I ask this because I think of the recent switch of Ubuntu to the Rust recode of the GNU core utils, which use an MIT license. There are many Rust recodes of GPL software that re-license it as a pushover MIT or Apache licenses. I worry these relicensing efforts this will significantly harm the FOSS ecosystem. Is this reason to start worrying or is it not that bad?
IMO, if the FOSS world makes something public, with extensive liberties, then the only thing that should be asked in return is that people preserve these liberties, like the GPL successfully enforces. These pushover licenses preserve nothing.
Coreutils has little commercial value to take can create a proprietary fork of. There is little value that can be added to it to make it worthwhile. The same is for sudo - which has had a permissive licence from the start. In all that time no one has cared enough to fork it for profit.
Not saying that is true of every project. But at the same time even GPL software has issues with large companies profiting off it and not contributing back. Since unless you are distributing binaries the GPL does not force you to do anything really. See mongodb and their move to even more restrictive licences.
The GPL is not the only thing that stops companies from taking open software. Not does if fully protect against that.
Not does everything need to be GPL. It makes sense for some projects and less sense for others. Especially libraries as that basically forces no company from using them for anything. Which is also not what you want from a library.
Compare Ubuntu and MacOS. MacOS ships ancient version of Bash because its GPL2 which allows for coexistence with proprietary software on sold machines.
So if Ubuntu gets rid of GNU coreutils and sudo what else stays GPL3 on a barebones system? You can swap Bash with Zsh like Apple did. And just like that you got yourself a corpo friendly distro to ship proprietary software. Just like Android, and look where that got us.
Okay then; what licence can we use to force any entity using a library to make their project open-source?
EDIT: clarification
GPL requires this, since linking with a library is considered a derivative work even if the library is dynamically loaded.
This is why the LGPL exists, which makes the library copyleft but does not extend the derivative work classification to programs linking with the library.
The FSF says this is the case but the actual legal situation is less clear, especially in the EU. Linking does not necessarily constitute a derivative work. Even decompilation of a (proprietary) library in order to link to it might be acceptable depending on the circumstance.
This isn’t something that can be fixed with a license, it’s a direct result of EU copyright law. Historically companies have tended to err on the side of the FSF interpretation, but it is on somewhat shaky grounds.
That’s the orthodoxy but noone ever bothers to actually back it up. If I write an encyclopedia and refer extensively to external sources it’s not a derivative work, and that seems to be the closest obvious example.
None. The closest you can get is the AGPLv3.
If you go further, it will no longer be open source. This is the case for the Server Side Public License (SSPL) for example. It requires the entire system configuration to be released under the same license*. This sounds “open source friendly” but it’s actually just a proprietary license because it’s not realistically possible to legally comply with it. You cannot run standard hardware without proprietary firmware, which means you cannot run SSPLed software on it legally.
*This only applies if you host the software as a service but the result is the same. It basically violates the freedom to use the work for any purpose.
I don’t think there is a good license for that. The ones MongoDB used turned the open source community against them. But that is not really my point. I just mean that some projects using MIT won’t suddenly mean every company will start stealing and closing that software. Some things like coreutils and sudo just don’t have the commercial value to make that worth the effort. So there is no real need to worry about these two projects IMO. Other projects are a different story altogether though. Each project needs to make its own decision on what licence best suits it. The GPL is not the one and only license that is worth using.
I would say AGPL is the “safest” license still approved by the OSI. Could you share your opinion?
There is no one size fits all safest option. Details matter and each project needs to read the licenses and decide on which suits their needs best.
MIT is probably the safest option for a company creating a library wrapping their service where there is no real value in others taking that code. Or for simpler libraries that are fairly easy to reproduce so the need to steal the code is low. Or you just don’t care what others do with the code.
GPL is probably safest for some hobbies that does not care about companies and just wants everyone that is using their project to not bake it into a product they distribute. But also means companies likely wont want to use your project if it is a library.
LGPL might be a good option for library code if you want other companies to use and contribute back to some complex library you are using that is hard to reproduce in isolation.
Other licenses are needed if you want to prevent other hosted services from using your project without contributing back.
Different licenses exist for different reasons and it all depends on what you want for your project.