Re: Source code via download -- MPL Alpha 1 Draft Released

  On 20.08.2010 20:20, Luis Villa wrote:
>  I was going to reply in great detail (and may yet) but I think I 
> should first highlight a general point. There is a tension between a 
> couple of different potential goals:
>
> * Making exploitation hard for hostile, sophisticated license users.
> * Making understanding and compliance easy for well-intentioned 
> license users.

 From my experience, the distinction is not so clear. Speaking of 
companies, there are often different people or fractions involved (often 
development dev against laywers), and they might fight with each other.

Being a contractor helping all kinds of companies with using Mozilla 
(XUL, Gecko etc.) in their products, I have very often been in these 
situations, arguing for source publishing, but having a hard stance, 
because the company has no inherent interest in it. In such situations, 
the license is the only "weapon" for the "good guys". In fact, in almost 
any company I worked for, I had to argue with "the license requires us 
to do this, at that time, we have no choice, we *have* to do it", and 
that argument was usually working, and the *only* argument that really 
worked. I can't say this, if I know the license has loopholes. So, 
having clear, loophole-free requirements for me is very important. It 
also shows that there's no clear distinction between "bad guys" and 
"good guys" when looking at companies.

Also, there are typically time pressures to get a release out, and 
fulfilling source code requirements is very low on the priority list (no 
direct benefit for company nor ordinary users), and after the release, 
people tend to slack a bit and/or move on to the next version, and 
forget about such things.

> In particular, the first two points can be in obvious tension: making 
> things ironclad against hostile exploiters can make the license harder 
> to understand and/or less flexible for well-intentioned users. Of 
> course, go too far towards making it easy, and you leave yourself with 
> no tools to use against unsophisticated violators.

I don't see the tension as far as understanding goes.
"You have to publish the source via a very widely established protocol 
(such as HTTP), accessible to anyone on the Internet, and mention the 
location (e.g. URL or hyperlink) in the product, where the product 
license is displayed or cited (e.g. About dialog). The source code must 
be accessible at this location at the same time when the product is 
available to the public, and for 6 months until this product version is 
replaced by a newer version, or for 12 month after the product is 
discontinued.",
or something like that, is not hard to understand. The time scale 
matches MPL 1.1, the "for anyone" is distributing the source 
theoretically wider than MPL1.1, but that at the same time makes the 
license language easier to understand.

> Two data points have informed my (personal) thinking about where to 
> strike the balance:

I hope my first-hand experience as a contractor, as written above, gives 
some more data.