Keeping track of licenses of OpenG components

[Mellroth]

Is there a reason you don't use the Filter Error made by OpenG which accepts a scalar or array of errors to filter?  This was made native in 2014, but only accepts a scalar for some reason.

 

One of the reasons we don't use OpenG in production code is that we find it hard to get all license information required by the BSD license, since different VIs and groups have different authors and thus requires different attribution.

 

 

   * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

 

Each time a new OpenG VI is added we basically have to check its FP to find the author and add a separate CopyRight message if that author is not already attributed.

 

/J

[mje]

One of the reasons we don't use OpenG in production code is that we find it hard to get all license information required by the BSD license, since different VIs and groups have different authors and thus requires different attribution.

 

Each time a new OpenG VI is added we basically have to check its FP to find the author and add a separate CopyRight message if that author is not already attributed.

 

/J

 

Ditto. Full credit to the OpenG authors for a fantastic library, but the reality is the licensing burden exceeds that of just banging out my own implementation. Even if the licensing was bottled up with a single clear attribution statement, there are other corporate challenges to using open source.

 

There's something to be said for just being able to throw money at the problem to get your own commercial license and not have to deal with open source requirements. A few hundred to a few thousand dollars may well be worth my time even if you also distribute via open source licenses. And here's a hint: when I say "worth my time", I'm not weighing against the time it would take for me to implement your library myself. I'm considering bureaucratic burden.

[hooovahh]

I feel like we are hijacking the thread a bit, but it is a curious topic.  I've just always used OpenG, it's always been there with the huge benefit of not having to develop, test, and document functions.  Of course it is possible I've been using it wrong all these years.  As for attribution can't you just use the copyright notice on the whole package, and not the individual functions in them?  I was thinking of writing a VI that just takes all the attributed individuals in the OpenG libraries, and making an OpenG BSD License.txt that can be included with the software documentation.

 

But I do see the point others are making, that the effort in complying with a license, might be more work than the functions themselves.  And if that is the case it is quite discouraging for the user of the library and the developers.  I know OpenG has wanted to make things simpler with various license changes in the past, but what I feel would be really nice is a simple "This is what you need to do if you use OpenG in an application".

[Mellroth]

I feel like we are hijacking the thread a bit, but it is a curious topic.  I've just always used OpenG, it's always been there with the huge benefit of not having to develop, test, and document functions.  Of course it is possible I've been using it wrong all these years.  As for attribution can't you just use the copyright notice on the whole package, and not the individual functions in them?  I was thinking of writing a VI that just takes all the attributed individuals in the OpenG libraries, and making an OpenG BSD License.txt that can be included with the software documentation.

 

But I do see the point others are making, that the effort in complying with a license, might be more work than the functions themselves.  And if that is the case it is quite discouraging for the user of the library and the developers.  I know OpenG has wanted to make things simpler with various license changes in the past, but what I feel would be really nice is a simple "This is what you need to do if you use OpenG in an application".

 

The copyright notice (and licensing) on the package itself might be different from some of the VIs in the package, and If I use a single VI, I still have to check all subVIs to comply with the BSD license.

 

I have also thought of writing up a simple little VI that scans the hierarchy and produces a OpenG license file, this VI could then be called as a Pre-build step to add the correct attribution to the built application.

Actually, I think OpenG should have this VI at the very top of its hierarchy, and the let it return the licensing info as it should be.

 

/J

[hooovahh]

Okay so it is clear to be in accordance with the BSD license in a binary build, we need to attribute the author(s) somewhere.  That can be in several forms, but the easiest to talk about is a About window.  

 

In your application you can have an about screen, and there can be a button to click or a link, which opens up and shows the detailed license information.  For BSD this is required to be a copy of the BSD copyright notice, and the list of authors.  This is how JKI does it with VIPM, clicking on About brings up a window where you can click Copyrights.  

 

The question that comes up is how do we easily generate a list of authors, for BSD code that is used?  Certainly a pre-build on an application builder can be used to run a VI that generates this text file, which is included in the project.  But with this is a few issues.

 

First is potentially large number of files to scan.  OpenG has many polymorphic types, and so using scripting to look on the front panel of every VI called looking for the copyright notice might take a decent amount of time.  I think a better approach would be to include the authors associated with the package.  So if you use the OpenG Tick Count (ms).vi instead of attributing just Jim Kring, and Jean-Pierre Drolet, you'd also attribute Jonathon Green, because he is associated with the package and not that particular file.  In my opinion this is fine.  We are attributing all authors of the module we are using which is the Time Library.  If we go with this technique it would be much easier to attribute authors because you only need to scan the installed packages, and not every file called.

 

Another potential problem is with non OpenG BSD licenses.  OpenG has a standard front panel comment attributing authors but other libraries may not.  But again if we decide that going with installed packages is sufficient, we can pull the author information from the spec file from each package installed.

 

What about VIPCs, can they be used in making BSD license management easier?  A VIPC is a collection of packages, that usually are associated with a specific project.  VIPM pro has the feature to scan source code and create a VIPC which is the packages, and versions, that the source uses.  This single VIPC file could be made for a project, and then scanned for licenses and authors, which could then create the BSD license file that needs to be included with the application.

 

And lastly another concern is that you maybe using BSD code not installed as a package.  Some LAVA Code Repository stuff is not in a package but licensed under BSD.  What ever Pre-build functions that are made are going to need to support including BSD attributions that aren't just packages.

[Mellroth]

The question that comes up is how do we easily generate a list of authors, for BSD code that is used?  Certainly a pre-build on an application builder can be used to run a VI that generates this text file, which is included in the project.  But with this is a few issues.

 

I'll try to dig up my old code that does just this.

Finding all Copyright notices on the FP of all OpenG VIs was quick, the problem was how to present this to the end user. If each VI has a © notice, does that mean we have to list the copyright for each VI, or just to find all contributors in the code and acknowledge them?

 

Regardless I think it is in the interest of OpenG to define how to acknowledge the contributors, and thus add a VI that returns this information.

And, I very much prefer to have a tool that scans the hierarchy for © text than manually have to remember to scan the VIPM hierarchy each time I build an application.

 

Code modules other than OpenG might have to be treated differently, but I guess there are more OpenG code.

 

I also think I made a feature request for VIPM to be able to not only scan the project for used modules, but also return the copyright messages for these modules (even if this doesn't solve the issue with OpenG where individual VIs have different contributors).

 

/J

[drjdpowell]

Anybody know any lawyers?  As a copyright holder of some BSD-liscenced packages (and one or two OpenG VIs) I couldn’t care less if you include me of my license in your binaries.  But I am interested in not being sued.   And not being a lawyer I can only use an established license in order to feel some confidence that I am protected.  From a common-sense point of view, it seem silly to think that one could be liable to a third party because a second party passed on your software in their product without passing on your legal disclaimer.  But I’m not a lawyer, and all licenses seem to have that.

[drjdpowell]

An earlier (rather long) discussion about licensing.

There's something to be said for just being able to throw money at the problem to get your own commercial license and not have to deal with open source requirements. A few hundred to a few thousand dollars may well be worth my time even if you also distribute via open source licenses. And here's a hint: when I say "worth my time", I'm not weighing against the time it would take for me to implement your library myself. I'm considering bureaucratic burden.

Are you sure you understand your commercial licenses?   The big difference about the BSD license from most licenses is that a human can actually quickly understand it.  Ever read the licenses you agreed to in using LabVIEW?

[drjdpowell]

For example, ever modified a VI.lib VI and used it in a commercial work?   Did you read and follow the "NI Release License Agreement" all the way to "Attachment A — Source Code Licenseâ€?  Commercial licenses aren’t a bureaucratic burden only to the extent you ignore them.  Perhaps the BSD license used by OpenG is too short and readable.  We need it to be long and unintelligible.

[mje]

Yes, I'm aware of the LabVIEW license requirements and BSD. That comment was originally presented in another context and wasn't meant to refer to either, rather licences that have non-commercial clauses. I'm not implying it is a valid model for OpenG.

 

Anyways, I was trying to say how I've come to very much like the model of distributing with a restricted free license with alternative paid licenses available if required. As for the throwing money comment, I can't really be specific in a public forum. All I can say is sometimes provisions in a license are unacceptable and instead we may look for an alternative.

 

Again though, I realize this isn't appropriate for OpenG.

[ShaunR]

I think the takeaway is that people would like a single licence that covers all the VIs in the OpenG that they can then reference in their documentation. A BSD, Creative Commons or custom  licence with a salutation section listing of all the contributors that can be cut and past into an appendix or included with  distribution that fulfills all licencing requirements. Something where the developer can say "put that in the manual" and sleep safe in the knowledge no vampire will attach itself to the financial jugular.

[drjdpowell]

I think the takeaway is that people would like a single licence that covers all the VIs in the OpenG that they can then reference in their documentation. 

The OpenG Toolkit VIPM package has this license:

 

 

 

OpenG Toolkit

Copyright © 1995-2004 Mark Adler, Jean-loup Gailly; 1998-2004 Gilles Vollant; 2002-2006 Jean-Pierre Drolet, Heiko Fettig; 2002-2007 Cal-Bay Systems, Inc.; 2002-2009 Christophe Salzmann; 2002-2010 Jim Kring; 2003 Paul F. Sullivan; 2003-2008 Rolf Kalbermatter; 2004 Enrique Vargas, Michael C. Ashe; 2006 JKI; 2006-2007 MKS Instruments Inc.; 2008 T. Plomp; 2010-2011 Jonathon Green

All rights reserved.

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

 

  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

 

  * Neither the name of the <organization> nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 

It needs updating (it's missing "2012 James David Powell" ), but it covers the entire toolkit.  Stick that in a TXT file in your installer and your done.

[hooovahh]

It needs updating (it's missing "2012 James David Powell" ), but it covers the entire toolkit.  Stick that in a TXT file in your installer and your done.

While I think this is the easiest solution, and probably something similar that I'll adopt, what if you only used on subVI made by one guy in your build?  You are crediting a few dozen people when really it should be one guy.  Could I take this to the extreme and credit every human on the planet, and then never need to worry about forgetting to credit someone?

[drjdpowell]

You are crediting a few dozen people when really it should be one guy.  

 

“Creditâ€?   What has this to do with credit?  This is legalese meant to disclaim liability.  Plus copyright, but I’m unsure of the value of copyright on something you’ve licensed without restriction.   Perhaps we could drop the requirement to reproduce the copyright, and just retain the disclaimer (see below):

Copyright © 1995-2004 Mark Adler, Jean-loup Gailly; 1998-2004 Gilles Vollant; 2002-2006 Jean-Pierre Drolet, Heiko Fettig; 2002-2007 Cal-Bay Systems, Inc.; 2002-2009 Christophe Salzmann; 2002-2010 Jim Kring; 2003 Paul F. Sullivan; 2003-2008 Rolf Kalbermatter; 2004 Enrique Vargas, Michael C. Ashe; 2006 JKI; 2006-2007 MKS Instruments Inc.; 2008 T. Plomp; 2010-2012 Jonathon Green; 2012 James David Powell

All rights reserved.

 

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following disclaimer is retained, in code, documentation, and/or other materials provided with a distribution.

 

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 

[hooovahh]

“Creditâ€?   What has this to do with credit?  This is legalese meant to disclaim liability.  Plus copyright, but I’m unsure of the value of copyright on something you’ve licensed without restriction.   Perhaps we could drop the requirement to reproduce the copyright, and just retain the disclaimer (see below):

I am not a lawyer (IANAL), but I was using the following definition for Credit

 

Publicly acknowledge someone as a participant in the production of (something published or broadcast).

 

If we are trying to disclaim liability, I'd suspect leaving someones name off of a list of developers who influence the creation of the product would be what is desired.  If that is the purpose couldn't I just say any code developed by someone other than me, used in this product are not responsible.

 

 

As a copyright holder of some BSD-liscenced packages (and one or two OpenG VIs) I couldn’t care less if you include me of my license in your binaries.  

Same here actually for some of my Code Repository stuff on LAVA.

[mje]

Also not a lawyer.

 

Would you instead be able to assign copyright and disclaimer to members of an "OpenG Group" or similar? That way individual people and time frames need not be called out depending on what dependencies were used.

 

"Copyright 1995-2015 © members of the OpenG Group. All rights reserved."

 

How OpenG handles membership would be a detail that doesn't need to be in the license. Not sure if there's precedent for anything like that. Also not sure how to phrase it such that the group proper isn't claiming the copyright, rather stating individual members of the group take claim.

 

Having a clear attribution/disclaimer statement would go a long way to getting adoption in my book. Part of the problem is indeed there's no easy way to know everyone has been covered, and the inability to provide objective evidence that every claim has been made is part of what prevents me even trying to push something like that through. Yes, I could scrape every front panel and put something similar to what JKI did into my application but there's no way to objectively prove I haven't missed anything.

 

There are other issues though that I really don't want to discuss, but suffice it to say fall into the category of change resistance-- "that's not the way we do things." Things like SOPs/ISOs/WTFs that need to be invoked/consulted/created to release an application containing code under some license. These barriers come from the consumer of the library and I think an author would be hard pressed to do anything to tackle these obstacles. Frankly I don't want to deal with any of it, I just want to create an application that works.

[hooovahh]

I understand where you are coming from, but even when I was in that type of industry, explaining that things get done faster, and cheaper when trusted toolkits are used instead of reinventing the wheel, usually persuades the customer.

 

It sounds like you are in a culture that doesn't use OpenG and it would be difficult to bring that in.  I'm in a culture where using OpenG is expected, so taking that away would be difficult.  Our applications are dependent on it, and so we always trying to make using and installing it as easy as possible.  Same with other trusted toolkits like JKI, WireFlow, MGI, and others from LAVA.

 

Again IANAL but I don't know if attributing OpenG as a consortium meets the needs or not.  For now I think that is what I will try doing, but in the back of my mind I'd like to scan installed packages, and generate a license text file.

[ShaunR]

The OpenG Toolkit VIPM package has this license:

 

 

It needs updating (it's missing "2012 James David Powell" ), but it covers the entire toolkit.  Stick that in a TXT file in your installer and your done.

 

Pretty much yes (there are a few other missing too ). Of course JKI could ask their lawyers what they think

 

Just to clarify. BSD is a copy left distribution licence. So, for example, CR components that use them don't need to reproduce the copyrights because VIPM will go and get any dependencies separately. When an end user uses the CR code in their software, then they do have to include the salutation and that is not always clear to some.

 

As for removing attributions. I am against that and I would be against it even if I hadn't supplied one insignificant piece of code. I have other code where I am not required to attribute but do anyway as a mark of respect for those on whose shoulders I stand. It acknowledges the community spirit, effort, hard-work and altruism of the contributors and can be used by less well known programmers to showcase their skills. ("I have had code published in the OpenG toolkit" is a pretty good brownie point in a job interview, is it not?). I fail to comprehend the (mainly companies) that think because something is free in terms of fiat tokens, the contributors time is of no value and is therefore contemptuous and shouldn't be acknowledged.

Edited May 21, 2015 by ShaunR

[Rolf Kalbermatter]

Also not a lawyer.

 

Would you instead be able to assign copyright and disclaimer to members of an "OpenG Group" or similar? That way individual people and time frames need not be called out depending on what dependencies were used.

 

"Copyright 1995-2015 © members of the OpenG Group. All rights reserved."

 

How OpenG handles membership would be a detail that doesn't need to be in the license. Not sure if there's precedent for anything like that. Also not sure how to phrase it such that the group proper isn't claiming the copyright, rather stating individual members of the group take claim.

 

Having a clear attribution/disclaimer statement would go a long way to getting adoption in my book. Part of the problem is indeed there's no easy way to know everyone has been covered, and the inability to provide objective evidence that every claim has been made is part of what prevents me even trying to push something like that through. Yes, I could scrape every front panel and put something similar to what JKI did into my application but there's no way to objectively prove I haven't missed anything.

 

There are other issues though that I really don't want to discuss, but suffice it to say fall into the category of change resistance-- "that's not the way we do things." Things like SOPs/ISOs/WTFs that need to be invoked/consulted/created to release an application containing code under some license. These barriers come from the consumer of the library and I think an author would be hard pressed to do anything to tackle these obstacles. Frankly I don't want to deal with any of it, I just want to create an application that works.

 

While this might be a possible option and is done in other software components to get around the problem of changing authors for different components I do think it is made more complicated by the fact that there would have to be some sort of body that actually incorporates the "OpenG Group". For several open source projects that I know of and which use such a catch all copyright notice, there actually existst some registered non-profit organization under that name that can function as copyright holder umbrella for the project. Just making up an OpenG Group without some organizational entity may legally not be enough. Personally I would be fine with letting my copyright on OpenG components be represented by such an entity.

 

Now, even if such an entity would exist there would be one serious problem at the moment. You can't just declare that any cody provided to OpenG in the past falls under this new regime. Every author would have to be contacted and would have to give his approval to be represented in such a way through the entity. Code from authors who wouldn't give permission or can't be contacted, would need to remain as is or get removed from the next distribution that uses this new copyright notice. And there would need to be some agreement that every new submitter would have to agree too, that any newly submitted code falls under this rule.

 

All in all, it's doable, but quite a bit of work and I'm not sure the OpenG community is still active enough that anyone would really care enough to pick this up.

[mgould2001]

I think I'm more confused about openG licensing than before I read this thread :-).  I hate to be that guy but can anyone, in three sentences or less, describe to me what I need to do to not get sued if I include openG functions in my software?  I would really like to use this in our software, but as a commercial company our lawyers are frightened by the licensing requirements of open source software.  If I could at least understand the minimum requirements we might be able to persuade them otherwise.  I've looked at the openG functions and they look amazing so I'm really excited about using them!

[Rolf Kalbermatter]

I think I'm more confused about openG licensing than before I read this thread :-).  I hate to be that guy but can anyone, in three sentences or less, describe to me what I need to do to not get sued if I include openG functions in my software?  I would really like to use this in our software, but as a commercial company our lawyers are frightened by the licensing requirements of open source software.  If I could at least understand the minimum requirements we might be able to persuade them otherwise.  I've looked at the openG functions and they look amazing so I'm really excited about using them!

 

I'm not a lawyer and as such my advice will definitely not help your company lawyers to think different. But IMHO if you use OpenG functions you simply need to add somewhere in your application or at least your documentation a reference to that fact and with the OpenG BSD style license text. This license text basically means you can not claim to have written those functions yourself and you have no right to sue any OpenG developer in any way if your application causes a nuclear meltdown or similar.

 

Not really that much different to commercial software where you also don't usually get any rights to claim damages if the software doesn't perform as you want.

 

If you use for the license text in your application or documentation the same text as is used by VIPM you should be fairly safe. It contains more or less all people who were at some point substantially active in providing functions to the Toolkit libraries. More than that really isn't there. You can also add a link to the OpenG Toolkit sourceforge site as extra service for anyone who wants to check out where this all comes from.

[hooovahh]

Yeah I'd just look at what VIPM does.  In the about screen they state they use open source software with a link to a license file that mentions OpenG and the other BSD tools used.  I'm not a lawyer but I'm betting JKI either has one, or consulted one when it comes to this topic.

[mgould2001]

I looked at VPIM's openG license and it looks like they credit individual people.  Are these the guys who wrote the specific VI's that JKI used or are they just the guys who made openG?  Do I have to go through every openG VI to figure out if I used a specific persons work and specifically credit them?

[Rolf Kalbermatter]

I looked at VPIM's openG license and it looks like they credit individual people.  Are these the guys who wrote the specific VI's that JKI used or are they just the guys who made openG?  Do I have to go through every openG VI to figure out if I used a specific persons work and specifically credit them?

 

Yes as is mentioned in the post #12 by James David Powell, the VIPM attributes the individual names. The reason being that OpenG started some more than 15 years ago like this and it would be pretty unpractical to get agreement by all authors to change that now, since some might not even be involved in LabVIEW work and impossible to contact anymore. There definitely is nobody who seriously considered to do that so far and I'm not volunteering. 

 

I would guess that VIPM does use most of the OpenG libraries in one way or the other and its license attribution is pretty complete but I can not talk for the VIPM developers nor for JKI and they would really be the more appropriate people to contact about this.

 

One other thing to consider here:

 

If you only use OpenG inside projects that are used inside your company, your company is your own customer and you maintaining the source code of the applications on a company provided source code control system (You do that, right???) does take care of all the license requirements of even more stringent Open Source licenses like GPL. Of course you have to document such use as otherwise an unsuspecting collegue may turn over a built of your application to a contractor or other third party or such and create a license violation in that way.

 

Only when you start to develop applications that your company intends to sell, lend, or otherwise make available to third parties without source code, will you have to seriously consider the various implications of most open source licenses out there, with the BSD license being definitely one of the most lenient licenses out there (with the exception of maybe the WTFPL (Do What the Fuck You Want to Public License), which some lawyers feel is so offending that they dispute the validity of it. And of course there is the Public Domain code but again some lawyers feel that it is impossible to abandon copyright and putting code into Public Domain is an impossibility.

 

Isn't law great and live without lawyers would be so easy? 

[mgould2001]

We've found that our software tools for our manufacturing floor have a habit of being sold by our service department to 3rd party repair centers, so we do care about licensing. Basically it sounds like OpenG is more trouble than it's worth (in our case).