←back to thread

238 points ferbivore | 1 comments | | HN request time: 0s | source
Show context
wooque ◴[] No.41894661[source]
CTO response:

Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility.

the SDK and the client are two separate programs code for each program is in separate repositories the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3 Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug.

replies(3): >>41894730 #>>41895757 #>>41897008 #
mattdm ◴[] No.41895757[source]
It's not necessarily about being "one program". It's this part:

"The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

I get that it's really hard to make money as an open source company. (That's why I am one of your paying customers.)

The exclusion you are putting on your SDK seems very similar to that of the "bitkeeper" version control software used for the Linux kernel for a short time. Look how that turned out.

replies(1): >>41897037 #
atanasi ◴[] No.41897037[source]
FSF has published a commentary: https://www.gnu.org/licenses/gpl-faq.html#MereAggregation

GPL licenses have allowed so-called "mere aggregation", where separate programs are distributed together. Such programs don't have to be all covered by GPL.

On the other hand, if parts are intimately tied to each other such that they are effectively a single program, GPL applies to the whole.

The FSF commentary explains that the judgment depends both on the mechanisms and the semantics of the co-operation. Technical implementation details don't make programs separate if they are intimately designed to work together: "But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program."

replies(2): >>41901495 #>>41907875 #
1. chme ◴[] No.41901495[source]
So they either have to license their SDK with a GPLv3 compatible license as well, or have to change the license of the client to a non-GPL one.

In the latter case, IIUC their CLA (https://cla-assistant.io/bitwarden/clients) allows to do change the license unilaterally. (Not a legal expert, so please correct me if I am wrong.)

If so, then I feel strengthened again in my conviction that permissive licenses (as well as closed-source licenses) and CLAs are bad for both users and developers and should be avoided, if possible.