[Bug 453422] Review Request: songbird - Mozilla based multimedia player

Fri Jun 5 14:33:22 UTC 2009

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=453422

Tom "spot" Callaway <tcallawa at redhat.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tcallawa at redhat.com
             Blocks|                            |182235(FE-Legal)

--- Comment #67 from Tom "spot" Callaway <tcallawa at redhat.com>  2009-06-05 10:33:13 EDT ---
Well, I've got a few concerns here:

* The License for Songbird appears to be GPLv2, which says:

"  5. You are not required to accept this License, since you have not
signed it. " 

The EULA would seem to add this additional requirement that you accept the GPL
terms.

"POTI IS WILLING TO LICENSE THE SONGBIRD MEDIA PLAYER AND SONGBIRD ADD-ONS TO
YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL THE TERMS CONTAINED IN THIS
AGREEMENT."

* The EULA covers "Songbird Add-Ons" without specifying what those are. In
addition, you mention that there are Free/Open Source add-ons coming, but this
EULA clearly states that all add-ons may not be copied or modified, and
imposing commercial use restrictions. All of these EULA overlay restrictions
render otherwise Free/Open Source addons non-free.

* The EULA requires that the end-user agree to the Fluendo EULA terms, which
are most certainly non-free.

These three items are showstoppers. While this isn't as bad as what Mozilla
originally tried to do with Firefox, the problem is the same.

I would suggest that we take a big step back from things and look at
specifically what problems that you (Songbird's copyright holder(s)) seem to be
trying to solve with this EULA.

1. The source code for the base songbird product is under the GPLv2. No
agreement is necessary for anyone to use, copy, modify, distribute, or sell the
songbird code. 

2. The base songbird product does not come with any addons. Thus, there should
not be a need to specify terms for these addons. If a user installs an addon
through songbird directly, they should be prompted to agree to downloaded terms
before downloading the addon, not at the initial use of songbird. (If addons
are manually installed by the user outside of songbird, it is the
responsibility of the addon provider to ensure that the terms of that specific
addon are either presented to the user before download or before installation).

3. "Proprietary Rights": The GPL is effective in providing this coverage,
nothing in the GPL takes away the rights that are preserved by copyright law.
There is no need for the user to agree to this explicitly.

4. "Disclaimer of Warranty": The GPL is effective in providing this coverage,
it has a thorough disclaimer of warranty. There is no need for the user to
agree to this explicitly.

5. "Third-Party Add-Ons": This covers the fact that third-party addons
available at the songbird website may have different terms and disclaims
warranty. If deemed absolutely necessary, this is something that could be
presented in a non-obtrusive way, similar to how firefox handles its third
party services, where the user is made aware of these facts, but is not
required to agree to them. Realistically, this should be on the songbird
website, not embedded in the client.

6. "Term and Termination": This legal boilerplate in the EULA arguably
conflicts with the GPL, thus, according to the beginning of the EULA ("To the
extent that any of the terms and conditions of this Agreement conflict with the
GPLv2 and POTI's exception, the conflicting terms and conditions of this
Agreement shall not apply to the Songbird Media Player."), they don't apply
anyway, and serve no purpose.

7. "Representations and Warranties." This states that songbird users must
comply with the law when using addons (but not the base songbird player?), and
that they cannot use the code to infringe other's copyrights. This technically
constitutes a use restriction, and conflicts with the GPLv2. In addition, you
do not need to force people to agree to follow applicable laws, they're
required to do that anyways, no prior agreement necessary. Thus, this entire
section is not required.

8. "No Obligation": Already covered adequately in GPLv2, not necessary.

9. "Government Users." These appear to impose additional rights restrictions
upon US goverment use, which may conflict with the GPLv2 and thus be
irrelevant. If there are additional US government policies covering the use of
specific types of software (I'm assuming this is primarily for cryptographic
related matters), you could certainly inform the goverment user in an
unobtrusive way that these policies may apply, but this is not something that
mandates acceptance. (Alternately, the Mozilla Public License 1.1 (Section 10)
has this as part of its license, thus, it may be a better fit for Songbird:
http://www.mozilla.org/MPL/MPL-1.1.html )

10. "Export Laws." Requiring people to follow US export laws in order to use
GPLv2 licensed software might be a restriction on the GPL as worded in the
EULA. However, the GPLv2 provides a mechanism to handle this:

"  8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded.  In such case, this License incorporates
the limitation as if written in the body of this License."

I would suggest that along with your gstreamer exception, you can accomplish
this by adding a export limitation excluding any countries where songbird could
not be distributed in accordance with US export laws.

Fedora has similar US export requirements, but we only impose them on our
distributors (e.g. mirrors), not via EULA to our users.

11. "Indemnity" and "Limitations of Liability": Covered adequately by the
GPLv2, no need for additional user agreement.

12. "General Provisions": More legal boilerplate. GPLv2 conflicts with forced
jurisdictional clauses, such as "This Agreement will be governed by and
construed in accordance with the laws of the State of California", so it
doesn't apply.

(It is worth noting that the Mozilla Public License v1.1 contains virtually
identical boilerplate, so, if you cannot move forward without it, switching to
that license may be a better fit for you.)

13. "Third-party software": It is good to have this listed, but the user does
not need to agree to it, nor be required to review it in order to leverage the
rights granted by copyright and the GPLv2 (use, copy, distribute, modify).

To put it bluntly, the EULA is entirely unnecessary, and in my opinion, the
impact of requiring the user to agree to the EULA's additional terms and
restrictions in order to use the songbird base client (and removing all rights
granted by the GPLv2 if it is not agreed to) renders this non-free.

Please realize that I'm not trying to be a roadblock here because I enjoy it,
or because I have anything personally against Songbird. It looks rather cool,
so I would encourage you to make the attempt to move away from the failed
Windows EULA legal model and have faith in the GPL (which, unlike boilerplate
EULAs, has never failed to be upheld in international courts).

If you have further questions or improvement suggestions, I would be happy to
discuss them, either publicly or privately.

Blocking FE-Legal

-- 
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.