MuleSource goes CPAL, discusses the role of the Open Source Initiative and the relevance of GPLv3

We answer to a higher authority

(Credit: ConAgra)

My good friend, Dave Rosenberg (CEO of MuleSource), has finally capitulated to the open-source gods and has licensed MuleSource's software under the nearly the exact same license as before (CPAL instead of MPL+attribution), only this time it's blessed by the Open Source Initiative (OSI).

It's like the hot dogs we buy in the Asay home: Hebrew National. I don't know that they're any different from any other hot dogs, but I like the fact that a rabbi blesses them and guarantees there aren't any non-kosher things in them (like rat hair and excrement).

Anyway, MuleSource ("Our open-source ESB answers to the OSI") is now blessed as open source, and Dave does a fine Q&A with himself to discuss the move, and why MuleSource didn't capitulate to my GPL (GNU General Public License) fetish. In the self-interview, Dave captures a fair amount of the good and bad in open-source business today, and manages to be a lot more interesting than most interviews.

On moving to CPAL instead of the GPL:

There are several reasons. First of all, we're not convinced that there is enough clarity about the way our software works (typical deployments have Mule touching 2 or more other applications via many different methods like JMS, web services etc.) to be able to accurately explain how derivative works are created. There are also a host of other wacky Java/integration aspects that are not totally clear. Under no circumstance do we want to stifle adoption of the product or upset the user community.

I find this fascinating. In some projects, derivative works are fairly straightforward. Not in an ESB (Enterprise Service Bus) like MuleSource. To ensure maximum community contribution, therefore, MuleSource is bending over backward to ensure its customers and community have an easy-to-grok license. The GPLv3 is still a bit unclear simply because it's so new.

He then mentions two other things with which I concur:

1. Open source is thriving in big companies and governments. I can't even believe the uptake that is going on. My guess is that we will see big companies attempting to acquire heavily starting in Q1 2008. I think by that time the proprietary vendors will start to see their revenue slip and will want to act. Stay tuned.


2. Rarely if ever do licensing questions come up. As such the majority of this post is just wasted sleeping time.

I'm not sure it's a waste of time, but it is true that open-source licensing rarely comes up in closing deals (at MuleSource, as Dave says, but also at Red Hat, MySQL, Alfresco, and others, as I know from direct experience and conversations with the companies). It's something that matters to the person who first downloads the software, and it matters for other benefits it provides to others within the buyers. But it doesn't cause undue concern anymore with Legal, Purchasing, etc. Open source is an accepted way of doing business in software. Period.

I'm glad to see MuleSource settle this licensing question. Dave has been pondering over it for awhile now, trying to figure out what would be best for the company, his community, and his paid customers. It's good to see the issue put to rest.

Disclaimer: I am an advisor to MuleSource.

[Timothy McIntyre]

Interesting post

I work as general counsel for Terracotta, another dual-license, professional open source software start-up, and we use a custom MPL + attribution license. We really like the CPAL and were pleased to see that it was approved by the OSI. Our only quibble with the license is that it requires attribution information to be included on every GUI, regardless of whether the licensed software is used solely for internal purposes within the licensee's enterprise, or whether the software is redistributed to third parties. Our license, the Terracotta Public License, is slightly different: it's less onerous than the CPAL in that attribution is only required when the software is redistributed to 3rd parties, but it's more onerous in that attribution information must be displayed on each UI (including command-line interfaces).