June 27, 2008 (7:00:00 PM)  -  5 days, 12 hours ago

By: Bruce Byfie

After 18 months of widespread consultation with community and corporate interests, the third versions of the GNU General Public License (GPL) and GNU Lesser General Public License (LGPL) were released one year ago on 29 June 2007. In November, they were joined by the GNU Affero General Public License
(AGPL). Looking back at these licenses today, observers of free and
open source software (FOSS) judge them a modest success, and credit
them with continuing to educate people about free software.

Figures on adoption of the GPL family vary somewhat, depending on whom you talk to. According to Doug Levin,
president and CEO of Black Duck Software, a company that tracks open
source code, 2,476 projects are now using the third version of the GPL,
358 are using the LGPL, and 72 the AGPL. Theresa Bui, vice president of
marketing for Palamida, a firm with a similar mission, gives roughly
similar figures of 2,271 for the GPL, 261 for the LGPL, and 100 for the
AGPL. The difference in the figures is probably explained by the fact
that Black Duck's figures include planned transitions to the licenses,
while Palamida's does not. Palamida's higher figures for the AGPL are
probably due to Palamida's recent interest in the license, as evidenced
by its blog.

In addition, Palamida tracks figures for projects that use a version
of the GPL that contain a clause allowing contributors to use version
2.1 or later of the license (which includes, of course, version 3.0).
These figures are 6,467 for the GPL and 372 for the LGPL. Since the
AGPL was not in widespread use until the third version, it is not
included in these figures.

Despite the difference in figures, both Black Duck and Palamida
agree on the overall trends. Both agree that, taking all versions and
variants of the GPL as a single unit, they account for about 70% of all
the free licenses in use. Moreover, both agree that the adoption rate
for the third versions of the GPL and LGPL remain steady at about 220
per month, and that this growth does not seem to have come at the
expense of the second versions. Both expect these trends to continue
with little change for the rest of 2008. Neither expects the third
versions to overtake the second ones any time soon.

The major difference in adoption rates comes with the AGPL. Levin is
cautious about talking about trends with AGPL, pointing out that it has
only been out for six months. He says only that "there has been some
pick up on the adoption of the AGPL." By contrast, Bui says that AGPL
adoption "is really starting to take off." She predicts another 50
projects will be using the license by August, and describes this
estimate as "incredibly conservative." She goes on to say that the AGPL
is causing far more excitement than the latest versions of the GPL or
LGPL, most likely because it received less attention in the consulting
process that produced the third versions, and therefore came as more of
a surprise.

By contrast, Bui says that the slow but steady adoption rates of the
GPL and LGPL third versions was predictable. Instead of rushing to
switch to the newest licenses, she says, "Software projects have been
just chugging along in their old, familiar lifecycles, and, when new
versions were ready, they converted to GPLv3."

One noticeable trend in adoption of the third versions is that
projects and companies that opposed them or were neutral during the
consultation process do not seem to have changed their minds. "It seems
that people who had significant qualms about it a year ago haven't
moved from them," says Bui. As a result, while some prominent companies
and projects have moved to the third versions, including SugarCRM, Sun
Microsystems, and OpenOffice.org, others, equally influential, have
not, including the Linux kernel and MySQL.

The outspoken resistance by Linux kernel developers that was so
highlighted during the consultation process may be slowing the adoption
rate. "The fact that the kernel has not adopted GPLv3 is a significant
part of any group's decision not to adopt," says Bui.

Still, both Bui and Levin see the third generation of the GPL family
as being steady, if unspectacularly successful. "We see no signs of
trends increasing or decreasing for the rest of the year," says Bui. As
for the second generation, she predicts that "it will not, in the next
two years, lose its position as the number one license."

Similarly, Levin says, "I believe that the GPL will have an average
increase of about 10% per month over the next year. What that means is
that there will be some 6,000 projects using the licenses a year from
now. It will continue to grow and continue to be a factor in the mix of
licenses, but the other licenses will continue to be used."

Another measure of success

However, statistics are only one way to measure the licenses'
success, as Peter Brown, executive director of the Free Software
Foundation, emphasizes. While Brown says he is "happy with the rate of
adoption," he suggests that the more important proof of the licenses'
success is their ability to educate free software users and "prevent
free software from being made proprietary. In that sense, we are very
happy about it."

Nor is Brown unduly disturbed that the second versions remain the
dominant ones, even though they offer less protection than the third
ones. "It's not as if there's been a move away from the GPL," he notes.
"It's the same GPL, in a sense."

Instead, Brown suggests that the consultation process and the third
versions themselves "have helped the conversation about free software
progress." The fact that large sections of the FOSS community were
consulted about the wording of the new licenses helped both to educate
people about the issues surrounding them, and to give them a stake in
the process.

In addition, the Free Software Foundation has made considerable
efforts to educate users about the licenses, such as its page about the
advantages of the third version.

These suggestions are supported by Bui's observations at client
sites of people using their knowledge of the GPL licenses to help plan
product lifecycles. "That's due to the good work of the FSF," she says.
"They have done a really good job of educating people about the GPL and
raising their awareness."

Brown also suggests that the lack of legal challenges to the third
versions may be a measure of their success, although he admits that
they may be too recent to be contested, and that the second versions
have not received many challenges, either. But he credits the
consultation process with improving the legal language of the licenses,
as well as making clear from the number of people involved in the
consultation just how large a community any potential violators would
be taking on.

Still another factor may be that the technology field has caught up
with the licenses. When the licenses were being drafted in 2006-07,
lockdown technologies were just starting to appear, so the language to
prevent them was seen as unnecessarily radical. Now, with examples like
the iPhone, such provisions are starting to seem far-sighted.

"The main thing is, we're satisfied that the changes that we've made seem to have done their job," Brown says.

Future measures of success

A year after third versions began to be released, an absolute
judgment of their success is still impossible. No comparison can be
made with the success of the second versions after their release in
1991, because the free software community and the pressures upon it
have changed so drastically since then.

For another thing, the licenses remain a work in progress. One of
the changes in the third version is greater allowance for exceptions --
special clauses that make small modifications to the basic GPL license.
Brett Smith, FSF compliance engineer, is still working with the
community to modernize and improve exceptions for the third generation.
"GPLv3 came out on a Friday, and I came in Monday and started working
on the exceptions," Smith says. A year later, they still occupy much of
his time, but their effectiveness will be a major factor in how well
the licenses themselves function.

It will take several years to see exactly how good a job the third
versions do of "futureproofing free software," as Brown puts it. He
suspects a major test will be the ability of the AGPL to create and
safeguard free network appliances. Nor does he rule out the eventual
need for a fourth generation of licenses in response to the discoveries
of new loopholes.

For now, the only measure of success is that the third generation of
the GPL family seems to be holding its own. It has not replaced the
second generation, as many might have assumed it would when the process
of creating it first began in 2006. Still, if counted separately from
the second generation, in a year it has become the seventh most popular
free license, according to Black Duck's statistics.

As Brown points out, "GPLv3 is probably the most adopted license in
the last year. And it seems to achieve its aims thus far." For any
other license, this performance would be a runaway success. It is only
by comparison with the dominance of the second version of the GPL
licenses that the success of the third versions might seem
disappointing.

But the ultimate success of the third generation GPL, and the
question of whether it will replace the second generation or continue
to coexist with it, remain almost as uncertain today as they were a
year ago.

Bruce Byfield is a computer journalist who writes regularly for Linux.com.