The Apache (Contributor’s) License Agreement Is Very Dangerous

EDIT: All of this applies to the regular Apache License (v2) as well, and any other licenses that use its language. I’ve contacted Apache on their legal list about this and am waiting to hear back.

UPDATE 2 3: Apache’s last reply on September 15, 2013“In response to your request for a formal answer to your question. I will say, as President of the ASF, please give us a little time to consider your comments.”

I recently published a paper1 about my experiences exploring and contributing to Numenta’s open source NuPIC project, during which I discovered a very concerning clause in their Contributor’s License Agreement (emphasis mine):

Subject to the terms and conditions of this Agreement, You hereby grant to Numenta and to recipients of software distributed by Numenta a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted.

In brief, I let Numenta know that I couldn’t sign the agreement because:

[..] it appears to allow an interpretation that states that I’m potentially giving away royalty-free licenses to all the software patent claims I ever make should I make a single contribution to NuPIC, whatever it may be.

For a complete understanding of how such an interpretation is possible, please read part of the email exchange.

I was told that it was a word-for-word copy of the same section in the Apache CLA (v2) (a very common CLA with a long history of use), and therefore it would not be changed. However, after some additional poking, they brought up the issue with their legal team and discussed it internally. Eventually, they agreed to add a few clarifying words that would address the issue completely.

Of significance, Numenta announced the changes via their blog, and stated that they would allow existing contributors to sign the updated version. Matt Taylor, Numenta’s “Community Flag-Bearer”, explained the essence of what was clarified in the update:

This addition bounds the rights of Numenta, preventing us from exercising a royalty-free license to any patents a contributor creates in the future unassociated with the NuPIC project.

I am quite grateful for Matt’s help in addressing this issue. I have no doubt that his professionalism played an important role in Numenta’s decision.

Regarding the resolution, a good friend of mine remarked:

No small feat, getting a company to understand the implications of a contract its executives probably didn’t actually read closely in the first place, and then to send the document back to their lawyers to make it reasonable.

[..] a sympathetic stance would entail understanding that virtually no one reads this boilerplate stuff, that “bad code” gets passed along from one attorney and one organization to others, and then it gets defended for the surface-defensible reason that ‘standard contracts’ allow for legal interoperability. None of that sympathy is to endorse the going ‘standard’ — and it takes something like what [happened] to put things in better stead.

Significance for the Open Source Community

That a fairly large and well known company took these steps to clarify the Apache CLA has fairly significant consequences for the entire Open Source community.

In effect, Numenta’s actions legitimize the concerns that were raised, which sends a strong signal to every other company out there that uses the Apache CLA. It also sends a strong signal to every single developer who has ever signed a CLA that contains an identical (or similar) patent license clause.

The group most affected, however, are developers who have not yet signed an Apache-based CLA and have become aware of this issue (either through this paper or some blog post). The reason for this is that even if most companies would never abuse the CLA in the manner that the original language allows, the mere awareness of the possibility implies consent.

Why? Because if you are aware of the potential consequences that signing a legal document can have, and you still put your signature on it, then you cannot even use ignorance as a defense should the issue ever arise. That was the reason it became impossible for me to sign Numenta’s original CLA:

Given that multiple individuals now have (in written form) my understanding of what the document allows for, I cannot in good faith sign such a document as-is, because written as-is, it appears to allow an interpretation that states that I’m potentially giving away royalty-free licenses to all the software patent claims I ever make should I make a single contribution to NuPIC, whatever it may be.

At the time of publishing, the Apache CLA was at version 2.0. Hopefully, the Apache Foundation can amend their CLA in a future update.


1 Hierarchical Temporal Memory, NuPIC, and Numenta’s Commendable Behavior

Humans are basically blind

AlmostBlind

In searching for “what percent of the light spectrum can humans see” I found answers varying from 0% to a maximum of 2.3%, depending on your definition of “light spectrum,” whether you’re asking in terms of a linear scale or a logarithmic scale, and whether you’re using wavelength or frequency [1] [2].

Painfully slow frame rate

The problem doesn’t stop there, however. Searching for “frame rate of human eye” suggests and upper bound of 60 fps.

When someone drops a piece of gelatin, is this what you see?

Dark matter + Dark energy

The above image is a screenshot of the universe’s virtual machine as it existed approximately 13.7 billion years ago. From it, we learned that:

It also constrained the content of the present-day universe; 4.6% atoms, 23% dark matter and 72% dark energy.

That means that everything you learned in school about the world, and everything our scientific instruments can see, only deals with just 4.6% of the universe. And that’s just what our scientific instruments can directly see. Of that, we only see a fraction (0% to 2.3%) with the naked eye, and only at about 60 frames per second (when you’re really paying attention).

Conclusion: don’t make fun of schizophrenics

Perhaps they can simply see more of the universe than you can.

On Integrity, and why we are not joining Fight for the Future’s “Internet Defense League”

TLDR: Using deception to promote a noble cause undermines you and the cause.

Yesterday the organization “Fight for the Future” attempted to organize a “massive online protest” against the NSA’s constitutional transgressions. It seems like many people are upset at the deception surrounding the NSA and the companies who bend over backwards to service their various voyeuristic desires.

So then, does it not seem perhaps a tad hypocritical that Fight for the Future used various deceptive tactics of its own to fool and mislead the public about the size and nature of its “massive online protest”?

bullshit

Here is a quote from a hype piece written by Tiffiniy Cheng, one of the organizers working with Fight to the Future, that ran on the Huffington Post the morning the protests were supposed to happen (some emphasis added):

To amplify the street protests, the Internet Defense League, which is the formidable network of websites that emerged victorious from the now-infamous SOPA blackout, has raised the “Cat Signal” — its warning beacon for the Internet. Thousands of websites, celebrities, and organizations will be posting the 4th Amendment on the web, including some of the biggest names on the web: WordPress (which serves up 18% of all websites), 4chan, Imgur, Reddit, Mozilla, Internet Association, Fark, TOR Project, Cheezburger, Namecheap, O’Reilly Media, MoveOn, Avaaz, Upworthy, ACLU, and EFF.

We liken today to the first protests that got us to the SOPA blackout and ultimately, the shelving of SOPA and PIPA; American Censorship Day took place 2 months before the blackout and was responsible for making SOPA a household term. It took a lot to defeat SOPA, but it was just one law.

http://www.huffingtonpost.com/tiffiniy-cheng/restore-the-fourth-amendment_b_3544740.html

Exciting! I remember participating in the SOPA blackout! Thousands of organizations, including heavy hitters like Wikipedia, succeeded in blocking the legislation by blacking out large portions of their site in protest. That was a spectacular moment of global unity that I, and many others, remember to this day.

Would this be something like that?

Cheng’s pieces seemed to suggest it would be, but with the twist that visitors would see the text of the 4th Amendment instead of a blacked out page. This CNET piece, prominently linked to from Fight for the Future’s campaign website, gave more details:

Reddit, Mozilla, EFF and more join July 4th anti-NSA protests

Rather than going black, like many sites did during the 2012 protests of Congress’ Stop Online Privacy Act, or SOPA, these sites will prominently display a Fourth Amendment banner. The banner will quote the text of the amendment, which says, “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.”

Additionally, site visitors will be asked to sign an online petition, e-mail Congress, or join street protests. A group called Restore the Fourth is organizing the street demonstrations in nearly 100 U.S. cities, including New York, Washington, D.C., and San Francisco.

http://news.cnet.com/8301-1023_3-57592268-93/reddit-mozilla-eff-and-more-join-july-4th-anti-nsa-protests/

Indeed, some websites listed on Fight for the Future’s campaign site displayed some sort of prominent banner to visitors in a show of solidarity with the campaign (e.g. 4chan).

Missing Participants

Although the campaign positioned itself as “the largest online protest since SOPA,” fully HALF of the “heavy hitters” did not modify their websites for the campaign. Among the non-participants, Reddit and Imgur apparently had an ad cycling through their adbox referencing the campaign, but that’s certainly not an indication of participation in the campaign as it was presented by Fight for the Future.

These were the heavy hitters listed as participating and endorsing the campaign on Fight for the Future’s website:

Misleading

And this is who actually participated:

Accurate

Fight for the Future may be forgiven for their pie-in-the-sky article on the HuffPo that promised the participation of organizations who ended up sitting on the sidelines. There may in fact have been agreements or implied (mis)understandings to that effect before the campaign started. However, as the day wore on, it should have become clear to them that half of their star participants weren’t participating, and therefore continuing to list them on the campaign site was the wrong thing to do.

I shot them an email requesting that they remove the non-participating sites, but they refused.

OK, but so what?

If you run an organization that purports to stand for a noble and “good” cause, then acting in a deceptive and manipulative way (read: “non-noble”) reeks of hypocrisy. It’s always in your best interest to behave with integrity. Any failure to do so will result in disillusionment, finger-pointing from the other side (or your own), and will undermine your ability to lead, because leadership demands respect. Few people respect you when you use deception to try to get them to join your group, or to take some action.

This disrespect and disillusionment weakens the organization and its cause. People stop taking it seriously, whether they support the cause or not.

It would’ve been better, I think, for FFTF to present their campaign honestly and with integrity.

In the end, it seems FFTF might have tried to redeem themselves a bit. In an email sent out to their mailing list at the end of the day, they refrained from mentioning Reddit, Mozilla, WordPress, or any of the other star non-participants:

FTFF campaign email

The campaign site, however, remains unchanged.

What impression will people who see this campaign walk away with? Some might be fooled, however others will focus on the missing “star participants,” and then turn away from the stench of a campaign full of manipulation and dishonesty that tries to hijack the reputation of other organizations to bolster its cause, instead of allowing the cause to stand on its own merit.

As much as I support this cause, I don’t want to associate Tao Effect with an organization that would mislead and lie to its own base. That’s why I took down their banner code from our websites, and why you won’t see any of the “Internet Defense League” badges on our site.

Espionage 3.5 — Introducing Folder Actions!

Big release today! We know you’ve all missed application associations, and while those have been deprecated, today’s release introduces Folder Actions to replace them!

This time, instead of giving you a description of the new features (in text), we’ve made a 720p screencast ! A picture is worth a thousand words. We hope you enjoy it! The summary of changes is:

  • NEW: Folder Actions! Make magic happen when you lock or unlock folders!
  • IMPROVED: UI transitions in folder details view
  • IMPROVED: Now uses Lion’s invisible scrollbar in the folder list
  • FIXED: Folders appearing as white disk images
  • FIXED: Custom folder icons not showing up
  • FIXED: Preferences shouldn’t be visible after autolock
  • FIXED: Focus ring issues when the modal panel is up
  • FIXED: Overwriting a folder set by changing password to an already used one
  • FIXED: Keyboard focus issues in the modal dialog.

Enjoy! 😀

Espionage 3.0.3 Released!

Version 3.0.3 brings some important bugfixes and Brazilian localization. If you’d like to localize Espionage into your language, please contact us.

  • NEW: Brazilian Portuguese Localization
  • FIXED: Error 9 when unlocking
  • FIXED: Changed method of starting at login to one that’s less likely to fail
  • FIXED: Changed method of disk mounting to one that’s less likely to fail

Version 3.0.2 brought these updates:

  • IMPROVED: Signed with Developer ID for Mountain Lion compatibility
  • FIXED: Crash in autounlock
  • FIXED: Spanish translation in english language

Enjoy! 😀

Espionage 3.0.1 Released!

  • NEW: Spanish Localization
  • IMPROVED: Don’t warn about visibility for folders inside folders on Desktop
  • IMPROVED: Ask for confirmation during setup assistant if user says “no” to launch at login
  • FIXED: Problem unlocking folders when master password is changed
  • FIXED: Allow encryption of folders inside Library
  • FIXED: Allow “Force remove from database…” when disk image is missing
  • FIXED: Allow passwords with non-ascii characters
  • FIXED: Problem unlocking folders when master password is changed

Note that it’s now possible to use Espionage to encrypt folders in ~/Library. Do this at your own risk and let me explain why: with Lion Apple introduced sandboxing which has caused a lot of headaches for many developers. It’s caused massive headaches for us, and was one of the changes that went into our decision to remove application associations. If you encrypt an application’s data with Espionage 3.0.1, there are some things to keep in mind:

  1. Applications might store their data in the ~/Library/Application Support folder, but then if the developer enables sandboxing the operating system will move their data to ~/Library/Containers. If you had their data previously encrypted, this transition may not go smoothly, and even if it does, you might not be aware of it and suddenly the data is now unencrypted in a different location.
  2. Because application associations are gone, you’ll need to unlock the application’s folder before using it. We’re considering our options as to what we can do here, whether it’s bring back application associations or something else, but don’t bet on it yet. The situation is hairy. In the meantime you can set the folder to auto-unlock when you login.

Mac App Store Failure

One of our goals for version 3, was to address a user-request to get Espionage into the Mac App Store (MAS). We thought we succeeded in this, but it looks like this was only a momentary success. Apple’s June 1st sandboxing deadline hit, and we thought we were safe because we were already in the store, but this turns out to be not true. Apple didn’t make this very clear, but they’re preventing non-sandboxed applications from receiving feature updates in the MAS. So all non-sandboxed apps in the MAS are essentially “dead in the store”.

We’re unable to sandbox Espionage because of a bug in Apple’s operating system (rdar://10419391), and we have a feeling they won’t fix this bug anytime soon. Since we’re not able to update Espionage in the MAS anymore, we’re going to have it removed from the store.

We’re asking users who purchased Espionage in the store to switch to the non-MAS version of Espionage, and to contact us using the following instructions so that we can send you a license to it. If you purchased Espionage in the MAS, please read these instructions before switching to the non-MAS version of Espionage.

How To: Switch to non-App Store version of Espionage 3

Step 1: Locate your copy of Espionage in the Applications folder and then right-click (control-click) on it, and choose Show Package Contents:

Step 2: Locate the receipt file in Contents > _MASReceipt > receipt. Copy this file to your Desktop (drag it while holding the Option key):

Step 3: Visit this link and enter your information. Click ‘Choose File’ (Safari) or ‘Browse’ (Firefox) and select the receipt file on your Desktop. Then click Submit. Your Espionage 3 license will be emailed to the address you provided, so make sure there are no typos.

Step 4: After you receive an email with your license, download Espionage 3 from its website, and replace your copy of Espionage with it. Then register it with the license you received. Don’t replace your copy of Espionage until you receive your license.

That’s it!

We apologize for the inconvenience that has been caused by this situation. On the bright side, we no longer have to wait for Apple’s approval to release updates to Espionage, and 3.0.1 will be released shortly.