses. Indeed, a bare license of copyright need not include a bare license of patent at all. It is only if the BSD is viewed as a contract that we can introduce contract law principles such as reliance or reasonable expectations of the parties. If software is licensed under the BSD without forming a contract between licensor and licensee, the extent of any patent grant is at best ambiguous.

As to whether an implied grant of patent rights extends to versions of the software with modifications, that’s an even more complicated question. The BSD license is silent about a patent license for derivative works. So if a licensee improves the origi- nal Berkeley Software Distribution in a way that infringes a patent owned by the University of California, there is no easy way of knowing whether an implied BSD patent license includes a patent license for that improvement.

Since courts are likely to construe implied grants of license narrowly, a licensee should consider obtaining separately from the licensor an explicit grant of patent rights that might be needed for modified versions of BSD-licensed software.

  http://rosenlaw.com/wp-content/uploads/Academic-Licenses.pdf

loceng2• 11 years ago

Sorry to jump in here - I can't see how to connect with you otherwise. Is React and future React Native not safe to use then? In my mind Facebook could eventually try to enforce, ask for money or other, for patents they hold against you - and if you try to fight them then you'll lose the ability to use this software? That seems horrific to me and something I'm surprised the development community isn't up in arms over.

anonbanker• 11 years ago

other than a) (ii) of that PATENTS file, it's way better than I thought it would be. Unless I'm reading it wrong, I'm losing my right to use the package if I publicly state that someone is misusing Facebook's software.

Ask HN: Is it safe to use Facebook's open source projects?

Related Stories