License?

[garyemiller]

The LICENSE file says Creative Commons 0 (CC0), which is FOSS.

here: https://github.com/cisagov/Epsilon/blob/develop/LICENSE

But every code file says:

# This (software/technical data) was produced for the U. S. Government
# under Contract Number HSHQDC-14-D-00006, and is subject to
# Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.
# As prescribed in 27.409(b)(1),
# insert the following clause with any appropriate alternates:
#
# Rights in Data-General (Deviation May 2014).
#
# No other use other than that granted to the U. S. Government,
# or to those acting on behalf of the U. S. Government under that Clause is
# authorized without the express written permission of The MITRE Corporation.
#
# For further information, please contact The MITRE Corporation,
# Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539,
# (703) 983-6000.
#
# Copyright 2017 The MITRE Corporation. All Rights Reserved.

Clearly not FOSS.

Like this file:
https://github.com/cisagov/Epsilon/blob/develop/epsilon/buffers.py

I cant ask my FOSS users to each get written permission from MITRE!

So, which is it? Can someone clean this up?

[h-m-f-t]

Hi @garyemiller, thanks for flagging this. We'll tag the right people and try to rectify this discrepancy.

[garyemiller]

While you are at it. Fedora does NOT accept CC0 (CC0-1.0) licensed code. The one in your LICENSE file.

Fedora does accept the CC-PDDC license.

https://docs.fedoraproject.org/en-US/legal/allowed-licenses/

When you get it changed, ensure the right SPDX line is added to every file.

[jsf9k]

Isn't the CC-PDDC deprecated?
https://wiki.creativecommons.org/wiki/PDM_FAQ#What_about_CC.E2.80.99s_Public_Domain_Dedication_and_Certification.3F_Can_that_tool_still_be_used.3F

Also, I see CC0 listed on the Fedora licensing page under "allowed content licenses".

[garyemiller]

I see you are right, I missed that one.

But OSI does not allow CC0-1.0. And CC0-1.0 does not give up patent rights, and this code appears to implement 2 patents:

https://www.mitre.org/our-impact/intellectual-property/gps-spoofing-detection-techniques

Any one that uses this code under CC0-1.0 is still beholden to MITRE on the patents.

[garyemiller]

Ah, I see how I missed it. CC0 as an "Allowed Content License". So OK for "Content", fonts, and such. But not an "Allowed License". so not good for code.

Either way, no good for this code, due to the patent overhang.

[mcdonnnj]

Some thoughts from me:

• How other entities (Fedora, OSI, etc.) feel about the CC0 is not necessarily a decision driver for us. Especially considering this is, to my knowledge, the first project on our GitHub organization where the patent overhang is potentially a problem. As an alternative view there's Debian's thoughts on CC0-style public domain dedications:

  The official viewpoint is that the software must meet the requirements of the DFSG. Generally, a CC0-style PD dedication is viewed as sufficient for all jurisdictions, and can satisfy the DFSG if source is available.

• Depending on the contract that generated the work I see two paths:
  • Although far from ideal, the code base can remain CC0, but any patent concerns would have to be resolved by end users if they do not fall under the umbrella of the original contract's terms.
  • This project could be updated to “CC0 plus patent pledge” to both maintain the public domain dedication and alleviate concerns about patent infringement.

Please see WhiteHouse/source-code-policy#149, WhiteHouse/source-code-policy#209, and the conversations in WhiteHouse/source-code-policy#240 for some background on how we came to use CC0 for our projects.

[garyemiller]

tl:dr: Change the license to an approved one, or don't expect any help from the FOSS community.

How other entities (Fedora, OSI, etc.) feel about the CC0 is not necessarily a decision driver for us.

"What you mean WE, white man?"

Maybe you don't care, but I, as a maintainer of the gpsd project must care. I have been asked to look at using this code in gpsd, and that is just not possible when the code requires patents that are not released to the public domain.

but any patent concerns would have to be resolved by end users

As a volunteer project, with no budget, gpsd is not prepared to take on this task.

This project could be updated to “CC0 plus patent pledge”

Which while technically might be correct, by using a non-standard license, it scares off all FOSS projects. Too much time and money has been spent on patent lawyers, time and money gpsd does not have.

The FOSS community has collectively decided that there are enough approved licences, they will not waste time on un-approved ones.

Please see WhiteHouse/source-code-policy#149, WhiteHouse/source-code-policy#209, and the conversations in WhiteHouse/source-code-policy#240 for some background

I really don't care how we got "here". The world has moved on. I care about the "here" and now. I just know that "here" is unacceptable to the FOSS community. I don't have the the time to change their collectively minds.

[garyemiller]

Also:

Although far from ideal, the code base can remain CC0,

Uh, no, the CODE is clearly labled "Rights in Data-General". The people that posted the code to Github added a CC0 License file. That license is invalid as the copyright holder has not assented.