Snort mailing list archives
Re: What's up with Snort's license?
From: Martin Roesch <roesch () sourcefire com>
Date: Wed, 18 Jul 2007 18:26:25 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jul 18, 2007, at 3:20 PM, Alan Shimel wrote:
Marty Thanks for the clarification. I wanted to clarify a few things myself. 1. I in my blog or anywhere else never claimed that Sourcefire was taking Snort out of open source. My claim and I stand by it, is that by putting your "clarification" of the GPL in on the 3.0 stuff, you are changing the GPL and it is no longer licensed under the "GPL" as we and our attorneys interpret it.
We haven't changed the GPL in Snort 3. We're specifying what constitutes a derivative product in our view for the sake of clarity to commercial integrators. We're also saying that people who want to contribute code to the project do so with the knowledge that we're going to consider the code as assigned to Sourcefire unless other arrangements are made. This is necessary for two reasons: 1) Mitigation of IP encumbrance due to a "hostile" contributer trying to "inject" 3rd party IP into the project. The FSF does this but uses a full legal document, we're trying to avoid that encumbrance. It would seem that by your logic projects like GCC are also not licensed under the GPL. 2) Given that we need to be able to offer Snort under an alternative license for commercial integrators who are integrating Snort and don't want to adhere to the GPL it's essential that we retain the right to relicense the totality of the codebase. If people don't want to contribute their code to the project due to this clause they can maintain their code as external patches. I've always enjoyed interacting with the community (even if it is less often than it used to be) and I'll respect people's decisions with regard to this assignment clause as it relates to their desire to contribute. I hope people will still feel free to contribute, as I said the code isn't going to ever disappear but, as with Nmap, we need to reserve the right to relicense for commercial use.
Does that make it not open source? I will leave that to others. My personal opinion is that you do not need a GPL license to be open source (but that is another matter). You choose what license you want to use. I just say it is not GPL anymore, it is Marty's GPL version.
Then we disagree.
2. Other companies using Snort. Marty what kind of support would you like? I feel that here you are not being quite as "open" as you would like us to believe. Do you mean that you want companies like StillSecure to contribute to developing and supporting snort or do you mean if you had your druthers you would prefer no other commercial entity uses snort to "compete" against you. If it is you want us to help support Snort, we are ready, willing and able. If you are using the open source license (gpl or otherwise) as a shield to prevent other companies from competing with sourcefire though, that is another story and you should just say so.
I (and Sourcefire) are not asking for any support from commercial vendors. On the other hand, we do put quite a bit of effort into Snort and we distribute it under a license which we expect to be adhered to. I don't care if companies integrate Snort, we're happy when they do because it builds a larger community of Snort users which is better for all of us. Competition doesn't worry us in this regard, we feel that we serve our area of the market quite capably irrespective of other companies that offer Snort-based solutions. This isn't about that at all, it's about enforcing compliance with the license that Snort is distributed under. The primary problem I have with companies that don't contribute to the project is when they don't like us being assertive about our rights as the copyright holder. Their legitimacy to question our licensing language is highly suspect given their past contributions to and role in the community. If all a vendor does is take and they don't give anything back to anyone then let's call it what it is and say they're a vendor who's worried that they're going to actually have to pay for something that you've been getting for free.
3. Changing peoples licenses and IP assignments - I think you realize the issues involved there and doing it in haste is not always the best way, but you apologized and that is enough for me. IP assignment is a case of buyer beware. But think about this, what message do you send to the developer community. You want people to help support snort but you are going to "own" what they contribute. Not very inviting, but at least you are upfront about it.
I outlined the reasons for doing so above, people are free to contribute (or not) in any way they see fit. This is the exact same thing that the Nmap project has been doing since 2001, it seems to have worked well for that community and I think it'll work for Snort's community as well. -Marty - -- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Security for the Real World - http://www.sourcefire.com Snort: Open Source IDP - http://www.snort.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iD8DBQFGnpORqj0FAQQ3KOARAoAjAJ9dYITfThxo69wt4+yOarXPye3W/ACfaTl1 5jNFVeKnN7F1xRMbMWoF4u8= =xCkz -----END PGP SIGNATURE----- ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- What's up with Snort's license? Martin Roesch (Jul 18)
- Message not available
- Re: What's up with Snort's license? Martin Roesch (Jul 18)
- Re: What's up with Snort's license? Ace Nimrod (Jul 18)
- Re: What's up with Snort's license? (Answer rollup) Martin Roesch (Jul 19)
- Re: What's up with Snort's license? (Answer rollup) Alan Shimel (Jul 19)
- Re: What's up with Snort's license? (Answer rollup) Matt Jonkman (Jul 20)
- Re: What's up with Snort's license? (Answer rollup) Paul Schmehl (Jul 21)
- Re: [Bleeding-sigs] Re: What's up with Snort's license? (Answer rollup) Matt Jonkman (Jul 21)
- Re: What's up with Snort's license? Martin Roesch (Jul 18)
- Message not available
- Re: [Bleeding-sigs] RE: What's up with Snort's license? Alan Shimel (Jul 19)
- Re: [Bleeding-sigs] RE: What's up with Snort's license? Matt Jonkman (Jul 19)
- Re: [Bleeding-sigs] RE: What's up with Snort'slicense? Alan Shimel (Jul 19)