JavaScript VDOM library evaluation: patents

I think the issue summary should also describe that Drupal is already violating a shit ton of software patents, just like the use of JSON, or responsive design. Much like facebook we probably could have issues with microsoft, google and many more companies.

INAL so I don't have much to add to a pretty good summary of the legal situation. I will say many organizations have already decided React is problematic based on earlier licensing so regardless of the interpretations and discussions had here reversing course is going to require developers making a legal argument to management and legal teams. Additionally those organization likely investing real time and resources into that process. This is something I'm personally not looking forward to doing at least.

Re #2: +1 to adding that to the IS if people can provide links to the relevant patents. Otherwise, it's just speculation of what is or isn't patented.

Maybe Dries has more concrete information, but I remember him saying something along 300 patents we already deal with.

Facebook has re-licensed React under MIT license.

See the changes from Git:

https://github.com/facebook/react/commit/b765fb25ebc6e53bb8de2496d2828d9...

This issue is specifically about patents, but patents are not the only values-related issue with React. Many of these issues are connected, and when making a decision on adopting React they should be considered together, not individually.

I do not disagree with any of the points presented in the summary. They paint a picture of the many problems with patents. This is why it would be good if all OSS projects used licenses which explicitly cover patents.

I think a key point is: "does not mean that it would hold up in court". Going to court to prove anything takes money and resources and involves risks. Facebook has bucketloads of money and an army of lawyers. Who is willing to get involved in a lawsuit against Facebook, and has the resources to do it, even if Facebook seemed likely to lose?

The many license changes are a great example of how Facebook has complete control over React. Facebook declared that BSD + Patents was "designed to ensure that developers can use our projects with confidence", but didn't return to using the initial Apache 2.0 license with React. Apache 2.0 explicitly covers patents, so why did Facebook choose MIT instead? We do not know, because React is not a truly open project. These kind of decisions, and likely many more, are made behind closed doors.

Even though React is now licensed under MIT, Facebook's past actions do not exactly increase trust in the company. By adopting React, Drupal would force all of its users to weigh whether they are willing to take all of the risks that come with React, regardless of the fact that they can use any framework for user-facing front ends.

I have no doubt that React can be an excellent choice for individual downstream projects, where the risks can be weighed individually. But I believe that as an OSS platform Drupal has a great responsibility when deciding on new dependencies.

Even jQuery is released under MIT license, though.

https://jquery.org/license/

If we can't adopt any other open source project which is under MIT License, our hands are definitely tied.

If FB re-license React back to BSD + Patent in v17. Can we still use v16 freely?

The problem Apache Software Foundation (and many others) had with BSD + Patents was the patent retaliation clause. I do not know of an official ASF position on MIT containing an implicit patent grant, I believe they are accepting MIT and React simply because React contains no known patents enforced by anyone.

Even after relenting under pressure and changing the license to MIT, Facebook still insists that "our BSD + Patents license provides some benefits to users of our projects". And they are right, because an explicit patent grant is better than a contested and untested implicit grant. But for some reason Facebook did not want to give an explicit grant without the retaliation clause, and chose MIT for React.

Completely avoiding projects without an explicit patent grant would unfortunately be very limiting indeed. So the risks involved need to be evaluated individually for each project.

jQuery for example is maintained by the JS Foundation. I would say the risks related to patents and possible legal cases are very different in magnitude between jQuery and React.

I'd like to stress once again that patents are not the only values-related issue with React. In an other issue MySQL, maintained by Oracle, was offered as an example of Drupal being dependent on technologies backed by enterprises. Well, Drupal isn't dependent on MySQL, but MySQL still makes a good example: MariaDB was forked because Oracle control over MySQL was unacceptable for so many.

Adopting React will affect the general acceptability of Drupal, unless the React UI is completely decoupled and offered as an optional and separate download.

> But for some reason Facebook did not want to give an explicit grant without the retaliation clause
Because in 2012 Yahoo tried to patent troll them and sued. You can read more about it here https://medium.com/@ji/the-react-license-for-founders-and-ctos-b38d2538f3e5

Also to echo what @dawehner mentioned - we're already violating several hundreds of patents and will continue to do so. Here's some examples of things you'll have to remove from Drupal if you want to pursue this issue:

• Responsive themes - https://www.google.com/patents/US20150040098
• Sending the contents of a body field over an API - https://www.google.com/patents/US9021035
• CKEditor - https://patents.google.com/patent/US20090006454A1
• Any module which calls a 3rd party API from the browser e.g. analytics - https://patents.google.com/patent/US6944660B2
• Any JavaScript Framework which does something in your browser, like render anything at all -
  https://patents.google.com/patent/US6973625B1
• Editing content - https://patents.google.com/patent/US6546397B1

This issue was opened to only focus on React. Considering the above, and also that React is now MIT licensed (as others have mentioned), and that we already used MIT licensed code - this can be closed as it's not a blocking issue.

@justafish That article explains Facebook's motives for BSD + Patents very well.

Are you saying that Facebook did not want to give an explicit patent grant and chose MIT instead because they want to be able to use patents on React technology against patent trolls? Because that is of course what the situation looks like, based on that article and numerous other articles.

I agree that Drupal is probably violating several hundreds of patents, and am not suggesting patents alone should be a reason for not adopting React.

However, like the ASF and others I think open source software should not contain patented technology, unless it is offered for free for everyone. Neither should standards. As a standards-based and community-led open source project should we just 'accept the reality' and give up without a fight?

Whatever the outcome, I think these are important topics to discuss before a decision like this, because these discussions shed light on what our values and principles really are (and are not) as a project and a community.

Does Drupal CORE compatible with Apache 2.0? I realise a (very popular) Polymer lib kit released under this license: https://vaadin.com/elements

So now, Drupal has no plans move to GPL v3
https://www.drupal.org/about/licensing#q12

On Apache 2.0 page, it says not compatible if I read it correctly.
https://www.gnu.org/licenses/license-list.html#apache2

Do we need to do a research on the these frameworks' popular `components` libs if we have a plan to reuse it instead make a custom one?

Replying to #2917161-20: JavaScript library evaluation: polymer license compatibility with GPL2 here as requested, although this issue has been closed as well.

If we are to trust the FSF on WebM, this is what they say about the MIT license: "For substantial programs it is better to use the Apache 2.0 license since it blocks patent treachery." In other words, the FSF does not believe that the MIT license blocks patent treachery.
https://www.gnu.org/licenses/license-list.html#Expat

In this recent article that goes through the MIT license line by line, the author, who is a lawyer, concludes that "as a result of this mishmash of legal, industry, general-intellectual-property, and general-use terms, it isn’t clear whether The MIT License includes a patent license."
https://writing.kemitchell.com/2016/09/21/MIT-License-Line-by-Line.html

GPLv2 and MIT are different licenses, and use different language. We would still need a court decision on MIT and patents to be sure.

I think it is too early to close this.

The issue here was never really about the specific license (at least in my mind; I was never bothered by the old license myself), but rather about people's reactions to it and their overall trust of Facebook's activity with regard to patents. If that causes enough people to not want to use Facebook's software, that's a problem regardless of the merits of their concerns.

It is not obvious to me that switching React from a license with an explicit (and arguably generous) patent grant to one that says nothing explicit about patent grants at all is going to end the concerns people have about Facebook and patents. Certainly reading through https://github.com/wordpress/gutenberg/issues/2733, for example, a number of people still seem to be concerned about it there.

So I think this issue should remain open (maybe postponed?) until it is more clear how the overall community is reacting to the new license.

I'm so lost with all this legal stuff. I see the argument of previous court ruling. Does a court ruling apply to the U.S. only? Does a U.S. court ruling also apply to France or Nicaragua (as examples)?

Even jQuery is released under MIT license, though.

jQuery for example is maintained by the JS Foundation. I would say the risks related to patents and possible legal cases are very different in magnitude between jQuery and React.