Open Source world's Bruce Perens emits draft Post-Open Zero Cost License

[starksm64]

https://www.theregister.com/2024/04/30/bruce_perens_post_open_license/ which leads to
https://postopen.org

It is somewhat akin to the way music royalties work, but the as yet to be worked out details of operation seem very complicated.

Many links in the current proposed license:
https://perens.com/static/DEVELOPMENT_LICENSE.txt?v=2004_04_01

do not exist, so it makes a complicated license even more so. My initial feeling after reading the license and proposals for operation is that it is too complicated. The license clearly states this is not open source. I'm just not groking how this even gets off the ground. In my experience a common path is that someone creates software and makes it open source to allow for easy interaction with end users and developers. As far as I can see, this post open model shuts that down. The expectation seems to be that you know or believe it to be possible that your software will be widely used and become a maintenance burden, and you want to be paid for that. It really just seems to be a fallback to a commercial license with unusable source available?

What would make more sense to me is that the post open terms kicked in based on age of the codebase, low priority requests, demands for CVE support, etc. Maybe the as yet to be determined operational aspects will address this. When Perens first made a statement about trying to address some of the current problems in open source it sounded interesting, but intractable. I would say that still remains the case.

[ebullient]

David Blevins once opined to me that the license change he would like to see is one focused on reciprocity: If your company uses an open source project, your employees are allowed to contribute to the open source project.

That, to me, would remove the barriers that prevent more developers from participating, which would also start to alleviate the problem.

[starksm64]

Ok, but that would be a complexity that would make it more difficult for companies to understand and accept the license. How would 'allowed to contribute' even be defined? Today that is handled outside of the license via a foundation contributor agreement, which is a barrier.

Even if there was a simple way to enable this, it does not deal with the real issue of supporting the versions that are older, or escalations due to CVEs.

In brainstorming some more practical ways of enabling financial support, it seems like the backing non-profit foundation needs to focus on tools that help projects identify and manage costs for support issues, including CVEs, and then provide an infrastructure that allowed funding of popular issues. The handling of a CVE is a special case that would have to be triaged into an actual amount of work, then a dollar amount for the fix, and then a mechanism to collect the funding. Here companies should have a CVE insurance balance to draw from to avoid delaying a fix depending on the severity.

This new model is a new form of a commercial license. I don't see any other way to look at it. Customers need to see how the money they spend provides them value. The current proposal has a simple linear relationship between the license cost and how much the company makes without any metrics of how the software contributes to the value produced by the company. This does not make any sense.

[ebullient]

I guess David was suggesting that this should change (to be something handled by the license): reciprocity should be part of the license. If you use it, your employees are allowed to contribute to it. Full stop.

You're right that participation is currently handled by contributor agreements: but not every project has one beyond a DCO. Some foundations have a CLA (we have the language for one), but I'm not going to force or require its use. I agree the CLA is a barrier.

The handling of a CVE is a special case that would have to be triaged into an actual amount of work, then a dollar amount for the fix, and then a mechanism to collect the funding. Here companies should have a CVE insurance balance to draw from to avoid delaying a fix depending on the severity.

There are a few experiments in this space.. we'll see how they do.