Licensing clarification about cosmopolitan HOT 7 CLOSED

Cosmopolitan is designed to help you write programs that are easy to distribute to a broader audience thanks to αcτµαlly pδrταblε εxεcµταblε. GPLv2 shouldn't be an issue for your users, since interprocess communication is a GPL boundary. If you want to be able to distribute binaries that keep your source code a secret, then I'm happy to offer you a commercial license. If you want to be able to vendor source code from Cafeteria Cosmopolitan into a separate codebase, then reach out to me and private and let me know what you need. I'm totally willing to consider releasing a specific subset under ISC notice license terms. I actually did that as recently as a few weeks ago with sectorlisp.

from cosmopolitan.

Thanks for the response.

GPLv2 shouldn't be an issue for your users

It shouldn't be a problem for my (I'm a totally doing-my-own-grocery-shopping person here) users, it should be a problem for your users. I'm just trying to gauge what to expect from the project. Because well, the idea is absolutely stellar, but will it become something more than a "display hack"?

Again, there's nothing wrong with being GPL, and it's certainly your right as the creator to make it so. (And for grassroot FOSS community it's only of more benefit.) But there's an approach of "obfuscated GPL" where naive corporations and schoolkids alike "suddenly" find themselves in violation because they did not read a fineprint somewhere. I guess, renaming NOTICE to LICENSE clarifies the concern that Cosmopolitan might go that way, thanks for doing that.

from cosmopolitan.

The license gives me an incentive to serve you. You do not speak for the users of this project. Help me understand why it's a dealbreaker for you personally, and I'll see what I can do to accommodate your needs. Otherwise I'm locking this thread.

from cosmopolitan.

You do not speak for the users of this project.

I don't. I'm actually first to bring up licensing matters among ~10 users who spoke up so far. Most are interested in more mundane matters like why it doesn't build OOB for them, or about GUI support.

Help me understand why it's a dealbreaker for you personally

It is not a dealbreaker for me personally, please treat it as a maintainer talking to maintainer of beyond-the-coding matters. Personally, I had a slight (and certainly misguided) suspicion of that "obfuscated GPL" approach, which was promptly addressed by a9ea949, thanks again. So, I'm personally fully satisfied, and hope that this ticket would serve as a useful reference for other interested parties (and they are coming, I'm certain, the project is fully worth it).

But again, if we talk about generic choose-a-license matters, it's common sense that:

1. GPL is more suitable for standalone applications, and less suitable for foundational layers, like libc's (and it's probably fair to characterize Cosmopolitan as very unusual kind of libc).
2. At the current spur of the moment, GPL is on downturn, with commercial world having commodotized the world of FOSS, and PRed (not pull-request'ed) "more liberal" licenses into everyone's ears (and minds of many).

That all has implications which affects even individual parties (like e.g. me). For example, redbean worked perfectly for me on the first try, thanks! But blinkenlights didn't. I'm not rushing to fix it (full of my own stuff which would take moths to clear). You made 8 commits to Cosmopolitan in November, 7 in October. A typical CS student (who unlikely can fix stuff properly, but at least has time to investigate) would likely be boo'ed by GPL. So, who's fixing all the stuff and developing it further? Only you, it seems, at your own pace. Which is certainly fine (well, it's great!), and I personally find an interesting topic to chit-chat about, sorry if you have a different opinion.

Thanks again for your work and patience!

from cosmopolitan.

Big things have small beginnings.

This project has always been focused on maximum transparency w.r.t. licensing. Read this Twitter thread if you want an idea of how much effort is placed in complying with third party notices: https://twitter.com/JustineTunney/status/1332576411345776640 What's best of all is it's done in a way that makes compliance an abstracted byproduct of the linker process, so it isn't something we need to think about on a regular basis.

Cosmopolitan is unusual because it employs a novel technology. I'm familiar Apple and Google have been very influential with their concerns regarding the GCC RTEv3 and GPLv3. However that doesn't apply to this project, which has gone to similarly great lengths to address the underlying cause, by simply using different compiler runtimes and favoring the v2 license which is totally fine.

This project obfuscates the need for continual maintenance, for the same reasons the Super Mario Bros ROM file has survived this long without needing to be maintained. Cosmopolitan is designed to be unbreakable in both source and binary form, by (1) using hermetically sealed builds, (2) depending solely on canonical stock kernel interfaces with long term stability promises, (3) hedging bets across multiple platforms. Whatever you build using Cosmopolitan will be a permanently working artifact invulnerable to the distro package memory hole many projects have seen so far, where they'll need Docker and old ISOs just to do a git bisect.

Question: If there was a freemium online ide that enabled you to develop standard C programs in a giant collaborative monorepo where the build service used cosmopolitan as an implementation detail (so that gpl didn't apply) then would you use it?

from cosmopolitan.

Big things have small beginnings.

True, so from my humble PoV, it would be totally fine if you played with a GPL-based "business model" (as that's what you seem to be interested in) for 10 years or so before relicensing it to BSD ;-). That will also allow to assess "longevity" claims, i.e. check whether some system will break something Cosmopolitan relies on. (But relicensing needs thinking-ahead with contributions, etc.)

This project has always been focused on maximum transparency w.r.t. licensing. Read this Twitter thread if you want an idea of how much effort is placed in complying with third party notices: https://twitter.com/JustineTunney/status/1332576411345776640

Nice tweet. And looking at the code, I can agree too that you spent a good work on licensing - copyright/licensing headers are everywhere, and the license even differs for different source files (e.g. public domain for simple examples).

Then https://justine.storage.googleapis.com/ape.html also mentions how you pay attention to compliance:

Cosmopolitan also uses the ZIP format to automate compliance with the GPLv2. The non-commercial libre build is configured, by default, to embed any source file linked from within the hermetic make mono-repo.

But that sentence raises more questions than it answers. Skipping questions of what is "non-commercial libre build" (perhaps, it's the version of Cosmopolitan in the public git repo?), what is the "mono-repo" mentioned there? Is it well, the repo of Cosmopolitan, and you're saying that any bit of Cosmopolitan's own source code, used by a particular application, will be included in a resulting executable-zip? Or are saying that any piece of the source code at all (including target application's) will be?

If anything, that gives an inline example why commercial companies stay away from GPL: why strain the brain to understand what exactly being done (== how to be compliant), if there're other alternatives? And if anything, that passage shows a problem spot in Cosmopolitan: you can't really make people (and companies!) be compliant with GPL behind their backs: it's explicit thought- and action-process on their side.

However that doesn't apply to this project, which has gone to similarly great lengths to address the underlying cause, by simply using different compiler runtimes and favoring the v2 license which is totally fine.

Yeah, v2 is usually a litmus test for a "business model with GPL" (vs "Stallman was right" attitude) ;-).

This project obfuscates the need for continual maintenance, for the same reasons the Super Mario Bros ROM file has survived this long without needing to be maintained.

This is so counter to any "startup" mentality... (which is usually "let's do something new!", whereas you're saying "let's do something old!") If you want to build a "startup" on such premises, well, good luck! (Truly contrarian approaches oftentimes work (as "new" is "well forgotten old").)

(2) depending solely on canonical stock kernel interfaces with long term stability promises
Whatever you build using Cosmopolitan will be a permanently working artifact invulnerable

I'm glad that in this very unstable industry, you found your stable point. It definitely resonates well with some crowd too (e.g. yours truly). However, this outside crowd may be more skeptical. There's a good local anecdote on the matter: There was a bus, and a guy running to it, not just staying on the stop. And the bus driver always wondered whether the guy would make it. And he always did. But one day, the driver shut the door before his nose and thought: "He didn't". So, I'm with you on your bet against (along with, along!) kernel ABI bus drivers, but don't think it's much of "long term stability promises", but more of "there's no money in munging the old stuff (even if munging is breaking)". If money will be found in breaking old stuff, they will break it.

Looking at the above quote from another angle, nice startup pitch ;-) (contrarian, again).

Question: If there was a freemium online ide that enabled you to develop standard C programs in a giant collaborative monorepo where the build service used cosmopolitan as an implementation detail (so that gpl didn't apply) then would you use it?

No ;-). I'm here for a pure old-skul hacker value of Cosmopolitan, and that's so opposite to "freemium" and "online ide". (You'll need to wait 30-40 years before crying to people inserting in the back of their heads neurointerfaces, for which they've given up a kidney: "Can't we just stay with freemium and online ide's, guys!!??").

My usecase is also pretty simple: for long time I consider making a static musl builds for my project. I saw Cosmopolitan and thought: maybe go straight to it? The keyword is "long time" however, I don't know how much time it was - a year, 2? Perhaps, from the beginning of the project. There were always more practical things to do. Another caveat is that it won't work. I need FFI right away (including foreign dyna-loading). It already doesn't work with static musl (or any other static libc), and won't work even more so with Cosmopolitan. Who'll be fixing it? Maybe someone's on corporate payroll who got a permission to explore idea to use these funky "actually portable exes" but still call out to external libs for gui? Nope, corporations won't touch GPL stuff in the first place. So, we're back to p.1, the "long time".

Thanks for discussion again!

from cosmopolitan.

It's insulting that you keep implying my motivations have to do with money or politics. Cosmopolitan is a labor of love intended to make a positive contribution to human knowledge. I published the work because I believe good things were meant to be shared. I have the luxury of being able to spend my time doing interesting stuff that puts the community first and addresses real pain points.

Like the way the scientific community has been impacted by those kinds of motivations. Tooling instability means we can't publish research finding code and expect it to run a few years later. That is exactly the kind of problem I set out to solve. Because it was only very recently that the system interface planets aligned in such a way that made it possible. There needs to be a space where simple instances of modern code can be written in such a way that it behaves predictably and lasts.

I had originally intended to use Donald Knuth's TeX license for this project. I had hoped GPL would be more conventional and help people to feel more comfortable, but perhaps it was the wrong choice, since I'd ideally like to not have these kinds of discussions, and I don't see any reason to continue having this one.

from cosmopolitan.