On Tue, May 17, 2005 at 04:14:29PM -0400, Lex Spoon wrote:
> Ross Boylan <RossBoylan at stanfordalumni.org> wrote:
> > On Fri, May 13, 2005 at 03:27:20PM -0400, Lex Spoon wrote:
...
 
> > On whether Cubans have a theoretical problem getting the software, the
> > squeak license includes this clause: 
> > "In particular, but without limitation, the Apple Software
> > may not be exported or reexported (i) into (or to a national or
> > resident of) any U.S. embargoed country or (ii) to anyone on the
> > U.S. Treasury Department's list of Specially Designated Nationals or
> > the U.S. Department of Commerce's Table of Denial Orders."
> 
> 
> I had forgotten the in particular part.  But again, this is extreme
> nitpicking of the legalese.  If there is no restriction in the export
> regs anyway, does this "in particular" apply?  It sounds explanatory to
> me, not an additional regulation on top of whatever the existing US regs
> are.

I agree that the wording sounds as if it's simply attempting to affirm
existing export regulations.  But the restrictions, whatever their
source, clearly are discriminatory.  Your argument appears to be that
anything from the US implicitly carries such a restriction.  That may
be so, though I don't think the regulations you cite further down aim
to cover everything.  They appear to concern military uses, and you
argue that they don't cover free software (with a certain definition
of free).

> 
> For further thought, here it is from the horse's mouth on re-export
> requirements for all goods, regardless of the license used:
> 
> 	http://www.bxa.doc.gov/licensing/ReExportGuidance.htm
> 
> It is things like this that would appear to cause lawyers to put in
> export clauses in their software licenses.  If you don't have such a
> clause, then you run into potential problems with re-export.

The indicated source appears to be limited to "dual use" items that
include potential proliferation or military application.  Of course,
we can all have fun speculating about how wide that category is.  In
computers, I am mostly aware of it applying to strong cryptography and
very powerful computers (some of you may recall Apple's ad a few
years ago with a tank and one of their computers, saying the US
government didn't permit export of either).

Maybe if squeak could be used to power an animotronic army, singing
"It's a small world", it would be considered dual-use.

 
> > I'm not sure where you got the idea that export regulation doesn't
> > apply to stuff that's freely available; 
> 
> Relevant material is listed at the end of this email.  I'm no lawyer,
> but it seems to state it very clearly.
> 
> 
> > at any rate, this clause means that squeak is not freely available.
> 
> No offense, but are you are a lawyer?  
No. But some of my best friends are...
> You are awefully certain here. 
Just taking the words at their ordinary meaning.  If something can't
go to x, y or z, it is not freely available.

> It looks to me like, whatever the restrictions are, they apply equally
> well to anything else originating in the US -- not just Squeak.  The
> presence of the clause doesn't seem to add anything.
> 
> 
> > > > On export restrictions: there are at least two issues.  One is
> > > > self-protection.  If you put something with export restrictions up on
> > > > a server where anyone can get it, you might be in trouble for
> > > > violating the restriction.
> > > 
> > > Talk to a lawyer before you are so sure.
> > 
> > I don't need to talk to a lawyer to be sure I might get in trouble.
> 
> At some point you have to stop being paranoid and take part in
> society. 
> There is nothing riskier about Squeak than using any public software
> from anywhere else.

We have different opinions about the legal risk; it seems clear to me
acceptance of the  license involves assuming additional legal risk.
We probably don't have different opinions about the practical risk;
after all, I'm using it.

> 
> As we tediously poke around the legalese in this discussion, it is
> showing that open-source software is in a bit of a mess in -- at the
> least -- the US and in Europe.  Remember, though, that we have done the
> sensible thing and hired lawyers to deal with this crud.  Apple's
> lawyers were perfectly well aware of this situation--it's their job.

By the "we" who hired the lawyers, do you mean some group other than
Apple (and, presumably, Disney)?
....

> No -- but now you are talking about talk, not about real legal risk.  We
> hired real lawyers and they have clued us in that it is a jungle out
> there.  We should not shoot the messengers and rush to use a flakier
> license.

Same question: what lawyers, hired by whom?  What form does the
clueing in take?
 
> 
> > > IMHO, it would be great if we had extended clauses like
> > > this to protect contributors from more countries.  Even though we don't
> > > *plan* to harm each other, it doesn't hurt to have things in writing. 
> > > (And if anyone *does* plan to do something sneaky and get many of us in
> > > hot water, then they are not playing particularly nice...)
> > > 
> > > 
> > > "Your freedom to swing your fist ends one inch from my nose".  
> 
> Out of curiosity, what do you think of this principle?  Is that not
> enough freedom from a license for you to use it?  Do you think that
> Debian should be insisting on more?
> 
It's a fine principle; the question is about the application.
Footnote: this is not exactly the principle in US law.  "Assault"
would be swinging your fist, or even starting to; "battery" is making
contact.  Both are crimes, though obviously of different severities.
So your freedom to swing your fist ends much further than an inch from
my nose.

> 
> 
> > Now that I look at it, this does *not* say the extent is limited to
> > the extent it is your fault.  
> 
> You skipped half the quote!  Go back and start at TO THE EXTENT IT
> ARISES OUT OF:
Huh?  I quoted the whole thing, including that clause (see below).

My point was precisely that the "extent it arise out of clause" does not
restrict the extent to your responsibility to stuff that's your fault,
as most would interpret it:
"to the extent it arises out of or is connected in any manner with the
operation, use, distribution or modification of Modified Software, or
the combination of Apple Software or Modified Software with other
programs;" not "to the extent it arises out of your actions."

This is not only, "if you insert military grade encryption in the image and
the government comes after us, you are on the hook" but also "if you
redistribute the software, and someone comes after us, you are on the
hook."  On its face, it also seems to mean "if you accept this license
at all, i.e., just use the software, you are on the hook."  I
speculate that this was poor drafting.

I think an analogy would be "by reading this book, you agree that if
someone sues us for libel or copyright infringement, you will
indemnify us."  Operationally, indemnify means "pay".  Not so
reasonable.

> 
> > "You agree to indemnify and hold Apple harmless from any and all
> > damages, liabilities, costs and expenses (including but not limited to
> > attorneys' fees and costs of suit) incurred by Apple as a result of
> > any claim, proceeding, and/or judgment to the extent it arises out
> > of
[Here is where my original quotation had the "to the extent" stuff]
> > or is connected in any manner with the operation, use, distribution or
> > modification of Modified Software, or the combination of Apple
> > Software or Modified Software with other programs"
> 
> 
> 
> > Even if it did (or that's what it
> > means), the meaning would be subject to dispute.  For example, if you
> > put squeak up, unaltered, on a server, and that drew someone's
> > attention to sue Apple for whatever bizarre reason, then Apple could
> > argue that your actions got them in trouble.  I believe this is why
> > Debian doesn't want to be a distributor.
> 
> First, Debian has not made a decision--they descended into a flame war
> and defaulted to doing nothing.  Go read the debian-legal archives if
> you like.
Operationally, the decision was negative.  As far as I know, there was
no formal vote, or even formal decision.

> 
> Aside from that, IMHO this is the way things should be.  If you do
> something that gets someone else sued, then that was not a nice way to
> thank them for giving you stuff for free.  
As I argued above, the clause appears much broader than your
characterization of it in the preceding sentence.

Even if it were more narrowly drawn, asking someone to assume a
special liability seems problematic to me.  There are already legal
mechanisms that allow damaged parties to recover damages; so such a
clause is either vacuous, or it is adding something more.

> In the example you give, it
> sounds like your posting it did not contribute to Apple getting sued, so
> you would not be liable.
The language, and perhaps the intent, are not clear, but that's not
the way it looks to me.

And, again, the situation where you would have to defend against a
certain interpretation, even if you could prevail on the merits, is
not a pleasant one.

> 
> By the way, if you read the whole clause, there are other reasons in the
> indemnification clause to reduce your fear level.  Not your only is
> liability limited "to the extent" of your involvement, but Apple has
> to

My reading is the extent refers rather to Apple's involvement.  If
someone sues them for something not related to squeak, the clause says
you are not on the hook.  Brutally excising most of the words to get
at the core of the sentence, I think it is "You agree to indemnify
... Apple ... from ... damages ... as a result of any claim ... to the
extent it ... is connected ... with the ... use, distribution or
modification of Modified Software".  In other words, "to the extent"
refers to the extent the claim is connected with the squeak software.

> allow you to try the case yourself before they can take any support
> from
If you had ever seen legal bills, as I have, you would not find the
"opportunity" to try the case yourself much of a plus.
> you.  I find it extremely unlikely that Apple will open themselves to
> this risk and this PR problem--and anyway, 
As it is unlikely they would take the bad PR of bringing legal action
against web sites that are run by Apple fans?  (In case the irony is
lost in electronic form, that's exactly what Apple recently did).

> if they ever try it on me I
> will gleefully accept and then go to court saying "I plead that Apple is
> guilty" and go home.
Well, they certainly would have grounds to say you had harmed them if
you did that :)
> 
> 
> 
> > > But if we must
> > > choose among licenses, I am comfortable choosing one that was desiged by
> > > friendly, professional lawyers.
> > 
> > Umh, that would be lawyers looking after Apple's or Disney's interest,
> > not ours or squeak's.
> 
> There's no need to be flippant.  You are surely aware that Squeak was an
> Apple interest at the time, and that these lawyers were acting at the
> behest of Squeak's founders.  That's as friendly--not to mention
> capable--as it gets.
We can speculate about motives.  I'm fairly confident that the lawyers
would see themselves as acting on behalf of Apple, and would seek to
shield Apple from problems as much as possible and put them in the
strongest possible legal position.  That is what they are hired to do,
and it is what their profession teaches them to do.  I'm sorry if I
sounded flippant, but I thought it was obvious that such lawyers were
not operating from the perspective of squeak users, or even the squeak
founders.

> 
> > >  I worry what will happen to projects
> > > using other licenses once the court cases start happening; they have
> > > good hearts, but good hearts are not going to make their flaky licenses
> > > more robust.
> > 
> > At least some of the other licenses have had quite a lot of thought
> > and legal expertise go into them, I believe.  I know the GPL does, and
> > I assume the University of California reviewed the Berkeley license
> > (probably MIT for X as well).
> 
> 
> Attention after the fact, not during the drafting.  The licenses were
> drafted before there was so much attention paid to these licenses. 
> Squeak-L, on the other hand, was drafted by the lawyers of a huge
> company that is based almost entirely on IP.
> 
> 
> I mentioned earlier that the export regs probably don't apply to Squeak
> anyway.  
As noted earlier, they don't seem to apply.  I agree that they appear
to offer a definition of free software different from the one I
suggested above, in which restricting distribution made it not free.

>Here's a web site about US export regulations:
> 
> 	http://www.bxa.doc.gov/

...
> 
> I'm no lawyer, but that seems pretty straightforward.  FYI, the same
> exemption seems to apply to any publically available work--I merely
> quoted the part that talks specifically about open-source software.
> 

Since neither of us are lawyers, and I suspect neither of us is in any
position to do anything about this situation, we've proably pushed
this about as far as is useful. :)

I do wish someone would get this straightened out, though.  Apparently
unlike you, I think there are things in squeak's license that need to
be straightened out, not just in people's reactions to that license.

Ross