EOLE European Open source & free software Law Event Brussels 06/12/2013 Impact of cloud computing...on FOSS users Benjamin Jean bjean@inno3.fr 1
Plan 0. Definition : who are the users? 1. Questions: is the FOSS licences still adapted? 2. Actions: what could we imagine? 2
I Definitions 3
Who are the users The FSD Free Software Definition (1986) define what is a free software (http://www.gnu.org/philosophy/free-sw.en.html ) regarding users. Free software means software that respects users' freedom and community. Roughly, the users have the freedom to run, copy, distribute, study, change and improve the software. Thus, free software is a matter of liberty [for users], not price. With these freedoms, the users (both individually and collectively) control the program and what it does for them. When users don't control the program, the program controls the users. The developer controls the program, and through it exercises power over the users. Therefore, a nonfree or proprietary program is an instrument of unjust power. A program is free software if the program's users have the four essential freedoms: The freedom to run the program, for any purpose (freedom 0). The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. The freedom to redistribute copies so you can help your neighbour (freedom 2). The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this. Users are central. No word about licences/terms/obligations (nor customers). 4
But who are the Free software users : Developers? They are certainly the first users But they are also the ones who have to take part of an unjust power End users? Seems to be the one targeted by the FSD But they don't really benefit from freedom 1 to 3 Maybe Both? Everyone knows the two main movements: With permissive licences, freedoms are given to first users only. They can choose to continue to share, to share only some developments or to close the sources. With Copyleft licences, freedoms are sustainable and provided to all. Because they are maybe subsequent end users (users can modify the software and have their own users) which will need these freedoms. Free dance Untitled blue, CC By 2.0 5
FOSS users in the Cloud Industrials : Saas is a good way for companies which want from one hand to contribute on some standards/non strategic software and, from the other hand, to develop a special implementation of this saas with some specific value (ie OpenStack quite similar to embedded software : Genivi, Open Handset Alliance/Android, etc.) Classical copyleft licence (as the GNU GPL/CCDL/EPL) can be used in saas with the same effects. Communities: FOSS projects (within foundation or not) do rely on specific license (as GNU Affero GPL) to ensure that the software will remain free & open (diaspora project. But Cloud End users are not FOSS users (as they were regarding FSD). 6
Who are the users OSD Open source doesn't just mean access to the source code. The distribution terms of open-source software must comply with the following criteria: 1. Free Redistribution. The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale. 2. Source Code. The program must include source code, and must allow distribution in source code as well as compiled form. Where some form of a product is not distributed with source code, there must be a well-publicized means of obtaining the source code for no more than a reasonable reproduction cost preferably, downloading via the Internet without charge. The source code must be the preferred form in which a programmer would modify the program. Deliberately obfuscated source code is not allowed. Intermediate forms such as the output of a preprocessor or translator are not allowed. 3. Derived Works. The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software. 4. Integrity of The Author's Source Code. The license may restrict source-code from being distributed in modified form only if the license allows the distribution of "patch files" with the source code for the purpose of modifying the program at build time. The license must explicitly permit distribution of software built from modified source code. The license may require derived works to carry a different name or version number from the original software. 5. No Discrimination Against Persons or Groups. The license must not discriminate against any person or group of persons. 6. No Discrimination Against Fields of Endeavor. The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research. 7. Distribution of License. The rights attached to the program must apply to all to whom the program is redistributed without the need for execution of an additional license by those parties. 8. License Must Not Be Specific to a Product. The rights attached to the program must not depend on the program's being part of a particular software distribution. If the program is extracted from that distribution and used or distributed within the terms of the program's license, all parties to whom the program is redistributed should have the same rights as those that are granted in conjunction with the original software distribution. 9. License Must Not Restrict Other Software. The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open-source software. 10.License Must Be Technology-Neutral. No provision of the license may be predicated on any individual technology or style of interface. No word about users! In fact, the creation of the OSI (1998) is also the date from which companies began to adopt the collaborative/open movement (Mozilla Public License (1998), IBM Public License/Apple Public Source License/Sun Public License (1999), Lucent Public License (2000), etc.)) 7
II - Questions 8
Questions If the FSD want to guarantee freedoms to end users, are actual FSD still relevant? Society/technology/etc. have changed ; User needs are different if we speak about software, service, material, etc. (regarding saas, there are for instance: data protection; security; moving from a service to an other, etc.) As we speak about services, users are not only software users ; If the OSD is limited to define what terms the contract/licence should implement (to be OS), are these criteria still relevant? Contracts are tools to organize (and secure) specific relationships between different actors; As the relationships have involved/changed, previous contracts are not sufficient to organize these new collaborations. Saas users at least have different needs than companies which contribute on Cloud FOSS project 9
III - Actions 10
Users which are developers, new needs? From a developers point of view, we can't say it's a new deal. Even if there are maybe some new issues Patents (already discussed); As the "Badgeware" common issue: With internet, everybody want to be visible. Even if FOSS has always been really attentive to the respect of paternity/attribution, there is a new move (originated from industrial players) which aims to require the use of an increasing number of words/sentence (including the trademarks) when using the FOSS software. As the BSD 4-Clause (some MIT-like and Apache v1) did; But with more obligations and not only in permissive licences. Or to ensure the users comply with the licences: the scope of the licence used by each component might be difficult to determine (especially since we can not access the software architecture) and Affero-like licences have really broad scopes ; An audit might be necessary to know what FOSS components are really used, to ensure obligations are respected, etc. 11
Thinking about End users freedoms Regarding end users, the paradigm evolves. Their needs are different FSD/OSD aren't enough to guarantee their freedoms Some new definitions need to be drafted and advocated FSD will still be necessary for software development but it will become part of more global definition ; Affero-like licences are a first needed evolution, but copyright isn't enough. We need to think broadly with new tools (as the ODbL did in some manners)!! Because Open Cloud is a broader move, some actors doesn't want to include any place to FSD/OSD. We must keep what has been built in recent years & must then educate users (as we've done with FSD), Maybe a mix of Open Source + Open Standards + Open Data This definition need to focus on end users from a service perspective and to define their freedoms New contracts need to be draft to match with these needs. 12
Open Cloud Consortium http://www.opencloudconsortium.org The Open Cloud Consortium (OCC) is a not for profit that manages and operates cloud computing infrastructure to support scientific, medical, health care and environmental research. Open Cloud Manifesto http://www.opencloudmanifesto.org A manifesto: ideas aren't formalized in any definition FFII TIO http://tio.ffii.org FFII TIO (Total Information Outsourcing) Workgroup Releases Guidelines to Protect Freedom and Competition in the Cloud. The criteria for Customer Freedom are: Data Freedom, i.e. the freedom to migrate all user data including configuration and logs to an infrastructure operated by any other party. Software Freedom, i.e. the freedom to benefit from the same service on a standalone infrastructure operated by any other party using solely Open Source / Free Software made available by the provider. Competition Freedom, the freedom to copy and provide the same service. Tio Libre Definitions http://tio.ffii.org/tio%20libre%20definitions Distributed Management Task Force (DMTF) http://www.dmtf.org Working to Address Management Interoperability for Cloud Systems Open Could Initiative Open Cloud Principles (OCP) : Users must be able to come (no barriers to entry) and go (no barriers to exit) regardless of who they are (no discrimination) and what systems they use (technological neutrality). (Open Standards and Open Interfaces) http://www.opencloudinitiative.org 13
Merci bjean@inno3.fr 14