The Open Road

Black Duck has admitted to "borrowing" Palamida's database of open-source projects/licenses, without giving attribution or any other indication that it had taken the data from Palamida. Legal? Yes. Wrong? Seems like it to me.

After two days of intense investigation, we have confirmed that most of our database has been copied directly--word for word and misspelling for misspelling, with very few original additions to our initial work," said Palamida spokeswoman Melisa LaBancz-Bleasdale.

Just because one can do something doesn't mean that one should.

Black Duck argues that it only uses a "small slice" of Palamida's data. Maybe. But apparently it was enough to be noticeable to Palamida. It seems to me that the two should collaborate on this sort of database, but this kind of action hardly leads to the trust required for collaboration.

Is Black Duck in the wrong? Thoughts?

Palamida has received a fair amount of press related to its tracking of the rise of GPLv3, most of it positive, but this doesn't do the company justice. Palamida's innovative inclusion of security with code/legal analysis - helping customers discover potential vulnerabilities in their code before they ship - is a welcome addition to the open-source world.

It (and I) has also taken some hits for "over-counting" GPLv3 deployments, but most such concerns stem from ignorance of what GPLv2 and v3 mean, rather than from an error on Palamida's part.

For instance, those who think that "GPLv2 or later" language does not qualify as an instance of GPLv3 miss the more critical point: those who adopt software under such a license may be exposing themselves to restrictions they aren't expecting:

The numbers had been showing a steady clip supporting GPLv3. So, hot, right? But Evans Data ran a survey of developers showing that support for GPLv3 is actually cold. So, which is it?

Probably both.

From the Evans Data survey:

(Credit: Palamida)

According to Palamida, this week has seen a 19% increase over last in the number of projects that have adopted GPL v3. As August 31st, our research indicates that 534 projects have officially adopted GPL v3, as compared to 450 on August 20, 2007. No new projects have adopted LGPL v3, with the number still holding at 27 projects.

Palamida also mentioned that it is "finding a number of projects that have adopted the GPL v3 (based on their web site, comments in the header files of their code, etc.) but they are failing to update their COPYING files, which still have the GPL v2 license texts.

So, maybe the numbers are even better than have been reported?

This just in from Palamida: roughly 50 percent of active projects licensed under the GPL are now GPLv3. In just one month. That's huge.

How does Palamida reach this number? Keeping in mind that the total number of projects on Sourceforge is actually poor context to determine the number of useful, living projects that you or I care about:

GPLv3 conversions

(Credit: Palamida)

Palamida reports that GPLv3 continues to grow at a steady, unyielding pace. This week has seen a 16% increase over last week in the number of projects that have adopted GPLv3 (300 projects now compared to 259 projects on July 27th). Importantly, there are now 3,408 projects licensed with the "GPLv2 or later" clause, which represents a 12% increase over last week.

There were no "SugarCRM"-worthy v3 conversions, but there were some interesting projects to move to GPLv3:

GPLv3 continued its forward march this past week, as Palamida reports. The pace accelerated this past week with a 30% increase, or 259 projects that have officially adopted GPLv3, as compared to 199 projects on July 20th. An additional 3 projects have adopted LGPLv3 bringing the total LGPLv3 projects to 12.

Of course, if you add in those projects licensed as "GPL v2 or LGPL v2.1 or later," then the total swells to 2,990. Not bad.

One notable addition last week was SugarCRM's Community Edition. One notable exception was the Linux kernel (2.6.22.1).

We're now at 199 projects that have adopted GPLv3, which represents a 21% increase over last week. Clearly, GPLv3 has legs. Significantly, Snort made the move this past week. This is a major coup for GPLv3. [I just found out that, in fact, Snort did not make the move to GPLv3.]

What's most interesting to me, however, are the projects this past week that have decided to stick with GPLv2. Two of my content management compatriots (Joomla and Mambo - who says they can't get along? :-), as well as Compiere. These are highly visible projects and, as such, it would be useful to know their reasons. (Of course, the Mambo and Joomla projects are tightly linked restricting their, or at least Joomla's, ability to act completely independently, as I understand it).

Palamida has been tracking the movement of open-source projects from GPLv2 to GPLv3 and estimates that 119 projects have converted (to GPL/LGPLv3), which represents less than 1 percent of projects using the General Public License, or GPL. Nothing to write home about, in other words.

Why is the uptake so tepid? Well, the rampant FUD around version 3 probably helped, but I don't think that's the main issue. I actually think the primary problem is that GPLv3 didn't go far enough, in many ways. It's an updated version of GPLv2, which is good, but it doesn't resolve some of the industry's most pressing issues, like the ASP loophole.

Instead, it tackles DRM (digital rights management), TiVo and other such issues that are salient to the Free Software Foundation but not so much to most of us.

Still, it's a good license, and I think the adoption will continue and accelerate as people grok it better. I particularly think that it will find adherents in companies and communities that have used quasi-open-source licenses. It allows for reasonable attribution, for one thing, which may serve to obviate the whole debate over Mozilla Public License (MPL) plus attribution.