OpenBSD forked Apache 1.3, when the Apache 2.0 license was introduced. One argument could be that maintaining, patch and extend a web server on top of writing an operating system is to much work, especially if there's a better alternative, with a license you can accept.
Including a web server isn't necessarily a security concern, it's not running by default. The advantages is that there's a web server included, with privsep, chrooting and a sane default configuration.
I not completely sure. One complaint was, if I recall correctly simply the length and complexity, compared the BSD license. The Apache 2.0 license is very much lawyer talk and a little hard to read.
More likely it was the patent clause of the license that made it so bad that the OpenBSD developers didn't want it. I can sort of see where they're coming from. If some company puts a bit of code into Apache 2, covered by one of their patents, that's okay, anyone using the Apache 2 gets a license. However it's pretty much impossible for anyone to tell which parts of the code is covered by the patent, so you could get in trouble, without knowing it, if you yank out that part of the code an use it elsewhere. The patent could also cover a protocol, an algorithm, whatever, the people using the Apache licensed code don't care, they where given a license for the pattern, but nobody else can do an implementation.
It's not for me to say, but I believe that the OpenBSD developers wanted an http server that came unencumbered by patent and was ensured to be free of any software patent. Instead the Apache 2.0 license presented them they the problem that you can actually tell if a given piece of code was covered under some patent.
The OpenBSD policy page is quite useless[0] on this, but I _believe_ the issue is that the Apache License 2.0 contains the patent clause that states something like "you can't sue apache if someone contributes stuff that infringes your patent", which limits the freedom of the openbsd users to sue apache.
The relevant thread[1] from the time may be of use, but a specific message sums it up:
"We've been clear: Their new license contains more stuff, and we do not accept MORE STUFF in licenses."
On the one hand being against MORE STUFF is a perfectly reasonable position. There's too much accumulated cruft in legal documents that has no real purpose besides make-work for lawyers.
On the other hand it's absurd to dogmatically oppose MORE STUFF regardless of what the stuff is. The added terms in Apache-2 make sense for a US-based collaborative software project that accepts contributions from businesses that hold software patents. They may be pointless legalese for a Canadian-based project whose contributors are mostly individual developers, but that doesn't make them an assault on developers' freedoms.
Is simple, unconditional freedom really that absurd?
We want to make available source code that anyone can use for ANY PURPOSE, with no restrictions.
That's what we call a free gift.
That is one of the project's goals.
You're right, the patent clause might not necessarily be an attack against the OpenBSD developers' freedoms. But they do not care about their own freedoms only; they want it to be free for anyone (this includes corporations who might hold patents, and also individual developers working for such corporations), for any purpose. It is really as simple as that.
You guys keep missing the point really.
We know what a free license should say.
It should say
Copyright foo
I give up my rights and permit others to:
distribute
sell
give
modify
use
I retain the right to be known as the author/owner
When it says something else, ask this:
- is it 100% gauranteed fluff which cannot ever affect anyone?
- is it giving away even more rights (the author right)?
If not, then it must be giving someone more rights, or by the same
token -- taking more rights away from someone else!
Then it is _less_ free than our requirements state!
So why even BOTHER wasting your time trying to understand what they
say?
Who cares if it is legal or not! We're not going to want to go
quibble in a court! We're trying to make it so simple that something
can't even GO to court, because it's free and, anyone can tell that it
is free because the language used to say so is SIMPLE.
That's noble and I respect that. Unfortunately it fails to address software patents at all, and that doesn't make the problem go away.
Copyrights are essentially about copying. Patents aren't - you can write a clean-room program that's entirely your own work, absolutely guaranteeing that you aren't infringing anyone's copyright, but it could still infringe a patent you've never heard of. Or you could accept code from a friendly company which has a few defensive patents on it, and some years later the friendly company comes under less friendly ownership and the defensive patents turn offensive.
Apache, being based in the US (which has many software patents) and accepting code from many companies that have patents, has to deal with these scenarios. OpenBSD, being based in Canada (with far fewer - but not zero! - software patents), isn't as affected by it so Theo calls it bullshit. But it's not so black-and-white.
You are right, copyrights are about copying. Copyright licenses cannot address software patents any more than they can address US export restrictions, trade marks, contracts, or any other international or local laws that might deny you some freedoms. Theo cannot grant you rights to Microsoft's or Cisco's patents. What he can grant you is rights to his code.
Now you can try to "address" software patents e.g. by obligating distributors to grant rights to their patents, but that is a restriction; it might be giving someone more rights, and by the same token is taking more rights away from someone else! More importantly, that would be a restriction imposed by the copyright holder, rather than an external restriction imposed on you by a third entity the copyright holder does not control.
OpenBSD does not want to impose such restrictions on you or anyone else. They make their code free.
You seem to think that OpenBSD or Theo simply disregard patent issues because they hail from Canada. Maybe you should learn about CARP[1][2], or figure out why many of the ports' Makefiles have a line like this:
Patents + OSS is a huge, under-served point that unfortunately Lessig is no longer working on.
I and others that open source tons of code will be the first to wave the FOSS banner all day long, but it's not going change the reality of the present landscape.
As such, open source projects and startup founders repeatedly fail to anticipate the consequences of nonparticipating in the patent scheme. If the other side (a company) holds a (shitty) patent, and a project doesn't... they can still squish them like the cockroaches they are should the project become significant. So there's options: either play the game, fight city hall or get fucked by pretending it doesn't exist. Not choosing an action is still a choice.
Perhaps one of the larger OSS orgs would show leadership on this to help projects manage this tricky minefield.
> "On the other hand it's absurd to dogmatically oppose MORE STUFF regardless of what the stuff is. "
I don't think that it is absurd to oppose stuff written a in language you can't understand, you will never be able to learn and you actually don't care about anyway.
The incompatibility is with their beliefs, it's not technical. You can get Apache 2 in ports and packages. They disagre with the license, so it is not acceptable to them in base. It's the same reason they ship an ancient GCC in base, but once again, the newer ones are in ports. What they include in base OpenBSD is very special to them.
It's the base system, so it makes more sense to include a small, fast, and secure HTTP server than one that includes everything and the kitchen sink. Note that it's still easy to install Apache from the OpenBSD ports.
I am not an openbsd guy obviously but know httpd is popular. Is it because adding it to base install adds too many security concerns?