Mongoose project status and licensing change

[Sergey Lyubka]

Hi mongoose users!

It is 9 years since I've started working on mongoose. Now it got to the point when project requires attention that exceeds free-time capacity of a single person (myself). I have decided to back mongoose by a company. I've started Cesanta Software and set the following goals:

   o  enhance mongoose embedding capabilities (e.g., provide OS API abstraction akin to Sqlite)

   o  enhance Lua API

   o  enhance Websocket support

   o  enhance testing

   o  enhance HTTP client

   o  provide fast response to issues

   o  provide technical support with SLA

   o  build a strong team of full- and part-time mongoose developers

Mongoose continues to be open source, and changes it's license from MIT to dual license:

  o  for non-commercial use, Mongoose continues to be free, available under GPL v.2 license

  o  businesses must get a standard commercial license

I would be happy to answer any questions.

[George Petsagourakis]

Good decision, I hope it works out for you. Bon courage!

[Thomas Davis]

Not a fan of GPL licences.  GPL is not open source.

[Joel Sherrill]

I won't get drawn into what is or is not an open source or free license. But I will say that RTEMS.org has bundled Mongoose with our RTOS since it was Simple HTTPD and the pure GPL is incompatible with our project license requirements.

We cannot update our included bundle past the last non-GPL version and do not know what we will do longer term.

We are an embedded RTOS with applications that link the OS and all libraries statically. This means that GPL code requirements get pushed to user applications and we won't do that. Our primary license is GPL with a linking exception.

--joel
RTEMS

On Aug 15, 2013 1:10 PM, "Thomas Davis" <sunse...@sunsetbrew.com> wrote:

Not a fan of GPL licences.  GPL is not open source.

--
You received this message because you are subscribed to the Google Groups "mongoose-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mongoose-user...@googlegroups.com.
To post to this group, send email to mongoos...@googlegroups.com.
Visit this group at http://groups.google.com/group/mongoose-users.
For more options, visit https://groups.google.com/groups/opt_out.

[Morgan McGuire]

Hi Sergey,

That's fantastic!  I wish you much luck with the company and think it is very good of you to still offer a non-commercial alternative.

For what it is worth, Mongoose is included with the G3D Innovation Engine (g3d.sf.net), which is under BSD + MIT. The GPL license will force us to either fork Mongoose using the last MIT version, or remove it from our distribution.  I will probably end up forking it, which I think is bad for the Mongoose community as a whole because the code will diverge, but the best option for our users.

-m

[Jeroen Walter]

Hi,

I think it's a big step from the MIT license to the GPL-release-all-your-code license or a very expensive commercial license (for me at least).
I understand the wish to get some monetary rewards for your work, but I think the suggested options are too extreme for small developers.

My project is commercial, but I don't sell enough (<5000 dollar a year) of it to justify a cost of 4999 dollar for a license.
LGPL I can live with, then I can link to a dll with mongoose for my little project.
For now I'll take my chances and use a fork of the still MIT licensed code.
That being said, I wish you all the luck !

[Michael Durland]

5000 euros is going to be a tough sell for my management.  $1000 would be no problem.  GPL is not an option for me, like others have already stated.

Mongoose is awesome, but this is a big change. I might have to look elsewhere, e.g. cpp-netlib and tntnet are a couple I have been looking at. Both are true open source.

One option might be to consider lowering the price with the goal of making up the difference in volume, kind of like the Amazon free shipping on orders over $25. Or going to a subscription license.  My company would easily pay $1000 per year to keep a license active. Maybe there could also be feature tiers: e.g. base C code is tier 1 for $1000, add LUA and SQLite is tier 2 for $2000, etc.
I suggest being open to considering different pricing options rather than set a fixed plan right from the start. I'm guessing many companies are likely not going to be able to justify the current pricing proposal.

Mike

[Dave Brower]

Well, that's going to be a problem for what I'm working on.   I guess a fork will be inevitable.

Good luck!

As a parting gift, attached are some mods that enable an authorize callback and get it to compile in my make environment.

-dB

On Thursday, August 15, 2013 1:57:53 AM UTC-7, Sergey Lyubka wrote:

[Sergey Lyubka]

On Thu, Aug 15, 2013 at 10:49 PM, Michael Durland <michael...@gmail.com> wrote:

5000 euros is going to be a tough sell for my management.  $1000 would be no problem.  GPL is not an option for me, like others have already stated.

Mongoose is awesome, but this is a big change. I might have to look elsewhere, e.g. cpp-netlib and tntnet are a couple I have been looking at. Both are true open source.

One option might be to consider lowering the price with the goal of making up the difference in volume, kind of like the Amazon free shipping on orders over $25. Or going to a subscription license.  My company would easily pay $1000 per year to keep a license active. Maybe there could also be feature tiers: e.g. base C code is tier 1 for $1000, add LUA and SQLite is tier 2 for $2000, etc.
I suggest being open to considering different pricing options rather than set a fixed plan right from the start. I'm guessing many companies are likely not going to be able to justify the current pricing proposal.

Hi Mike, I am going to be flexible with the pricing options, subscription sounds fine.

With regard to forks - it would be good to keep people's efforts consolidated.

If there are many forks, changes & fixes will be scattered, and that's a waste.

One way to deal with that is to create an 'official' fork and grant anybody who's

interested commit privileges. Any other thoughts?

 

Mike

On Thursday, August 15, 2013 1:57:53 AM UTC-7, Sergey Lyubka wrote:

Hi mongoose users!

It is 9 years since I've started working on mongoose. Now it got to the point when project requires attention that exceeds free-time capacity of a single person (myself). I have decided to back mongoose by a company. I've started Cesanta Software and set the following goals:

   o  enhance mongoose embedding capabilities (e.g., provide OS API abstraction akin to Sqlite)

   o  enhance Lua API

   o  enhance Websocket support

   o  enhance testing

   o  enhance HTTP client

   o  provide fast response to issues

   o  provide technical support with SLA

   o  build a strong team of full- and part-time mongoose developers

Mongoose continues to be open source, and changes it's license from MIT to dual license:

  o  for non-commercial use, Mongoose continues to be free, available under GPL v.2 license

  o  businesses must get a standard commercial license

I would be happy to answer any questions.

--

[Thomas Davis]

On Friday, August 16, 2013 2:51:31 AM UTC-4, Sergey Lyubka wrote:

With regard to forks - it would be good to keep people's efforts consolidated.

If there are many forks, changes & fixes will be scattered, and that's a waste.

One way to deal with that is to create an 'official' fork and grant anybody who's

interested commit privileges. Any other thoughts?

 

This will not work because GPL is viral.  Any fork has to run independently and cannot take code from Mongoose going forward.   This is your baby and I respect that.  You deserve to make some money as well.  However, the GPL license is not the answer.  Further, the moment GPL code from a source other than yourself is added to Mongoose, your right to dual license may be waived.

I initially chose mongoose over others as well as the option to write my own because of the MIT license.  Since then, for the past few years, I have molded Mongoose into the heart of my software designs.  It is but a speck of the whole, but a very important speck at that.  Since the license cannot be changed retroactively, I have taken a snapshot, and forked it and renamed it on sourceforge as civetweb.  In the end, I might roll my own, but I have too much invested in Mongoose to just walk away on whim.

I do not intend to compete with Mongoose and if there is a way to help out without changing the license I am all ears.  I believe that the real opportunity for money is in the support roll or by productizing the applications, not the license.

[Morgan McGuire]

This will not work because GPL is viral.  Any fork has to run independently and cannot take code from Mongoose going forward. 

That's not exactly the case.  Code can be released under multiple licenses (in fact, Sergey is about to do just that--take a bunch of MIT code and re-release it as GPL code as well as have his own non-GPL commercial version).

So we can have an official MIT fork (civet seems to be that) that Sergey and the rest of us contribute to under the MIT license and he can maintain his own GPL version.

The only catch is that Sergey can't take patches submitted by OTHER people to the GPL version and give them to the MIT branch, since he won't own the copyright on patches to the GPL version and GPL prohibits him from changing the license on patches.

-m

 

[Sergey Lyubka]

Yep, thanks Morgan, you've put it precisely.

 

-m

 

[Joel Sherrill]

I want to follow up on my earlier message. 

I understand the challenges of trying to make some money off a FOSS software effort. RTEMS was started as a research project in 1989. We have offered support, consulting, and training on it since about 1993 as the project began to move out of the lab and into users hands.  RTEMS is now what I consider a fairly successful FOSS project. We are on many NASA and ESA missions including Mars Curiosity, many experimental physics users, and many commercial users. But we still do not place any licensing restrictions that inhibit commercial use. And we support students via programs like Google Summer of Code and ESA Summer of Code in Space.

But we also do a lot of consulting where RTEMS is our "calling card". We do embedded application work, consult on standards development, systems architecture, independent reviews, etc.. The FOSS project makes us known internationally where it is likely we wouldn't be known outside our city otherwise. 

One cynical thing I have learned is that people who want to contribute will find a way to use your services when they can. Those who don't, won't. Some will run from a dual license. Some will ignore your license request and use it anyway.

I understand we both suffer in the sense that Mongoose and RTEMS are easy enough to use out of the box that most people don't need help. But a rising tide raises all boats. Ask yourself some questions:

+ Do you have a full business and service plan?

+ Honestly, what do you expect to get?

+ Will you self-host or run a business via code.google.com?

+ What services can you offer that are affordable to the user base?  Normally this is going to be things like annual support with quick turn around on bug reports, customization, assistance in integration, etc.

+ Are there features or add-ons or a kit you could provide? There is a lot to be said for nicely packaged, easy to use out of the box with someone to call.

+ Does it make sense to write a book on Mongoose?

+ Could you teach classes?On Mongoose, network programming, tuning, etc.? RTEMS classes are a week but I suspect Mongoose could be a series of shorter special topic on-line courses. I know a few projects that have 1-2 hour video training topics for USD100 to USD500. Not a lot of money per view but you only have to make the videos once. Just make them and the supporting material good. :)

+ What related expertise do you have that someone who finds Mongoose would be interested in? 

+ RTEMS uses Mongoose for httpd but we have our own small embedded ftpd and telnetd. Does it make sense to broaden the scope to include other network services?

+ Do you have a Roadmap or wish list for Mongoose? People tend not to think of things to add. You have to make suggestions.

+ Who are your competitors? Both open and closed. Mongoose is not the first embedded webserver. RTEMS used GoAhead's before Simple HTTPD existed. I know what happened to them. 

+ Would you be willing to work with the projects who have mentioned including or redistributing Mongoose so we can at least make our users aware of your services? For RTEMS, we have a small community of core developers who get recommended for various types of work. [Disclaimer: In our case, the dual licensing will likely be a stopper.]

You definitely need a business entity to accept work through. But dual licensing is not the only business option. Dual licensing is a stick. Is there a carrot approach to the problem?

Maybe I am a cynic but the quick rash of comments leads me to believe that the dual licensing is not popular and will cost you users and some redistributions.

Sorry to rant but after 20 years of offering services for FOSS, it is a challenge and there are lots of options. I also believe very few FOSS consultants make a full-time living doing it. Most offer related services that the FOSS is an entry path or calling card to.

--joel

RTEMS

[Thomas Davis]

Sergey,

I don't have objections to this proposal.  In fact, if there is anything you want me to change about civetweb write up to help promote your business, don't hesitate to tell me.  People can contribute to it of course.  I don't mind being the keeper for the MIT version.

Thomas

[Sergey Lyubka]

Joel, excellent questions indeed, appreciated!

I have to say that I've been thinking about different options, some of which

you have mentioned, for a long time already.

I have an objective that drives my decision.

That objective is to make mongoose the best product in the niche.

I understand clearly that for some people or organizations licensing would be

a show stopper. That is not a barrier to reach the objective though.

If an objective was to retain all users, the decision would have been different.

[Christoph Rupp]

Thanks for the fascinating discussion. I'm in the opposite position - i have a dual licensed (gpl/commercial) library, but think about switching to MIT with commercial add-ons.

Sergey, good luck with your endeavor! I think the critical question is how you define being the "best" in your niche, and which metric you will use to calculate the "best-ness". Is it by subjective taste, or will you write benchmarks, or compare market shares? If you use market share or financial success as a metric, then Joel's and your positions are not far off. I think financial success is a metric that is objective and resilient.

From personal experience (my project is about 8 years old and was dual-licensed from the start) i am slowly coming to the conclusion that the GPL hurts the adoption of open-source-users AND potential commercial customers.
Joel's mail kind of brought me closer to the decision because his arguments are excellent. If you two decide to continue the discussion off-list, then i'd appreciate if you CC me; not because i want you to change your decision, but because i want to learn from it (and maybe share my own experiences with dual-licensing, in case you want to hear them.)

Best regards
Christoph

[Jeroen Walter]

Mongoose over the years has had an active developer community with lots of people contributing.

So regarding copyright, doesn't this also mean, that patches made by people in the last couple of years for the MIT version are also copyrighted and therefore should not be part of the new GPL version without their consent ?

[Sergey Lyubka]

Note that the license cannot be changed retroactively, meaning that the old

code, and thus past contributions, are still MIT. Also, there will be MIT forks.

Whether a patch is a copyrighted software, and must not be a part of the

new GPL version, would be a question to the lawyer. If you know the answer,

please share, I'd appreciate that.

--

[Morgan McGuire]

My understanding is that when we submitted patches, we were implicitly signing our copyright over to the owner of the repository (Sergey, since the MIT license said that he had copyright).  If this wasn't the case, then open source wouldn't work very well--we'd have to sign contracts every time that we submitted patches handing over ownership explicitly, or we would have to have giant license files that described the ownership of each line of code.  As the copyright owner of the currently-MIT code in git, Sergey can't take away the MIT license on the code (which he isn't), but because he owns it, can re-publish the code and derivations from it under any new license that he wants.  He could put it in the public domain, keep it closed source, or offer it under the GPL (which he is).

When there is a fork, the GPL library can take code from the MIT one but not vice versa because that's what their licenses say.

A lawer at the EFF or Open Source Initiave may be willing to weigh in on this for free if asked.

-m

Prof. Morgan McGuire
Computer Science Department
Williams College
http://cs.williams.edu/~morgan

--
You received this message because you are subscribed to a topic in the Google Groups "mongoose-users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/mongoose-users/aafbOnHonkI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to mongoose-user...@googlegroups.com.

[Joe Mucchiello]

You can't implicitly give up your copyrights. All old contributions are owned by their original contributors unless they explicitly gave up those rights. (And then there are also countries where you cannot give up those rights. But that's a different issue.)
It is not possible to change the license on outside contributions without those author's permissions.

And I hate to be a stick in the mud, but I explicitly forbid any of my contributions from being placed under the GPL. Allowing that would violate my work contract.

Farewell mongoose community.

[Morgan McGuire]

You can't implicitly give up your copyrights. All old contributions are owned by their original contributors unless they explicitly gave up those rights. (And then there are also countries where you cannot give up those rights. But that's a different issue.)

Well, we've all allowed our code patches to be distributed under the blanket statment at the top of the git that says,

"Copyright (c) 2004-2013 Sergey Lyubka <val...@gmail.com>"

so it seems that we had no objection until yesterday to letting Sergey claim copyright on that code.

I see that the GIT repository as of Friday says that it is under the GPL, which means that people may be posting GPL code to this list and I can't risk compromising myself by seeing it.  

So, I have to leave this list and the mongoose community now.  Best wishes to Sergey and the new company. Thanks for writing mongoose!

-m

Prof. Morgan McGuire
Computer Science Department
Williams College
http://cs.williams.edu/~morgan

[Joe Mucchiello]

You can't lose you copyrights by not asserting them. Trademarks can be lost by not asserting them. Patents and Copyrights can be ignored or asserted at will without damage to those copyrights or patents. And like Morgan. I cannot stay around as long as the code is GPL.

[Jeroen Walter]

Regardless of any legal or copyright related issues, my main objection is one of morality.
Contributors to the code have done so in the spirit of openness and lack of restrictions as promoted by the MIT license.
This change in licensing to one that poses a set of restrictions, that for many users of mongoose may not be a valid option, feels like a slap in the face to all those contributors.
All contributions were done via the MIT license. You cannot pose restrictions on those contributions, as the license doesn't permit it.
My fear is that the official GPLed mongoose will die a slow death, with only some updates from Sergey, and that the main work and bugfixes will be done in one or more forks.
This would be a shame for such a nice project, which I have followed over the last years, in awe of the nice support and joint efforts to make this project better all the time.

[Thomas Davis]

I just created the Civetweb google group on request by a member here which also suggested I post it here.

I have many reservations posting this message.  I am only posting it as information and in no way suggesting anything.  But if there are people concerned about the GPL tainitng, it is sensible to have a place for them to go rather than lose them.  For those that are ok with the new licence, it makes sense to keep an eye on both to minimize defects.  If I am mistaken, then I am happy to be wrong.  Nevertheless, I am posting this with the utmost of support and respect for Mongoose.

Cheers!
Thomas

[Czarek Tomczak]

Hi Sergey,

So what is the last commit that was still MIT-licensed? Is it the "removing dmg dir on clean" commit?

https://github.com/valenok/mongoose/commit/04fc209644b414d915c446bb1815b55e9fe63acc

It is just before the two "License change" commits.

How do I fork on github only up to this commit? Anyone know?

I'm author of the PHP Desktop project, I'm afraid I also have to give on the new GPL-licensed

mongoose.

Best regards,

Czarek

[Sergey Lyubka]

https://github.com/sunsetbrew/civetweb is the MIT fork of mongoose, please use it.

--

[Czarek Tomczak]

On Tuesday, August 20, 2013 8:35:21 AM UTC+2, Sergey Lyubka wrote:

https://github.com/sunsetbrew/civetweb is the MIT fork of mongoose, please use it.

Thank you Sergey for the link. But still I would like to know what was the last MIT-licensed commit

to Mongoose. Which commit was that?

-Czarek

[Sergey Lyubka]

You had it correct, https://github.com/valenok/mongoose/commit/04fc209644b414d915c446bb1815b55e9fe63acc

--

[Czarek Tomczak]

On Tuesday, August 20, 2013 8:55:19 AM UTC+2, Sergey Lyubka wrote:

You had it correct, https://github.com/valenok/mongoose/commit/04fc209644b414d915c446bb1815b55e9fe63acc

Thank you Sergey for this great project.

-Czarek

[Webber Han]

Hi, Sergey,

Thank you for your great work.

I learnt so much from your code.

Good luck for your biz.

Best wish,

Webber Han

Sergey Lyubka於 2013年8月15日星期四UTC-7上午1時57分53秒寫道：

[Alexander Broekhuis]

Hello,

Just wanted to add my voice to this. While I appreciate all the work being done, for me the change to GPL sadly means that I will have to look for an alternative.

I could start talking about my personal opinion and start a debate about what GPL is/means etc, but that doesn't help in any way and isn't my intention.

For me the reason I can't use GPL is simple because Apache projects can't use any GPL licensed code, see http://www.apache.org/licenses/GPL-compatibility.html for more information on this.

So while I do understand the dual licensing and the need for a commercial option, I currently don't see any option for Apache projects to use Mongoose. This is really sad especially since Apache projects by itself don't have any commercial interest at all and are fully open source.

Good luck with your business and the future of mongoose!

So long, and thanks for all the fish!

Op donderdag 15 augustus 2013 10:57:53 UTC+2 schreef Sergey Lyubka:

[Sergey Lyubka]

On Thu, Sep 26, 2013 at 8:22 AM, Alexander Broekhuis <a.bro...@gmail.com> wrote:

Hello,

Just wanted to add my voice to this. While I appreciate all the work being done, for me the change to GPL sadly means that I will have to look for an alternative.

I could start talking about my personal opinion and start a debate about what GPL is/means etc, but that doesn't help in any way and isn't my intention.

For me the reason I can't use GPL is simple because Apache projects can't use any GPL licensed code, see http://www.apache.org/licenses/GPL-compatibility.html for more information on this.

So while I do understand the dual licensing and the need for a commercial option, I currently don't see any option for Apache projects to use Mongoose. This is really sad especially since Apache projects by itself don't have any commercial interest at all and are fully open source.

Good luck with your business and the future of mongoose!

Thanks Alexander!

 

So long, and thanks for all the fish!

Op donderdag 15 augustus 2013 10:57:53 UTC+2 schreef Sergey Lyubka:

Hi mongoose users!

It is 9 years since I've started working on mongoose. Now it got to the point when project requires attention that exceeds free-time capacity of a single person (myself). I have decided to back mongoose by a company. I've started Cesanta Software and set the following goals:

   o  enhance mongoose embedding capabilities (e.g., provide OS API abstraction akin to Sqlite)

   o  enhance Lua API

   o  enhance Websocket support

   o  enhance testing

   o  enhance HTTP client

   o  provide fast response to issues

   o  provide technical support with SLA

   o  build a strong team of full- and part-time mongoose developers

Mongoose continues to be open source, and changes it's license from MIT to dual license:

  o  for non-commercial use, Mongoose continues to be free, available under GPL v.2 license

  o  businesses must get a standard commercial license

I would be happy to answer any questions.

--

[Luc Isaak]

Hi Sergey,

Can you please clarify how the license applies to the following scenario?

The testers inside the company want to run mongoose.exe on their PC in order the test the functionality of our web pages. Do we need a commercial license? There's no need for access to the source code, just the executable.

Thanks!

[Sergey Lyubka]

I meant to have executables under MIT, however I need to consult legal person

about that, since some executables are using 3rd party code (Lua, Sqlite, CyaSSL).

Tiny executable uses MIT and BSD only code, and could be used with no restriction.

Bottom line: no license restrictions on executables implied by mongoose; there could

be some restrictions implied by 3rd party code.

--

[Luc Isaak]

mongoose-tiny is good enough for testers, thank you for creating it.

I suggest that you add this clarification to the license, that basically the usage of the binary is free in any environment, personal, or corporate.

[Ed Swift]

I'm not a lawyer, but the Lua license is identical to the MIT license (except for not being called "The MIT License"), and SQLite is in the public domain, so I don't think you'd have a problem with distributing either one with other MIT-licensed software.

http://opensource.org/licenses/MIT

http://www.lua.org/license.html

http://www.sqlite.org/copyright.html

CyaSSL is dual-licensed GPL/commercial, like Mongoose.

http://www.yassl.com/yaSSL/License.html

I wonder if this means that your commercial users are supposed to pay for a CyaSSL license as well as a Mongoose license? That seems a little scary. Does it mean that *you* are supposed to pay for a CyaSSL license, since you're using their code in a commercial context? At least that would make things easier on your customers. Maybe you can talk to your legal people and have them set up some kind of deal with wolfSSL's legal people.

Maybe there should be a "mongoose-small" with Lua and SQLite, but without SSL. You could even keep it in another branch, rip out the SSL stuff, and keep that source under the MIT license; maybe people would be more willing to contribute. You could always transplant stuff into the GPL/commercial version with SSL. I guess most commercial users would need SSL, so you probably wouldn't lose many paying customers.

Sorry for rambling, but it's interesting to think about.