Subject: Fwd: [Trustees] Proposed Revisions to the IETF Trust LegalProvisions (TLP)

From: Marshall Eubanks <[email-masked]>
Date: Tue, 23 Jun 2009 12:49:51 -0400

Simon asked that this go to the IETF list.

Begin forwarded message:

> From: Marshall Eubanks <[email-masked]>
> Date: June 23, 2009 11:30:50 AM EDT
> To: Simon Josefsson <[email-masked]>
> Cc: Trustees <[email-masked]>
> Subject: Re: [Trustees] Proposed Revisions to the IETF Trust  
> LegalProvisions (TLP)
>
>
> On Jun 23, 2009, at 10:18 AM, Simon Josefsson wrote:
>
>> "Contreras, Jorge" <[email-masked]> writes:
>>
>>>
>>>>> 4.e -- this new section clarifies the legend requirements for Code
>>>>> Components that are used in software under the BSD License.
>>>> In short,
>>>>> the user must include the full BSD License text or a shorter  
>>>>> pointer
>>>>> to it (which is set forth in Section 6.d)
>>>> ...
>>>>> 6.d -- the BSD legend/pointer described in 4.e above
>>>>
>>>> The text in 6.d doesn't work.  Part of the BSD license (quoted in  
>>>> your
>>>> document) is this paragraph:
>>>>
>>>> Redistributions in binary form must reproduce the above copyright
>>>> notice, this list of conditions and the following disclaimer in the
>>>> documentation and/or other materials provided with the  
>>>> distribution.
>>>>
>>>> If you replace the BSD license with a pointer, you would violate  
>>>> that
>>>> part of the BSD license.
>>>>
>>>> To avoid simple mistakes when changing things related to the
>>>> BSD license
>>>> (which now appears to be the norm rather than the exception) I  
>>>> believe
>>>> it would be a good idea for the IETF Trust to talk with people and
>>>> organizations who understands open source licensing.  I'm sure the
>>>> Software Freedom Law Center could help here.
>>>
>>> Simon (removing the large cc list):
>>>
>>> This language was added after extensive review and consultation with
>>> open source experts, including members of the IESG.  There are  
>>> several
>>> open source projects (including some run by Yahoo) that use a  
>>> pointer
>>> for the BSD license, rather than the full text.  We do not think  
>>> this is
>>> a violation of the BSD language.  You may disagree, which is why  
>>> there
>>> is a public comment period for these documents.  But please don't  
>>> assume
>>> that these decisions were taken rashly or without serious  
>>> consideration.
>>
>> Can you name the open source projects that operate like this?  I've
>> never heard of a model like this before, and I'm interested to learn
>> about it if it is used successfully.
>
> Dear Simon;
>
> There was a lot of discussion about this inside the Trust, and I was  
> originally in favor of
> sticking with the BSD 15 line template and was very dubious about a  
> "license by reference" approach. However, there was push-back on the  
> length of this (from, e.g. Pasi Eronen), and then Russ found out  
> that for YAHOO the
>
>>> YUI JavaScript library and the Django web framework (used in
>>> datatracker.ietf.org) don't include the license terms in every file.
>>
>> The code contain this:
>>
>> /*
>> Copyright (c) 2009, Yahoo! Inc. All rights reserved.
>> Code licensed under the BSD License:
>> http://developer.yahoo.net/yui/license.txt
>
> It is not hard to find examples of this, both within Yahoo and  
> without.
> See, e.g., http://developer.yahoo.com/yui/docs/AttributeProvider.js.html
>
> So, we researched the status of the BSD license in this regard.
> I took it upon myself to query various people I know in the open  
> software community (without, however,
> using the name of the Trust or saying that this is for the IETF - I  
> am, myself, involved in OSS, including in
> the GNUGK effort).

While the individual responses are private (I could certainly ask  
people if they mind being quoted, but I wanted to get this out today),  
typical is this :

> "Yahoo is following common practice."
>
> I did not receive a single negative response.
>
> I also talked with corporate counsel from a large corporation with a  
> heavy IETF involvement, who at least did not object to this.
>
> In addition, the other Trustees did their own research, and this was  
> discussed both internally and externally over a period of over 2  
> months.
>
> And, of course, our own counsel, Jorge Contreras, researched this  
> and agrees with the feasibility of the license by reference approach.
>
> After all of this, the Trust developed consensus around the license  
> by reference option.
>
> So, I feel that the Trustees have done due diligence here.
>
> Of course, there is never a final word on these matters. If you know  
> reasons why this is inadvisable, I would be glad to hear them. That  
> is, of course, why all of these matters go to community review.

I of course extend this request to everyone. It is important to get  
this right.

Regards
Marshall

>
>
> Regards
> Marshall
>
>
>>
>>
>> Which open source experts did you consult about licensing?
>>
>> Providing background information and rationale behind changes when
>> posting drafts would give you the benefit of doubt about these  
>> issues,
>> and would probably build more confidence in the change within the  
>> IETF
>> community.
>>
>> /Simon
>>
>
> _______________________________________________
> Trustees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trustees
>

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Jun 2009 19:16:53 +0200

> Simon asked that this go to the IETF list.

Thanks for moving this back to the IETF list.  I believe these
discussions should be public.  Many considerations appears to have been
made that the wider IETF community is unaware of.

I would expect information like this to be part of the IETF Trust
minutes, but it seems no minutes have been published since September
2008: http://trustee.ietf.org/minutes.html

>> length of this (from, e.g. Pasi Eronen), and then Russ found out

Before continuing the response, should we understand that the rationale
for this change is to shorten the license text that has to be included
in derived works?  Did the Trust do anything to identify whether the
wider IETF community feels this is a problem?  In other words: on whose
behalf is this change made?

If that is the rationale, has an alternative to the BSD license been
considered?  The GNU All Permissive (GAP) license is comparable in size
to the excerpt in 6.d.  The entire GAP license reads:

     Copying and distribution of this file, with or without modification,
     are permitted in any medium without royalty provided the copyright
     notice and this notice are preserved.

Another option is to describe the common practice that many open source
packages are using: include a short blurb in the file or function that
contains the derived work, pointing to a file included in the
distribution.

>> See, e.g., http://developer.yahoo.com/yui/docs/AttributeProvider.js.html

This usage is typical and fine.  In general, there are two reasons why
this usage is fine.  Only one condition needs to hold:

1) The publisher of the material is not a "redistributor" of the code
under the BSD license.

2) The copyright holder includes the BSD license in the package.

Note that Yahoo includes the entire copy of the BSD license where it has
used others code in the YUI package.

The new IETF policy text suggests that recipients redistribute code
components under the BSD license when they include only the notification
text in section 6.d.  I.e., not the entire BSD license text.  Doing that
would violate the letter of the BSD license.  This is not the same
situation as for the Yahoo case, since the recipients of an IETF work is
neither the copyright holder nor does the redistributed combined work
necessarily include the entire BSD license.

>> software community

That is excellent, and I applaud you for it.

I believe this background information is important for the community to
know about, because information like this creates confidence in your
work.  I'm curious why information like this is only communicated
re-actively.  Is it due to lack of manpower?  It may be that
communicating material like this pro-actively would create less work in
the long term.

>> "Yahoo is following common practice."

They are indeed.  My claim is that the new IETF policy would result in
situations where common practice is not followed.

>> I did not receive a single negative response.

Actually, one of the cut out responses said that re-distributors must
include the BSD template in the distribution.  That is my concern.

/Simon

---

From: John C Klensin <[email-masked]>
Date: Tue, 23 Jun 2009 13:53:28 -0400

--On Tuesday, June 23, 2009 12:49 -0400 Marshall Eubanks
<[email-masked]> wrote:

>...
>> After all of this, the Trust developed consensus around the
>> license by reference option.
>> 
>> Of course, there is never a final word on these matters. If
>> you know   reasons why this is inadvisable, I would be glad
>> to hear them. That   is, of course, why all of these matters
>> go to community review.
> 
> I of course extend this request to everyone. It is important
> to get this right.

Marshall,

As you will see in the much longer note I just sent in response
to a note from Jorge on which the Trustees were copied, my
fundamental problem here is not with one form of license
statement or another or with one phrasing or another, although I
think both need to be examined carefully and gotten right.

Instead, I think a fundamental disconnect has developed between
at least some portion of the community and how we understood BCP
101 and the intent behind it on the one hand and the
IAOC/Trustees on the other.

In my view, the IASA (including both the IAOC and the Trust) are
expected to be implementers of policy, not definers of policy.
I welcome policy _suggestions_ and drafts from the IASA but
believe that the IAOC and Trustees are obligated to be
sufficiently open and accountable that the community can really
engage intelligently in discussions of the policy issues.

When you say something equivalent to "the Trustees did a lot of
work, evaluated all of the options in private, and then reached
consensus and presented the community with the one option we
agreed on (also in private)" then I think you are violating both
the assumption about where the policy-determination
responsibility lies but fundamental norms of the community.   If
the document came to the IETF list with a summary of the other
options you had considered and why you had made those decisions,
the situation would be different.  If that summary was in
minutes that were published on a timely enough basis that they
could figure into this discussion, the situation might be
different.  But here you say "After all of this, the Trust
developed consensus" ... "and this is what you get", I think we
have a disconnect.

I note that the IESG is much more closely connected to the IETF
community than the Trustees and that they have explicit
responsibility and authority for determining IETF consensus.
100% of its "voting" members come out of a community selection
process via the Nomcom.  It does its work iteratively with the
community and many of its decisions are made based on
suggestions from, and after thorough vetting by, open Working
Groups.   It holds private discussions for convenience but
concluded years ago that the community would be much better
served by tracking systems that actually identify discussions,
options, and, where relevant, the reasoning behind decisions.
More recently, they have adopted models for narrative as well as
formal teleconference minutes in order to keep the community
better informed on a timely basis.  They seem to be about a
month behind on those, but that is hugely different from "no
minutes or other public record since September".

The Trustees, if only because of that lesser degree of
connection and less well defined responsibility for defining
policy and determining community consensus, have, IMO, a much
stronger obligation than the IESG, not for making decisions, but
for exposing options and considerations to the community for
decisions.

Another example of this arises in conjunction with the comments
that I made to the IAB and that were circulated to the Trustees
based on a draft the IAB had seen very short time earlier.
Apparently those comments reached the Trustees and you decided
(perhaps by default) to put them aside and get the draft out due
to time considerations.  At one level that is ok -- if you have
concluded that you have a deadline and need to get a document
posted, I'm ok with that (although the iterative and I-D posting
style I suggested would largely eliminate the problem of a
"deadline" associated with the community's first look at a
document (except in real emergencies).

But then I think your cover note should have said "The Trustees
want the community to look at this because we think most of the
details are solid even though we are still examining some of the
text" and not "Please accept this message as a formal request by
the IETF Trustees for your review and feedback on the proposed
revision to the TLP document. The comment period will end on
July 20, 2009. [...] I expect the Trustees will decide on
whether to adopt this revision shortly after July 20, 2009."
That sort of statement is appropriate only for a document that
is already debugged and that the Trustees believe is ready to
go... not one that, to borrow words from RFC 2026, "contains
known ... deficiencies".

regards,
    john

p.s. Either you or Jorge have my permission to post my more
extended response to him and the Trustees to the IETF list
should you choose to do so.

---

From: Marshall Eubanks <[email-masked]>
Date: Tue, 23 Jun 2009 14:08:16 -0400

Dear Simon;

Just to save people from having to wade through lots of text  
unnecessarily, the major issue we are discussing here
is the "license by reference" aspect of the proposed TLP's BSD license  
requirements.

> made that the wider IETF community is unaware of.

At least in this case, there was no secrecy intended - I just hit  
"reply all." It had
come to me with the distribution stripped out.

> 2008: http://trustee.ietf.org/minutes.html

We are working on this and expect to get caught up soon - but minutes  
will rarely capture
all of the details of such discussions.

> behalf is this change made?

We received complaints about the February 15th TLP in this regard.

> considered?

The answer is yes, alternatives were considered, but this is a  
complicated issue.
Part of the advice we received from the legal people
we talked to was to use a common license choice, lest corporations  
simply never use the code, to save
the expense of getting legal approval of the license. BSD seemed
to be strongly favored here, as something that is well known and used  
by lots of parties. This advice, as
far as I can tell, was virtually unanimous, both to the Trust as a  
whole, and to myself and others in our
individual discussions.

The GAP below seems simple, but that doesn't mean that corporate  
counsel would regard it as simple. I do not
know. (In my experience is very hard to get a corporate counsel,  
especially counsel you are not paying for, to
say that anything is OK. I am inevitably reminded of the J.R.R.  
Tolkien's saying :

"Go not to the elves for counsel, for they will say both yes and no.")

All of this makes it hard for me to see the wisdom of adopting another  
license.

>  The GNU All Permissive (GAP) license is comparable in size

Just as an aside, one thing that worried me about this was that we  
would have little or no control over
packages using IETF code. It seems better to me to keep a notice close  
to the code, instead
of requiring it in another file in a distribution that could be  
removed entirely, say if the
distribution was used in another distribution.

> this usage is fine.

Can you provide a reference here ? This was not the legal reasoning  
brought forth in the
discussions I was part of.

If there are any court cases that deal with this matter, we would love  
to learn about them.

We were told by counsel that there was no court cases involving  
license by reference and so, in their
absence, this would be in the end a matter of judgement on the part of  
the Trust and the IETF. The proposed TLP thus results from our best  
estimate of what is legally sound, informed of course by the Trust's  
legal counsel.

>  Only one condition needs to hold:
>

It could be. I did not communicate this because I just assumed it was  
part of my job not to
approve anything without doing due diligence.

> include the BSD template in the distribution.  That is my concern.

I have asked them to comment publicly.

Regards
Marshall

---

From: Sam Hartman <[email-masked]>
Date: Tue, 23 Jun 2009 14:48:41 -0400

I find myself in complete agreement with John's message.  I'll admit
that I probably don't have the time or desire to actually examine the
IAOC's actions if they were to be accountable to the community.
However, when I was involved in drafting BCP 101 it was my assumption
that the IAOC would be accountable to the community and to the extent
that there are people who want to take advantage of that
accountability, we should foster and support that.

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 23 Jun 2009 20:49:15 +0200

This is another side-discussion that may be useful to do publicly,
forwarded with Sam's permission.

This discussion brings up another (subtler) point about allowing
re-licensing between works licensed under the BSD license directly and
works licensed under the newly proposed BSD-license-via-IETF-pointer.

If the new Trust text allowed recipients to re-license code back to the
original BSD licensed code, and not the BSD-license-via-IETF-pointer
license, I would not object to the new text.  It would allow me to do
what I prefer, and allowing others to do what they prefer.  I would
continue to feel that the new text is mis-guided and opens for solutions
that I believe are sub-optimal, but if others believe they want that
option, I would not be against having that option (as long as I can use
their BSD-license-via-IETF-pointer derived work under the original BSD
license).

/Simon

Sam Hartman <[email-masked]> writes:

> Simon, I appreciate your concern about the BSD license.
>
> However, I'm not entirely sure why it matters.
>
> There are apparently some lawyers out there who believe the pointer
> approach is reasonable.  What's the harm in the trust permitting this?
>
> If your legal advice suggests that using that option would produce
> inconsistent results, then you can simply include the full text.
>
> I'll admit that I'd be totally happy with the GAP license or (given
> growing frustrations) the WTFPL as a license for ietf documents or as
> large a subset of IETF documents as we can get.  So, I'm not really
> bothered by options that some might view as inconsistent, provided that
>
> 1) I don't have to use them
>
> 2) If someone else uses them and I'm using their code I can go change
> it to something reasonable.

Simon Josefsson <[email-masked]> writes:

> Sam Hartman <[email-masked]> writes:
>
>> Simon, I appreciate your concern about the BSD license.
>>
>> However, I'm not entirely sure why it matters.
>>
>> There are apparently some lawyers out there who believe the pointer
>> approach is reasonable.  What's the harm in the trust permitting this?
>
> I haven't seen any references to lawyers that believe redistributing
> others BSD works and replacing the BSD license with a pointer is OK --
> do you have any links?
>
> The BSD license has peculiar wordings here ("Redistributions in binary
> form must reproduce ... this list of conditions ... in the documentation
> and/or other materials provided with the distribution"), so a general
> opinion about replacing licenses with a pointer would not apply as far
> as I can tell.
>
> If there are lawyers that really do believe the situation wrt BSD is OK,
> I'm fine with the trust allowing either case.  I'm basing my opinion on
> the assumption that there aren't any.
>
>> If your legal advice suggests that using that option would produce
>> inconsistent results, then you can simply include the full text.
>
> I couldn't if I receive the derived work from someone that didn't
> include the entire BSD license.
>
>> I'll admit that I'd be totally happy with the GAP license or (given
>> growing frustrations) the WTFPL as a license for ietf documents or as
>> large a subset of IETF documents as we can get.  So, I'm not really
>> bothered by options that some might view as inconsistent, provided that
>>
>> 1) I don't have to use them
>
> Me too.
>
>> 2) If someone else uses them and I'm using their code I can go change
>> it to something reasonable.
>
> I'm not sure you could do that in this situation.  You received their
> code under a license that points to some document for the BSD lciense,
> and that document does not allow you to change the license of that
> derived work.  So you are struck with the IETF pointer license.
>
> /Simon

Sam Hartman <[email-masked]> writes:

> Simon, thanks for explaining your concern.  I agree that if I cannot
> replace the poinrter with the full text of the BSD license, then the
> trust language is problematic.
>
> I'd suggest that allowing this replacement might be an easy way to
> make progress.
>
> Although I seem to have written to you individually, which is not my
> intent.  If you think it would be beneficial, feel free to forward our
> conversation to a wider audience.
> Hmm, perhaps I should have added code begin and code end tags to this IETF contribution:-)

---

From: Marshall Eubanks <[email-masked]>
Date: Tue, 23 Jun 2009 15:10:17 -0400

> their BSD-license-via-IETF-pointer derived work under the original BSD

Can you send text / mods that would do that ? I am not sure I get it  
on the first reading.

Marshall

> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>