
Apache Foundation disallows use of the Facebook “BSD+Patent” license - thelarkinn
https://issues.apache.org/jira/browse/LEGAL-303?focusedCommentId=16088663&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-16088663
======
numair
Finally, people are beginning to realize the insanity of this entire PATENTS
file situation!

When I first brought up how misguided people were for embracing React and
projects with this license, I was downvoted to hell on HN. But really,
everyone, THINK ABOUT IT. This is a company that glorifies and celebrates IP
theft from others, and lionizes their employees who successfully clone others’
projects. They’ve built their entire business on the back of open source
software that wasn’t ever encumbered with the sort of nonsense they’ve
attached to their own projects. And this industry is just going to let them
have it, because the stuff they are putting out is shiny and “convenient” and
free?

Having known so many people involved with Facebook for so long, I have come up
with a phrase to describe the cultural phenomenon I’ve witnessed among them –
ladder kicking. Basically, people who get a leg up from others, and then do
everything in their power to ensure nobody else manages to get there. No, it’s
not “human nature” or “how it works.” Silicon Valley and the tech industry at
large weren’t built by these sorts of people, and we need to be more active in
preventing this mind-virus from spreading.

By the way, the fact that Facebook is using this on their mostly-derivative
nonsense isn’t what should concern you. It’s that Google has decided, as a
defensive measure, to copy Facebook’s move. Take a look at the code repo for
Fuschia and you’ll see what I mean. Imagine if using Kubernetes meant you
could never sue Google?

~~~
cma
Yep, the patent grant is not fully reciprocal. As I understand it:

To use React, you give Facebook permission to use any of your software patents
(edit: all patents, even on a new jet engine) throughout your whole company.
Facebook gives you permission to use only the software patents necessary for
React.

If your company sues Facebook over an unrelated software patent (edit: as
above, any patent), your React license (to the React patents) is pulled and if
your business has any dependency on React that part of your business is broken
until you can port to something else, or you are in license violation if you
keep using it.

On the other hand, if Facebook sues you over a software patent (edit: any
patent) that isn't related to React, they are still free to do so (edit: you
become free to defensively sue with other patents in response and not lose
your license to React patents, meaning with the nuclear analogy below you give
Facebook "first strike" capabilities but are allowed to keep a retaliatory-
only arsenal).

So there is a big asymmetry: all of your software patents for a few of ours.
(edit: all of your patents for a few react software patents)

It's a nuclear arms reduction agreement where Facebook gives up 1% of nukes in
exchange for co-signers giving up 100%.

(edit: as pointed out below, it is a much worse deal: you give up all patents
on everything, not just software patents; Facebook only gives up software
patents on React)

~~~
carussell
> As I understand it: To use React, you give Facebook permission to use any of
> your software patents throughout your whole company.

That is, on its face, absolutely untrue. Nowhere in the React patent terms
does it specify that you grant Facebook rights to use your patents--not even
to ones related to React.

That's something that isn't in the React terms, nor does it seem to show up in
any legal analyses published online from a lawyer making that claim. (None of
the analyses I've seen, at least; if you found some, please post them.) In
fact, the only place where this claim does crop up is in off-the-cuff message
board comments.

FWIW, I don't use React, I don't want to, I'm not a Facebook employee, and in
fact I think the world would be a lot better off with Facebook having less
influence than they do today. But that doesn't change how weird it is to keep
seeing comments like yours that make claims like the one above.

~~~
khuey
It maybe "on its face absolutely untrue" but it is true in practice. If
Facebook infringes your patent and you sue them to enforce you lose the rights
to use any patents React requires. So while you're not required to grant
Facebook rights to use your patents, you are required not to enforce your
rights relating to your patents against Facebook.

~~~
captainmuon
What if there was no patent grant, and just the BSD license?

Then you have no patent protection in the first place! You are in the same
situation as when the patent grant expired because you sued them. I don't see
how this is any better.

You _do not_ give them a license to use any patent. You are right that in
practice the non-enforcement means that they can willy-nilly use your patents.
But if we are arguing about factual ability vs legal rights - they can
probably already to that, due to the fact that they likely have more money and
better lawyers then you do.

~~~
khuey
Yes, you're right that "BSD+patent"+"revoked patent grant because you sued
Facebook over another patent" is pretty much the same as just BSD from the
start. Licensing software you know you have patents on under BSD only with no
patent grant would be pretty awful, of course.

If Facebook wanted to be the good guys here they would license under Apache
2.0 or write their own symmetric patent grant. They already relicensed RocksDB
after Apache's move, perhaps they will do the rest of their stuff too.

~~~
merijnv
> "BSD+patent"+"revoked patent grant because you sued Facebook over another
> patent" is pretty much the same as just BSD from the start.

Not really. If you have BSD with no patent grants you can at least argue that
there's an implicit patent grant. If there's an explicit patent grant which
you violated/got terminated that defence is clearly not going to fly.

~~~
khuey
I'm not a lawyer but my understanding is the case for an implicit patent grant
with BSD is pretty weak.

------
erichocean
To anyone concerned about React's virtual DOM and diff'ing stuff, and a
potential Facebook patent thereof, in early 2012 I wrote and published (under
a GLPv3 license) a virtual DOM implementation with efficient diff'ing when I
forked SproutCore[0] to become Blossom.[1]

So even if Facebook tries to patent that particular invention/innovation, it
may not stand up to legal scrutiny depending on the filing date. AFAIK,
Facebook didn't do a provisional patent for virtual DOM stuff before July 2012
(long after I released Blossom), because that patent filing would have become
public AT THE LATEST on January 1st, 2016 and nothing has come to light that
I'm aware of.

So…you _should_ be safe (IANAL).

[0] Ironically given the subsequent popularity of React, the SproutCore team
rejected my virtual DOM approach which is why I had to fork it. Live and
learn. I actually came up with the specific virtual DOM + diff design in
spring 2008, but didn't get around to writing the code for it until someone
paid me to do it (I had asked Apple and they declined). Eventually, the
copyright owner of SproutCore (Strobe, Inc.) got bought by Facebook, though I
don't recall when…

[1]
[https://github.com/erichocean/blossom](https://github.com/erichocean/blossom)

------
softinio
I really have no idea why react is so popular with such a silly license.

I agree with this move.

There are plenty of OSS projects out there without patent thing attached to
its license so no reason to use react.

~~~
TheAceOfHearts
Considering almost every single large tech company is using React, presumably
there's not much reason for concern? IANAL.

But you're not wrong, preact is a great alternative to react and it comes with
a permissive license.

~~~
Steeeve
> Considering almost every single large tech company is using React

React isn't as popular in the real world as it is on HN.

~~~
madeofpalk
Well, I guess it depends on what you mean 'almost every single large tech
company', but React is used by Facebook (of course), Apple, Twitter, Yahoo,
Netflix, Amazon, just to name a few.

~~~
Avshalom
you have only named a few though; 'almost every single large tech company'
requires a _particular_ definition of large tech company or a lot more than a
few to be a useful(ly true) statement

~~~
objclxt
Take a look here:

[https://github.com/facebook/react/wiki/sites-using-
react](https://github.com/facebook/react/wiki/sites-using-react)

...that's obviously not complete, either. If you think of a large tech company
the odds are they are using react somewhere for something, be it public facing
or internal tooling. Many of the companies that _aren 't_ actively using React
do so because they have their own JS stacks to dogfood (like Google and
Angular).

~~~
chrisco255
Google hardly dogfoods Angular. They use Closure for most of their apps. SPF
for YouTube. Polymer in some places. GWT in many others.

------
clarkevans
I'm not a lawyer, but perhaps Facebook's BSD+Patent license is not even open
source.

It's tempting to consider the BSD license independent of the additional patent
license. However, the OSI has not approved CC0 as being open source precisely
because it expressly reserves patent rights [0]. In the OSI's justification,
permissive MIT and BSD licenses may provide implicit patent license, so by
themselves they are open source. However, like CC0, BSD+Patents expressly
exclude this possibility. Indeed, Facebook's licensing FAQ deems the combined
work of the BSD+patents to be the license [1]. Further, recent court case has
shown that these licenses are not simply copyright or patent statements, but
can be actual contracts [2].

Hence, we have to consider the BSD text + the patents file text as the
combined license. This license is not symmetric and hence may violate OSI
license standards. I've made this comment in the facebook bug report,
[https://github.com/facebook/react/issues/10191](https://github.com/facebook/react/issues/10191)

[0] [https://opensource.org/faq#cc-zero](https://opensource.org/faq#cc-zero)
[1]
[https://code.facebook.com/pages/850928938376556](https://code.facebook.com/pages/850928938376556)
[2] [https://perens.com/blog/2017/05/28/understanding-the-gpl-
is-...](https://perens.com/blog/2017/05/28/understanding-the-gpl-is-a-
contract-court-case/)

------
captainmuon
I think this is an overreaction (pun accidental).

There are two things here: The copyright license, and the patent grant.
Copyright applies to the concrete implementation. You have to agree to the
license to be subject to it, and to legally use the code.

A potential patent applies to any implementation. Even if you write a clean-
room clone of React, if it uses the same patent, Facebook has a patent claim.
But that means the patent grant is not specific to the code; it doesn't even
require consent, Facebook could allow you conditional patent usage even
without your knowledge! A corollary is that you are strictly better off with
the patent grant, it imposes no additional constraints on you.

License with no patent grant: Facebook can sue you for infringing patents,
even if you are using a clone!

License with patent grant: Facebook cannot sue you for infringing patents,
unless you do it first.

\----

Second, I think the philosophy behind the patent grant is twofold: 1) that
software patents are not legitimate. Enforcing a patent is not seen as a
legitimate right, but an annoyance, like pissing on someones lawn. From that
point of view, it seems not asked too much from somebody to refrain from doing
that. (I don't know if that was the idea of the people who drafted that
license, but it wouldn't surprise me.)

\----

Another, unrelated observation (and please don't invalidate the first
observations if this one is wrong as internet commentators are wont to do):

I see nowhere in the license [1] that it _requires_ you to take the patent
grant. Is that true? It would be silly to refuse it, because you are strictly
better off with it, of course.

[1]
[https://github.com/facebook/react/blob/master/LICENSE](https://github.com/facebook/react/blob/master/LICENSE)

~~~
discordianfish
That's how I understand the patent grant too. Are people here really confusing
a grant with some sort of restricting of their freedom or do we miss
something? I frankly don't want to believe everyone, including apache
foundation, believes this without getting their facts straight..?

~~~
cyphar
The problem is that unlike the Apache 2.0 or GPLv3 patent grants, the React
license restricts you from suing Facebook for _any_ patent (even non-software
patents).

And note that that Facebook doesn't reciprocate that, and so if they decide to
sue you for any alleged patent infringement then you cannot counter-sue for
patent infringement they may be committing if you are using React. Also it
makes you far weaker in negotiations about patent portfolios.

I personally dislike this whole patent business, but I can imagine even pro-
patent people would also be against this.

~~~
discordianfish
In what way does it restrict you from suing Facebook?

From what I can tell the patent grant is only beneficial to users of the
software, not facebook. And it exists to address the concerns people might
have that, if they use any facebook tech, they might risk getting sued. If you
decide to sue, you're as good off as before. But if you don't sue, you can be
sure facebook will never sue you either for violation of the patents they
granted.

~~~
CodeWriter23
> In what way does it restrict you from suing Facebook?

Economically, by losing the license to use React in your product once you
serve them with papers. It's an implied gun to the head. Or poison pill, if
you prefer.

~~~
discordianfish
You're not losing the license to use React if you sue Facebook. You only loose
the patent grant if you do. In which case you're off as without a grant in the
first place. At least that's how I understand it, so this still looks to me
like people raging about something they simply don't understand.

------
fencepost
I was interested in React based on what I'd read and was figuring it'd be
worth looking into, but this provides all the reason I need to avoid it - I
don't forsee a situation where I would personally or as a small company be
suing Facebook, but I could see developing something then selling/trying to
sell it to a larger company. If my code comes with a big side of "oh, and if
you buy this you won't be able to sue Facebook or its affiliated companies for
patent infringement" that could significantly hurt sales chances.

~~~
mlsarecmg
You can't avoid react because it started a new paradigm. 9 out of 10
frameworks are based on the same principles and native follows suit where even
big vendors are changing their strategies for mobile and desktop to align them
with reacts principles (react-native, microsofts react-native-windows, reactxp
and office fiber, googles kotlin for android, litho, componentkit, etc).
Switching from react to something else is sometimes as simple as adding an
alias in webpack. If you don't like the license, use preact, inferno, etc. But
the idea itself is way too valuable to be in any way affected by petty
licensing issues.

~~~
threatofrain
The paradigm is everywhere, so just use another library that uses that
paradigm, like Inferno or Preact, or even something slightly different like
Vue if you want.

~~~
chrisco255
The point is those other libraries could be in violation of any patents that
Facebook may or may not have with regards to React. Perhaps they have a patent
on virtual DOM? That would mean your usage of Inferno, Preact, Vue, or Angular
2+ would violate the patent.

~~~
mlsarecmg
That would frankly be impossible. All JSX boils down to is h(name, properties,
children) and that is literally it. Each reconciler is different, uses another
v-dom, etc. If you wanted to patent react, you patent the mere use of
functions. And not just that there are about 20 years of fair use of similar
principles, even for jsx in particular which evolved from mozillas e4x and
otherwise keeps to basic xml markup and mustaches.

~~~
chrisco255
I would like to think it's impossible. I just have seen crazier things
patented
before...[https://en.wikipedia.org/wiki/1-Click](https://en.wikipedia.org/wiki/1-Click)

------
chx
RocksDB has fixed this
[https://github.com/facebook/rocksdb/commit/3c327ac2d0fd50bbd...](https://github.com/facebook/rocksdb/commit/3c327ac2d0fd50bbd82fe1f1af5de909dad769e6)
now and moved to Apache / GPL dual license.

~~~
sheeshkebab
they should fix it the same way in react and react-native repos (delete the
PATENTS file).

~~~
whatnotests
PR submitted.

[https://github.com/facebook/react/pull/10194](https://github.com/facebook/react/pull/10194)

~~~
sheeshkebab
Nice try!

------
altotrees
I worked or a large company on several web-based apps right around the time
React came out. There were some UI issues I thought could be sorted easily
using React.

After going to our lead dev, who in turn went to our project manager, we
received an email from our legal department a few days later that simply
stated we would not be using React due to "certain patent constraints."

Having not done any prior research, I looked into what the problem might be
and was pretty floored with what I found. At first I scoffed when they said
no, but after reading about the patent situation I totally get it.

------
jorgemf
Can someone explain how this can affect to projects using react, as in a part
of a product of a company or personal projects? Thanks

I found this [1]:

> FB is not interested in pursuing the more draconian possibilities of the
> BSD+patents license. If that is true, there is actually very little
> difference between BSD+patents and the Apache license. As such, relicensing
> should make little if any pragmatic difference to Facebook.

So what happens if Facebook doesn't change the license and in the future
changes its mind?

[1]
[https://github.com/facebook/react/issues/10191](https://github.com/facebook/react/issues/10191)

~~~
geofft
From Mark Thomas's comment on this bug:

> _My reading of that is if you use this code and Facebook infringes a
> completely unrelated patent that you own, you can 't sue them for
> infringement without giving up this patent license. That is much broader
> than the language in the ALv2 which is limited to a single work._

So it almost certainly doesn't affect personal projects unless you are the
sort of person who files for patents as a hobby, but for a commercial project,
the scenario, I think, is that if you own some patent (not even a software
patent!) and you sue Facebook for it, you lose your patent rights to React. In
effect, you may as well be granting Facebook a patent license to literally all
your patents for use in any context, in exchange for using React.

Also, it's not just Facebook: it also covers suing anyone for infringing your
patent in their use of any other Facebook product or service, as well as "any
party relating to" React -- so quite possibly, depending on how lawyers and
judges read the license, you can't enforce your non-software patents against
anyone who uses React.

~~~
tomelders
I think this is misleading. In the event that you bring a patent infringement
case against Facebook, you still have a license to use react, but you lose the
patent rights that would cover you if you came up with something that
infringed on a Facebook patent. Meaning that you now have to fight your case
in court without any protection. You're safer with this license and the patent
grant, than you are without it. The BSD license on it's own, and the MIT
license don't give you any sort of patent grant at all.

~~~
geofft
That depends on whether you believe that the BSD license gives you an implied
patent grant - it does, after all, just say "Redistribution and use...are
permitted," without saying anything specific to copyright.

See also
[http://en.swpat.org/wiki/Implicit_patent_licence](http://en.swpat.org/wiki/Implicit_patent_licence)

If the concept of an implicit patent license is coherent and legally
meaningful (it sounds like it is), then an _explicit_ patent license, like
Facebook's, would supersede it - and so losing your rights under the explicit
license would leave you worse off than relying on the implicit one.

In any case, this is why people like the Apache license and the GPLv3, so you
don't have to think about whether a patent license is implied. Both of those
have explicit patent licenses with significantly less draconian termination
clauses than Facebook's.

(Obviously I am not a lawyer, otherwise I'd know better than to comment on HN
about unclear areas of IP law.)

------
j_s
So push finally comes to shove.

Glad the long-term legal implications will be given serious consideration
publicly, rather than the "this is not the droid you're looking for" I've seen
nearly everywhere so far!

------
rdtsc
I was wondering about a similar issue for zstd compression library. It has a
similar BSD+Patentsfile thing.

There is an issue with a related discussion about it going for more than a
year:

[https://github.com/facebook/zstd/issues/335](https://github.com/facebook/zstd/issues/335)

Last update is interesting. Someone did a search and looked for any patents FB
filed for and couldn't find any in last year. So somehow based on that they
decided things are "OK".

To quote:

\---

US allows to patent up to a year after the publication, allowing to conclude
that ZSTD remains free of patents (?) - suggesting this "The license granted
hereunder will terminate, automatically and without notice (...)" from PATENTS
file has no legal meaning (?)

\---

Anyone care to validate how true that statement is?

~~~
beagle3
They do not _have_ to publish. The USPTO will publish patents (provisional or
full) 18 months after filing, so -- at the very least -- one has to wait 18
months.

It is also quite possible that facebook collects patents under a different
name, e.g. "faceless intellect llc", a wholly owned subsidiary of Facebook. Or
they may have bought patents that are essential for ZSTD from someone else who
filed them independently.

The conclusion that "zstd remains free of patents" is baseless and made by
someone who is not familiar with patent practice.

~~~
Nullabillity
> They do not have to publish. The USPTO will publish patents (provisional or
> full) 18 months after filing, so -- at the very least -- one has to wait 18
> months.

Holy shit, _what_?! The US patent system means that you can infringe on
patents that you had no way to know even existed at that point in time? How
the fuck can someone look at this policy and think that it's in any way
reasonable?!

~~~
beagle3
They also publish at grant of course. It's just that it rarely takes less than
2 years from filing to grant so first publication by USPTO is usually pre-
approval, 18 month from filing

------
TheAceOfHearts
In the discussion they say RocksDB will be relicensed under dual license
Apache 2 and GPL 2.

There's already an issue [0] asking them to consider doing something similar
for react, and Dan Abramov said he'd route the request internally on the next
work day.

I can't imagine they'd keep the existing license without harming their
community image. But even if they keep the license, many applications should
be able to easily migrate to preact [1] and preact-compat, which provides a
react-compatible API.

Hopefully they relicense the project. It seems like it's the first thing that
gets brought up each time react gets mentioned.

[0]
[https://github.com/facebook/react/issues/10191](https://github.com/facebook/react/issues/10191)

[1] [https://preactjs.com](https://preactjs.com)

~~~
Lazare
What patents do you imagine Facebook might have on React's concepts that
Preact would not also violate?

~~~
pmontra
Probably any patent FB has on React. The point is, did FB enumerate the
patents they have on React or they keep the list secret?

~~~
Lazare
A React developer is on record some months ago as saying that as far as he
_personally_ is aware, no such patents exist. Further, patents are a matter of
public record, and to date, nobody has identified a patent that might cover
React.

Of course, a random comment from a React dev on github carries no legal
weight, and absence of evidence is not evidence of absence. But so far the
picture being painted seems consistent with there being no list of patents at
all, secret or otherwise.

------
learc83
If Facebook has patents that cover React functionality. They almost certainly
cover parts of other JavaScript frameworks. React is well executed, but it's
conceptually simple.

I don't think avoiding React makes you any safer. You don't know how broadly
Facebook or the courts will interpret their patents.

------
tomelders
Ok. With the BSD + patent grant

Do you have a license to use Facebook's patents? Yes.

Do you have a license to use Facebooks patents if Facebook brings a patent
case against you? Yes.

Do you have a license to use Facebooks patents if you bring a patent case
against us? No.

If you do not have a patent grant, can you still use React? YES!

If you're going to down vote this, please say why. This is how I interpret the
license plus patent grant. If I'm wrong, I'd like to know why.

~~~
Lazare
No, you're quite right.

The license to _use_ React is governed by the BSD license, and it's not
terminated if you end up suing Facebook over their violation of you VR patents
or whatever.

Edit: Downvoted for a factual answer? There's a host of sources confirming by
answer as correct, including Facebook's official FAQ on React licensing[0].

Q: "Does termination of the additional patent grant in the Facebook
BSD+Patents license cause the copyright license to also terminate?"

A: "No."

That's about as simple as it gets.

[0]:
[https://code.facebook.com/pages/850928938376556](https://code.facebook.com/pages/850928938376556)

~~~
afro88
Apologies for the dumb question, but what rights do you lose if the patent
license is terminated?

I mean, if you can use the software without the patent license, what is the
patent license giving you?

~~~
Lazare
> I mean, if you can use the software without the patent license, what is the
> patent license giving you?

Facebook may or may not have some patents covering concepts or algorithms used
in React. If they do (nobody is aware of any), then they could sue you for
using React, or any other framework which uses the same underlying concepts
(eg, Preact, maybe Vue, possibly Angular 2.x, etc., depending on what the
patents cover). If they did sue you, a valid patent grant (which you obtain by
using React) would be a very strong defence, and would be quite useful.

The value is real...but quite narrow in scope. :)

~~~
tomelders
I think the patent grant applies to everything you make, not just anything
involving react.

~~~
Lazare
I'm not entirely sure what you're trying to say. The patent grant applies to
_Facebook 's_ patents (if any) on the tech used in _React_.

> I think the patent grant applies to everything you make

Yes, if you have a patent grant from using React, it would be a defence from
claims that things you have written that do not use React violate patents
included in the grant.

~~~
tomelders
I just re-read it, you're correct. It only covers React

> For avoidance of doubt, no license is granted under Facebook's rights in any
> patent claims that are infringed by (i) modifications to the Software made
> by you or any third party or (ii) the Software in combination with any
> software or other technology.

------
tomelders
INAL - But this seems strange to me. The Apache license has what I see as
being the same patent grant, with the same condition that if you make a claim
against them, you lose the patent grant.

Apache 2.0

> 3\. Grant of Patent License. Subject to the terms and conditions of this
> License, each Contributor hereby grants to You a perpetual, worldwide, non-
> exclusive, no-charge, royalty-free, irrevocable (except as stated in this
> section) patent license to make, have made, use, offer to sell, sell,
> import, and otherwise transfer the Work, where such license applies only to
> those patent claims licensable by such Contributor that are necessarily
> infringed by their Contribution(s) alone or by combination of their
> Contribution(s) with the Work to which such Contribution(s) was submitted.
> If You institute patent litigation against any entity (including a cross-
> claim or counterclaim in a lawsuit) alleging that the Work or a Contribution
> incorporated within the Work constitutes direct or contributory patent
> infringement, then any patent licenses granted to You under this License for
> that Work shall terminate as of the date such litigation is filed.

The important bit being...

> If You institute patent litigation against any entity (including a cross-
> claim or counterclaim in a lawsuit) alleging that the Work or a Contribution
> incorporated within the Work constitutes direct or contributory patent
> infringement, then any patent licenses granted to You under this License for
> that Work shall terminate as of the date such litigation is filed.

But what people seem to be missing (as far as I can tell) is that you don't
lose the licence to use the software. You just lose the patent grants. But
with the BSD licence alone, you lose both the patent grand AND the licence. I
really don't see how the Apache 2.0 License and Facebook's BSD+Patent Grant
are any different.

~~~
FRex
I'm neither and English isn't my first language (not that legalese is even
close to any sane kind of English from last 200 years..) but due to my deep
interest in Free and Open software, old games reimplementations, abandonware,
reverse engineers and emulation I spent quite a while reading about legal
stuff.

The part you said is important sounds like you lose the right to use the
patent in the given software if you attempt to sue someone over patents in
that software which sounds absolutely sane.

In facebook's case they terminate the patent grant given to you for you trying
to sue them for any patent, except a counterclaim if they sue first:
[https://github.com/facebook/react/commit/b8ba8c83f318b84e429...](https://github.com/facebook/react/commit/b8ba8c83f318b84e42933f6928f231dc0918f864)

And even that is just few years ago, RakNet that Facebook owns via Occulus is
still using the old wording:
[https://github.com/facebookarchive/RakNet/blob/master/PATENT...](https://github.com/facebookarchive/RakNet/blob/master/PATENTS)

So basically the difference boils down to the CAPS part below:

Apache 2.0: we grant you use of these patents, sue anyone over one of the
patents we gave you and we take that grant away.

Facebook's BSD: we grant you use of these patents, sue anyone over one of the
patents we gave you OR SUE US OVER ANY PATENT AT ALL and we take that grant
away.

Another difference is what is covered. Apache is about suing, Facebook's BSD
says you can't even 'take a direct financial interest in' any of the stuff
they don't want you doing.

~~~
matthewmacleod
_Another difference is what is covered. Apache is about suing, Facebook 's BSD
says you can't even 'take a direct financial interest in' any of the stuff
they don't want you doing._

I do fully support this bit though, which is specifically to avoid that whole
thing where Microsoft was bankrolling patent trolls.

~~~
FRex
This says you can't even seriously financially consider suing them or even
call them out in any way over ANY of your patents.

If you happen to be a ML/VR/cars company and think "oh, we use React on one
tiny website that'd be cheap to rewrite and Facebook uses without paying our
42314 super expensive patents for ML and self driving cars and VR.. should we
sue them?" you already are using React patents illegally because you took
financial interest in patent assertion.

With that wording taking out the "you (or any of your subsidiaries, corporate
affiliates or agents)" part would still cover cases like bankrolling patent
trolls that sue.

And 'patent assertion' means: >A "Patent Assertion" is any lawsuit or other
action alleging direct, indirect, or contributory infringement or inducement
to infringe any patent, including a cross-claim or counterclaim.

So basically, thanks to that language, being that kind of a company I
mentioned above, you could write a blog post saying "WTF, we use React and
Facebook uses our expensive shit for free!?!" or even a legal letter to them
to stop using patents without getting a grant from you and lose your patent
grant already because you are 'alleging' or 'taking financial interest' in
'alleging' or 'lawsuit'.

And other users of software are only protected from you suing them over React
patents like in Apache license, Facebook is protected in a special separate
way from any patent lawsuit, allegation or even financial consideration of a
lawsuit or allegation.

This is very one sided and the reason why I immediately remembered RakNet
PATENTS file I've seen back in 2014 when I got hyped over RakNet being open
source is because it stuck in my mind how stupid and one sided that patent
grant was.

------
mixedbit
Does this mean that a startup that uses React becomes un-buyable for any
company that sells or plans to sell patent rights to Facebook?

~~~
HappyTypist
No, they can replace it with Preact pretty simply.

------
ec109685
I don't understand how code with a bsd license without a patent grant is
better for the apache foundation than facebook's bsd + patent license. With
the former, the entity donating the source can sue you for patent infringement
at any time.

Clearly the apache 2 license would be preferable (and what rocks db did), but
I am puzzled the foundation accepts bsd code in their products, given their
worry about patents.

------
vbernat
How did Facebook was able to change the license of RocksDB so easily? The CLA
is not a copyright assignment and therefore all contributors have to agree for
the change. Did they contact anyone who has signed up the CLA?

~~~
khuey
On purely copyright grounds, any BSD licensed code can be relicensed as Apache
2.0 code. And the patent grant was solely from Facebook so it can be modified
at their discretion.

~~~
dchest
This is incorrect. Here's the full text of BSD license:

    
    
        Copyright (c) 2011 The LevelDB Authors. All rights reserved.
        
        Redistribution and use in source and binary forms, with or without
        modification, are permitted provided that the following conditions are
        met:
        
           * Redistributions of source code must retain the above copyright
        notice, this list of conditions and the following disclaimer.
           * Redistributions in binary form must reproduce the above
        copyright notice, this list of conditions and the following disclaimer
        in the documentation and/or other materials provided with the
        distribution.
           * Neither the name of Google Inc. nor the names of its
        contributors may be used to endorse or promote products derived from
        this software without specific prior written permission.
        
        THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
        "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
        LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
        A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
        OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
        SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
        LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
        DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
        THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
        (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
        OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
        View
    
    

The first list item disproves your statement.

~~~
thrillgore
There is a similar clause in the MIT License, which is even weaker than the
BSD License.

~~~
dchest
MIT license includes the right to sublicense, however the terms of
sublicensing is retaining the original copyright and permission notices, so
you'll still have to retain the large portion of the MIT license text.

------
Xeoncross
> Does the additional patent grant in the Facebook BSD+Patents license
> terminate if I create a competing product?

> No.

> Does the additional patent grant in the Facebook BSD+Patents license
> terminate if I sue Facebook for something other than patent infringement?

> No.

[https://code.facebook.com/pages/850928938376556](https://code.facebook.com/pages/850928938376556)

Consider re-licensing to AL v2.0:
[https://github.com/facebook/react/issues/10191](https://github.com/facebook/react/issues/10191)

~~~
colejohnson66
> The license granted hereunder will terminate, automatically and without
> notice, if you (or any of your subsidiaries, corporate affiliates or agents)
> initiate directly or indirectly, or take a direct financial interest in, any
> Patent Assertion: (i) against Facebook or any of its subsidiaries or
> corporate affiliates, (ii) against any party if such Patent Assertion arises
> in whole or in part from any software, technology, product or service of
> Facebook or any of its subsidiaries or corporate affiliates, or (iii)
> against any party relating to the Software. Notwithstanding the foregoing,
> if Facebook or any of its subsidiaries or corporate affiliates files a
> lawsuit alleging patent infringement against you in the first instance, and
> you respond by filing a patent infringement counterclaim in that lawsuit
> against that party that is unrelated to the Software, the license granted
> hereunder will not terminate under section (i) of this paragraph due to such
> counterclaim.

[https://github.com/facebook/react/blob/master/PATENTS](https://github.com/facebook/react/blob/master/PATENTS)

The actual license text is what matters, not what some intern wrote on a page.

~~~
charleslmunger
>Facebook or any of its subsidiaries or corporate affiliates files a lawsuit

And then

>against that party

IANAL, but does that mean that if Facebook proper transfers a patent to a new
subsidiary (wholly owned patent troll) they can sue you, and the only patent
counterclaim you can make without terminating your ready license is against
the troll subsidiary, not Facebook proper?

------
vxNsr
>> David Recordon Added Yesterday 21:10 Hi all, wanted to jump in here to let
everyone know that the RocksDB team is adjusting the licensing such that it
will be dual-licensed under the Apache 2 and GPL 2 (for MySQL compatibility)
licenses. This should happen shortly and well ahead of August 31st. I'll leave
the history and philosophy around licensing alone since it's generally a
complex discussion to have and I'm not sure that it has actually been fully
captured in this thread especially vis a vis Facebook's intent. Hopefully this
morning's guidance to PMCs can be adjusted since I don't think any of us see a
bunch of extra engineering effort as a desirable thing across the ASF projects
which are already making use of RocksDB Thanks, \--David

Looks like they're working on amending this issue, could very well be a case
of legal getting involved and the regular engineers not realizing the change
or simply not paying attention. Alternatively, maybe this is just crisis
management and they were just hoping this wouldn't happen.

------
issa
I rejected using React in a project just for this reason. I'll be perfectly
honest: I didn't (and still don't) completely understand the implications, but
on it's face it sounds like trouble.

------
geofft
Am I reading this right that Apache's unwillingness to use rocksdb under the
custom license pressured Facebook into switching to Apache || GPLv2? That is
pretty cool!

~~~
MVorlm
I don't think Facebook has done anything yet. The ticket was only opened 4
hours ago.

~~~
geofft
Facebook relicensed RocksDB to dual Apache and GPLv2 3 hours ago:
[https://github.com/facebook/rocksdb/pull/2589](https://github.com/facebook/rocksdb/pull/2589)

~~~
droidist2
Yes! People are also now starting to pressure Facebook to change React's
license.

[https://github.com/facebook/react/issues/10191](https://github.com/facebook/react/issues/10191)

------
plastroltech
There is so much FUD around this PATENTS file.

If Facebook had not included this Patent grant and had released React under
only the BSD license then any user would be in the exact situation which
everyone is complaining so loudly about being in IF they decide to bring a
patent action against Facebook. Specifically, you would be open to being sued
by Facebook for violating a patent which they own.

What this grant says is for one specific circumstance (you haven't brought a
patent suit against them) and for one specific limited set of patents (those
related to React), Facebook will not sue you. If you like that protection then
don't sue them. If you decide that you do want to bring a patent suit against
them then you're right back where you were to begin with. Your one small
limited protection is removed and Facebook can once again sue you if you
violate one of their patents - just like they could before you started using
React in the first place.

This business about it being asymmetrical is IMO a distraction. What would it
mean for it to be symmetrical? That it would only trigger if you sue them for
a patent violation related to React? What does that mean? You don't hold React
patents, Facebook does. How would you sue them for a violation of a React
patent? It makes no sense.

~~~
webmink
To put it concisely, “why is having a patent license until you commence
litigation worse than not having one at all?” The answer is subtle.

Many corporate lawyers operate on the assumption that all open source licenses
that do not mention patents (BSD, MIT etc) implicitly grant a patent license.
Clarifying this ambiguity is seen by them as harmful — that’s why approval of
CC0 at OSI was abandoned[1], for example. Including an explicit patent grant
removes the possibility this could be argued in court and is seen as an
escalation of the patent conflict by Facebook.

Given many voices at Apache are being quietly guided by corporate counsel,
this seems the most likely underlying explanation for the antipathy that's
been rationalised out into the open.

[1] [https://opensource.org/faq#cc-zero](https://opensource.org/faq#cc-zero)

------
isaac_is_goat
If you can't use React because of the license, use InfernoJS (MIT). In
fact...you should probably use Inferno JS anyway.

~~~
ec109685
Using InfernoJS doesn't mean you aren't infringing on Facebook patents.

~~~
trueadm
A very large software company that use Inferno in production already had their
legal team look into Inferno. It didn't infringe on any patents.

~~~
ec109685
What makes it different than react in that respect?

------
didibus
So if I understand correctly, by using React, you agree that if you sue
Facebook, you'll need to stop using React? And that goes no matter the reason
why you're suing them for?

So say Facebook was infringing on one of your patent, you could still sue
them, but you'd have to give up React if you did. Is that correct?

~~~
matthewmacleod
No, this is not correct.

If you sue Facebook for infringing on your patents, then you lose the rights
to any patents which Facebook may or may not have on parts of React.

Nobody has, to my knowledge, found one of these patents to date.

~~~
stale2002
Then why does that line even exist? Why doesn't facebook just get rid of it
entirely?

~~~
JepZ
Probably they just want to keep to door open and when some oracle comes
around, their lawyers can make up some connections to patents facebook has
then.

------
nsser
Facebook's open source projects are potential trojan horses.

~~~
seattle_spring
That's an interesting opinion you've got there, Alex Jones.

~~~
2_listerine_pls
How can I downvote you?

~~~
quickthrower
You need 424 more karma points.

------
jzelinskie
As the other comments say, RocksDB is going to be dual licensed both GPLv2 and
Apache. What's the advantage to doing so? If I choose to consume the library
via the Apache license, I'd never have to contribute back code; doesn't this
invalidate the copyleft of GPLv2?

~~~
rdtsc
The copyright owner gets to decide how to license their stuff.

So my guess, is Apache and GPLv2 together makes sense if author wants to give
the user the maximum choice in combining the library with other software. That
because depending which lawyers you ask Apache and GPL are not always
compatible.

So say your code is Apache and you want to use RocksDB, you can pick to use
the Apache license for it. Your code is GPL, then you can pick GPL.

------
gedy
This keeps coming up as a concern with back and forth "it's a big deal"/"it's
not a big deal" \- so if FB has no ill-intent from this, are there any simple,
obvious changes they could/should make to the React license?

~~~
erichocean
Sure, Facebook could do what they did for RocksDB and use the Apache 2 license
(and optionally, the GPLv2). People have been asking/telling Facebook to do
just that for at least a year.

The reason Facebook doesn't, I assume—and this is just my personal opinion—is
because Facebook wants to do evil shit in the future that the Apache 2
wouldn't allow them to do. Otherwise, I just don't see any value for Facebook
in all the negative publicity they've gotten over this idiotic patent grant
crap they're trying to pull.

------
maxsavin
And now, for a tinfoil hat moment: even though companies like Microsoft and
Google are using Facebook's libraries, it is possible that they have some kind
of private deal in regards to the patents clause.

~~~
hocuspocus
I work at a fairly big company that has a good relationship with Facebook
(they're a customer and partner) and we aren't allowed to use React or zstd.

But MS and Google are big fish relative to Facebook, private deal or not.

------
alecco
This is the major drawback of adoption for Zstandard, too.

------
Steeeve
Interesting note from the discussion:

> As noted earlier, the availability of a GPLv2 license does not preclude
> inclusion by an ASF project. If patent rights are not conferred by the
> 3-clause BSD and required by ASLv2 then would not these licenses be
> incompatible?

\---

> he has discussed the matter with FB's counsel and the word is that the FB
> license is intentionally incompatible. It is hard to make the argument that
> it is compatible after hearing that.

------
snarfy
Is it any patent, or only patents pertaining to the "Software" as defined in
the license (react)?

I cannot sue Facebook for patents in react or lose my react license, but I
could some other patent I own e.g. fizzbuzz that Facebook is violating. Is
this correct or is it _any_ patent?

If it is _any_ patent, I cannot believe that was the intent even if that's how
Apache Foundation is interpreting it.

------
ouid
If your landlord does something that they would normally be within their
rights to do in retaliation to you enforcing some other provision in your
agreement, then it is illegal. I'd bet that this was not the kind of statute
that they could override in a lease agreement.

I wonder if such a clause is actually enforceable. Are there any actual cases
where this clause was invoked?

------
brooklyntribe
I'm a vue.js guy myself. Think it's far more cooler then React. And not every
going to face this issue, me thinks.

:-)

~~~
d0100
Unless Facebook has a patent on some particular virtual-dom related tech that
Vue uses. Then you got zero patent grants, and can be sued at any time.

------
Communitivity
Thanks to David Recordon this has now been fixed and RocksDB is now dual
licensed under Apache or GPL 2. The ball has been started to have the same
change occur at React, which AFAIK is still under the old BSD+Patents license.
Please click through the OP's link to get the current details.

------
didibus
What patent does React depends on?

------
hellbanner
What will Facebook have to do now - they either have to opensource their
infringing software or re-write them convincingly (Wasn't there an Oracle vs
Google case about duplicate implementations of a function?)

------
rmgraham
IANAL, but...

People should be aware that Atom (the editor) uses React internally, so it's
possible you face similar legal exposure without even shipping anything just
because you agreed to the terms by installing an editor.

------
vbernat
Reading a bit more the thread, it's quite surprising. The assignee is Chris
Mattmann. From his webpage, he is not a legal counsel. The only evidence of a
problem they show is that BSD alone implies a patent grant but coupled with an
explicit patent grant, this is not the case anymore. The other evidence is
brought by Roy Fielding who does not appear to be a legal counsel either about
a discussion (oral?) with Facebook's legal counsel that the license is
incompatible with ASLv2.

The whole decision seems to have been taken by "not-a-lawyer" people with
their own interpretations. Doesn't the Apache Foundation have some software
lawyers they can ask?

~~~
smarx007
Cheers, Chris Mattmann VP Legal Affairs

WUT?

~~~
vbernat
Damn. My bad.

------
hordeallergy
When has Facebook ever demonstrated any integrity? Why anyone chooses to have
any association with them is inexplicable to me.

------
shams93
Do 3rd party implementations like inferno or preact have legal issues from
being based off Facebook intellectual property?

------
Kiro
Why would I care about patents if I'm outside the US? Software patents are not
even valid where I live.

~~~
ergo14
You work in vacuum?

~~~
floatboth
In many many jurisdictions, software is not patentable
[https://en.wikipedia.org/wiki/Software_patent#Jurisdictions](https://en.wikipedia.org/wiki/Software_patent#Jurisdictions)

You usually can get patents for "software-related inventions" but there's no
huge "software patents" problem in most other places like there is in the US.

~~~
ergo14
I'm perfectly aware of that software patents are not enforceable in country I
live in as far as I can tell. At same time I work with companies across the
globe so I have to at least think at possible implications of licenses.

------
flushandforget
Please can someone paraphrase the implications of this. It's hard for me to
understand.

~~~
jjirsa
I opened the issue, as a member of the Apache Cassandra PMC, because a
committer employed at FB has a POC that uses RocksDB as a Cassandra storage
engine, and wanted to gauge the viability of upstreaming it.

LEGAL-303 (the issue linked here) was opened to ensure that we were legally
clear to do that. The answer of "no" basically means that a project such as
Cassandra:

\- Can create a pluggable storage engine that enables RocksDB

\- Can not have the RocksDB implementation of that plugin in an Apache repo

There were about half a dozen other ASF projects (Kafka, Samza, etc) that had
some reference to RocksDB in their source, that likely would have been
impacted.

There are about 50 ASF projects that seem to have some reference to React in
their source, which (as this HN comment section clearly noticed) is much more
heavily used, and seems to scare more people.

The RocksDB team has already re-licensed the project to make it compatible.

Whether or not that happens with React will determine the apache projects'
reactions - a product like CouchDB, which uses react for its database user
interface, may have to strip it out (or use a drop-in alternative) before
their next release, which is probably a LOT of work for someone.

------
luord
I've never liked react (and not only because of the sketchy licensing, in
fact, that's fairly low among my qualms about react) so it's nice to see
validation.

I'm sticking with Vue, even if (and that's a big if) it might also infringe
facebook patents.

------
anon335dtzbvc
I've made a pull request to fix that situation
[https://github.com/facebook/react/pull/10195](https://github.com/facebook/react/pull/10195)

~~~
dis-sys
already closed.

------
guelo
I hate Facebook but I also hate patents so I like this license and wish more
projects would use it because lawsuits impede progress, damage the economy,
and no matter what the laws are curious smart people will always invent.

------
erichocean
Well, now I can use CockroachDB, so that's nice. :)

------
weego
I'm sorry but I struggle to take anyone here seriously that thinks that having
to not use a specific js framework would be grounds to be legally neutered in
a patent litigation case

------
zengid
TIL "IANAL" means I Am Not A Lawyer.

------
BucketSort
Ding ding. Vue.JS wins.

------
known
Sounds rational

------
0xbear
Edit: Caffe2 is similarly afflicted. Torch and PyTorch are not. Some of Torch
modules are, however.

~~~
boulos
You're right about Caffe2 [1], but Torch and PyTorch have existed for a long
time and don't seem infected [2] and [3]. For completeness, both TensorFlow
[4] and MXNET [5] are Apache 2.

[1]
[https://github.com/caffe2/caffe2/blob/master/PATENTS](https://github.com/caffe2/caffe2/blob/master/PATENTS)

[2]
[https://github.com/torch/torch7/blob/master/COPYRIGHT.txt](https://github.com/torch/torch7/blob/master/COPYRIGHT.txt)

[3]
[https://github.com/pytorch/pytorch/blob/master/LICENSE](https://github.com/pytorch/pytorch/blob/master/LICENSE)

[4]
[https://github.com/tensorflow/tensorflow/blob/master/LICENSE](https://github.com/tensorflow/tensorflow/blob/master/LICENSE)

[5]
[https://github.com/dmlc/mxnet/blob/master/LICENSE](https://github.com/dmlc/mxnet/blob/master/LICENSE)

------
GoodInvestor
Luckily React itself is no longer unique in itself, and project can use the
ideas popularized by React with liberally licensed alternatives such as Preact
or Inferno.

