Some hard numbers on licenses used by elisp packages

Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

Hello,

While the current discussions focus on copyright assignments, I think
it would be a good idea to have some statistics on what licenses are
being used by Emacs packages.

Luckily answering such questions is one of the many use cases of the
Emacsmirror [1], which I maintain.

Here are the licenses used by packages that are available from Melpa:

| License       | Count | Percent |
|---------------+-------+---------|
| GPL-3         |  2268 |      62 |
| GPL-2         |   634 |      17 |
| (unknown)     |   509 |      14 |
| as-is         |   117 |       3 |
| MIT           |    45 |       1 |
| public-domain |    41 |       1 |
| GPL           |    29 |       1 |
| Apache-2.0    |    18 |       0 |
| GPL-1         |     4 |       0 |
| BSD           |     3 |       0 |
| CeCILL-B      |     2 |       0 |
| EPL           |     1 |       0 |
| MS-PL         |     1 |       0 |
|---------------+-------+---------|
| total GPL     |  2935 |      80 |
|---------------+-------+---------|
| total         |  3672 |     100 |

You can find more such tables on [2], along with some notes on how this
information was obtained and more.

[1] https://emacsmirror.net
[2] https://emacsmirror.net/stats/licenses.html

  Best regards,
  Jonas

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

Richard has asked me privately (by accident, I suspect) for some
clarifications.  Many of his questions were already addressed by the
page I linked to, and most others were already answered by the code
that that page in turn linked to.

I have now improved the introductory text on the linked page and I am
including that text here for your convenience:

> This page contains statistics about the licenses used by known Emacs
> packages.  *These statistics are not legal advice.  They are
> distributed in the hope that they will be useful, but WITHOUT ANY
> WARRANTY; without even the implied warranty of MERCHANTABILITY or
> FITNESS FOR A PARTICULAR PURPOSE.*
>
> The information used here is available from the Emacsmirror database
> (also known as the Epkg database).  For more information about the
> Emacsmirror see these [[https://emacsair.me/2016/04/16/re-introducing-the-emacsmirror][blog]] [[https://emacsair.me/2016/05/17/assimilate-emacs-packages-as-git-submodules][posts]].
>
> I have created this page to accompany [[http://lists.gnu.org/archive/html/emacs-devel/2017-07/msg00341.html][this]] conversation on
> ~emacs-devel~.
>
> I will periodically update the these statistics.  If you want to do so
> yourself, then read the relevant documentation.  You may also ask me
> for guidance.
>
> This information is extracted using the function ~elx-license~, which is
> provided by my package [[https://github.com/tarsius/elx][elx]] (~git clone https://github.com/tarsius/elx.git~).
>
> The license is determined from the contents of the "main library" of
> the package alone (the library whose name matches the name of the
> package).  First this function looks for a permission statement for a
> license published by the Free Software Foundation, if any.  If that
> fails, then the value of the "License" header keyword is considered.
> Finally it searches for brief, and potentially ambiguous, permission
> statements for non-FSF licenses.  For FSF licenses a "+" is appended
> if the text "or (at your option) any later version", or similar was
> found.  An effort is made to normalize the returned value.  This
> function also accounts for some commonly used variations in wording,
> typos, and other complications.
>
> However the returned value is sometimes false or ambiguous.  In
> particular note that if a license is "unknown", then that merely means
> that it is /not known/ what license applies.  This may be because the
> library lacks a permission statement altogether (possibly because an
> accompanying ~LICENSE~ file is considered sufficient by the upstream),
> but it may also be because ~elx-license~ does not attempt to detect the
> used non-standard and/or non-fsf permission statement, or because of
> typos in the statement, or for a number of other reasons.

I have also improved the code used to extract this information and made
a new `elx' release.  This is the relevant code, including doc-strings:

> (defconst elx-gnu-permission-statement-regexp
>   (replace-regexp-in-string
>    "\s" "[\s\t\n;]+"
>    ;; is free software[.,:;]? \
>    ;; you can redistribute it and/or modify it under the terms of the \
>    "\
> GNU \\(?1:Lesser \\| Library \\|Affero \\|Free \\)?\
> General Public Licen[sc]e[.,:;]? \
> \\(?:as published by the \\(?:Free Software Foundation\\|FSF\\)[.,:;]? \\)?\
> \\(?:either \\)?\
> \\(?:GPL \\)?\
> version \\(?2:[0-9.]*[0-9]\\)[.,:;]?\
> \\(?: of the Licen[sc]e[.,:;]?\\)?\
> \\(?3: or \\(?:(at your option) \\)?any later version\\)?"))
>
> (defconst elx-gnu-license-keyword-regexp "\
> \\(?:GNU \\(?1:Lesser \\| Library \\|Affero \\|Free \\)? General Public Licen[sc]e\
> \\|\\(?4:[laf]?gpl\\)[- ]?\
> \\)\
> \\(?:\\(?:v\\|version \\)?\\(?2:[0-9.]*[0-9]\\)\\)?\
> \\(?3: or \\(?:(at your option) \\)?\\(?:any \\)?later\\(?: version\\)?\\)?")
>
> (defconst elx-non-gnu-license-keyword-alist
>   '(("Apache-2.0"    .  "apache-2\\.0")
>     ("MIT"           .  "mit")
>     ("as-is"         .  "as-?is")
>     ("public-domain" . "public[- ]domain")))
>
> (defconst elx-non-gnu-license-keyword-regexp "\
> \\`\\(?4:[a-z]+\\)\\(?:\\(?:v\\|version \\)?\\(?2:[0-9.]*[0-9]\\)\\)?\\'")
>
> (defconst elx-non-gnu-permission-statement-alist
>   `(("Apache-2.0"    . "^;.* Apache License, Version 2\\.0")
>     ("MIT"           . "^;.* mit license")
>     ("public-domain" . "^;.*in\\(to\\)? the public[- ]domain")
>     ("public-domain" . "^;+ +Public domain\\.")
>     ("as-is"         . "^;.* \\(provided\\|distributed\\) \
> \\(by the author \\)?[\"`']\\{0,2\\}as[- ]is[\"`']\\{0,2\\}")))
>
> (defun elx-license (&optional file)
>   "Attempt to return the license used for the file FILE.
> Or the license used for the file that is being visited in the
> current buffer if FILE is nil.
>
> *** A value is returned in the hope that it will be useful, but
> *** WITHOUT ANY WARRANTY; without even the implied warranty of
> *** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
>
> This function completely ignores and \"LICENSE\" or similar file
> in the proximity of FILE.  The returned value is solely based on
> the contents of FILE itself.
>
> The license is determined from the permission statement, if any.
> Otherwise the value of the \"License\" header keyword is
> considered.  An effort is made to normalize the returned value.
>
> *** However this function does not always return the correct
> *** value and the returned value is not legal advice.
>
> Note in particular that if this function returns nil, then that
> merely merely means that it is not known what license applies.
> This may be because the library lacks a permission statement
> altogether (possibly because an accompanying \"LICENSE\" file
> is considered sufficient by the upstream), but it may also be
> because this function does not attempt to detect the used
> non-standard and/or non-fsf permission statement, or because
> of typos in the statement, or for a number of other reasons."
>   (lm-with-file file
>     (cl-flet ((format-gnu-abbrev
>                (&optional object)
>                (let ((abbrev  (match-string 1 object))
>                      (version (match-string 2 object))
>                      (later   (match-string 3 object))
>                      (prefix  (match-string 4 object)))
>                  (concat (if prefix
>                              (upcase prefix)
>                            (pcase abbrev
>                              ("Lesser "  "LGPL")
>                              ("Library " "LGBL")
>                              ("Affero "  "AGPL")
>                              ("Free "    "FDL")
>                              (`nil       "GPL")))
>                          (and version (concat "-" version))
>                          (and later "+")))))
>       (let ((bound (lm-code-start))
>             (case-fold-search t))
>         (or (and (re-search-forward elx-gnu-permission-statement-regexp bound t)
>                  (format-gnu-abbrev))
>             (-when-let (license (lm-header "Licen[sc]e"))
>               (or (and (string-match elx-gnu-license-keyword-regexp license)
>                        (format-gnu-abbrev license))
>                   (car (cl-find-if (pcase-lambda (`(,_ . ,re))
>                                      (string-match re license))
>                                    elx-non-gnu-license-keyword-alist))
>                   (and (string-match elx-non-gnu-license-keyword-regexp license)
>                        (format-gnu-abbrev license))))
>             (and (re-search-forward
>                   "^;\\{1,4\\} Licensed under the same terms as Emacs" bound t)
>                  "GPL-3+")
>             (and ;; Some libraries are releases "under the *GPL and
>                  ;; "<other license>", while the GPL is mentioned in
>                  ;; a way the above code does not recognize.  Return
>                  ;; nil instead of "<other license>" in such cases.
>                  (not (re-search-forward elx-gnu-license-keyword-regexp bound t))
>                  (car (cl-find-if (pcase-lambda (`(,_ . ,re))
>                                     (re-search-forward re bound t))
>                                   elx-non-gnu-permission-statement-alist))))))))

Note that this function now returns e.g. "GPL-3+" if the "or (at your
option) any later version" pattern was detected.  I also made some other
changes to avoid false-positives (which comes at the cost of also no
longer matching some patterns that were previously matched correctly).

I can provide lists of packages that fall into a particular "category".
These lists can contain the names and email addresses of the maintainer,
links to the homepage and repository and many other things you might
find useful.

I would also be willing to contribute this code to the `lisp-mnt.el'
library, which is part of Emacs.  It certainly could still be improved
a lot, but it is a start.

Oh, and I almost forgot - here is an updated table:

| License       | Count | Percent |
|---------------+-------+---------|
| GPL-3+        |  2230 |      61 |
| GPL-2+        |   611 |      17 |
| (unknown)     |   511 |      14 |
| as-is         |    91 |       2 |
| MIT           |    70 |       2 |
| public-domain |    52 |       1 |
| GPL-3         |    41 |       1 |
| GPL-2         |    31 |       1 |
| Apache-2.0    |    18 |       0 |
| GPL-1+        |     4 |       0 |
| BSD           |     3 |       0 |
| GPL           |     2 |       0 |
| LGPL          |     2 |       0 |
| AGPL-3        |     1 |       0 |
| AGPL-3+       |     1 |       0 |
| BSD-3         |     1 |       0 |
| EPL           |     1 |       0 |
| LGPL-3+       |     1 |       0 |
| LGPL-3.0      |     1 |       0 |
|---------------+-------+---------|
| total GNU     |  2925 |      80 |
|---------------+-------+---------|
| total         |  3672 |     100 |

And to briefly answer the post questions:

>   > | (unknown)     |   509 |      14 |
>
> Could you explain what "unknown" means?  If a program
> does not explicitly state a license, it is proprietary.

Either the license was not specified OR the code was unable to find
the permission statement, which actually is present.

>   > | as-is         |   117 |       3 |
>
> Could you tell me what "as-is" means, here?  Is "as-is" meant to
> identify a speciic license?  If so, could you please show it to me?  I
> need to determine whether it is a free license and GPL-compatible.

Essentially the string "as-is" was found in the header.  I do agree
that this is ambiguous and problematic, but I decided to provide
this information anyway, because it is at least less ambiguous than
"unknown".

>   > | MIT           |    45 |       1 |
>
> "MIT" as the name of a license is ambiguous; see

Merely reporting that the string "MIT license" was found.

>   > | GPL           |    29 |       1 |
>
> What does that mean, concretely?
> Do these packages say, "any version of the GNU GPL"?
> That would be peculiar but not a substantive problem.
>
>   > | GPL-1         |     4 |       0 |
>
> Do these packages carry "GPL version 1 only"
> or "GPL version 1 or later"?

This has been improved now:

* "GPL"     => the GPL was mentioned, no version was mention
               (or possibly was just not detected)
* "GPL-N"   => the GPL and version N were mentioned
* "GPL-N+"  => ... additionally "or (at your opinion) any later version"
               was found (or a variation thereof).

>   > | EPL           |     1 |       0 |
>
> Does that mean the Eclipse Public License?

My guess is as good as yours; the string ";; License: EPL" was found.

  Best regards,
  Jonas

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  >   This may be because the
  > > library lacks a permission statement altogether (possibly because an
  > > accompanying ~LICENSE~ file is considered sufficient by the upstream),

  > > but it may also be because ~elx-license~ does not attempt to detect the
  > > used non-standard and/or non-fsf permission statement, or because of
  > > typos in the statement, or for a number of other reasons.

We need to get a handle on what is really going on for these cases.
A typo in a license notice, or an unusual license, might not be a real
problem.  The lack of a clearly stated free license is a real problem,
and the mere possibility that someone stated a license for it
in some other site is not enough to make the problem go away.

We need to find out what is going on in those 500 packages.

One useful way to investigate would be to pick 10 of those packages,
and see what is the situation with each of them.

Would someone please volunteer to do this?

  > > Does that mean the Eclipse Public License?

  > My guess is as good as yours; the string ";; License: EPL" was found.

Could someone please check for certain?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

Richard Stallman <rms@gnu.org> writes:
>   > > This may be because the
>   > > library lacks a permission statement altogether (possibly because an
>   > > accompanying ~LICENSE~ file is considered sufficient by the upstream),
>
>   > > but it may also be because ~elx-license~ does not attempt to detect the
>   > > used non-standard and/or non-fsf permission statement, or because of
>   > > typos in the statement, or for a number of other reasons.
>
> We need to get a handle on what is really going on for these cases.
> A typo in a license notice, or an unusual license, might not be a real
> problem.  The lack of a clearly stated free license is a real problem,
> and the mere possibility that someone stated a license for it
> in some other site is not enough to make the problem go away.
>
> We need to find out what is going on in those 500 packages.
>
> One useful way to investigate would be to pick 10 of those packages,
> and see what is the situation with each of them.
>
> Would someone please volunteer to do this?

Once you have found someone to do this, s/he should contact me and I
will provide the necessary data and/or help that person get started
using my tools themselve.  Using those tools instead of just relying
on a data dump would actually make the process easier.  But currently
the usage instructions are spread across multiple manual, blog posts,
and repositories, so some guidance by me might be necessary to get
started.

The process could then be something like
1. emacs ~/code/epkg-stats/licenses-extras.org
2. emacs ~/code/emacsmirror/mirror/<package>/<package>.el
3. emacs ~/.emacs.d/lib/elx/elx.el # refine and add regexps
4. M-: (elx-license)               # in <package>.el
   unless satisfied, goto 3
5. M-x emir-recreate-packages      # *
6. C-c C-v C-b                     # in licenses-extras.org
7. M-x magit-diff-unstaged
8. goto 1

* Doesn't actually exist right now, you need to use
  emir-update-packages, with the irrelevant parts
  commented out.  Even then, this takes a few minutes.

  Jonas

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Jonas Bernoulli writes:
> Richard Stallman <rms@gnu.org> writes:
[..]
> > We need to find out what is going on in those 500 packages.
> >
> > One useful way to investigate would be to pick 10 of those packages,
> > and see what is the situation with each of them.
> >
> > Would someone please volunteer to do this?
>
> Once you have found someone to do this, s/he should contact me and I
> will provide the necessary data and/or help that person get started
> using my tools themselve.  Using those tools instead of just relying
> on a data dump would actually make the process easier. [...]

Getting it into elx-license in source code format is of course great but I
would start with just looking at a few packages as suggested to find out if
there is an overall picture, if there is any new license patterns to grep for
so to speak.

I'm initializing/updating the epkgs/mirror now so if you could provide me with
a list of the interesting packages it would be most helpful and speed things
up.

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

500 (roughly) packages is a lot of packages, and checking them by hand
would be a fair amount of work.  The only way to check so many packages
efficiently is with tools.

But we don't need to study 500 packages to understand the _general
causes_ for which packages show up as "unlicensed".

I propose that people pick 10 of these packages, perhaps randomly, and
study each of the 10 by hand.  Does it have any license that the
existing tools did not notice?  If so, is there a way to fix them to
notice that license?  Was it a typo in the licence notice?

Or was that package simply published with no license?

10 packages is a much smaller task.  Small enough, I think, that there
is no need to worry about making any special tools.  It's enough to
look at the source files.

Once we understand what KINDS of problems appear among these
"unlicensed" packages, I expect it will be clear what questions to
pose for the other 500 or so "unlicensed" packages, and easy enough to
write automatic tools to characterize almost all of them.

Wha do you think of this approach?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Jean-Christophe Helary]

> On Jul 16, 2017, at 10:55, Richard Stallman <rms@gnu.org> wrote:
> 
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
> 
> 500 (roughly) packages is a lot of packages, and checking them by hand
> would be a fair amount of work.  The only way to check so many packages
> efficiently is with tools.
> 
> But we don't need to study 500 packages to understand the _general
> causes_ for which packages show up as "unlicensed".
> 
> I propose that people pick 10 of these packages, perhaps randomly, and
> study each of the 10 by hand.  Does it have any license that the
> existing tools did not notice?  If so, is there a way to fix them to
> notice that license?  Was it a typo in the licence notice?
> 
> Or was that package simply published with no license?
> 
> 10 packages is a much smaller task.  Small enough, I think, that there
> is no need to worry about making any special tools.  It's enough to
> look at the source files.
> 
> Once we understand what KINDS of problems appear among these
> "unlicensed" packages, I expect it will be clear what questions to
> pose for the other 500 or so "unlicensed" packages, and easy enough to
> write automatic tools to characterize almost all of them.
> 
> Wha do you think of this approach?

That's an easy and useful task that can be handled by beginning contributors. Could experienced people provide the list of packages 500+ that we need to pick 10 from ?

Jean-Christophe 

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

I have looked at some files and made some improvements.  We are now down
to roughly 200 packages that still need to be checked.

| License       | Count | Percent |
|---------------+-------+---------|
| GPL-3+        |  2247 |      61 |
| GPL-2+        |   614 |      17 |
| (unknown)     |   209 |       6 |
| MIT           |   169 |       5 |
| GPL-3         |    99 |       3 |
| as-is         |    72 |       2 |
| (pending)     |    66 |       2 |
| BSD-2-clause  |    43 |       1 |
| GPL-2         |    41 |       1 |
| unlicense     |    30 |       1 |
| Apache-2.0    |    24 |       1 |
| public-domain |    23 |       1 |
| BSD-3-clause  |    17 |       0 |
| WTFPL         |     9 |       0 |
| GPL-1+        |     4 |       0 |
| BSD           |     3 |       0 |
| GPL           |     2 |       0 |
| ISC           |     2 |       0 |
| LGPL          |     2 |       0 |
| AGPL-3        |     1 |       0 |
| AGPL-3+       |     1 |       0 |
| Artistic-2.0  |     1 |       0 |
| BSD-3         |     1 |       0 |
| EPL           |     1 |       0 |
| EPL-1.0       |     1 |       0 |
| LGPL-3        |     1 |       0 |
| LGPL-3+       |     1 |       0 |
| LGPL-3.0      |     1 |       0 |
| MPL-2         |     1 |       0 |
|---------------+-------+---------|
| total GNU     |  3014 |      82 |
|---------------+-------+---------|
| total         |  3686 |     100 |

Well not quite the 66 "pending" packages also have "unknown" licenses,
bit in those cases I have already contacted the maintainers.

There are a few additional ambiguous and/or otherwise problematic
licenses showing up now, but I would suggest that we concentrate on
getting the number of packages with unknown licenses down, before we
tackle those.

  Richard Stallman said:
> I propose that people pick 10 of these packages, perhaps randomly, and
> study each of the 10 by hand. [...] 10 packages is a much smaller
> task.  Small enough, I think, that there is no need to worry about
> making any special tools.  It's enough to look at the source
> files. [...]  Wha do you think of this approach?

Of course that helps, and since some people have offered to help with
that, I have now created a list of the remaining packages.  There is now
a new file, licenses-details.org in the epkg-reports [1] repository that
contains just that.

It would however be nice if the people who look into this would also
contact some authors to encourage them to properly license their code.

  Jonas

[1]: git clone https://github.com/emacsmirror/epkg-reports.git

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Jonas Bernoulli writes:

> [...] since some people have offered to help with that, I have now created a
> list of the remaining packages.  There is now a new file,
> licenses-details.org in the epkg-reports [1] repository that contains just
> that.

Thanks. Just what I need. Picking the first ten of that list gives:

achievements	No license    
gap-mode	No license    
ttl-mode	Two-clause BSD licence
riscv-mode	README.md says GPLv3+ but source file lacks license information
zig-mode	No license
airline-themes	No license    
ghc	        According to LICENSE file: AGPL3 but files with BSD3 exists
darkane-theme	No license
kpm-list	Home made license!?
google-this	Incomplete GPL license

From this it looks like manually going through the packages could be the only
way.

Maybe greping through all files in a package looking for the absence of
strings like gpl or license could spot many of the "No license" cases.

> It would however be nice if the people who look into this would also
> contact some authors to encourage them to properly license their code.

Or we could do a centralized effort when we have classified all packages?

What is the motivating factor for the authors who have not assigned any
license to their package? That open source software should be covered bye one
clearly stated open source license?

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Mats Lidell writes:
> Thanks. Just what I need. Picking the first ten of that list gives:

Picked ten more:

ruby-dev          No license
zerodark-theme    Creative Commons Attribution-ShareAlike 4.0 International License.
erc-view-log      "Do What The Fuck You Want To Public License, Version 2, as published by Sam Hocevar"
omnisharp         No license
nyan-prompt       "Copying is an act of Love, please copy."
password-vault    "Copying is an act of Love, please copy."
iasm-mode         BSD 2-clause "Simplified" License (Only in LICENSE file)
refheap           No license
zonokai-theme     GPLv3+ (Not found by elx-license because main file is called zonkai.el!?)
reverse-im        No license

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Thanks for checking 10 packages.  Your report makes the issue
completely clear.

This one package might actually be ok.

  > ttl-mode	Two-clause BSD licence

Is the license properly applied?  If so, I guess the license-checking
scripts should be fixed to take notice of it.

The rest are all real problems of greater or lesser severity.

  > achievements	No license    
  > gap-mode	No license    
  > riscv-mode	README.md says GPLv3+ but source file lacks license information
  > zig-mode	No license
  > airline-themes	No license    
  > ghc	        According to LICENSE file: AGPL3 but files with BSD3 exists
  > darkane-theme	No license
  > kpm-list	Home made license!?
  > google-this	Incomplete GPL license

For the moment, I don't think I need any more information about the
other packages.  The overall outlines of the problem are clear enough,
and one package more or less in each category won't change it much.

I will study the right way to address the situation.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > > It would however be nice if the people who look into this would also
  > > contact some authors to encourage them to properly license their code.

  > Or we could do a centralized effort when we have classified all packages?

By its nature, it is a matter of talking with developers for one
package at a time.  Thus, I don't see that it makes much difference
how we organize it or schedule it.

What could make a big difference is to find someone particularly good
at talking with people tactfully.  Alas, that's not our forte.  I will
look for someone to do this.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > What is the motivating factor for the authors who have not assigned any
  > license to their package? That open source software should be covered bye one
  > clearly stated open source license?

I suspect part of the cause is the influence of the "open source"
idea.

In the free software movement, the point a free program is to give
users freedom.  The license is what gives users that freedom, so the
choice of the best free license is a very important question, and
applying the license properly is crucial.

The "open source" idea tends to make "good code" the highest value,
and treats "giving users freedom" as secondary.  While the original
leaders of open source treated licenses as important, the ideas have
evolved over the last ten years to dismiss licenses as a minor detail.

Under the malign influence of GitHub, developers often don't bother to
put on a license.  This means the program is not free software (nor
open source either).

https://gnu.org/philosophy/open-source-misses-the-point.html explains
the difference between free software and open source, especially at
the level of ideas.

This is part of why, in the GNU Project, we never use the term "open
source" to describe what we are doing.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> Under the malign influence of GitHub, developers often don't bother to
> put on a license.  This means the program is not free software (nor
> open source either).

Maybe we need to ask the authors why the decided to do as they did?

If I remember correctly, most of the "No license" packages I looked at were
really small consisting of just one file and that that file too was rather
small. I can, in my fantasies, come up with a number of possible reasons why
the author of such a package would skip the licensing but why guess, lets ask
them!?

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > Maybe we need to ask the authors why the decided to do as they did?

If you would like to do it, please give it a try.
I'd be interesting to hear what you find.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

Hi,

> Richard Stallman writes:
> If you would like to do it, please give it a try.
> I'd be interesting to hear what you find.

Of the packages I checked there were six that had no license. I tried to
contact the authors or teams and this is the result:

  - Two had no easy to find contact info so I gave up on contacting them.
  - Still waiting for a reply from one author.
  - One author had unfortunately died.
  - One reply was: "Oh, I haven't thought about it. Is it a problem?".
  - One reply pointed out that the string GPLv3 is in the main file in the
    copyright line(!) and with the belief that this would be enough.

So the two answers I got sound to me like the authors are neglecting the
license issue but that there is likely good intentions and willingness to fix
the problem (maybe after getting some advice on how to do that.)

Not much of statistics but it is what it is!

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Mats Lidell writes:
> Of the packages I checked there were six that had no license. I tried to
> contact the authors or teams and this is the result:

I received two more replies to add to the ones reported before which in my
words or interpretation can be phrased like this:

 - Hacking for fun and see not value in adding a license
 - Forking some other work, which lacks a license, so adding one does not feel
   ethical

I don't expect that I will be getting more answers now unless I start asking
more projects. Is the info I have received useful? Where do we go from here?

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

   > - Hacking for fun and see not value in adding a license

Where was that package originally posted?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> Where was that package originally posted?

I'm not sure what package you mean. Are you referring to the package that was
forked or the package created for fun?

In the case of the forked package does that really matter where that source
came from if it is not licensed according to the book?

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > > Richard Stallman writes:
  > > Where was that package originally posted?

  > I'm not sure what package you mean. Are you referring to the package that was
  > forked or the package created for fun?

I meant the earlier version, which was later forked.

  > In the case of the forked package does that really matter where that source
  > came from if it is not licensed according to the book?

It doesn't matter legally, but I'm hoping to better understand the
chain of events.  This will help for that.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> It doesn't matter legally, but I'm hoping to better understand the
> chain of events.  This will help for that.

I was curious about it too so I asked the author a few days ago but I have not
received any response.

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Ivan Andrus]

[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]

On Jul 29, 2017, at 1:09 PM, Richard Stallman <rms@gnu.org> wrote:
> 
>>> Richard Stallman writes:
>>> Where was that package originally posted?
> 
>> I'm not sure what package you mean. Are you referring to the package that was
>> forked or the package created for fun?
> 
> I meant the earlier version, which was later forked.

I found it here: https://www.gap-system.org/Packages/Contrib/emacs.html <https://www.gap-system.org/Packages/Contrib/emacs.html>
Which is to say, as a file uploaded to the GAP website (for which it is a major-mode).
That page contains a pointer to a patch adding font-lock support, as well as to my version.

>> In the case of the forked package does that really matter where that source
>> came from if it is not licensed according to the book?
> 
> It doesn't matter legally, but I'm hoping to better understand the
> chain of events.  This will help for that.

I forked it in 2010, so I don't remember many of the details, but I know that I did search for the author and couldn't find him.

-Ivan

[-- Attachment #2: Type: text/html, Size: 1952 bytes --]

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > I found it here: https://www.gap-system.org/Packages/Contrib/emacs.html <https://www.gap-system.org/Packages/Contrib/emacs.html>
  > Which is to say, as a file uploaded to the GAP website (for which it is a major-mode).

What is the GAP system?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Achim Gratz]

Richard Stallman writes:
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > I found it here: https://www.gap-system.org/Packages/Contrib/emacs.html <https://www.gap-system.org/Packages/Contrib/emacs.html>
>   > Which is to say, as a file uploaded to the GAP website (for which it is a major-mode).
>
> What is the GAP system?

It's a computational algebra / group theory system, complete with
libraries, data structures, foreign language bindings and their own
programming language.  From their homepage:

--8<---------------cut here---------------start------------->8---
What is GAP?

GAP is a system for computational discrete algebra, with particular
emphasis on Computational Group Theory. GAP provides a programming
language, a library of thousands of functions implementing algebraic
algorithms written in the GAP language as well as large data libraries
of algebraic objects. See also the overview and the description of the
mathematical capabilities. GAP is used in research and teaching for
studying groups and their representations, rings, vector spaces,
algebras, combinatorial structures, and more. The system, including
source, is distributed freely. You can study and easily modify or extend
it for your special use.

In July 2008, GAP was awarded the ACM/SIGSAM Richard Dimick Jenks
Memorial Prize for Excellence in Software Engineering applied to
Computer Algebra.
--8<---------------cut here---------------end--------------->8---


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Waldorf MIDI Implementation & additional documentation:
http://Synth.Stromeko.net/Downloads.html#WaldorfDocs

Re: Some hard numbers on licenses used by elisp packages

[Ivan Andrus]

> On Jul 30, 2017, at 6:46 PM, Richard Stallman <rms@gnu.org> wrote:
> 
> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
> 
>> I found it here: https://www.gap-system.org/Packages/Contrib/emacs.html <https://www.gap-system.org/Packages/Contrib/emacs.html>
>> Which is to say, as a file uploaded to the GAP website (for which it is a major-mode).
> 
> What is the GAP system?

It stands for Groups, Algebras, and Programming.  It's a programming language and REPL for working with groups, algebras and other areas of abstract algebra.

-Ivan 

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

    > - One author had unfortunately died.

How useful is that package?  It may be possible to find the person's
heirs.  It would be some work, though.  How much work would that
package be worth?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> How useful is that package?

[1]

Pragmatically I would say that small packages, like this, generally would not
be that useful. But again for a few users it could be a very useful
package. Who can tell or judge that?

> It may be possible to find the person's heirs.  It would be some work,
> though.  How much work would that package be worth?

In this case it might be possible to find the heirs but generally I suspect
that can be very difficult if not impossible. So for a small package I suspect
that it is easier to give it a new implementation. But theoretically that will
not solve the issue I guess since the new implementation would not really
replace the old one so that would still be around.

These are the tricky questions you wind up in when there is no license and I
don't know the proper way out of it if there is any. I suspect at some distant
time in the future an unmaintained package will break and will be removed for
that reason.

Yours Mats

Footnotes: [1] This is my investigation about the author. The package is
https://github.com/Raynes/refheap.el. When the authors email given at github
did not work I search the net to find this
article. https://www.facebook.com/lancepantz/posts/10104155686547809?pnref=story
Which links to the memory page of Anthony Grimes. The github profile picture
is there and the authors interest in clojure indicates a match.

Re: Some hard numbers on licenses used by elisp packages

[Stefan Monnier]

> These are the tricky questions you wind up in when there is no license and I
> don't know the proper way out of it if there is any.

Easy: wait 75 years (plus the extra extensions Disney will get during
that time), after which it falls into the public domain and Bob's
your uncle.

See, wasn't that hard, was it?


        Stefan

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > Easy: wait 75 years (plus the extra extensions Disney will get during
  > that time), after which it falls into the public domain and Bob's
  > your uncle.

Alas, the required waiting period is even more than that.

For individual authors, you have to wait until 70 years after the
author's death.  That could be 120 years from now, or more.
And if the human life span is extended, it could be hundreds of years.

If it is a work made for hire, you only have to wait 95 years
in the US.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Stefan Monnier]

>> Easy: wait 75 years (plus the extra extensions Disney will get during
>> that time), after which it falls into the public domain and Bob's
>> your uncle.
> Alas, the required waiting period is even more than that.
> For individual authors, you have to wait until 70 years after the
> author's death.

AFAIK the question was in the case the author is already dead.
So I stand corrected: it's not even 75 years, but only a mere 70 years
(plus the extra extensions Disney will get during that time).


        Stefan

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

> Under the malign influence of GitHub, developers often don't bother to
> put on a license.  This means the program is not free software (nor
> open source either).

Github actively encourages users to specify the license.  (Yes, they
suggest free software as well as open source licenses.)

Also I am under the impression that things are getting better, not
worse.  A higher percentage of new packages specify a license than in
the old days.  The following potential reasons for this come to mind:
Packages get more exposure now (thanks to Github and even more
importantly Melpa), so their authors make a bigger up front effort to
do things the right way.  If they don't do so initially, then it is now
much easier to contact them and ask them to do it.  People like Steve
Purcell and me have contacted hundreds and hundreds of authors over the
course of many years encouraging and helping them to improve their
packages.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

I wrote

> Under the malign influence of GitHub, developers often don't bother to
> put on a license.

You responded

  > Github actively encourages users to specify the license.

which appears to disagree.  However,there is no conflict between what
you report and what I wrote.  They appear to conflict, but they really
don't conflict.

You report what GitHub says NOW.  That is a change Github made in
response to the failing grade we gave GitHub two years ago in
https://gnu.org/software/repo-criteria.html.

The change was an improvement, but it doesn't erase the past.
GitHub operated for many years presenting "no license" as a fine
alternative.

Thus, I stand by what I wrote.  During those years, GitHub spread a
malign influence against putting on a license.  The effects continue
to spread among the users.

Should we forgive GitHub for the past harm?  That depends on how hard
GitHub works now to correct the past harm.

I don't remember the specifics of what GitHub says now -- I saw it
over a year ago.  ISTR it was not a strong and firm policy, and I was
disappointed.  It was less bad, but not very good.  You described it
with the word "encourages", which also suggests it is not strong and
firm.

A weak policy will not suffice, in practice, to undo the past harm.

A strong and firm policy would mean telling all the users: "Warning:
if a source file has no license, you are not authorized to copy it or
redistribute it, let alone change it."  And then saying, "Upload of
software source files not carrying a clear license is not permitted --
don't do it here!"

If GitHub did that, the FSF would welcome its efforts to undo the past
harm, and would no longer blame present-day GitHub for it.  (Our other
criticisms of GitHub, on other issues, would remain active.)

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

> However,there is no conflict between what you report and what I wrote.

Yes I agree.  I just wanted to point out that they are now making some
effort, in case you were not aware of that.

> A strong and firm policy would mean telling all the users: "Warning:

That would indeed be nice.  Meanwhile I will inspect new Emacs packages
and ask for a license to be specified if I cannot find any, just like I
am already doing for packages that have issues regarding the features
they provide and require.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > Also I am under the impression that things are getting better, not
  > worse.  A higher percentage of new packages specify a license than in
  > the old days.

This might be very significant.  Would you like to describe the
comparison more precisely?

For instance, what is the pool of packages you're analyzing?  All
packages in GitHub?  All Emacs packages?  Something else?

What time periods did you use for analysis, for each time period, what
was the fraction with licenses?

  >   People like Steve
  > Purcell and me have contacted hundreds and hundreds of authors over the
  > course of many years encouraging and helping them to improve their
  > packages.

Thank you very much.  It's possible that your efforts are responsible
for the improvement, if it is in Emacs packages.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

Richard Stallman <rms@gnu.org> writes:
>   > Also I am under the impression that things are getting better, not
>   > worse.  A higher percentage of new packages specify a license than in
>   > the old days.
>
> This might be very significant.  Would you like to describe the
> comparison more precisely?
>
> For instance, what is the pool of packages you're analyzing?  All
> packages in GitHub?  All Emacs packages?  Something else?

All Emacs packages known to me.

> What time periods did you use for analysis, for each time period, what
> was the fraction with licenses?

I didn't say "analyse" but "impression" ;-)

While I do intend to thoroughly analyse the data in the future, I don't
currently have the time to do that.  I am quite busy improving the
*current* licensing situation by contacting authors.  Once that is fully
on track, I can concentrate on other important things again, like
talking to you about including Magit it in Elpa for example.  And then I
also have some priorities of my own.

> Thank you very much.  It's possible that your efforts are responsible
> for the improvement, if it is in Emacs packages.

You are welcome!

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > While I do intend to thoroughly analyse the data in the future, I don't
  > currently have the time to do that.

I'm using the word "analyze" in a broader sense.  Your report
represents a kind of analysis -- I just wanted to know the what you
checked for, etc.  Now I know.

Thanks.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Can you tell me where to find the list of license-checking results,
per package?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Karl Fogel]

Jonas Bernoulli <jonas@bernoul.li> writes:
>Github actively encourages users to specify the license.  (Yes, they
>suggest free software as well as open source licenses.)

There's a difference?

If you're thinking that "free software" == "copyleft" and "open source" == "non-copyleft", that's actually not the case.  For example, the GPL is both a free software and an open source license, and the same is true of (say) the MIT license.

This FAQ item at the OSI explains this in more detail: https://opensource.org/faq#free-software.  (I believe that FAQ entry explains it in such a way that the FSF would agree with the facts & history as presented there, although perhaps not with the philosophical equivalence implied.)

I completely agree with you that GitHub now actively encourages people to apply a free software license when publishing their code.  GitHub does this both via UI nudges and via their public posts and comments on the topic (see https://help.github.com/articles/licensing-a-repository/ for example).

-Karl

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > >Github actively encourages users to specify the license.  (Yes, they
  > >suggest free software as well as open source licenses.)

  > There's a difference?

Yes, there is a practical difference.

  > If you're thinking that "free software" == "copyleft" and "open
  > source" == "non-copyleft", that's actually not the case.  For
  > example, the GPL is both a free software and an open source
  > license, and the same is true of (say) the MIT license.

That is correct.  However, there is a between open source licenses and
free licenses -- in a different area.  A few open source programs use
licenses which are too restrictive to qualify as free.

Fortunately the number of those programs seems to be small.
I think that over 99% of all open source source programs are free.

https://gnu.org/philosophy/open-source-misses-the-point.html gives
a full explanation.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > This FAQ item at the OSI explains this in more detail:
  > https://opensource.org/faq#free-software.

What that says is not correct: open source and free software are not
equal as subsets of software.  There are a few programs whose source
code qualifies as open but not free.

In addition, tivoized executables made from free software source code
are nonfree even if the source code is free.  Many Android devices
contain tivoized executables of Linux, for instance.

https://gnu.org/philosophy/open-source-misses-the-point.html
explains all of this carefully.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > I have looked at some files and made some improvements.  We are now down
  > to roughly 200 packages that still need to be checked.

That's much better than it previously appeared.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

>   > I have looked at some files and made some improvements.  We are now down
>   > to roughly 200 packages that still need to be checked.
>
> That's much better than it previously appeared.

And it is getting better.  Patience seems like the best strategy right
now.

* I have improved the heuristics etc.  More licenses and permission
  statements are now being detected and identified.  I also make an
  effort to differentiate between variations of a license.  This
  obviously can still be improved, but that isn't urgent.

* I have looked at nearly every package with an "unknown" license, and
  have split that set into two new sets: "none" and "failure".

  - failure: The licensing terms are specified somehow.  But my tools
    cannot detect that.  In some cases that is a failure of my tools,
    in other cases it is a failure to specify the terms in a way that
    could possibly be detected automatically.

    I don't think it is important to get this number down at this point.
    Doing so is certainly possible, but teaching the tools to match more
    also comes at the risk of false-positives.

  - none: Looking at the package for half a minute did not reveal any
    license of permission statement.  Like my tools, I myself can make
    mistakes, so this is an upper bound.  A small number of these
    packages (let's guess ten) probably do actually feature some kind of
    permission statement, which I failed to see.

* I have contacted nearly all of the authors of packages that appear to
  not specify a license.  These packages are being identified below by
  the pseudo license "pending".

  Responses - all positive - have started to dribble in.  Several dozen
  packages now have proper licensing terms thanks to these efforts.  But
  most of the authors I did not contact until last night, so a few dozen
  additional quick responses are to be expected within a week or so.

  What is needed now is patience.  As I have said elsewhere in this
  thread I have years of experience contacting authors of elisp packages
  to ask them to fix something that they might consider to be a very
  minor issue.  Usually a small number of authors (up to 10%) respond
  and acts very quickly, within hours or days.  A large number of
  authors (up to 60%) respond within one to three months without
  requiring any reminders.  The rest requires reminders.  However these
  reminders should not be send out until a few months later.  In my
  experience, sending out reminders too early, reduces the likelihood of
  something being done.

The newest statistics:

| License       | Count | Percent |
|---------------+-------+---------|
| GPL-3+        |  2295 |      62 |
| GPL-2+        |   617 |      17 |
| ((pending))   |   128 |       3 |
| MIT (x11)     |   117 |       3 |
| MIT           |   102 |       3 |
| GPL-3         |    98 |       3 |
| ((failure))   |    66 |       2 |
| BSD-2-clause  |    65 |       2 |
| GPL-2         |    40 |       1 |
| unlicense     |    30 |       1 |
| Apache-2.0    |    26 |       1 |
| BSD-3-clause  |    26 |       1 |
| public-domain |    23 |       1 |
| ((none))      |    16 |       0 |
| as-is         |    15 |       0 |
| WTFPL         |    11 |       0 |
| GPL-1+        |     4 |       0 |
| ISC (and)     |     3 |       0 |
| Artistic-2.0  |     2 |       0 |
| CC-BY-3.0     |     2 |       0 |
| GPL           |     2 |       0 |
| ISC           |     2 |       0 |
| LGPL          |     2 |       0 |
| AGPL-3        |     1 |       0 |
| AGPL-3+       |     1 |       0 |
| BSD           |     1 |       0 |
| BSD-3         |     1 |       0 |
| EPL           |     1 |       0 |
| EPL-1.0       |     1 |       0 |
| ISC (and/or)  |     1 |       0 |
| LGPL-3        |     1 |       0 |
| LGPL-3+       |     1 |       0 |
| LGPL-3.0      |     1 |       0 |
| MPL-2         |     1 |       0 |
|---------------+-------+---------|
| total GNU     |  3063 |      83 |
|---------------+-------+---------|
| total         |  3703 |     100 |

  Best regards,
  Jonas

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

Hi Jonas,

> Jonas Bernoulli writes:
> * I have contacted nearly all of the authors of packages that appear to
>   not specify a license. [...]

Wow. Great work!

>   Responses - all positive - have started to dribble in. [...]

Yes. My gut feeling from the small number of authors I have spoken to in
regards to this thread, is that they are positive to do the right thing and
just needs a bit of advice to get going.

During this thread I have been reading up on what advice is available to
authors and I find this page to be pretty good and short:

    https://www.gnu.org/licenses/gpl-howto.html.

Still I fear that it could be to long and even that page could use a shorter
intro. Like bullet points with links to longer explaining text when necessary.

>   What is needed now is patience. [...]

Yes. Lets see what your effort will bring. 

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  >     https://www.gnu.org/licenses/gpl-howto.html.

  > Still I fear that it could be to long and even that page could use a shorter
  > intro. Like bullet points with links to longer explaining text when necessary.

It would be good to make the page easier to read.
Would you like to send me a draft of what you suggest adding?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

    > - failure: The licensing terms are specified somehow.  But my tools
    >   cannot detect that.  In some cases that is a failure of my tools,
    >   in other cases it is a failure to specify the terms in a way that
    >   could possibly be detected automatically.

It is good that many of the unknowns are "failures", because the
"failure" is actually is a superficial problem and we can fix it on
our own.

If, on careful study, we can see that the authorss of package P tried
to say it was under license L, we can edit the text of the package so
make that same statement in the recommended and clear way.

We don't need to ask specially for permission to do this, because this
change follows the authors' stated licensing decision.  It presents
their decision in a more visible way.

    > - none: Looking at the package for half a minute did not reveal any
    >   license of permission statement.

These cases are the hard problems.

  > * I have contacted nearly all of the authors of packages that appear to
  >   not specify a license.  These packages are being identified below by
  >   the pseudo license "pending".

Thank you.  That's exactly what needs to be done.

  > Responses - all positive - have started to dribble in.

This is good news.  When the authors say they want to add a license,
anyone can do the editing to add it.  That's lawful because it is
carrying out the authors' wishes.

However, we cannot take for granted that all will say yes or that we
will succeed in reaching them all.


-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Some packages have licenses that are incompatible with Emacs.

  > | GPL-2         |    40 |       1 |

  > | CC-BY-3.0     |     2 |       0 |

  > | EPL           |     1 |       0 |
  > | EPL-1.0       |     1 |       0 |

These should not be included in Emacs package archives.

There are also licenses that threaten to become incompatible.
If we ever make a GPL version 4, we will release Emacs
under GPL version 4 or later.  At that point, these packages

  > | AGPL-3        |     1 |       0 |
  > | GPL-3         |    98 |       3 |

will become incompatible with the license of Emacs.

We should take action now to ask their authors to change
from *GPL-3 to *GPL-3+, so that they will not be a problem
in the future.

People, Jonas has done a great service by asking other authors of the
(none) packages.  But now there are around 143 more packages to
handle.

Let's not expect Jonas to do all the work by himself.
Can other people please volunteer now to share the work?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> Let's not expect Jonas to do all the work by himself.
> Can other people please volunteer now to share the work?

Sure. I'm in. @Jonas, if you need help, feel free to drop me a line to see how
we can organize things

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Jean-Christophe Helary]

> On Jul 29, 2017, at 22:07, Mats Lidell <mats.lidell@cag.se> wrote:
> 
>> Richard Stallman writes:
>> Let's not expect Jonas to do all the work by himself.
>> Can other people please volunteer now to share the work?
> 
> Sure. I'm in. @Jonas, if you need help, feel free to drop me a line to see how
> we can organize things

I can help too. I'm on vacation starting today !

Jean-Christophe 

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

Here's the list:

| Package (46)          | License   | Class    | Link                                                    | Contacted | Response |
|-----------------------+-----------+----------+---------------------------------------------------------+-----------+----------|
| ahk-mode              | GPL-2     | github   | https://github.com/ralesi/ahk-mode                      |           |          |
| binclock              | GPL-2     | github   | https://github.com/davep/binclock.el                    |           |          |
| caml                  | GPL-2     | orphaned | https://github.com/emacsorphanage/caml                  |           |          |
| chinese-conv          | GPL-2     | github   | https://github.com/gucong/emacs-chinese-conv            |           |          |
| crontab-mode          | GPL-2     | orphaned | https://github.com/emacsorphanage/crontab-mode          |           |          |
| dfmt                  | GPL-2     | github   | https://github.com/qsimpleq/elisp-dfmt                  |           |          |
| dna-mode              | GPL-2     | github   | https://github.com/jhgorrell/dna-mode-el                |           |          |
| ensime                | GPL       | github   | https://github.com/ensime/ensime-emacs                  |           |          |
| harvest               | GPL-2     | github   | https://github.com/kostajh/harvest.el                   |           |          |
| helm-ctest            | GPL-2     | github   | https://github.com/danlamanna/helm-ctest                |           |          |
| inline-crypt          | GPL-2     | github   | https://github.com/Sodel-the-Vociferous/inline-crypt-el |           |          |
| js-comint             | GPL-2     | github   | https://github.com/redguardtoo/js-comint                |           |          |
| live-py-mode          | EPL-1.0   | github   | https://github.com/donkirkby/live-py-plugin             |           |          |
| obfusurl              | GPL-2     | github   | https://github.com/davep/obfusurl.el                    |           |          |
| orgit                 | GPL-2     | github   | https://github.com/magit/orgit                          |           |          |
| pasp-mode             | GPL-2     | github   | https://github.com/santifa/pasp-mode                    |           |          |
| plantuml-mode         | GPL-2     | github   | https://github.com/skuro/plantuml-mode                  |           |          |
| prettify-greek        | GPL       | gitlab   | https://gitlab.com/fommil/emacs-prettify-greek          |           |          |
| protocols             | GPL-2     | github   | https://github.com/davep/protocols.el                   |           |          |
| py-gnitset            | GPL-2     | github   | https://github.com/quodlibetor/py-gnitset               |           |          |
| recover-buffers       | GPL-2     | github   | https://github.com/tripleee/recover-buffers             |           |          |
| review-mode           | GPL-2     | github   | https://github.com/kmuto/review-el                      |           |          |
| rhtml-mode            | GPL-2     | github   | https://github.com/eschulte/rhtml                       |           |          |
| rich-minority         | GPL-2     | github   | https://github.com/Malabarba/rich-minority              |           |          |
| sensitive             | CC-BY-3.0 | github   | https://github.com/timvisher/sensitive.el               |           |          |
| sequences             | CC-BY-3.0 | github   | https://github.com/timvisher/sequences.el               |           |          |
| services              | GPL-2     | github   | https://github.com/davep/services.el                    |           |          |
| sly-repl-ansi-color   | GPL-2     | github   | https://github.com/PuercoPop/sly-repl-ansi-color        |           |          |
| smartwin              | GPL-2     | github   | https://github.com/jerryxgh/smartwin                    |           |          |
| ssh-config-mode       | GPL-2     | github   | https://github.com/jhgorrell/ssh-config-mode-el         |           |          |
| stgit                 | GPL-2     | git      |                                                         |           |          |
| syslog-mode           | GPL-2     | github   | https://github.com/vapniks/syslog-mode                  |           |          |
| ts-comint             | GPL-2     | github   | https://github.com/josteink/ts-comint                   |           |          |
| uptimes               | GPL-2     | github   | https://github.com/davep/uptimes.el                     |           |          |
| web-mode              | GPL-2     | github   | https://github.com/fxbois/web-mode                      |           |          |
| web-mode-edit-element | GPL-2     | github   | https://github.com/jtkDvlp/web-mode-edit-element        |           |          |
| xah-css-mode          | GPL-2     | github   | https://github.com/xahlee/xah-css-mode                  |           |          |
| xah-elisp-mode        | GPL-2     | github   | https://github.com/xahlee/xah-elisp-mode                |           |          |
| xah-find              | GPL-2     | github   | https://github.com/xahlee/xah-find                      |           |          |
| xah-fly-keys          | GPL-2     | github   | https://github.com/xahlee/xah-fly-keys                  |           |          |
| xah-get-thing         | GPL-2     | github   | https://github.com/xahlee/xah-get-thing-or-selection    |           |          |
| xah-lookup            | GPL-2     | github   | https://github.com/xahlee/lookup-word-on-internet       |           |          |
| xah-math-input        | GPL-2     | github   | https://github.com/xahlee/xah-math-input                |           |          |
| xah-reformat-code     | GPL-2     | github   | https://github.com/xahlee/xah-reformat-code             |           |          |
| xah-replace-pairs     | GPL-2     | github   | https://github.com/xahlee/xah-replace-pairs             |           |          |
| xahk-mode             | GPL-2     | github   | https://github.com/xahlee/xahk-mode.el                  |           |          |

Have fun. I can produce more lists ;-)

Re: Some hard numbers on licenses used by elisp packages

[Jonas Bernoulli]

> | orgit                 | GPL-2     | github   | https://github.com/magit/orgit

Ups, that's one of my own packages.  It was already released under
GPL-3+, but it also contains a note about containing code which was
released under GPL-2+ which confused `elx-license'.

Re: Some hard numbers on licenses used by elisp packages

[Mats Lidell]

> Richard Stallman writes:
> Some packages have licenses that are incompatible with Emacs.
>
>   > | GPL-2         |    40 |       1 |

I got a questions from one of the authors whether just changing the license to
GPL-2+ would be enough to resolve the issue. Would it?

Yours
-- 
%% Mats

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > > Richard Stallman writes:
  > > Some packages have licenses that are incompatible with Emacs.
  > >
  > >   > | GPL-2         |    40 |       1 |

  > I got a questions from one of the authors whether just changing the license to
  > GPL-2+ would be enough to resolve the issue. Would it?

Yes, it would.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

Re: Some hard numbers on licenses used by elisp packages

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > | BSD           |     3 |       0 |
  > | BSD-3         |     1 |       0 |

What is the difference between "BSD" and "BSD-3"?
Can you show me the text of the license that plain "BSD" represents?

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.