Hacker News new | comments | show | ask | jobs | submit login
Apache Foundation disallows use of the Facebook “BSD+Patent” license (apache.org)
1277 points by thelarkinn 100 days ago | hide | past | web | 362 comments | favorite

Finally, people are beginning to realize the insanity of this entire PATENTS file situation!

When I first brought up how misguided people were for embracing React and projects with this license, I was downvoted to hell on HN. But really, everyone, THINK ABOUT IT. This is a company that glorifies and celebrates IP theft from others, and lionizes their employees who successfully clone others’ projects. They’ve built their entire business on the back of open source software that wasn’t ever encumbered with the sort of nonsense they’ve attached to their own projects. And this industry is just going to let them have it, because the stuff they are putting out is shiny and “convenient” and free?

Having known so many people involved with Facebook for so long, I have come up with a phrase to describe the cultural phenomenon I’ve witnessed among them – ladder kicking. Basically, people who get a leg up from others, and then do everything in their power to ensure nobody else manages to get there. No, it’s not “human nature” or “how it works.” Silicon Valley and the tech industry at large weren’t built by these sorts of people, and we need to be more active in preventing this mind-virus from spreading.

By the way, the fact that Facebook is using this on their mostly-derivative nonsense isn’t what should concern you. It’s that Google has decided, as a defensive measure, to copy Facebook’s move. Take a look at the code repo for Fuschia and you’ll see what I mean. Imagine if using Kubernetes meant you could never sue Google?

Yep, the patent grant is not fully reciprocal. As I understand it:

To use React, you give Facebook permission to use any of your software patents (edit: all patents, even on a new jet engine) throughout your whole company. Facebook gives you permission to use only the software patents necessary for React.

If your company sues Facebook over an unrelated software patent (edit: as above, any patent), your React license (to the React patents) is pulled and if your business has any dependency on React that part of your business is broken until you can port to something else, or you are in license violation if you keep using it.

On the other hand, if Facebook sues you over a software patent (edit: any patent) that isn't related to React, they are still free to do so (edit: you become free to defensively sue with other patents in response and not lose your license to React patents, meaning with the nuclear analogy below you give Facebook "first strike" capabilities but are allowed to keep a retaliatory-only arsenal).

So there is a big asymmetry: all of your software patents for a few of ours. (edit: all of your patents for a few react software patents)

It's a nuclear arms reduction agreement where Facebook gives up 1% of nukes in exchange for co-signers giving up 100%.

(edit: as pointed out below, it is a much worse deal: you give up all patents on everything, not just software patents; Facebook only gives up software patents on React)

> As I understand it: To use React, you give Facebook permission to use any of your software patents throughout your whole company.

That is, on its face, absolutely untrue. Nowhere in the React patent terms does it specify that you grant Facebook rights to use your patents--not even to ones related to React.

That's something that isn't in the React terms, nor does it seem to show up in any legal analyses published online from a lawyer making that claim. (None of the analyses I've seen, at least; if you found some, please post them.) In fact, the only place where this claim does crop up is in off-the-cuff message board comments.

FWIW, I don't use React, I don't want to, I'm not a Facebook employee, and in fact I think the world would be a lot better off with Facebook having less influence than they do today. But that doesn't change how weird it is to keep seeing comments like yours that make claims like the one above.

It maybe "on its face absolutely untrue" but it is true in practice. If Facebook infringes your patent and you sue them to enforce you lose the rights to use any patents React requires. So while you're not required to grant Facebook rights to use your patents, you are required not to enforce your rights relating to your patents against Facebook.

Companies shouldn't be dictating what happens if they're sued; it's a government right just like it's a natural right to accuse someone of theft. People shouldn't be sabotaged of their right to sue based on some arbitrary terms meant to block people from suing, their right to accuse someone of theft.

What if there was no patent grant, and just the BSD license?

Then you have no patent protection in the first place! You are in the same situation as when the patent grant expired because you sued them. I don't see how this is any better.

You do not give them a license to use any patent. You are right that in practice the non-enforcement means that they can willy-nilly use your patents. But if we are arguing about factual ability vs legal rights - they can probably already to that, due to the fact that they likely have more money and better lawyers then you do.

You are in a better place though - because you're not the only react user. If indeed it turns out there are some submarine react patents facebook owns, with this patent license most other users can continue to work. Without the license, facebook then has the choice to either sue everybody (kind of unlikely) or to create the situation wherein suddenly everyone knows that they're infringing but haven't yet been sued, or to retrospectively grant the license (probably losing trust).

And if you do have the license - then what? It's still a react death-knell should any submarine patent appear; no large company is every going to agree to such an assymetrical deal.

Better to at least be left in the situation where it's likely in facebook's own interest to never surface any (so restrictively licensed) patents in the first place.

> no large company is every going to agree to such an assymetrical deal.

The thing is, if you just use react for something inconsequential, and can live with the fact that you have to cease using it when you sue Facebook, then it is fine.

You shouldn't base your business on Facebook's (potential) patents, and then attack them with your own patents - but that is true with or without the patent grant.

Of course, what would be great would be 1) a finer grained, symmetrical patent grant, or 2) a bilateral agreement between your company and Facebook instead of the patent grant. If you are big enough and have patents, you can probably negotiate something like that.

> You shouldn't base your business on Facebook's (potential) patents, and then attack them with your own patents - but that is true with or without the patent grant. [...] If you are big enough and have patents, you can probably negotiate something like that.

The chilling future effect, which I believe is the primary driver of op worries, is what if you build on React and are the next Facebook? (I.e. you are growing quickly to become "big enough" but are not yet)

Old Facebook now how a lot more leverage on you at several critical moments -- either in terms of making an offer, or in the negotiations around a more reciprocal patent licensing deal, or the aforementioned infringing of your patents, or the mere threat of either if someone else makes an offer.

The entire point of ladder kicking is to build a moat to ensure that others can't grow past you in the same way you did, and this is pretty effective at that (intentionally or unintentionally).

As you said, a more reciprocal, more finely-scoped patent balance would resolve these concerns. (E.g. "if you sue Facebook over a patent involved in React...")

Yes, you're right that "BSD+patent"+"revoked patent grant because you sued Facebook over another patent" is pretty much the same as just BSD from the start. Licensing software you know you have patents on under BSD only with no patent grant would be pretty awful, of course.

If Facebook wanted to be the good guys here they would license under Apache 2.0 or write their own symmetric patent grant. They already relicensed RocksDB after Apache's move, perhaps they will do the rest of their stuff too.

> "BSD+patent"+"revoked patent grant because you sued Facebook over another patent" is pretty much the same as just BSD from the start.

Not really. If you have BSD with no patent grants you can at least argue that there's an implicit patent grant. If there's an explicit patent grant which you violated/got terminated that defence is clearly not going to fly.

I'm not a lawyer but my understanding is the case for an implicit patent grant with BSD is pretty weak.

My understanding is that if a company open sources a patent protected code (with one of the standard open source licenses without any additional patent clauses), the company grants anyone the right to use the patented technique without any obligations to the company. Otherwise we would see many cases of code released on liberal licenses, such as MIT, that no one is allowed to use, unless they pay for the patents separately.

That's definitely not the case. Some licenses like Apache-2 explicitly grant you the use of necessary patents. Others do not. And there are projects which are absolutely covered by patents, yet the code is opensource. That was the situation with Gif and MP3 formats for years.

I was involved with an opensource project which got a patent application submitted by the company. Even though I pointed out prior art. And even though I refused to sign the application as one of the authors. That's corporate environment for you.

As far as I know GIF and MP3 decoders were made open source not by the patent holders, if the patent holders open sourced the decoders, would they be able to enforce the patent rights?

The license of an open source implementation is granted by the authors and allows you to make copies and derivative works, while a patent grant comes from the patent holder and allows you to actually use the software. They are two completely independent things.

The fact that GPL licenses went for a patent grab (on hardware patents too) with an implicit patent grant paved the way for Facebook. It's just a very bad idea, unless you think all intellectual property should be swept into the dustbin of history, of course.

A company the size of Facebook can't really get away with that scheme even if it were intentional. For one thing, I can sell the patent to a troll and let them do my dirty work. Or a company could buy you solely to get fuel to sue Facebook over.

If Zuckerberg signs a paper with the wrong title, there's a troll lawsuit the next day. So if you make a habit of "in practice" strongarming people, you can easily slip up and have a huge headache on your hands.

> A company the size of Facebook can't really get away with that scheme even if it were intentional.

You maybe be right, but why would I want to take my chances?

> Nowhere in the React patent terms does it specify that you grant Facebook rights to use your patents--not even to ones related to React.

I detailed the specifics.

Take this example:

In exchange for doing graphic design on your menu, I stipulate that I can shut down your bakery if you take me to court when I eat from the bakery without paying. Now, sure, I haven't granted you the right to come eat my wares, but I'm going to have to shutdown my shop to keep it from happening.

In this case as long as you change the menu you can go back and enforce it, but with software, it isn't as feasible (say you had a game built on top of Raknet, which has the same PATENTS rider).

It's a de facto one-way "all your patents are available to us" grant, because you can't sue them if they violate any patents you may have, without ceding your l̶i̶c̶e̶n̶s̶e̶ ability to use React.

EDIT: better?

> without ceding your license to use React.

Ceding your license to use any patents Facebook may or may not have on React. There's a difference.

I'd call that a "distinction without a difference". Those are generally fallacious, and more often pedantic. Sure, you can still technically use React if, say, you're based somewhere that patents aren't particularly enforced. But if that's the case, why do you have patents in the first place?

In many European countries (all of the EU ?), software patents are not recognized.

You may still have other kinds of patents, which are very much enforceable.

That is plain wrong. Software patents exist and are enforced in the EU and other member states of the European Patent Treaty. The European Patent Office even has a nice FAQ on helping you get your software patents granted at:


The situation is a bit more subtle than you make out. The EPT has clear language which excludes software from patentability, but that hasn't stopped lawyers from arguing that some software can be patented if it has a physical effect (even a minimal one). Wikipedia actually summarises it decently: https://en.wikipedia.org/wiki/Software_patents_under_the_Eur...

The situation isn't even that subtle. The "physical effect" AKA the German Teaching has eroded into a "further technical effect" in the past decade. And with the UPC looming, things could get even worse. But that's getting off topic.

I must have missed the part where the patent clause in the React license applied only to software patents.

You can't legally use React without a patents license. The difference between the patents grant and the copyright license is mostly in the timeframe they cover (20 years for patents, 100+ years or whatever for copyright).

> You can't legally use React without a patents license.

I'll send you US$50 if you can find ANY evidence this is true in the US, UK, Aus, or Canada. :)

That nobody seems to know whether there are in fact any patents licensed by the patent grant within React is one of the most frustrating things about it.

Agreed. It gives the entire debate a very metaphysical quality. How can I determine the value of a patent grant when I don't know what the patents are, or if they even exist?

A quick search on WIPO:

https://patentscope.wipo.int/search/en/detail.jsf?docId=US90... https://patentscope.wipo.int/search/en/detail.jsf?docId=US19...


    PA:facebook* AND FP:(Hierarchical user interface) AND CTR:US


Now where does it say that? The way I read it, so long as you don't sue Facebook, you have a patent grant. If you believe people when they say that their patent portfolios are purely defensive, there is no problem.

On the other hand, being the aggressor in a patent lawsuit loses you the patent grant. This seems sane enough to me.

The normal state of affairs is completely ambiguous about patents. You get no explicit grant, so if they feel like suing, there's nothing to stop them. Some people claim an implicit grant, but there's no conclusive ruling on it.

I don't particularly care for software patents, but I don't see anything more stupid than the usual lawyerly CYA layered on an attempt to disambiguate the patent situation.

Why is it sane to lose the patent grant if you are a aggressor in a patent lawsuit against Facebook (for any patent, even ones unrelated to React)?

The clause also doesn't explicitly cover software patents only, so if Facebook infringes on your hardware patents (which is plausible, since Facebook does hardware related work as well), you still can't sue them.

I think the spirit is that patents are not legitimate. Suing for patent infringement is not considered exercising a legal right, it's considered being a dick and vandalizing someones property. So this is not to be read like a contract between to businesses, but like a truce.

It might as well say "we agree to not destroy your business using dirty tricks if you don't attempt the same".

Of course, opinions on that are divided...

That's how Apache 2.0 and GPLv3 treat patents. The language in the React license is not symmetric like the above licenses and thus doesn't feel like it's a "screw you" to patents. Not to mention that Facebook is very patent-heavy and it doesn't feel like they're anti-patent in any meaningful way.

I'd be more sympathetic to Facebook if they declared they would never use patents to sue someone and they'd only use their patents "defensively". Of course, they'd never do such a thing even though such a statement has zero weight.

> Suing for patent infringement is not considered exercising a legal right, it's considered being a dick and vandalizing someones property. So this is not to be read like a contract between to businesses, but like a truce.

This is an oversimplification. There are plenty of mum and dad inventors who would get destroyed by large companies but for relying on patent protection for their life's work.

Of course. I'm not claiming it is so. I'm just saying, if you think so, then you are likely to come up with such a license.

> Why is it sane to lose the patent grant if you are a aggressor in a patent lawsuit against Facebook (for any patent, even ones unrelated to React)?

Why should Facebook support companies that are suing them?

Counterpoint - why would I want to build my business on software that, if the parent company screws me in some unrelated way, I have no recourse but to rebuild my entire software portfolio, or just accept that I've been screwed?

If they were offering something unique or especially distinctive, then maybe it would be worth risking, but as there are half a dozen or so alternatives, why bother putting myself into that particular pickle?

> Counterpoint - why would I want to build my business on software that, if the parent company screws me in some unrelated way, I have no recourse but to rebuild my entire software portfolio, or just accept that I've been screwed?

This doesn't prevent you from suing. It just prevents you from suing over patents.

Because they already allowed other people to use it, and it doesn't required extra effort on Facebook's part to allow another company to use it.

I can understand why Facebook would want to have a clause like this (to discourage lawsuits against them), but I would consider it against the spirit of open source to do so (ie. Facebook should be able to continue to do this, but I wouldn't consider React to be open source software in that case).

I wonder, does the definition of "open source" or "free software" require any patent grant at all?

I guess the GPLv3 has provisions for patents, but older licenses didn't. I remember some controversy around open source video codecs that you were not able to use safely because they were infringing patents.

Patents can be used to restrict all four of your freedoms under the FSF definition of "free software". They have written about this problem for quite a long time[1,2]. The problem with patents for things like formats or protocols is that they make free software implementations potentially dangerous to use (users can be sued for violating a patent). That's why h264[3], MPEG-whatever, FLV, etc are all considered to be bad even though they have free software implementations. MP3 recently shedded its patent licenses[4], and the response was that every distribution finally packaged mp3-lame in their main repos.

GPLv2 didn't have a patent grant because it wasn't a very well-known issue in 1991. Apache 2.0 was the first free software license to have a patent grant (which unfortunately made it GPLv2 incompatible) but GPLv3 included a similar (though stronger) patent grant because of Apache 2.0.

While these may sound like theoretical problems, people have been sued over using GIF, MP3, etc before. Every time you install Firefox, it will download a free software binary from a Cisco server that does h264 decoding[5]. However, they cannot legally recompile the binaries themselves as it means that the patent grant no longer applies and Mozilla (or your distribution) could be sued -- even though the binary's source is BSD-licensed.

[1]: https://www.gnu.org/philosophy/fighting-software-patents.htm... [2]: https://www.gnu.org/philosophy/danger-of-software-patents.ht... [3]: https://www.fsf.org/licensing/h264-patent-license [4]: https://www.iis.fraunhofer.de/en/ff/amm/prod/audiocodec/audi... [5]: http://www.openh264.org/index.html

> Now where does it say that? [...] If you believe people when they say that their patent portfolios are purely defensive, there is no problem.

Where does it say what? Which part of my post are you taking issue with, because I would love to correct anything.

What it certainly doesn't say is that Facebook's patent portfolio is non-aggressive. And when, outside of this, has Facebook said that about their entire portfolio (I'm not saying they haven't, I just haven't seen that before)?

My personal interpretation of this is that hypothetically you are likely to value your own patent(s) more than you value the time to re-write your application with something other than React. So if you need to sue Facebook, factor in that you’ll need a re-write as well.

My professional opinion is that if you use React and are concerned about this, talk to your attorney.

Thank you for cutting through the fog.

Actually, it seems even worse, because you give Facebook permission to use all patents, both software and non-software.

The thing with legal documents is that you can author whatever you please and none of it really means anything until it is brought to the courts to be enforced. At that point we learn what parts of what was written are actually valid.

Has any of this React patent usage agreement been tested yet?

But what that FAQ does not answer is: "Does the additional patent grant in the Facebook BSD+Patents license terminate if I sue Facebook because they violated one of my patents unrelated to the Facebook software?"

The answer to that one is, unfortunately, yes.

IANAL. One-sided contracts fail during legal process. There must be sufficient mutual benefit (mutuality in legalese). Has Facebook successfully defended the license's mutuality in court yet?

Maybe someone out there has access to legal cases and could help?

> To use React, you give Facebook permission to use any of your software patents throughout your whole company. Facebook gives you permission to use only the software patents necessary for React.

W̶o̶u̶l̶d̶ ̶y̶o̶u̶ ̶p̶l̶e̶a̶s̶e̶ ̶q̶u̶o̶t̶e̶ ̶t̶h̶e̶ ̶e̶x̶a̶c̶t̶ ̶t̶e̶x̶t̶ ̶t̶h̶a̶t̶ ̶g̶i̶v̶e̶s̶ ̶F̶a̶c̶e̶b̶o̶o̶k̶ ̶a̶n̶y̶ ̶r̶i̶g̶h̶t̶s̶ ̶t̶o̶ ̶u̶s̶e̶r̶'̶s̶ ̶p̶a̶t̶e̶n̶t̶s̶.̶ ̶A̶s̶ ̶f̶a̶r̶ ̶a̶s̶ ̶I̶ ̶c̶a̶n̶ ̶s̶e̶e̶ ̶o̶n̶l̶y̶ ̶F̶a̶c̶e̶b̶o̶o̶k̶ ̶i̶s̶ ̶a̶c̶t̶u̶a̶l̶l̶y̶ ̶g̶r̶a̶n̶t̶i̶n̶g̶ ̶p̶a̶t̶e̶n̶t̶ ̶r̶i̶g̶h̶t̶s̶.̶ ̶Y̶o̶u̶ ̶l̶o̶s̶e̶ ̶t̶h̶e̶ ̶p̶a̶t̶e̶n̶t̶ ̶r̶i̶g̶h̶t̶s̶ ̶i̶f̶ ̶y̶o̶u̶ ̶s̶u̶e̶ ̶F̶a̶c̶e̶b̶o̶o̶k̶ ̶f̶o̶r̶ ̶a̶n̶y̶ ̶p̶a̶t̶e̶n̶t̶s̶ ̶t̶h̶a̶t̶ ̶i̶n̶v̶o̶l̶v̶e̶ ̶R̶e̶a̶c̶t̶ ̶o̶r̶ ̶y̶o̶u̶ ̶s̶u̶e̶ ̶a̶n̶y̶o̶n̶e̶ ̶u̶s̶i̶n̶g̶ ̶R̶e̶a̶c̶t̶.̶


edit: nvm, I misread line 16-17. Naturally line 21-26 is mostly useless.

No, you lose the patent rights if you sue Facebook for any patents period.

> The license granted hereunder will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: (i) against Facebook or any of its subsidiaries or corporate affiliates

If you have to agree not to enforce any of your patents, that's pretty much equivalent to giving Facebook the rights to use them.

So if I understand correctly, if I were to use React for a marketing website about my patented system for <some extremely valuable invention> and Facebook steals/uses that extremely valuable invention, I can’t sue Facebook by virtue of using React?

Obviously, if that were to happen, you’d simply have to stop using React or else you’d get countersued for using React without a license right?

Why would anyone use React ever if that’s how it works? It feels like a payday loan – React makes it “easy” right now, but if your business is built dependent on React, you could pay a serious price later in exchange for “right now” convenience. It makes a strong case for Ember or Glimmer or any of the other front-end systems not tied to Facebook. Imagine a React “Native” app around which your business is based – you’d have to rewrite the entire thing of Facebook were to start using some patented aspect of your business.

Perhaps I am misinformed, but it seems absolutely bonkers to essentially indemnify Facebook from patent infringement just by virtue of using React somewhere in your business.

Imagine if Apple did this: if you release on the App Store using Xcode, you can’t sue us for any patent infringement ever or we’ll sue you for using Xcode illegally.

Is my assessment correct? Is React that good to risk such a situation? Facebook could sit back and watch a company using React develop something amazing, then Facebook could steal it and you’d have no recourse but to stop using React. Meanwhile, while you are rebuilding your application, you lose all your customers, but if you don’t rebuild your application, Facebook can legally take your invention and crush you in the market. Either way, you lose – simply because a few developers on the team were insistent on React’s greatness. If I were a VC, I’d be incredibly wary about supporting a company using React for their primary application.

Am I wrong? I am not trying to be argumentative – I just want to be sure I am understanding this correctly.

Yes, your understanding is largely correct. To be clear, you can still sue Facebook for stealing your patented invention, but then your grant to any patents that your use of React infringes would expire and Facebook could countersue over that. Facebook legal's response to this concern has been largely obfuscation and "trust us" which is not encouraging. They did change the patent grant two years ago to allow you to assert patent claims against Facebook without losing the grant if Facebook sues you first, but that's of limited utility.

It's funny you mention Apple, because the Apple Public Source License has a very similar provision.

> 12.1 Termination. This License and the rights granted hereunder will terminate: > ... >(c) automatically without notice from Apple if You, at any time during the term of this License, commence an action for patent infringement against Apple; provided that Apple did not first commence an action for patent infringement against You in that instance.

The good news is that the Apple Public Source License is basically dead and not used for anything of importance.

> They did change the patent grant two years ago

Please explain to me - are they able to change it again at any time in the future to "unclear" it again or just change wording altogether? Will it affect all users retroactively in that case? Because all this "they had bad wording in license but they changed it so we can use it now" sounds kinda crazy.

The patent grant is solely a grant from Facebook to the world, so Facebook can choose to grant more rights at any time. Just like I can sign a contract with you allowing you to borrow my bicycle on Thursdays and then later unilaterally decide that you can borrow it on Mondays as well.

The University of California did something like this in 1999 when they cancelled the advertising clause of the original BSD license. See ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change.

I understand now. I missed the "any Patent" assertion.

> You lose the patent rights if you sue Facebook for any patents that involve React

I see nothing that limits the termination clause to patents involving React. The only limitation following those general lines is the one you quoted, which is a limitation on the exception, implying that the license does terminate if the patent over which Facebook sued you is a React patent.

RakNet does that too (it's owned by Facebook via Occulus for a while now, Facebook bought Occulus then Occulus bought RakNet): https://github.com/facebookarchive/RakNet/blob/master/PATENT...

Is this widespread at all or is it just Facebook..?

Edit: I'm glad to be downvoted for asking a genuine fucking question if anyone else does this since Apache mentions Facebook and the only place I ran into PATENTS file is another Facebook property and googling brings nothing up except more React..

I love that while we discuss this awful attitude by the corporate giants like Facebook and Google, internally in "our own" (HN really isn't the community's, get a grip) we are CONSTANTLY worrying about getting downvoted for asking what we see as a genuine question.

There's a larger problem here, and I feel it comes down to our collective attitudes.

Important: IANAL and I am commenting from my personal reading

In the case of Fuschia, I don't see any more restriction of end-user rights than Apache 2.0 would give you. The only real difference is this line:

> This grant does not include claims that would be infringed only as a consequence of further modification of this implementation.

That makes it clear if you make a modification to Fuschia, that infringes on a patent that Google holds, that you don't automatically get rights to that patent too. Apache 2.0 doesn't mention that, but it appears implicit to me as Apache 2.0 only gives you patent rights to whatever is in the source.

Not to mention that patent law explcitly does not accept independent discovery as a defence for patent infringement, so I doubt that Apache 2.0 has any defences for that. I also don't believe GPLv3 does either but I would have to read through it again.

> They’ve built their entire business on the back of open source software that wasn’t ever encumbered with the sort of nonsense they’ve attached to their own projects.

So did Amazon apparently and others. At least Google have open sourced many interesting and useful projects so they have given back. Microsoft have been open sourcing things lately too. Others so so.

The problem is that a critical protection against large companies is via patents or at least the threat of. Without them, the ability to dethrone them becomes very limited.

Can you name an example of when a patent was used by a small company in the software industry to "dethrone" a very large company?

I'm having a hard time coming up with any examples; the lawsuits that come to mind are patent trolls, where the "little" company is a non-practicing entity so they can't be counter-sued for violating the giant's portfolio of patents. But, you sound pretty certain, so I want to figure out where I'm wrong.

Dethrone, no, but certainly sue for 100s of millions of dollars.

OK, can you name an example of that?

It's the whole point of patents. You want me to give you a list of patent lawsuits? :) Google is your friend.

I want an example of a case where a small software company successfully litigated a patent lawsuit against a huge company like Google, Microsoft, Facebook, etc. Preferably one where the instigator of the lawsuit was legitimately defending something novel and innovative. This is subjective, of course, and I tend to come down on the side of software not being something that should be patentable...but, it is patentable, so there are patents, so I'm asking: where are the lawsuits brought by small companies that are actually in the business they've patented and have sued a huge company?

You've made it sound like it happens all the time. I've been in the tech industry for two decades, and I can't think of any (though I'm sure they must exist). I assumed you had some cases in mind when you made the comment earlier, and I wondered what it was. I'm not demanding you go search for such a case. But, absent some sort of example, I'm gonna continue to assume it (almost) never happens.

Well, defending the company might entail getting acquired by another large company or NPA. I don't know of any examples where a small company sued a large one and continued to do business based on that lawsuit, but the threat of getting acquired certainly adds value to the company itself and discourages large companies from blatant copying.

Take that threat away, and small companies lose value and large companies copy without regret.

So, do you have an example of that?


Please don't violate the guidelines by rudely complaining about downvotes:


Open sourcing the spam filter will only help spammers. It is unlikely that it would work on an individual server with small amount of traffic.

Instead of trying to make a perfect spam filter we should abandon outdated inreliable mail transfer protocol.

What would a spam-resistant successor to today's email protocols look like? Is such a thing in the works by someone?

This is completely off topic from this thread, but one way to easily cut down on spam (that would break many email senders today) would be to require that a mail server can only send email for a domain you own. Yes, I'm familiar with DKIM and similar tools, but they don't go far enough.

Another way is to accept emails only from your contact list.

Re Google: You are mistaken. A big open source project by Google, gRPC, recently switched from BSD+Patents to Apache 2.0.


gRPC relicensed to Apache-2.0 as part of joining CNCF. We explain the reasoning here: https://www.cncf.io/blog/2017/02/01/cncf-recommends-aslv2/

(I'm the executive director of CNCF and wrote the blog post. )

Was Zuck taking some Business & Econ classes in his school days? This is from 2002:


Yah, I was particularly amused by Zuck when he gave a speech at his ol' stomping grounds suggesting everyone should focus on public works rather than companies competing with facebook. Very thematic, you have to give him credit.

I had the same downvoted experience. Hopefully this will evolve into a full victory - https://github.com/facebook/react/issues/10191

Thank you. People shy away from posting common sense. It is insanity.

Calling what it is has become unpopular amongst the hipsters.

> This is a company that glorifies and celebrates IP theft from others, and lionizes their employees who successfully clone others’ projects.

What are you referring to?

The irony of using Youtube, a platform that rose to fame after hosting pirated Viacom content, to highlight IP theft.

The real irony would be that if I found this video hosted anywhere else, it would be IP theft because the creators post it to Youtube. Your comment is unnecessary.

What percent of the top videos on Youtube were pirated from Viacom? Because according to the Kurzgesagt video, 73% of the top 1000 Facebook videos were pirated from Youtube.

If we can just remove emotion for a little bit, and coldly apply law and the terms of the license to fact, the picture is really not so dire.

- As stated in the standard BSD 3 clause, you're more or less licensed to do whatever you want with the software.

- The above doesn't give you a patent grant (at least not an explicit one), so Facebook also grants you a license to use any patents they have associated with the software.

- The ONLY possible way you can lose the above patent grant is if YOU sue Facebook for patent infringement.

Even if we assume, for the sake of argument, that everyone working at Facebook is a child of Satan, the only thing your company has to do to not lose the patent grant is NOT SUE Facebook for patent infringement. Seems pretty simple, no?

If your company is one that plans to, as part of its business plan, make money by suing companies like Facebook for patent infringement (which I have nothing against by the way), probably don't use react . Everyone else, what is there to lose?

Is the BSD-3 + PATENTS as nice as the Apache 2? No. Is it anything to get hysterical over? I can't see why.

It's because it covers any unrelated patents, not just the ones related to React. You can't sue Facebook or its subsidiaries, like Oculus or Instagram, for patent infringement, e.g. if Oculus were to infringe on your VR or AR patent, without losing a grant to any patents that may cover React owned by Facebook. It's unknown that Facebook has any patents for React, but if it did, it could countersue you simply because you rightly assert your patent against their infringing technology. If you own a company or are part of a university that has a patent and Facebook infringes, then you can't really use any of their open source products that have this specific grant, rather than not being able to use the specific product that they are infringing upon, if any. It's their prerogative to disallow that, but it goes against the spirit of open source, in my opinion.

I speculate that this grant was probably written in this way to ward off NPEs, but I doubt any of those NPEs actually would use React and so in reality it causes issues for pretty much anyone else that cares.

Yeah, I've been trying since November 2015 to get Automattic to understand the Facebook BSD+PATENTS problem with their Calypso frontend to WordPress that uses React. Just added another comment to the issue linking back to this story: "Replace React with Mithril for licensing reasons" https://github.com/Automattic/wp-calypso/issues/650#issuecom...

Of course, that issue was rapidly closed with essentially a "we don't think there is anything to worry about here" -- ignoring that even if Automattic may not have patents to defend, any of their customers who has patents could face an issue using Calypso.

All this is made more confusing by the fact that Facebook changed the React license over time from Apache to BSD+WORSE_PATENTS and then to BSD+LESS_BAD_PATENTS. And it looks like Automattic may have started using React when it was Apache licensed. So they got the rug pulled out from under them by trusting Facebook. I can wonder if their code might be considered to have grandfathered Apache patent licensing rights?

The Fuchsia license by Google (at least the one file I looked at) does not seem to me to be that different from other FOSS Patent licenses in that it is not as broad as Facebook's and just covers patent claims about Fuchsia itself. So I would not put it in the same category as React's much broader PATENT retaliation clause which applies for any disagreement over any patents with Facebook whether they are related to React or not. So it is more like if you sue about Fuchsia patents you can't use Fuchsia. https://github.com/fuchsia-mirror/magenta/blob/master/PATENT...

I don't think Google is doing the same - look at Polymer for example. You also have a patent grant but it expires if you try to attack possible patents related to Polymer itself - its like in Apache 2.0 which is more sane in my opinion.

I was downvoted like hell too when I commented that "only a fool will use react in their code because of its license"

This was covered a year ago: https://news.ycombinator.com/item?id=12108273

Can't believe how great it is that a developer needs to check the license of open source libraries before using them.

To be specific, it is an open source developer

In this case, but really anyone using the library could be affected if found infringing on patents within the library.

Your second paragraph describes Mark Zuckerberg as a person since his younger days.

Are there any cases where someone using React sued Facebook?

If my company don't ever plan to sue Facebook for patents, is not involved with patents, doesn't care about patents and everyone leading the company thinks patents are bullshit, why should I worry?

You should worry because you don’t have a magic orb that lets you look into the future.

What if you got acquired. What if something unexpected happens. What if you got pulled into some suit against Facebook. There are a ton of things that could potentially happen.

In this thread (unrelated) - nobody can spell fuchsia :)

https://blog.xkcd.com/2010/05/03/color-survey-results/ (at the end of post)


What the hell?

To anyone concerned about React's virtual DOM and diff'ing stuff, and a potential Facebook patent thereof, in early 2012 I wrote and published (under a GLPv3 license) a virtual DOM implementation with efficient diff'ing when I forked SproutCore[0] to become Blossom.[1]

So even if Facebook tries to patent that particular invention/innovation, it may not stand up to legal scrutiny depending on the filing date. AFAIK, Facebook didn't do a provisional patent for virtual DOM stuff before July 2012 (long after I released Blossom), because that patent filing would have become public AT THE LATEST on January 1st, 2016 and nothing has come to light that I'm aware of.

So…you should be safe (IANAL).

[0] Ironically given the subsequent popularity of React, the SproutCore team rejected my virtual DOM approach which is why I had to fork it. Live and learn. I actually came up with the specific virtual DOM + diff design in spring 2008, but didn't get around to writing the code for it until someone paid me to do it (I had asked Apple and they declined). Eventually, the copyright owner of SproutCore (Strobe, Inc.) got bought by Facebook, though I don't recall when…

[1] https://github.com/erichocean/blossom

I really have no idea why react is so popular with such a silly license.

I agree with this move.

There are plenty of OSS projects out there without patent thing attached to its license so no reason to use react.

Honestly, I didn't read the fine print. I've been having fun playing around with it. I assumed the license was OK considering its popularity.

"I assumed the license was OK considering its popularity."

Always check the licence. Public domain, MIT, simple, plain BSD, GPL (any version), apache - if it's anything else, be extremely cautious.

> Public domain

There are jurisdictions that don't recognize PD grants. I can't think of a good reason to use CC0 over MIT or BSD.

> GPL (any version)

This might be doctrinaire but I won't use the (L)GPLv3 because of the AGPL linking clause:

> Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.

CC0, Unlicense etc. always contain fallbacks for jurisdictions without PD grants. That's the whole point of using them instead of just saying "public domain" and nothing more.

There's also the Zero-clause BSD License https://spdx.org/licenses/0BSD.html which is the same kind of thing except it does not even mention the words "public domain".

If it's anything else, I would say start by checking the Open Source Initiative Web site: https://opensource.org/licenses

Still, be cautious. The OSI has approved a number of bad licenses. The UPL (https://opensource.org/licenses/UPL) stands out to me as one that should've been rejected.


The discussion around its approval was contentious. My reading is that it exists primarily as an Oracle CLA. The license wasn't rigorously reviewed by non-Oracle counsel and there's some worry about hidden landmines.



As AGPL still on most proples danger list? Or did you not include it in your GPL any version list.

I can't speak for corporate lawyers, but I treat AGPL v3 similar to GPL v3 (a bit truer to the GPL spirit, but in consequence a bit stricter).

Then again, GPL v3 is on many people's danger list

Hey now, the Artistic License is also one you can trust not to bite you in the ass.

What about MPL?

"I assumed the license was OK considering its popularity."

I would have too. I'm getting into Clojure(Script) where React(Native) seems to be a popular choice for UI. I haven't touched it yet. I hope there's a good alternative when I get around to it because I really like Clojure but I never wanted to rely on anything made by Facebook.

Doesn't that still require React under the hood? It's the licensing that's a concern to me, not the code/interface itself.

I'm in the same boat. Hadn't bothered to check out their license yet. Kinda makes me wary about using it for any social platform.

As far as I can tell the license is okay unless your product depends on suing Facebook while at the same time being so strongly dependent on React you can't switch it out.

I'm bewildered by the number of individuals who are stating surprise at how/why people use react despite it's license. It feels like a very out of touch perspective. What % of React users read licenses or need to care about licenses?

It's very, very hard to give up immediate advantage+ in return for reducing a nebulous risk very far in the future.

+ (not saying React is objectively better than alternatives, only that if you believe it's better then the statement is true for you)

> use in source and binary forms, with or without modification, are permitted

You are licensed to use React even if you never agreed to whatever is in the PATENTS file. The reading where to use a source code is meant only to compile it, maybe admire the compiled artifact but never to put it anywhere near an executable environment seems pretty far-fetched to me.

Considering almost every single large tech company is using React, presumably there's not much reason for concern? IANAL.

But you're not wrong, preact is a great alternative to react and it comes with a permissive license.

"Considering almost every single large tech company is using React, presumably there's not much reason for concern? IANAL. "

Actually, React is banned at a number of them, and i've personally discussed the issue with a number of fairly concerned counsel.

So for better or for worse, i don't believe this is as simple as you make it out to be.

Off the top of my head big users of React include:

* Apple (their entire dev docs site is built in it, and they've hosted Bay Area React user meet-ups)

* Twitter (for their mobile web)

* Microsoft (parts of Visual Studio use it)

* Netflix (all over their frontend stack)

...as well as Dropbox, AirBnb, Venmo...

So whilst I don't doubt you've discussed it with concerned counsel, there are huge corporations deploying React today, many of whom have extensive experience dealing with patent and IP issues (Apple, Microsoft, etc).

To add on to this list, even IBM with their large patent portfolio has a large number of teams deploying projects using React and other FB OSS technology.

Disclaimer: I work for IBM.

Yes and for a while it wasn't allowed at IBM either for the same reasons. The latest changes made it possible again which is why now they can/do use it.

Source: Friends at IBM

This is absolutely correct. Before the end of last year, getting approval to use it was a very challenging process.

However, many teams went through the process in order to use it because of how valuable they believe React is to their products. Groups like IBM Watson IoT were fortunate enough to get portfolio-level clearances as well during that time.

Thankfully the process changed and many product teams add React to their list of libraries/frameworks to evaluate for their use-cases.

Are those internal projects? Or external?

A good mix of both, surprisingly :)

To be concrete, IBM Watson has several products that leverage it that we sell to customers. For example, Watson Company Profiler, Watson Virtual Agent, Watson Discovery-related tools, and more.

Other organizations use it as well inside of IBM, like IBM Cloud and IBM Watson IoT, but I'm less familiar with their products off the top of my head.

Maybe they signed separate agreements with FB. Patents sharing or exceptions. Big corporations do that.

I'd like to ask their legals about why they feel OK using React, but I'm too far away. Is anybody here in touch with them?

I don't think so, I work for a big corporation, and our legal department contacted Facebook to confirm the interpretation and ask if a reworking of the license was possible.

It wasn't possible, consequently my company asked that we move away from React.

However, one thing that could be interesting to see is:

* do the companies using React are using the latest version or the last version without the patent clauses?

* do they start new projects with React?

Big companies know they have the resources to devote to a code rewrite if it ever came to that. Small- to mid-size companies are the ones that have the greatest exposure.

Also, it's my opinion that the companies like AirBNB who use it are not considering that it will complicate acquisition by another party. They are basically taking themselves out of contention for purchase by a company that is in direct competition with FB. Maybe, evidently, they don't care but I just hope everyone using it is thinking about such things.

Small to mid-size software companies mostly don't have patents. Naturally they aren't going to be too worried about problems that will only affect them if they are wildly successful. They are more worried about becoming successful in the first place than they are about optimizing their level of success in the unlikely event that they do become that successful.

So, the OP had a question, which was ""Considering almost every single large tech company is using React, presumably there's not much reason for concern? IANAL. ""

I pointed out a number of these are concerned. There is in fact, reason for concern. That doesn't mean people won't use it, it just means they may be willing to take the risk. In fact, some of the counsel who are in fact, concerned, are on your list of big users!

If i have 100 billion dollars in the bank, i may be willing to take more risk around a random open source project than a small startup.

You don't seem to argue the original point at all (ie whether there is cause for concern), just point out "there are lots of people who use it who have extensive experience dealing with IP". I'm not sure how this means there should be no concern.

For example, i know at least a few of those corporations treat React very specially compared to most other open source (in how they use it, in how they try to segregate it, etc).

So yeah.

>* Microsoft (parts of Visual Studio use it)

you mean vs code, which is a separate product from "visual studio"

Vscode does not use react specifically for the licensing reason. I don’t know if they do now but when I was at MS this was the case. I know many teams at MS who evaluated react and lawyers strictly advised to stay away from it. I hear things have changed a bit, but you’ll never see Office and Windows use it.

That’s not “Office uses React”, it’s a “collection of robust components designed to make it quick and simple for you to create web experiences using the Office Design Language.”

Do you really see no difference between the two?

The React components are being used on production Office websites/webapps. Source: I'm a Microsoft employee working on this project.

http://www.reactnative.tools/ React Native at Microsoft

Very limited “use”; mostly just enabling external developers to interface using React to their existing tools (that are not using React). If the Armageddon should come, and Microsoft is to enter a legal patent dispute/battle, stopping this React “use” is a no-op for Microsoft.

Microsoft builds Skype on React Native. They use React in production on several websites including outlook.com. They are using it internally and not just for external devs.

Also see this HN thread from a year ago: https://news.ycombinator.com/item?id=12108273

You'd be actually surprised how many teams inside Microsoft wrote their own smaller versions of OS libraries. It happened a lot less after Nadella era, but Ballmer era had a "we can't use anything not built here"

VS (the big one, not VSCode) has a bunch of stuff in it written in HTML5/JS.

The relatively new client framework for SharePoint Online is also based on React.

Can you add a short elaboration on the visual Studio bit? I use visual studio every day in my day job and am very curious how react fits into that.

VS and EdgeDevTools use InfernoJS I believe. Another VDOM implementation.

Funny enough that the author of Inferno now works for React team at Facebook. Inferno was a great project with perf that blows react out the water. Not sure if it’s maintained anymore.

He intentionally left the project to protect the IP of Inferno from falling into the same patent'y business is what I heard.

This wasn't the case. I left the project to focus my attention on React.

Haha! When the author actually comes to clarify and make a response. Oh! I love HN!

It seems like Google is the only one that stands out.

If you're concerned about React, then Preact is actually significantly worse.

Consider: The risk for React is based on 1) speculation that Facebook has patents on core React concepts and 2) the fact that patent grant that comes with React terminates in some situations if you end up in conflict with Facebook. So for safety, it might be better to make sure you use code that Facebook has no patents on, which (if (1) above is true) means "code that is nothing like react at all".

A React clone that doesn't have the patent grant at all is vulnerable to all the same issues React itself is, plus more. It's strictly more dangerous than using React itself.

(Unless, of course, we assume there's some bit of React that's subject to a Facebook-owned patent that would not also apply to Preact. But having spent a few minutes thinking about it, nothing leaps out at me.)

If Facebook can has patents that cover Preact, they likely cover parts of every JavaScript framework out there.

React is a functional component library that uses the virtual DOM. It's well executed, but it's a simple concept.

Yep. And if Facebook has such patents, I wouldn't be surprised if Google, Microsoft, Oracle, etc. do too.

The more you think about the ramifications, the more I come to the conclusion that software patents are an existential threat.

Tip: move to the EU.

The EU does not recognise software patents.

This is not true, since Preact only implements the same software interface. Its internals are fundamentally different and not a derivative work.

Software interfaces cannot be patented - this has been upheld in every court, most recently in Google V Oracle.

> Its internals are fundamentally different and not a derivative work.

That would be a strong defence to a copyright claim. We're talking about patents, where there is no concept of "derivative works", and what matters isn't implementations but broad concepts.

> Software interfaces cannot be patented

Right, but what makes Preact concerning isn't that it offers the same API, but that it is built using the same underlying concepts.

Preact renders independent, encapsulated, nested, functional-ish components, usually but not always written in JSX, into a virtual DOM. Components are rerendered to the virtual DOM when their inputs change, and then diffing is used to efficiently sync the virtual DOM with the browser DOM.

If Facebook has some sort of patent covering the virtual DOM (although thankfully as far as I know, they don't), it's hard to see how it would not also cover Preact. And this is true even if, as I assume is the case, Preact shares 0 lines of code with React.

Edit: To be clear, I don't believe the patent situation is concerning, I think Preact is a great project, and I may well be using it in production soon. But if I was worried about Facebook's patent portfolio, I would be worried about using Preact.

Understandable, and agreed about my point being for copyright as opposed to patents. It's interesting to note that, since the majority of DOM rendering libraries now employ some variant of Virtual DOM (react, preact, mithril, glimmer/ember, angular, even polymer!), a patent claim covering the concept of Virtual DOM itself would likely be invalid - the presence of so many prior and contemporary implementations of that paradigm make would invalidate it on the grounds that it cannot be "Non-obvious" or "non-novel". My knowledge of this stuff is largely gleaned from Wikipedia and thus not to be trusted, but it seems like there would be little grounds for a patent suit over VDOM. Also interesting to note: there are few (if any?) other companies directly associated with any of the other VDOM implementations - can a patent claim even be made against an Open Source project?

Lots of large companies are not using React because of the licence. It's just that companies generally don't talk about legal matters like this openly. So you only hear about who is using it, not who isn't.

Often the large companies that are using React have patent cross-licensing agreements with Facebook (or other special arrangements) that make the issue moot for them.

Otherwise, getting your in-house council (or even your board, depending on the situation/risk) to approve of using React with the very broad patent restrictions can be an uphill battle indeed.

My most recent 'big' fortune 500 company put me under very strict legal terms regarding what type of software I was allowed to use. Any code I didn't write 100% myself had to be approved by legal before it could be used in software I wrote for them.

No, seriously, that is what the contract said.

In reality, the bulk of developers used whatever they wanted with no consideration. I assume other contractors were under similar legal terms, but not sure about employees. I was seen as a pain when I kept asking for formal permission for stuff.

>My most recent 'big' fortune 500 company put me under very strict legal terms regarding what type of software I was allowed to use. Any code I didn't write 100% myself had to be approved by legal before it could be used in software I wrote for them.

Back in the day, this was the norm.

>In reality, the bulk of developers used whatever they wanted with no consideration.

This wasn't - it was grounds for termination.

I remember stuff like - (for Windows C++) you can use Microsoft MFC and Microsoft STL - anything else you write from scratch.

Legal wasn't very flexible back then.

If the other developers did so without asking formal permission, then if the company was sued, they'll just pass it on to the developer.

The happy medium that I've found is to provide a list of acceptable licenses and let lead engineers audit that software to be included obey them.

but still many licenses have legal requirements. i.e. I was working at a fortune 50 rare open source project, we had an acceptable license list but still all the source code needed to be audited for dependencies licenses and the legal team produced the license file to be included in distribution with all the notices as required by mit and apache

I tried very hard to negotiate that happy medium, but was shot down.

> Considering almost every single large tech company is using React

React isn't as popular in the real world as it is on HN.

Wal-Mart, Baidu, Spotify, Netflix, Coinbase, Wired, Yahoo, Atlassian, AirBnB, Asana, Atlassian, BBC, Chegg, CloudFlare, CNN.com, Codecademy, Coursera, Craftsy, Dailymotion, Dropbox, Expedia, Facebook, Feedly, Flipboard, HipChat, IMDb, Imgur, Instagram, Khan Academy, KISSmetrics, Mattermark, Minerva Project, Netflix, OkCupid, Rackspace, Rally Software, Ralph Lauren, Reddit, Redfin, Salesforce, Squarespace, The New York Times, Trunk Club, Twitter, Uber, University of Cincinnati, Venmo, WhatsApp, Wired, Wix, WordPress, Yahoo, Zendesk, Microsoft, Apple

If y'all think you're going to find some edge case that these companies lawyers haven't already...

Well, I guess it depends on what you mean 'almost every single large tech company', but React is used by Facebook (of course), Apple, Twitter, Yahoo, Netflix, Amazon, just to name a few.

I know atleast one of these companies (I can't speak for the rest) had a pre-existing bi-lateral patent agreement with Facebook which rendered the react patent clause irrelevant, allowing them to use react without concern. Without that existing agreement this would not have been the case.

I would certainly concede that. And I'm not trying to rain on React's parade here. I'm just saying that HN is particularly pro-React as a community.

you have only named a few though; 'almost every single large tech company' requires a particular definition of large tech company or a lot more than a few to be a useful(ly true) statement

Take a look here:


...that's obviously not complete, either. If you think of a large tech company the odds are they are using react somewhere for something, be it public facing or internal tooling. Many of the companies that aren't actively using React do so because they have their own JS stacks to dogfood (like Google and Angular).

Google hardly dogfoods Angular. They use Closure for most of their apps. SPF for YouTube. Polymer in some places. GWT in many others.

Well, anecdotally speaking of course, my company does work for most of the major (a) banks, (b) telcos and (c) insurance companies in Canada, and the majority of them are moving from Angular 1.x to React (because Angular 4 is a mess) for their front-end work, both on the public and secure side of things.

Hopefully they've all done their due diligence..

That's interesting. I've done a good deal of work in all three verticals and introducing a restricted license in any of their environments would have been a tough sell that involved a legal review and a well documented business case. I can think of a few where I can guarantee they would never allow it - and not based on any problems with React's license in particular, but because of internal history.

I wouldn't be surprised if the choice of front-end framework for website development is still below the radar of legal/compliance for some of these places..

A lot of these groups still see front-end tech as just HTML and CSS..

What sort of things would banks, telcos, and insurance companies typically patent? These don't strike me as innovation-oriented companies.

If you don't have any patents, you're not really risking anything using React.

Are you joking, or you just don't know? Telcos alone have a huge list of patents which they are happy to use in the courtroom, and they have won cases in the millions USD. Verizon ranked 52nd in the world for patents granted in 2016.

Bank of America was ranked 124th for its number of U.S. patents granted in 2016.


wouldn't that mean that your company is covered by the react clause but your clients aren't? of course they're not worried, if they're a separate entity they aren't the one in the agreement.

We typically deliver pages and/or SPAs into their existing environments, where these libraries are already installed globally, so I don't think so.

Some large tech companies may have large coffers of money and other bargaining power, and thus use React.

Many don't, and don't.

BTW one can use [preact] which is an almost drop-in replacement, but smaller, and is under MIT license.

[preact]: https://github.com/developit/preact/

I suspect that for a lot of those it's a case of "the development guys want to use this open source library" and nobody in legal has ever been asked. For large companies this is likely an annoyance move, with the argument that nobody who chose to use it is authorized to make that kind of patent - related agreements any more than they're authorized to sell office buildings or manufacturing facilities, but for small tech startups of the sort that Facebook once was this may be a huge hammer.

Thank you for telling us about preact. Is there a good react-native alternative? Our team has bound our codebase pretty tightly to react and react-native (optimized for code sharing).

Preact compat mode is amazing. Highly recommended.

We've begun work on a NativeScript integration that would meet this need. It's early stage though.

I believe some of the larger companies negotiate special/alternative licenses with them though.

I dunno "every single large company" seems like an overstatement. Maybe thats the reason some of big enterprises are still on Angular and Polymer - some go for Vue. Some of them also have BSD+Patents but its less broad.

Preact is not an alternative I'd reccomend. It's riddled with very serious bugs. I've found it incredibly difficult to work with.

Could I ask what those bugs we're and if you had filed an issue for them? I don't have any deployed projects based on it, but I've played with it and talked to the main dev a couple of times - he's usually very on top of it.

I'd be curious to hear about this too - I don't see any issues filed or commented on by him, perhaps the bugs are more perceptual mismatches with his React experience as opposed to actual bugs. We only recently released preact/debug, which brings with it some of the guardrails React ships by default - maybe without those people run into issues.

FWIW there are hundreds of companies (some very very large) using Preact in production. If there were showstopper bugs, they'd be fixed immediately.

I think this may be referring to "preact-compat" issues rather than Preact issues. I know the Inferno team recently had to change a lot of the state scheduling to be 1:1 with React 15/16 (i.e. batch sync schedule setState after events was very broken and there were issues with controlled components in Safari).

https://github.com/developit/preact/issues - would you mind logging them as issues?

Are we talking about the same? I only use preact because react is so weight for the web :)

>Considering almost every single large tech company is using React,

How did you arrive at that conclusion?

I'm not a lawyer, but perhaps Facebook's BSD+Patent license is not even open source.

It's tempting to consider the BSD license independent of the additional patent license. However, the OSI has not approved CC0 as being open source precisely because it expressly reserves patent rights [0]. In the OSI's justification, permissive MIT and BSD licenses may provide implicit patent license, so by themselves they are open source. However, like CC0, BSD+Patents expressly exclude this possibility. Indeed, Facebook's licensing FAQ deems the combined work of the BSD+patents to be the license [1]. Further, recent court case has shown that these licenses are not simply copyright or patent statements, but can be actual contracts [2].

Hence, we have to consider the BSD text + the patents file text as the combined license. This license is not symmetric and hence may violate OSI license standards. I've made this comment in the facebook bug report, https://github.com/facebook/react/issues/10191

[0] https://opensource.org/faq#cc-zero [1] https://code.facebook.com/pages/850928938376556 [2] https://perens.com/blog/2017/05/28/understanding-the-gpl-is-...

I think this is an overreaction (pun accidental).

There are two things here: The copyright license, and the patent grant. Copyright applies to the concrete implementation. You have to agree to the license to be subject to it, and to legally use the code.

A potential patent applies to any implementation. Even if you write a clean-room clone of React, if it uses the same patent, Facebook has a patent claim. But that means the patent grant is not specific to the code; it doesn't even require consent, Facebook could allow you conditional patent usage even without your knowledge! A corollary is that you are strictly better off with the patent grant, it imposes no additional constraints on you.

License with no patent grant: Facebook can sue you for infringing patents, even if you are using a clone!

License with patent grant: Facebook cannot sue you for infringing patents, unless you do it first.


Second, I think the philosophy behind the patent grant is twofold: 1) that software patents are not legitimate. Enforcing a patent is not seen as a legitimate right, but an annoyance, like pissing on someones lawn. From that point of view, it seems not asked too much from somebody to refrain from doing that. (I don't know if that was the idea of the people who drafted that license, but it wouldn't surprise me.)


Another, unrelated observation (and please don't invalidate the first observations if this one is wrong as internet commentators are wont to do):

I see nowhere in the license [1] that it requires you to take the patent grant. Is that true? It would be silly to refuse it, because you are strictly better off with it, of course.

[1] https://github.com/facebook/react/blob/master/LICENSE

> A potential patent applies to any implementation.

This is the point that most people seem to be missing, and it applies to much more than just React clones. If for Facebook has patents required for Virtual DOM, you are no better off if you use Vue.js or almost any other recent frontend framework. Just because you're using a project without the patents file doesn't mean those patents won't affect you.

Virtual DOM? Really?

Does anyone know what patents you are granted with the React license? Virtual DOM work that I and some colleagues did (and have patents for) pre-dates even the earliest internal Facebook experiments with the virtual DOM. We even spoke with the team at Facebook about our work well before React was even publicly released.

>A potential patent applies to any implementation. Even if you write a clean-room clone of React, if it uses the same patent, Facebook has a patent claim.

Sure, but that only rules out a reimplementation of React. The question most people face is "React or existing alternative X?". If your chosen alternative is still actively developed, it's probably notably different from React in concept and implementation (why else would it still exist).

Now if Facebook owns any react-related patents, you use all of them by using react, your alternative has a good chance to be sufficiently different to not be infringing.

In terms of your chances of using Facebook patents, any alternative is strictly better than React itself.

That's how I understand the patent grant too. Are people here really confusing a grant with some sort of restricting of their freedom or do we miss something? I frankly don't want to believe everyone, including apache foundation, believes this without getting their facts straight..?

The problem is that unlike the Apache 2.0 or GPLv3 patent grants, the React license restricts you from suing Facebook for _any_ patent (even non-software patents).

And note that that Facebook doesn't reciprocate that, and so if they decide to sue you for any alleged patent infringement then you cannot counter-sue for patent infringement they may be committing if you are using React. Also it makes you far weaker in negotiations about patent portfolios.

I personally dislike this whole patent business, but I can imagine even pro-patent people would also be against this.

In what way does it restrict you from suing Facebook?

From what I can tell the patent grant is only beneficial to users of the software, not facebook. And it exists to address the concerns people might have that, if they use any facebook tech, they might risk getting sued. If you decide to sue, you're as good off as before. But if you don't sue, you can be sure facebook will never sue you either for violation of the patents they granted.

> In what way does it restrict you from suing Facebook?

Economically, by losing the license to use React in your product once you serve them with papers. It's an implied gun to the head. Or poison pill, if you prefer.

You're not losing the license to use React if you sue Facebook. You only loose the patent grant if you do. In which case you're off as without a grant in the first place. At least that's how I understand it, so this still looks to me like people raging about something they simply don't understand.

I think there is a legal layer, and an ideological layer. From the legal layer, this is a non-issue. You are not in any way worse off than if the license was public domain or BSD (as far as I understand it).

From an ideological or appearances point of view, it seems a bit clumsy. People see it as a submarine to get access to their patents, rather than an insurance to prevent unnecessary patent litigation costs.

I wonder what other companies do with their patent grants, e.g. Microsoft. I remember MS had one that said, you may use our patent for the Ribbon UI, as long as you follow our UI guidelines and don't make an Office competitor (which I find pretty restrictive). But maybe there are other options out there that people would find more agreeable.

I think a unilateral patent grant for React in the license would be nice, but unrealistic. Maybe they should restrict the kinds of patent actions that trigger the invalidation of the grant, say only to certain patents, but it is hard to find a good compromise.

Actually, from a legal layer it also might be a tactic to weaken the bargining power of anyone who uses React (why would Facebook want to discuss a patent portfolio with a company that cannot sue them for any form of patent infringement without losing their React protection). They also would lose their effective ability to counter-sue in a patent case.

I don't like software patents on an ideological level, but even from a legal and practical perspective these license terms should be reason for concern. The first thing I read when I look at a free software project is the license, and when I first saw React a few years ago I stopped looking once I read the PATENTS file.

I was interested in React based on what I'd read and was figuring it'd be worth looking into, but this provides all the reason I need to avoid it - I don't forsee a situation where I would personally or as a small company be suing Facebook, but I could see developing something then selling/trying to sell it to a larger company. If my code comes with a big side of "oh, and if you buy this you won't be able to sue Facebook or its affiliated companies for patent infringement" that could significantly hurt sales chances.

If Microsoft's lawyers were okay with React, then I'm pretty sure your startup is okay. https://github.com/Microsoft/react-native-windows

I'll call that a false equivalency, because only in my wildest dreams can I consider anything I'm working on equivalent to Microsoft. Among the Microsoft-level things I lack I'll count their legal teams, patent portfolio, and negotiating clout.

Anything I as a solo or mostly-solo dev would put together to sell would almost certainly be sold to a company less than 0.1% Microsoft's size - even at the 1% level it's just as likely that a company would decide they'd rather just build their own version or get someone to do so as a work for hire.

Edit: I'm also mentally picturing scenarios where Facebook's terms might end up tested in court. A developer team using an open-source framework without understanding the legal ramifications is one thing, and a thing done by people not authorized to negotiate binding contracts for the company. A purchase of a company or significant software (not off-the-shelf) on the other hand is by definition done by someone with authority to negotiate binding contracts. It's not that hard to imagine a scenario where that difference becomes relevant in court. Heck, I wouldn't be surprised if it turned out that Facebook had an intern or two somewhere focused on identifying and tracking projects using React and what companies they're owned by, just in case they end up in a conflict with someone and need to say "Hey, are they using anything of ours that can make this go away?"

Well, my point was that Microsoft has a very broad patent portfolio, as does Apple, and many other such companies that are using React in production. If they do not fear this patent clause, then I fail to see why your startup would. Especially if your startup has no patents at all (as is the case with most software startups). Apple & Microsoft would have a lot more to lose if they were somehow granting Facebook unlimited access to their patent portfolio just by their usage of React. You think their attorneys would let that fly?

I don't think their attorneys would let that fly, but I also think their attorneys most likely have already negotiated other contracts with Facebook that override whatever's in the React license.

This is not a tool for Facebook to be able to use against another multibillion major tech company. This is a tool for Facebook to be able to use against potentially disruptive tech upstarts of the sort that they were 10-15 years ago. Also, don't just think about Facebook's core business - remember that they're getting into all sorts of fields now. Do you think there are any VR related patents held by smallish companies that might be of interest to the owner of Oculus? If those companies are using React, Facebook now gets to negotiate with them from a position of "You've already basically given us permission to use your patented IP in our new headsets."

You can't avoid react because it started a new paradigm. 9 out of 10 frameworks are based on the same principles and native follows suit where even big vendors are changing their strategies for mobile and desktop to align them with reacts principles (react-native, microsofts react-native-windows, reactxp and office fiber, googles kotlin for android, litho, componentkit, etc). Switching from react to something else is sometimes as simple as adding an alias in webpack. If you don't like the license, use preact, inferno, etc. But the idea itself is way too valuable to be in any way affected by petty licensing issues.

The paradigm is everywhere, so just use another library that uses that paradigm, like Inferno or Preact, or even something slightly different like Vue if you want.

The point is those other libraries could be in violation of any patents that Facebook may or may not have with regards to React. Perhaps they have a patent on virtual DOM? That would mean your usage of Inferno, Preact, Vue, or Angular 2+ would violate the patent.

That would frankly be impossible. All JSX boils down to is h(name, properties, children) and that is literally it. Each reconciler is different, uses another v-dom, etc. If you wanted to patent react, you patent the mere use of functions. And not just that there are about 20 years of fair use of similar principles, even for jsx in particular which evolved from mozillas e4x and otherwise keeps to basic xml markup and mustaches.

I would like to think it's impossible. I just have seen crazier things patented before...https://en.wikipedia.org/wiki/1-Click

Also impossible because JSX is independent of React. The specification is only subject to a standard Copyright and is released under the Creative Commons Attribution 4.0 International license.

Which is what i said.

Oops I didn't read carefully.

As if nobody was ever able to make a user interface before 2013.

It didn't start a new paradigm. It's a failure to understand functional reactive programming hidden behind a bizarre mix of HTML and JavaScript.

RocksDB has fixed this https://github.com/facebook/rocksdb/commit/3c327ac2d0fd50bbd... now and moved to Apache / GPL dual license.

they should fix it the same way in react and react-native repos (delete the PATENTS file).

Nice try!

They did (?)

LOL facebook, move fast and break things.

this one was FAST :)

Well, I opened that issue quite some time ago, and opened it in response to a proposal by FB to use RocksDB in Cassandra, so it's a great change but not a single Fay turnaround

I worked or a large company on several web-based apps right around the time React came out. There were some UI issues I thought could be sorted easily using React.

After going to our lead dev, who in turn went to our project manager, we received an email from our legal department a few days later that simply stated we would not be using React due to "certain patent constraints."

Having not done any prior research, I looked into what the problem might be and was pretty floored with what I found. At first I scoffed when they said no, but after reading about the patent situation I totally get it.

Can someone explain how this can affect to projects using react, as in a part of a product of a company or personal projects? Thanks

I found this [1]:

> FB is not interested in pursuing the more draconian possibilities of the BSD+patents license. If that is true, there is actually very little difference between BSD+patents and the Apache license. As such, relicensing should make little if any pragmatic difference to Facebook.

So what happens if Facebook doesn't change the license and in the future changes its mind?

[1] https://github.com/facebook/react/issues/10191

Facebook has reserved its rights with their license and they can decide to enforce it at any time. Personal projects should be ok, but commercial projects should involve a discussion with legal. If the company thinks it's possible that they end up in a lawsuit with FB, it won't be allowed. For those who get caught unawares, they will have to move off react if possible, or seriously consider settling.

For personal projects, my interest here is in whether or not the patents license is compatible with other free software licenses (say GPLV3). That might be a consideration for some people.

Section 11 might be incompatible with the facebook Patent+BSD license.

As far as I understood It is not compatible with other licenses, that is why the apache foundation doesn't allow it.

(But don't ask me which licenses, I have no idea)

From Mark Thomas's comment on this bug:

> My reading of that is if you use this code and Facebook infringes a completely unrelated patent that you own, you can't sue them for infringement without giving up this patent license. That is much broader than the language in the ALv2 which is limited to a single work.

So it almost certainly doesn't affect personal projects unless you are the sort of person who files for patents as a hobby, but for a commercial project, the scenario, I think, is that if you own some patent (not even a software patent!) and you sue Facebook for it, you lose your patent rights to React. In effect, you may as well be granting Facebook a patent license to literally all your patents for use in any context, in exchange for using React.

Also, it's not just Facebook: it also covers suing anyone for infringing your patent in their use of any other Facebook product or service, as well as "any party relating to" React -- so quite possibly, depending on how lawyers and judges read the license, you can't enforce your non-software patents against anyone who uses React.

I think this is misleading. In the event that you bring a patent infringement case against Facebook, you still have a license to use react, but you lose the patent rights that would cover you if you came up with something that infringed on a Facebook patent. Meaning that you now have to fight your case in court without any protection. You're safer with this license and the patent grant, than you are without it. The BSD license on it's own, and the MIT license don't give you any sort of patent grant at all.

That depends on whether you believe that the BSD license gives you an implied patent grant - it does, after all, just say "Redistribution and use...are permitted," without saying anything specific to copyright.

See also http://en.swpat.org/wiki/Implicit_patent_licence

If the concept of an implicit patent license is coherent and legally meaningful (it sounds like it is), then an explicit patent license, like Facebook's, would supersede it - and so losing your rights under the explicit license would leave you worse off than relying on the implicit one.

In any case, this is why people like the Apache license and the GPLv3, so you don't have to think about whether a patent license is implied. Both of those have explicit patent licenses with significantly less draconian termination clauses than Facebook's.

(Obviously I am not a lawyer, otherwise I'd know better than to comment on HN about unclear areas of IP law.)

The MIT license almost definitely protects you from anyone who published under that license and would try to bring a patent suit against you. It enumerates protection against anything a suit might deal with. It just does it without actually using the word "patent" anywhere.

Not necessarily. Case in point: Its language regarding patents is what made the OSI reject CC0 (or discuss it to death until its application was withdrawn):

Without an explicit mention of patents, it's up to the courts to decide whether the grant of usage rights includes an implicit grant of patent right. With an explicit mention, you're hosed.

> In effect, you may as well be granting Facebook a patent license to literally all your patents for use in any context, in exchange for using React.

I'd say that's overstating the case. You aren't granting them a license to your patents and you can still sue them for infringing (which you would not be able to do if you granted them a license).

Rather, you are promising to look the other way for as long as you are using React. Should you choose to sue,

1. You can say in your case that they never had a right to your patents

2. You can take the time to remove your usage of React prior to filing the court case (so that you never infringe).

Point 2. sounds kinda sketchy. Facebook's BSD says that even 'take a direct financial interest in' suing is forbidden. So if you begin cutting React out of your operations and then sue them already React-free they will probably try to claim that for a time you were using their patents in React illegally because you considered suing them before removing it and at that moment the patent grant terminated.


So push finally comes to shove.

Glad the long-term legal implications will be given serious consideration publicly, rather than the "this is not the droid you're looking for" I've seen nearly everywhere so far!


Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | DMCA | Apply to YC | Contact