"If we were to allow this license, it could lead to potential future conflicts with software licensed under Apache. Also, we could be impairing the future rights of our customers. Essentially, this is not really an open source product based on the implications of the license. While there is no payment of cash, payment is in the form of giving up future rights." 
- She is talking there about the PATENTS grant in React and most other Facebook software, not about GraphQL.
- This is immediately preceded by a mention of the Apache Foundation. When she says it could conflict with Apache, it either means Apache Foundation projects (since they wouldn't be able accept contributions without reversing their stance), or she's suggesting that Apache Foundation might issue future revision of the license that specifically breaks compatibility. Because as of right now, there is no conflict with Apache-the-License, only Apache-the-Foundation, and it doesn't really matter how Apache Foundation feels about Facebook's PATENTS grant wrt license compatibility. The conflict is a policy one, not a legal one.
The comment I responded to framed the situation as if GitLab took a look at the terms of the GraphQL spec, realized that it wasn't good for them, and made the above comments to explain why. The reality is, GitLab realized the current lack of FRAND-RF terms for GraphQL wasn't good for them, and they made the above comments only in response to somebody else's proposed solution to the current situation. That is, the comment doesn't explain why GitLab isn't using GraphQL right now, it explains why GitLab wouldn't use GraphQL if Facebook included the PATENTS grant. Which means that if someone is trying to understand the current situation or why GitLab originally halted GraphQL development, the comment I responded to isn't going to help anyone, because GraphQL is not and never has been subject to the terms of that grant.
If you're still not able to make sense of this, look no further than the first person account from the author of the Medium article referenced (who happens to be the same person who opened the issue):
> I've been a Facebook licensing defender for other OSS like React, but I think this is a completely different issue
Emphasis added by me.
In the longterm can the HN team to look at how snippets work on mobile.
Reading that on my phone was horrendous...
Edit: Oh. Never mind, there seems to be two buttons to expand/collapse?
This is a very nice way to put it, I guess it also applies to the React license issue.
“TL;DR Facebook’s GraphQL spec doesn’t grant a patent license. Therefore, for reasons as set forth below, most GraphQL users infringe Facebook’s patents.“
> fnord123: That post has text of the patents in question. Please warn if you're linking to text of patents so people don't expose themselves to triple damages
To be concrete: If you license the reference code as apache2, that would grant patent rights to people if they used reference code, and they'd be SOL otherwise. Licensing the spec as apache2 would do nothing, as it's not software.
So if you want something apache2 like, you have to use a grant that tries to talk about granting rights to implementations of the spec, and that, for example, terminates if people sue people for implementing the spec.
The first pass i took at this was in https://www.webmproject.org/license/bitstream/
(but i'm sure there are better approaches now)
> Yes, the OSP is legally binding upon Microsoft. The OSP is a unilateral promise from Microsoft and unilateral promises may be enforced against the party making such a promise. Because the OSP states that the promise is irrevocable, it may not be withdrawn by Microsoft. The OSP is, and will be, available to everyone now and in the future for the specifications to which it applies. As stated in the OSP, the only time Microsoft can withdraw its promise against a specific person or company for a specific Covered Specification is if that person or company brings (or voluntarily participates in) a patent infringement lawsuit against Microsoft regarding a Microsoft implementation of the same Covered Specification. This type of "suspension" clause is common industry practice.
If the new patent owner tries to sue people who relied on Microsoft's prior promises not to sue, it might be possible to accuse them (Microsoft) of promissory estoppel and force them to cover any damages. It's probably not in Microsoft's interest to play games like this.
Just out of curiosity though, has this sort of backdoor patent infringement actually been tested in court?
IANAL, let alone a bitter twisted IP lawyer, but it seems perfectly reasonable to infer relevant patent licenses from an open source contribution. "Hey here's a free meal, but you better not eat it or we'll sue!" Sticky stuff.
This has been the gist of the complaint against software patents for the last decade+. It's why all the latest revisions of Apache, GPL, and MPL include explicit patent grants and termination criteria in their texts. It's why Microsoft included a separate patent promise when they placed .NET Core under MIT. And it's why Facebook themselves has released most of their projects with the now-infamous PATENTS additional grant.
> As I understand it, this is bad because
Not really. This is bad because GraphQL is a spec. If Facebook released some GraphQL-related software under any modern FOSS license, you'd be able to use it, regardless of any patents covering it. (See above.) The problem with GraphQL being a spec is that if you use some GraphQL-related software that doesn't originate from Facebook, then the licenses on any Facebook software (and thus the patent grants in that license) are irrelevant and you have no patent protection. And now you might begin to see why everyone in OSS who's acting in good faith would be better off with their own Facebook-style PATENTS grant.
No false equivalence should be made here. Facebook needs and deserves to be called out over it as much as possible.
Still, the result is an arms race among land-mine manufacturers. Nobody wins but the undertakers and the orthopedic surgeons... or in this case the lawyers.
In that light, the owner (or even expiration) does not matter. You can claim to implement an expired patent as a defense of a patent lawsuit. You can claim to implement/steal somebody else's patent (but that is unwise at times). This principle is how RISC-V and J-Core have survived. They pointed to expired patents and saying, "we do that, not your thing." (They really did too)
Privately owned patent rights, without rights granted to other entities can only be used offensively. Anyone saying otherwise is wittingly or unwitting supporting the patent system and arguing company line.
Companies that are serious about only using patents for this purpose can contribute them to open licensing schemes.
(And in the case of specifications that want to be standards, full patent grants should absolutely be included. You want people to use their stuff, make it safe for them to do so)
An eye for an eye, and a tooth for a tooth leaves us all blind and toothless.
> Examiner suggested . . . to advance the prosecution of this application: 1) Add the following limitations in claim 1: ‘a) graphs associated with a social-networking system’ . . . .
It sounds to me like the examiner is contradicting their self. They initially state that the type of information being manipulated does not render the idea less abstract, then go on to suggest limiting the information to social networking graphs.
This GraphQL situation is different and, arguably, somewhat worse than the ReactJS BSD+Patent license issue.
The problem here is the GraphQL specification doesn't have a patent grant (unlike ReactJS, which does, but people don't like the terms of the grant). And Facebook have filed a patent for GraphQL (https://www.google.com/patents/US9646028) that has some quite broad language.
Due to the patent, and the lack of a patent grant, most GraphQL users likely infringe on Facebook's patents.
Please read: https://firstname.lastname@example.org/using-graphql-why-facebook-n...
I'm not sure if the author of that article is partially trolling in the attempt to get Facebook's patents terms applied to the entire spec.
The best solution would be to abolish software patents completely.
I think this entire PATENTS situation with Facebook is a good reason why people should prefer Free software that is created and managed by individual developers and independent foundations over "open source" software produced by large companies with legal teams and dubious agendas.
That post has text of the patents in question. Please warn if you're linking to text of patents so people don't expose themselves to triple damages.
TL;DR - In 2012, Yahoo sued Facebook over 10 patents, "general sentiment in the industry was that the lawsuit against Facebook was without merit; some said Yahoo was a patent troll." Facebook spent a lot of money acquiring a patent warchest to be used defensively against patent suits in the future. Yahoo then drops the patent infringement case.
"The key thing to understand is that Facebook used and invested in patents as an important way to defend itself."
Facebook asserts that anyone can use these open source libraries with a patent use grant. However, if that company then sues Facebook over patent infringement, Facebook reserves the right to revoke all patent grants so they can use their own patents in a countersuit.
I can see how it makes sense for Facebook, but still a toxic effect on the actual "open source" status of React et al.
That's the definition of toxic.
So if fb just uses something patented by my company in one of their products, just uses it without my company's permission, but doesn't sue, what is my company's recourse?
What is my company's leverage or incentive to get them to pay my company for a license?
You assume an intent but the intent is unclear here. React is an incredibly attractive technical product. As a web dev at my company I really want to use it, but had I not realized its strange underhanded bidirectional patent grant and evangelized it I could have boxed my company into a corner, forcing it to decide to sacrifice our React web infrastructure or defend our patents.
Spreading misinformation about the danger only serves to undermine the OSS community's response.
In more concrete terms, if you see some project is licensed under Apache 2.0, then you can still be sued for using it, because while you may have a guarantee that its contributors won't sue you, it doesn't make anybody else's patents go away.
In slightly more concrete terms than that, if Project X causes Facebook to be sued by Corp Y because Facebook is using that project, then Facebook has no protection if it is not a Corp Y project nor have they ever contributed to it.
In real life, Corp Y is Yahoo, who sued Facebook several years ago on a bunch of patent-related matters. Facebook then went on a tear building up a war chest and crafting the PATENTS text so that it could never happen again.
You can't know what would happen if Zuckerberg is replaced (accidents happen) and corporate water-heads take over Facebook.
I’m not trying to be sarcastic, I just really don’t understand how these fears are justified. Besides, if Facebook decides they want to crush you and use React as a shield, you’ll probably have bigger problems in that moment than your choice of front end libraries. A bigger problem, I would think, is that you have something worth Facebook thinks is worth stealing. Facebook doesn’t need a React patent clause to smother a company.
Imagine a tiny company finally figures out UX and solves some of the problems with spam, load balancing, etc. on a decentralized social network. If the cat gets out of the bag, they're an existential threat to Facebook.
> If Facebook were going to leverage
> this the way people are scared of,
> wouldn’t there be some example of
> them using it the way people are
> scared of?
The license is real, anybody can read it, when you can guarantee or demonstrate that Facebook will never act on in, not today, not in 10 years, under any circumstances then you can call it a conspiracy theory.
A patent grant is a good thing, you want a patent grant as a user of OSS.
The problem people have with React's patent grant is the one sided terms of the patent grant (and the fear that Facebook could hold you hostage with those terms).
> Geez, wish they would just re-license under Apache 2.0.
This would be my preference.
IMO, for the React issue, even if the issue is a paper tiger (https://email@example.com/react-facebook-and-the-revok...), this puts a massive hit on Facebook's OSS credibility. Even if the fear was irrational, many people are never going to understand that now and many people won't touch any Facebook OSS because of that fear.
Facebook would probably solve a lot of that credibility loss by just re-licensing under Apache 2.0.
If Microsoft and Broadcom are better OSS+patents citizens then you are, you have a serious problem.
That article is just another reminder why one cannot afford to give Facebook a pass on this.
This means that the React patent card is a one-time play with HUGE repercussions. Facebook isn't going to target your little company or startup and worrying about it IMO is foolish.
Besides, isn’t the wording in this clause immediate loss of use? You’d either have to take the time to convert your app to something else before you sue them, which would still take a long time and give them the time to build/perfect your new lethal competitor, or sue them and shut your business down until you converted it to something, which is equally lethal.
I mean, we don't have software patents in Germany.
There's significant differences, but it means that if someone designs an "OData without the suck" then there's a fair chance Facebook doesn't have much to go on.
That said they can still play patent troll of course - patents hardly ever get evaluated on their merits in court AFAIK.
This is madness…
The graphql repo is the specification for GraphQL. There has never been a PATENTS file in that repo or any mention of patents:
See DannyBee's post for why a patent grant for a specification is different from software:
> At the very least, Facebook doesn't
> care about solving the problem