top | item 15050841

Explaining React's license

978 points| y4m4b4 | 8 years ago |code.facebook.com

595 comments

order
[+] kevinflo|8 years ago|reply
I love love love love love react as a technology, but this is just awful. I believe any developer not on Facebook's payroll still contributing to React or React native at this point has a moral obligation to stop. I personally feel like such a fool for not taking all this seriously before the ASF gave me a wakeup call. React is a trojan horse into the open source community that Facebook purposely and maliciously steered over time to deepen their war chest. Maybe that's an overblown take, but they had a perfect opportunity here to prove me wrong and they didn't. The defensive cover they present here feels so paper thin.

Even if we paint all of their actions in the most favorable possible light, and even if the clause is a paper tiger as some have claimed, it doesn't matter. This is not how open source should work. We should not have to debate for years if a project's license is radioactive. Especially individual devs like myself who just want to use a great tool. We should be able to just use it, because it's open and that's what open means. This is so much worse than closed. It's closed masquerading as open.

[+] stephen82|8 years ago|reply
Well, I planned to learn more about React, but reading now this convinced me to learn Vue.js instead.

It's under MIT license developed by a single person in addition to community's contribution.

This link is rather interesting https://vuejs.org/v2/guide/comparison.html#React

[+] zackbrown|8 years ago|reply
I remember sitting in the front row at ngEurope (Angular conf) back in 2014, when Misko announced that Angular 2 would be a (breaking) API rewrite vs Angular 1. At that time, Angular was perhaps at its global maximum of community mind share—bigger than React!—and its popularity began to sink afterwards in large part due to that PR snafu.

I wonder if this is React's "Angular 2." What's worse, the misstep this time is due to ham-fisted corporate mal- stewardship, not just miscommunicated technical good intentions. Vue is similarly positioned to be the "next thing" in the way React was three years ago. My how this space churns.

[+] IanKelling|8 years ago|reply
> if a project's license is radioactive

It's not a copyright license. It's a patent grant/license which is completely independent. This matters for several reasons, including when just saying "license", this usually means a copyright license.

If this patent grant get's revoked, you are back to simply using the BSD license with no patent grant. I've read so many people say "you'd have to stop using react if you sued facebook", uh, no, you'd have a bsd license with no patent grant like you probably do with tons of other free software your company uses. Clearly, people should be complaining about that if they are complaining about this, but the misunderstanding and misinformation is really strong. If you believe software patents are universally bad, like many people including me, then it is clearly better using the MIT/BSD license alone, which gives you zero patent rights, you are simply infringing and waiting to be sued. I have no problem with it. https://www.gnu.org/philosophy/software-patents.en.html.

[+] thesagan|8 years ago|reply
I'm also going to hop on this train and move away from react. Personally and professionally, I don't like the direction the big players are taking the internet. (The closed, proprietary model.)

I suppose there's not much I can do about it except to move my efforts elsewhere, even if it affects my earnings.

[+] drieddust|8 years ago|reply
Agreed and there is no reason to still stick with react when alternatives like vuejs and angular are available.

Its not that great anyways when compared to angular 2/4. There are too many concepts to be mastered and it soon become overwhelming. I tried learning react but dropped it after spending a week when I still could not understand routing. Sense of cohesiveness between different concepts is missing. I believe some learning junkies may get the kick out of it but that's not me. My time is better spent elsewhere.

Angular on the other hand introduces everything one single tutorials[1] to make one productive. Deep dive later can be done later on when required.

[1] https://angular.io/tutorial

Edit: minor typo

[+] Strom|8 years ago|reply
> I believe any developer not on Facebook's payroll still contributing to React or React native at this point has a moral obligation to stop.

I've contributed to React before and will continue to do so. I haven't seen a single reason why not to. Just because React doesn't use your favorite license? Well this may shock you but I also use and help develop closed source software. In my view there is nothing morally wrong here. What's more, it's not even clear which morals you think I would be failing by continuing to contribute to React.

[+] patrickaljord|8 years ago|reply
Here's a list of companies using React:

- Microsoft - Uber - Yahoo Mail - Dropbox - Airbnb - Netflix - NY Times

If they're ok with the license, you probably shouldn't worry too much. Basically, if you don't own any patents or if your company is smaller than any of the above, you should be ok.

[+] DannyBee|8 years ago|reply
So, i feel for them, having watched Google's open source projects be targeted by patent trolls in the past. But i really don't think this is the way forward.

A few things:

1. If you want to suggest you are doing this as part of an attempt to avoid meritless litigation, you really should give concrete examples of that happening. Otherwise, it comes off as a smoke screen.

2. The assertion is that if widely adopted, it would avoid lots of meritless litigation. This is a theoretically possible outcome. Here's another theoretically possible outcome of wide adoption of this kind of very broad termination language: Facebook is able to use other people's technology at will because nobody can afford to not use their stuff, and no startup that they decide to take technology from, and say "no more facebook/react/etc for you" could realistically launch an effective lawsuit before they died. Assume for a second you think Facebook is not likely to do this. If widely adopted, someone will do it. Nobody should have to worry about this possibility when considering whether to adopt particular open source software.

(there are other theoretical outcomes, good and bad).

It's also worth pointing out: None of this is a new discussion or argument. All of the current revisions of the major licenses (Apache v2, GPLv3) went through arguments about whether to use these kinds of broader termination clauses (though not quite as one sided and company focused), and ultimately decided not to, for (IMHO good) reasons. I'm a bit surprised this isn't mentioned or discussed anywhere.

These kinds of clauses are not a uniform net positive, they are fairly bimodal.

[+] fhrow4484|8 years ago|reply
That's a good point, especially since the concrete examples won't possibly be about patent trolls. Why would patent trolls (aka Non practicing entities) care about loosing rights "to make, have made, use, sell, offer to sell, import, and otherwise transfer the [React] Software". (as defined in https://github.com/facebook/react/blob/b8ba8c83f318b84e42933...)?
[+] carussell|8 years ago|reply
> no startup that they decide to take technology from, and say "no more react (or whatever) for you" could realistically launch an effective lawsuit before they died

If it's the case that these startups wouldn't have the resources to mount an effective lawsuit, then that's true regardless, no? Whatever the React terms say are moot. (I might be misunderstanding; the sentence is one that's hard to parse.)

> All of the current revisions of the major licenses (Apachev2, GPLv3) went through arguments about whether to use these kinds of clauses (though not quite as one sided and company focused), and ultimately decided not to.

When MPL2 was being drafted, I pointed out that a strong, React-like approach to patents would be better, because the protection that Apache 2.0 offers against patents is very narrow. My takeaway was that the reason not to do so was because it wouldn't have been politically expedient at the time—it would just result in people rejecting the MPL. If Facebook is now taking that approach, then run with it now; it suggests the idea should be opened back up for reconsideration in future revisions of these licenses because they can capitalize on the momentum.

[+] sverhagen|8 years ago|reply
To your second point, wouldn't there be a tremendous amount of startups who aren't interested in being in the patents business, or that would otherwise not own the patents over which to sue Facebook, that would thus not be able to get into this position, or did I just completely misunderstand the issue?
[+] Flenser|8 years ago|reply
Here's another theoretically possible outcome of wide adoption of something without any patent licence:

Google is able to use other people's technology at will because nobody can afford to not use their stuff, and no startup that they decide to take technology from, and say "no more Google/Angular/Closure Library/etc for you" could realistically launch an effective lawsuit before they died.

[+] jwingy|8 years ago|reply
I wonder how Facebook would feel if all the open source software they currently use incorporated the same license. I bet it would deter them from enjoying much of the code they built their business on. This stance seems pretty antithetical to the goal and spirit of open source software and I really hope it's not the beginning of other companies following suit and 'poisoning' the well.
[+] eridius|8 years ago|reply
> We've been looking for ways around this and have reached out to ASF to see if we could try to work with them, but have come up empty.

There's a pretty obvious solution to this: relicense React. The fact that Facebook isn't even considering that is a pretty strong indication that they "weaponized" their license on purpose.

> To this point, though, we haven't done a good job of explaining the reasons behind our BSD + Patents license.

I think we already understand the reasoning behind it.

> As our business has become successful, we've become a larger target for meritless patent litigation.

And the solution you chose stops merit-ful litigation as well.

> We respect third party IP, including patents, and expect others to respect our IP too.

Clearly you don't, because you've intentionally designed a license to allow you carte blanche to violate other companies' patents if they're dependent enough upon React to not be able to easily stop using it.

[+] rakibtg|8 years ago|reply
This is pathetic and breaks my heart. Expecting something good from thieves is not very practical, Facebook the company started by stealing others dream. This days if you take a look at them, they won't let grow any other app for any cost. They bought instagram, whatsapp where they already was providing such feature but due to their earlybird list.

Also instead of contributing few tweaks into NPM they made a clone of NPM called Yarn, so funny.

Instead of contributing changes to PHP they made a clone of PHP called HackLang, i am laughing laughter :D

Facebook is a proven bad actor for all open source projects, and its time to be aware. One possible solution is to ban facebook from using any open source projects with a new license.

One day we will going to have F-Git (a copied version of git with some tweaks by facebook)

Snapchat denied to become a part of their monopoly cycle, they made a 100% clone of the product in facebooks every fucking platform. As a software engineer i found it very illegal and unethical, every maker should have good ethics, thats why facebook was unable to invent anything other than Poke feature on facebook itself.

Shame

If i were working at facebook i would definitely switch the company to better one, who won't force me to copy others.

However, i am upset, because the technology that i loved most was just a typical facebook product comes with hidden payloads. I would definitely stay 100% away from all facebook products. It also gives us a free lesson how a evil a tech company could be.

Alternatives: My personal list of alternatives are,

React = Vue JS

React Native = Native Script

All i can do is this: https://twitter.com/rakibtg/status/892784442476904449

[+] davnicwil|8 years ago|reply
> One day we are going to have F-git

Funnily enough, their source control is actually a counter example to your assertions here.

Facebook reportedly don't use git but rather mercurial, and seemingly have contributed significantly to that project. See this for example https://code.facebook.com/posts/218678814984400/scaling-merc...

Note, I don't work at Facebook or have any affiliation or knowledge of how they operate, I'm just taking the contents of this blog post at face value.

[+] msoad|8 years ago|reply
I'm really thankful for Yarn.

npm is the buggies software I had to deal with! Also God forbids if you want to fix a bug! First the code is absolute piece of poop and when you figure all this "smart" hacks they wrote and fix it you will have a hard time getting it merged. They close prs and force their way of doing things without caring about community feedback. Take for example that stupid error output or randomly running prepublish script for example

There are so many bad architectural decisions in npm that there is no way you can fix it by a few changes.

[+] AgentME|8 years ago|reply
>Also instead of contributing few tweaks into NPM they made a clone of NPM called Yarn, so funny.

npm is buggy and seems to need a lot more than a few tweaks. Some time before Yarn came out I was wondering why no one had yet decided to make a direct competitor / rewrite npm from scratch.

[+] rafinha|8 years ago|reply
Caffe and Caffe2 is also a good example!
[+] krowel|8 years ago|reply

[deleted]

[+] Scaevolus|8 years ago|reply
Almost all of Facebook's "open source" code has the same PATENTS file, which makes them toxic if you can imagine a future where Facebook infringes one of your patents: https://github.com/search?p=5&q=org%3Afacebook+filename%3APA...

This includes things far outside the React ecosystem:

    - Flow (JS type checker, like TypeScript)
    - prepack (JS optimizing transpiler)
    - a bunch of Android/iOS UI/debugging frameworks,
    - all their GraphQL libraries (server/client)
    - their machine learning work (mostly targeting Torch)
    - Reason (statically typed programming language that transpiles to JS/OCaml)
    - ZSTD, a highly competitive compression algorithm.
Disclaimer: I work at Google on Kubernetes (which is Apache licensed). This is my personal opinion. I am frustrated with software with trivially incompatible licenses.
[+] IanKelling|8 years ago|reply
> I am frustrated with software with trivially incompatible licenses.

It's not a copyright license, and it's not incompatible with any other free software license. I'm frustrated with the misinformation spread about it.

If this patent license/grant get's revoked, you are back to simply using the BSD license with no patent grant. I've read so many people say "you'd have to stop using react if you sued facebook", uh, no, you'd have a bsd license with no patent grant like you probably do with tons of other free software your company uses. Clearly, people should be complaining about that if they are complaining about this, but the misunderstanding and misinformation is really strong. If you believe software patents are universally bad, like many people including me, then it is clearly better using the MIT/BSD license alone, which gives you zero patent rights, you are simply infringing and waiting to be sued. I have no problem with it. https://www.gnu.org/philosophy/software-patents.en.html.

[+] diakritikal|8 years ago|reply
What's the difference between say the PATENTS file/grant in these Facebook projects and the PATENTS file/grant in Go which Kubernetes is written in?

Not being inflammatory, genuinely interested as a user of both Go and React...

[+] Steeeve|8 years ago|reply
> We've been looking for ways around this and have reached out to ASF to see if we could try to work with them, but have come up empty.

This, to me, is a significant warning sign.

I was leery of the React license to begin with. But the community at large had _almost_ convinced me that it was nothing to worry about.

Unfortunately, Facebook's position as stated here is clearly that the license is weaponized for a reason. I think it's irresponsible to leverage software with this license without clear guidance from legal and corporate overlords stating that it's OK.

[+] pdfernhout|8 years ago|reply
Yeah, I got tons of pushback when I tried to steer Automattic and the WordPress community away from React in 2015 with people saying not to worry:

"Replace React with Mithril for licensing reasons" https://github.com/Automattic/wp-calypso/issues/650

Personally, I increasingly doubt that BSD+PATENTS is even GPL-compatible -- and so potentially Automattic may be violating the GPL by using React integrated with WordPress.

What's especially sad about this is that React isn't even that good compared to other vdoms like Mithril and Inferno and others. React just has a lot of name recognition and mindshare from the Facebook association (which then translates into a rich-get-richer effect with more tutorials and components).

Here is a list of more than twenty alternative vdoms I put together in January 2016 (although Mithril remains my favorite): https://github.com/dojo/meta/issues/11#issuecomment-17679024...

[+] abritinthebay|8 years ago|reply
That’s an impressive conclusion you’ve jumped to there, but there’s no evidence of it in the linked post or your comment.

That, to me, is also a significant warning sign.

[+] jnbiche|8 years ago|reply
I agree. Even if they're not necessarily up to something nefarious, this all seems quite odd.
[+] votepaunchy|8 years ago|reply
The fallback to BSD+Patents is simply BSD and should be evaluated by legal and corporate likewise.
[+] antoncohen|8 years ago|reply
Facebook's license is no more dangerous than regular MIT or BSD-style licenses. If you are OK with using MIT or BSD licensed software you should be OK with using Facebook's BSD + Patents software.

Here is why:

MIT and BSD licenses don't have any patent grants, unlike the Apache 2.0 license. If you use MIT/BSD open source software, and some functionality of that software is patented by the author, you could be sued for patent infringement.

If you use software licensed under Facebook's BSD + Patents license, and the author of the software (Facebook) has patented technology in the software (which AFAIK they don't), the author CANNOT sue you.

Now if you turn around and use the author for patent infringement for something else, you lose the patent grant that came with the software, and you are back to a normal plain old BSD license.

The BSD + Patents license is strictly better than the regular BSD/MIT licenses. You lose no rights, you may gain some patent protection.

Major software like Ruby (BSD), Rails (MIT), and FreeBSD (BSD) use licenses without patent grants. Entire businesses are built on top of these pieces of software, e.g., GitHub (Ruby and Rails) and a lot of commercial hardware built on FreeBSD (https://en.wikipedia.org/wiki/List_of_products_based_on_Free...).

Read the patent grant for yourself:

https://github.com/facebook/react/blob/master/PATENTS

[+] fhrow4484|8 years ago|reply
This is in reply to the Apache Software Foundation decision to list the BSD + Patents license as a Category-X license.

- Facebook gets attacked by meritless patent litigation

- Facebook creates the BSD + Patents license, which has the following effect :

> The patent grant says that if you're going to use the software we've released under it, you lose the patent license from us if you sue us for patent infringement.

- Facebook believe that 'if this license were widely adopted, it could actually reduce meritless litigation for all adopters'

I understand Facebook's position here, surely this will decrease meritless litigation, but what about meritful litigation?

Let's take an example, a small startup has a cool technology but also all their front-end is using React. That cool technology is patented.

Now if 'Facebook or any of its subsidiaries or corporate affiliates' infringe on that patent, that startup won't be able to sue them without first re-writing the entire front-end to not use React.

I don't think software should be patent-able in the first place anyways but it seems the situation above would still be true if that startup sues them for what they believe is a completely legitimate hardware patent.

Also, IANAL, I'm wondering what even is the definition of a 'corporate affiliate' here? Who is a 'corporate affiliate' of FB?

Finally, what 'patent license' are they referring to in this post anyways ? The react's PATENT clause (https://github.com/facebook/react/blob/b8ba8c83f318b84e42933...) says they're providing the React software License, and they revoke this software license if you sue them.

[+] bryanlarsen|8 years ago|reply
Facebook and other large software firms have a large arsenal of patents that's sufficient to defend themselves from a patent lawsuit from a large competitor. These patents are broad. So if you're writing web software with any amount of compexity, you probably infringe on Facebook's patents. If you are a small firm that owns a patent Facebook is infringing on and you wish to litigate it, you have basically two options:

1: give up your main business so you no longer infringe on the Facebook patents. IOW, become a troll.

2: get demolished by the Facebook counter suit.

The React license doesn't change those two options one bit, it just makes it much more obvious. Facebook's intent is likely just to prevent the suits from even being considered in the first place.

[+] bpicolo|8 years ago|reply
> without first re-writing the entire front-end to not use React

Do note this isn't necessarily the case, because nobody has yet found a patent that covers React.

[+] valuearb|8 years ago|reply
Since patents are evil, I have no problem with some small startup losing the ability to be a patent troll.
[+] Eridrus|8 years ago|reply
I think the reasoning that this will protect them against frivolous lawsuits is pretty poor; you only need a patent grant if you're actually building software. Patent trolls don't build anything so they have no need for patent grants.
[+] ralmidani|8 years ago|reply
For someone like me, (Free Software advocate, Ember user looking for a breath of fresh air--and better job prospects--with React), it all boils down to doing a cost-benefit analysis.

Sweeping conclusions like "you have nothing to worry about" or "you should never use software with such a license" do not apply to everyone.

As a Free Software advocate, I abhor troll-like behavior, regardless of whether the vehicle is patents, copyrights, or anything else.

I am also more likely to benefit from potential patents contained in a project like React than I am to ever 1) Own a patent. 2) Have a company use that patent in a way I find harmful and offensive. 3) Have the resources to sue an internet giant.

So for me, it's probably worth it to use React, although I can understand why others insist on a more cautious approach.

One thing Facebook could do that would inspire confidence (not to mention make the company a champion of free innovation) is to enumerate which patents the company owns and release all of them under the Defensive Patent License [0].

Such a move would require a lot of courage, but Facebook is large enough and entrenched enough that they would probably gain much more than they could potentially lose.

[0] https://defensivepatentlicense.org

[+] slackoverflower|8 years ago|reply
Of course they release this late on a Friday so it is does not get much reach. Facebook is very very evil - in every part of the company. Copying other's ideas (Snapchat) yet trying to stop other companies from copying them (this licensing).
[+] Illniyar|8 years ago|reply
It seems to me the core of the disagreement revolves around whether you believe there is an implicit grant of patent or not.

If you believe the BSD has an implicit grant, then the facebook license is a more limited license. If you don't believe it, then the facebook license is better for the user.

As far as I know there is no president to solve this neither in the U.S. or europe, so both views are valid.

One thing is weird in facebook's behaviour though - they imply that the BSD doesn't have an implicit grant, and so they are benevolently giving away a better license, but if so, then the public outcry should be enough to take it back, if it's just a gesture of good will, and it isn't received as such, what's the point in continuing in this course?

The only explanation they give is that they are more or less on a crusade for people to adapt this license because they believe it will reduce patent lawsuits

[+] joobus|8 years ago|reply
The Facebook patents license, https://github.com/facebook/react/blob/master/PATENTS , says:

> The license granted hereunder will terminate, automatically and without notice, if you (or any of your subsidiaries, corporate affiliates or agents) initiate directly or indirectly, or take a direct financial interest in, any Patent Assertion: ... (ii) against any party if such Patent Assertion arises in whole or in part from any software, technology, product or service of Facebook or any of its subsidiaries or corporate affiliates,

I always thought the main problem was this part, where you basically lose the license or your IP if Facebook ever decides to become your competitor, e.g. you start a company with a react front-end that does X, and then Facebook decides to directly copy your business. You have no recourse against Facebook, because if you sue them for infringing your IP, you lose the ability to use the React license.

[+] nojvek|8 years ago|reply
If Snapchat used React, Facebook would kill them to death because Snapchat couldn’t do much. They already mass copied snapchat’s Features.

Any sane aspiring developer would know not to give Facebook that much power.

[+] beager|8 years ago|reply
As I understand the asymmetry in the BSD+patents license, the real issue here is that usage of React significantly weakens you with respect to mounting a defense against Facebook for infringing upon your own patents or IP, a possibility which, given the stark example of Instagram Stories, is plainly plausible. (This is not to say that Instagram Stories is patent theft, but rather a propensity to copy ideas wholesale).

Were Facebook to amend that license to soften the criteria for revocation of the license grant in cases of suits against Facebook for infringement, this outrage might just go away. But as it stands now, Facebook stands to exercise an ability to infringe on others' patents for monetary gain so long as the patent holder uses React in deployment. It would be easy to weaponize this arrangement, and you have to assume that any fiduciary would consider it.

More broadly, this is a good case to be made against software patents in general.

[+] captainmuon|8 years ago|reply
I would appreciate if Facebook would actually explain their license.

Especially: Is BSD+Patent strictly more permissive than BSD or not? There are two major camps as far as I can see:

Camp 1: BSD license does not give you a patent grant. You can always be sued by Facebook if you infringe (potential) React patents. On top of this, Facebook grants you use of (potential) React patents - but only as long as you don't enforce patents against them. If you do, you are back to the BSD license alone.

Camp 2: This camp believes a) that the BSD license implies an unconditional patent grant (for React) and b) that the conditional patent grant ('PATENTS') is not optional, but inseparable from 'LICENSE'. If this is true, BSD+Patent grant is strictly less permissive than BSD alone. If you enforce patents against Facebook, you stand worse than with BSD alone.

The only way this could be cleared up (beyond doubt) is by a court, or very easily with a few lines from Facebook.

[+] thesausageking|8 years ago|reply
> Their decision was not a legal decision about the compatibility of projects with this license. As has always been the case, source code licensed under the Facebook BSD + Patents license can be combined with source code licensed under other open source licenses like BSD, MIT, Apache 2.0, and GPL.

What complete, tone deaf newspeak. If a BSD-licensed project uses code with a Facebook BSD license, the project is now Facebook BSD licensed. That means it's incompatible with the BSD license.

[+] jwingy|8 years ago|reply
I wonder how Facebook would feel if all the open source software they currently use incorporated the same license. I bet it would deter them from enjoying much of the code they built their business on. This stance seems pretty antithetical to the goal and spirit of open source software and I really hope it's not the beginning of other companies following suit and 'poisoning' the well of other open source projects.
[+] tbrock|8 years ago|reply
Isn't the style of programming react imposes (unidirectional data flow and component composition) the real innovation for front end applications here?

Sure the dom diffing technology was hot at the time it came out but it's basically is a commodity item at this point.

In that sense, the open source community can (and should) build multiple react clones that are licensed more liberally.

Sure, I'm annoyed by the licensing of React too, I think abou it a lot. But does it really matter that Facebook won't budge on this? The technology is out there whether it's React or not.