OPINION
OpenSolaris: Beyond the Rhetoric

Large patent portfolio owners seem to be in a particularly generous mood these days. A few weeks after IBM (NYSE: IBM) announced it was giving away 500 patents, Sun jumped on the bandwagon by announcing that it is releasing more than 1,600 patents associated with the Solaris OS, a move they describe as eclipsing any other vendor's contribution.

While IBM's patent release was generally well-received by the open source community, Sun's move has so far been viewed with suspicion by some, including its competitors, IBM, Red Hat (NYSE: RHT) and Novell.

IBM vs. Sun

Perhaps this is because, as Dan Ravicher, lead counsel for Open Source Risk Management and the executive director of the Public Patent Foundation (PubPat) said, "IBM said what they did so there was no confusion on their intent. They said 'here are 500 patents; you can do with them what you want.' They were very clear. Sun on the other hand has said something different from what it is really doing."

The IBM patent pledge is problem-free, as I wrote in an earlier column; however, Ravicher has a point that there's a gap between Sun's press release and the legal documents releasing the Sun patents.

Free But Shackled?

"By releasing the OpenSolaris OS platform under the CDDL, the open-source community will immediately gain access to 1,600 active Sun patents for all aspects of operating system technologies that encompass features ranging from kernel technology and file systems to network management, to name a few." -- Scott McNealy in Sun's January 25 press release

In spite of McNealy's statement, the reality is that, to date, Sun has only released a small but much-touted diagnostic feature. Dynamic Tracing (DTrace) was released under the newly OSI-certified Common Development and Distribution License (CDDL). True, the DTrace source was made available as a good faith gesture of Sun's intent to open-source the OpenSolaris system in the second quarter of 2005, but on its licensing FAQs, it promised to "release as much of the source code as possible under the CDDL."

Sun says it does not have legal permission to open-source some Solaris 10 source code. The source for third-party specifications and drivers will be released only as binaries. The reality is that developers may end up having to pay for third-party components needed to build a functional program from the Solaris source.

The question is whether OpenSolaris will become what Richard Stallman calls "free but shackled" -- unusable in the Free World because the entire program cannot run on an entirely free system. "The program is free software, but it is effectively shackled by its non-free dependencies," he said.

What Should We Know About the CDDL?

There are two important things to note about the CDDL. First, it is incompatible with the GNU General Public License (GPL). Second, it is a non-copyleft license, which means that it is possible to keep some modifications in closed source.

The legal reason why the CDDL is incompatible with the GPL is because it imposes restrictions (for example, non-copyleft provisions) which violate the GPL's requirement that the user is not allowed to impose any further restrictions on the recipients' exercise of the rights granted under the GPL.

The business reason why OpenSolaris is deliberately incompatible with the GPL is probably that Sun fears that OpenSolaris features will be ported to other software, including the Linux operating system. That may be fair, but Sun will take some heat for it.

Sun should make it clear to developers who consider adopting any OpenSolaris source code that they should not combine GPL'ed code, the same way some other organizations such as the Apache Software Foundation and the Mozilla Foundation have done.

The CDDL is a non-copyleft license, which means that it is possible to use the OpenSolaris source and create proprietary modifications. Source code must be made available for any modifications to CDDL-licensed software (Section 3.2). The file-based definition of "covered software" (Section 1.3) makes it easier to keep certain files proprietary.

In developing the CDDL, Sun used the Mozilla Public License (MPL) as a starting point, partly because it provides a "file-based" definition of modifications and covered software, which makes it easy to combine code with code distributed under license. Many of Sun's changes from the MPL are good but not major, so why didn't Sun just use the MPL? The open-source world can certainly do with less license proliferation.

As Larry Rosen puts it, the risk is that "we end up with ... lots of little lumps of software that can't be combined." How can we create a commons of software, Rosen asked, "if every company has its own commons?"

Unanswered Questions

In an open letter to Scott McNealy, Ravicher wrote that the Sun's "announcement was so broad in comparison to the related legal documents, that serious questions now exist regarding what rights the public has to Sun's patents."

For example, although McNealy claimed that Sun granted the open-source community more than 1,600 patents, the CDDL does not mention specifically the number of patents being released. IBM, on the other hand, listed all 500 patents in its patent pledge.

Assuming the 1,600 patents are accessible, Ravicher asks if Sun's patent grant is limited to software licensed under the CDDL. Is it limited to software distributed directly by Sun?

Reading the CDDL, the patent grant in Section 2.1(b) along with the definition of "Original Software" (Section 1.10) suggests that the patent grant is only for software licensed under the CDDL. No patent license is granted for code that is deleted from the Original Software, or for infringements caused by modification or combination of the Original Software with other software or devices.

What about indemnification? Sun's press release states that its new open-source approach "underscores Sun's belief that license agreements for software are not as significant as the company who stands behind its products." Is Sun proposing to indemnify its users from any patent infringement actions? There is nothing in the CDDL or the OpenSolaris Web site to back up or expound on what Sun means by that statement. As I have stated before, a patent owner's "release" of a patent does not provide the right to make what is shown in the patent, because there are still patents of third parties to deal with.

What's the Verdict?

In some sense, Mark Webbink of Red Hat was right when he said, "It's not about the license, it's about the community." A posting on Groklaw saw this as Sun's missed opportunity: "If Sun had GPL'ed this code, with the patent grant, they would have been heroes and folks would have contributed back, just as they are giving support to IBM and other corporate friends."

One reason why Linux gained such a loyal base of supporters is because it built a solid developer community that understood that open source was about give and take. As one representative from IBM stated, "It's been interesting that [Sun] ... was willing to continue to milk its proprietary Solaris cash cow up to the point that it would no longer give milk. Now they want the community to step in and nurse the cow back to health."

It remains to be seen whether it's a case of too little too late or whether Sun's baby steps towards open source will lead to a new chapter in the troubled company's history. But Sun needs to remember that the open-source community can smell a phony a mile away. If Sun can freely give and back it up with clear and unequivocal actions, there's a much better chance that the open-source community will embrace it and freely give back.