switch license to apache 2

[satra]

[yarikoptic]

sure, benefit? altogether probably should be the same as for heudiconv ;) https://github.com/nipy/heudiconv/issues/163

[satra]

yes - completely forgot about heudiconv!

apache 2 protects against companies using it and then suing the project

[yarikoptic]

isn't it what all (BSD-3, MIT) licenses also provide with their disclaimer of any warranty and liability?

[yarikoptic]

e.g. here is a portion from the MIT license:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

[satra]

apache 2 makes it very explicit and from people i have spoken to that helps were it to ever get to such a state. also given that many major products - apache, itk, tensorflow and others follow it makes it easier to adopt scientific projects. the first time i went through this was when ITK switched over to apache 2. especially given tensorflow, i suspect google's lawyers looked at it.

[satra]

this page helps clarify: https://choosealicense.com/

[yarikoptic]

I can see why big companies, would want apache 2.0 better, thanks for the weblink which says:

The Apache License 2.0 is a permissive license similar to the MIT License, but also provides an express grant of patent rights from contributors to users.

So, unless project implements patented tech which it owns, I see no benefit from that clause. As for "explicit" -- that is why I like MIT and BSD-3 -- because they are short, even a mortal can read and even understand them. Apache 2 is already beyond the limit of "I can quickly read and understand it", so I would not say that it is more explicit (to a regular reader/user) than MIT and BSD-3.

Apache 2.0 adds an additional restriction which actually, if meticulously followed, is quite anal and could discourage creating of derivative projects:

You must cause any modified files to carry prominent notices stating that You changed the files

So, still not sure what advantage I would be gaining by switching to Apache besides loosing

• short, clear to the point wording
• being as permissive as I could be

And I do see why bigger companies and industry-supported projects would go after Apache 2.0. So I would actually prefer to stay with the simpler MIT here (and ideally in heudiconv)

[satra]

what we read of the license or understand it is completely useless from a legal perspective. as i said, i was convinced with the arguments when itk switched to apache 2. there were many more people who took a look at it. and as such it has become my default go to license.

for heudiconv, i would like to stick with apache 2. that's also the license for nipype.

and git provides all the necessary info for file changes. you can check out the tensorflow repo.

[satra]

personally i don't think one should ever rule out patent protection provisions in any software project (however small).

[yarikoptic]

"what we read of the license or understand it is completely useless from a legal perspective." - I will digest this for a while since it suggests that I shouldn't even try to grasp what license terms are of the software I am using/contributing, which generally goes against my practice ;)

ITK is by kitware, which is a company! so once again, not surprising that they would switch since it fits their needs better, so I would not just take "the best for Kitware (company) - the best for me (individual)"

"You must cause any modified files to carry prominent notices stating that You changed the files" != some logs in VCS since they

• aren't prominent notices
• aren't distributed alongside with the sources ... reading more -- it should suffice just to include some notice on top of the source code (and within redistributed binaries somehow) that code was modified (no need to list all the changes apparently). IIRC some similar clause exists in GPL ... but I rarely see such notices in the source code under Apache or GPL and it was patched

"patent protection": I have re-read it... ok -- this one might make sense indeed since (if I got it correctly), it provides our project a protection from patent litigation by someone who had the rights to the patented technology which then he contributed to the project... So, indeed if Siemens or Philips decide to contribute to HeuDiConv, it wouldn't hurt to have that protection.

So ok -- agree! ;) Let it be Apache and let's hope it wouldn't fire back (the majority of Python ecosystem is under BSD-3 and MIT AFAIK)

[mvdoc]

So...Apache 2.0 it is?

[yarikoptic]

yeah