Can you stop your open-source project from being used for evil? | Hacker News Reader

Can you stop your open-source project from being used for evil?

stackoverflow.blog

You can use whatever no-evil license for your open-source project, but if you want your project to be FOSS [1], you can't. If you restrict your project from being used for evil, it'll violate the basic freedoms that proper Free licenses grant to their users.

Also, check this video by Douglas Crockford [2]. ("I give permission for IBM, its customers, partners, and minions, to use JSLint for evil.")

[1]: https://en.wikipedia.org/wiki/Free_and_open-source_software

[2]: https://youtu.be/-C-JoyNuQJs?t=39m45s

A no-evil clause makes your license not Open Source either. There's no practical difference between "Open Source" and "FOSS". You probably meant something like "source available".

I think what you are actually talking about is permissioned vs permissionless licenses. We typically think of open source as the later, but licenses like GPLv3, the licenses like Elastic & Mongo (commercial restrictions), and ethics are all licenses that only grant you permission in certain situations.

OSI couldn't trademark "Open Source" and the common usage of the term (source available) has steered away from the OSI definition.

[citation needed]

Common usage has matched the OSI definition for decades. Even Wikipedia acknowledges it [0]. There are always some people who are confused about the terms, sure, but those usually come simply from lack of exposure and experience around FLOSS communities. Trademarks have nothing to do with it; it's not OSI that owns the term, but the community that uses it and widely agrees with OSI's definition.

[0] https://en.wikipedia.org/wiki/Open-source_software#Definitio...

In my experience, some people are genuinely confused, but also a lot of people who misuse it and argue that OSI shouldn't be the authority because they really want to call their license "open source" even though it isn't.

i don't think that's quite fair. for example take stallman's comment, linked from your wikipedia reference above,

  the obvious meaning for the expression “open source software” is “You can look at the source code.” This is a much weaker criterion than free software; it includes free software, but also some proprietary programs, including Xv, and Qt under its original license (before the QPL).

  That obvious meaning for “open source” is not the meaning that its advocates intend. The result is that most people misunderstand what those advocates are advocating. Here is how writer Neal Stephenson defined “open source”:

  Linux is “open source” software meaning, simply, that anyone can get copies of its source code files."

i wouldn't call Stephenson's confusion here a rare occurrence; "Source available" hasn't really caught on, but instead open source remains ambiguous

I agree that the term isn't self-explanatory, which is why people get easily confused. I also happen to agree with Stallman there and I strongly prefer to use the term "Free Software" instead, as it highlights what's actually important. Nevertheless, the "obvious meaning" isn't how it's actually being used in communities that produce and use such software, so its actual meaning is still worth pointing out.

> There's no practical difference between "Open Source" and "FOSS".

These terms are often used as if they are interchangeable, but they are not. Source code can be open, and yet, its license might not grant the users necessary freedoms for the software to be classified as FOSS.

I do agree that "Open Source" is a flashier term and much more popular, yet, when we specifically talk about project licenses, I prefer to be specific.

The term "Open Source" has a specific definition which covers practically the same set of software that "Free Software" does: https://opensource.org/osd

If the license doesn't grant the users freedoms, it won't match the definition. A commonly used term for software that has its source code public but isn't FLOSS is "source available".

I've had the (mis?)understanding that these two were not in fact synonymous as you claim.

Let's just collapse on some specifics, then? Please correct any inaccuracies in the below:

Licenses promoted by FSF qualify as "Free/Libre software" - GPLv2, GPLv3, AGPL. These also qualify as "Open source" per OSI.

Licenses which qualify as "Open source" but not "Free": Apache, MIT, BSD-like.

All the licenses that you mentioned qualify as both Open Source and Free Software. A license doesn't have to be viral (copyleft) in order to be free.

See: https://www.gnu.org/licenses/license-list.html and https://opensource.org/licenses

Okay, great. So I've learned something new. But I feel like this distinction didn't come from nowhere. Did the FSF not feel the same way at some point in the past?

Not that I'm aware of. The licenses you mentioned as "free" are copyleft licenses which require modifications to retain the same license terms. The rest are usually called permissive licenses, as they don't have such requirement. Nevertheless, both kinds of licenses are and AFAIK have always been considered FLOSS and I'm not aware of any controversy around that.

The distinction came basically because of political reasons. The term "Free Software" is about user freedom; the term "Open Source" has been coined so you don't have to refer to scary freedoms when presenting practical aspects of FLOSS to businesses. That's more or less the whole reason why those are separate terms, and also why FSF doesn't like the latter one.

The "Good, not Evil"[1] licence:

Crockford started releasing his JSMin software under a custom license, which he created by adding the requirement "The Software shall be used for Good, not Evil" to the open source MIT License.

[1] https://en.wikipedia.org/wiki/Douglas_Crockford#%22Good,_not...

Who cares if it's FOSS or not? Neither FSF or OSI existed when Stallman enshrined his morals into the GPL, that didn't stop him.

I won't argue about FOSS, as a specific term of art. But "open source" is a generic thing, without a single rightful authority that controls what it means.

As a member of the open source community, I think "open source" is what we make of it. Open source didn't stem from political or technical passivity, and it doesn't need to remain passive or static. What that means is up to individuals who actually do it.

Both Free Software and Open Source Software (commonly abbreviated together as FOSS) does have a established meaning though, authority or not. Starting to include things like "do no evil" in something already established, adds confusion. "Do you mean old FOSS or new FOSS?"

What you can do instead, is to come up with a new term for what you want to describe. So instead of just saying your software has a open source license, say it had a open-but-only-good-users license (whatever that means), so the rest of us don't get confused.

For bonus points, that term already exists; the original article we're commenting on says that they're calling it "ethical source".

I don't think an appreciable amount of confusion is added: there's already a wide range of "approved" open source licenses that impose varying restrictions or requirements on end users, packagers, and potential contributors. AGPL, for example, is materially different in its requirements from Apache-2, and yet both are "open source."

Put another way: it's not clear why the current complexity is okay, but other kinds of complexity (that accurately reflect the current ethical landscape, instead of the ethical landscape of software in the 1990s and 2000s) are not.

> that accurately reflect the current ethical landscape, instead of the ethical landscape of software in the 1990s and 2000s

This seems like it provides exactly the reason why we shouldn't have such a thing. What is the ethical landscape of the 2040s going to look like compared to today?

By that token, we shouldn’t have open source at all, even in the OSI’s approved form. After all, it’s a direct product of a historical ethical landscape, one that shaped our current landscape.

Have you not heard of the OSI? I think they may beg to differ on that.

Of course I've heard of the OSI. I don't understand why I'm particularly bound to their definition of open source, given that both the phrase and the concept predate the OSI, likely by decades.

Why do you care? You have a particular vision of how your software should be able to be used. Why do you care if it's "open source" or not? At least with companies, I understand the reason for marketing purposes to be perceived as open source. I'm not sure I understand why an individual maintainer of a project is so desperate to be seen as being open source if it doesn't conform to their vision.

Why does anybody care about anything? It’s certainly not life or death for me; I guess I feel like it’s an unnecessary restriction of what “open source” could (and maybe even ought to) mean.

I’m not desperate to be perceived any way in the OSS community; I do plenty of work on projects that satisfy the OSI’s definition, and that will never change. But I also don’t see why the work I do, which I do for the public and not for corporations, which is open in the most literal sense of the word, can’t be rightfully called open source.

If you're deeply concerned about who uses your software and for what purpose they do so; "open source" isn't what you want. You want a real commercial license, even if you're not charging money. There's nothing wrong with that, and no reason to try making "open source" attempt to conform to moral stances.

I'd say that the core value that open source serves is the notion that sharing our thoughts is better than not doing so. That is enough of a stance to take. People can agree to that even in the face of differing values in other areas.

Adding to this, even a commercial license may not be sufficient in some cases. If the people doing evil things are truly evil people or organizations, it may not be feasible or even possible to take legal action against them. Some groups are effectively untouchable by the legal systems and some people are within the boundaries of governments or organizations that exemplify the concept of total corruption and hegemonic domination.

Yes. And your commercial license can still offer the source code.

Unreal engine is an example of such a licence. Anyone can access the source code for free (just need to jump though a hoop of signing up of an account and agreeing to the terms and conditions). Anyone can release a game without paying unreal a cent.

But it is not open source. The two major restrictions are: You can't share the source code to people who haven't agreed to the terms and conditions; And if you earn more that $1 million in revenue, you must pay epic games 5% of all additional revenue.

Epic have even gone to the additional step of removing their right to revoke the license from the license agreement. They can take you to court if you don't pay, but they can't simply revoke the license.

"I asked Coraline Ada Ehmke, a leader in..."

Oh good grief. This tired topic again. How'd all this nonsense do for the Node TSC and Rod Vagg?

Ehmke isn't anyone I'd trust making ethical decisions for anything. In Ehmke's own words, "the Contributor Covenant is a political document".

It has zero to do with fixing real world problems, and everything to do with using software development as a tool to advance political ideology.

And Ehmke has the audacity to lecture about ethics. Here's something unethical: weaponizing a neutral thing (software, medicine, sports) in pursuit of political power.

> Ehmke isn't anyone I'd trust making ethical decisions for anything. In Ehmke's own words, "the Contributor Covenant is a political document".

Independent of your trust, can you explain the connection between these two points? The Bill of Rights is a nakedly political document, and yet a large swath (probably the overwhelming majority) of the US attributes some moral value to its contents.

This is an excellent question, and I struggle to answer it.

Part of why I don't trust the "Code of Conduct" things is because of how they started off -- the desire to "protect marginalized people's safety over privileged people's comfort" is inherently prejudiced. Who decides who is privileged and who is marginalized?

What this boils down to is there are favored people to which the rules do not apply. Although the language is no longer there, in many instances the result is the same. See the aforementioned Node TSC drama.

But none of that is listed in the Contributor Covenant, which Ehmke authored. Version 2.1 pledges to make participation a "harassment free experience for everyone".

As a software maintainer, how can I make good on that pledge? How can I arbitrate disputes between members? Especially when this involves conduct outside of git, and with sensitive users who consider many innocuous things as harassment?

But furthermore, WHY should I arbitrate members conduct? I have enough on my plate just writing software. Now I have to decide who is right in a "he/him said, they/xir said", and decide who gets voted off the island?

You'll note that I have referred to Ehmke without pronouns, and this is intentional. While I do not wish to be offensive, I can't use Ehmke's pronouns in good conscience. According to one version of the Stack Overflow guidelines on pronoun usage, this constitutes harassment. I firmly disagree -- harassment is "you call me a woman, or I will have you removed from the project".

As Ehmke said, this is a political document. But politics does not belong in software development.

> politics does not belong in software development.

Those who insist on ideological purity in their software are welcome to do so. I'll just not work with them, being by habit persistently, willfully, stubbornly impure.

I firmly believe that software, most jobs, and many other areas of human endeavor can be pursued without reference to politics and are better for it. I've been repeatedly informed that alone is "unenlightened" and makes me a political opponent of those who disagree; that there can be no common ground to work with unless it's all common ground.

I sure hope not. The definition of evil is too subject to interpretation.

one of the examples given in the article is torture.

That’s an example, not a limitation on the definition of the word ‘evil’.

another could be genital mutilation, or giving puberty blocking hormones to children.

Are you serious? There might be some grey areas but ethics and morality is a lot more developed than that.

Yes, OP is serious. I have to ask if you're serious.

There was an extensive interview with an Australian ISIS recruiter in The Atlantic (I think) several years ago. The guy wholeheartedly believed he was doing good, and felt sadness and compassion for Muslims outside the caliphate because they weren't getting into heaven.

What if he was also a developer and forbade you from using his software because you weren't using it for his definition of good?

I think we are looking at this from different angles. Certain persons might not have a clue on right/wrong and/or simply lack a moral compass. That doesn’t mean there is a whole field of study on ethics and morality, from which I am viewing this.

Indeed, private property is a good example.

To some, protecting private property ownership is an evil. To others, undermining private property is an evil.

Another aspect would be copyright protections. Depending on the circumstance people have widely varying ideas of whether copyright protection is good or bad. If my Linux distro includes some “do no evil” license what if they decide my anti-copyright program is evil? Or vice-versa?

Making a living as an indie game developer, perhaps one would be more inclined to view copyright protection as “good”. A decade later someone trying to archive the same indie devs game which made a big impact on their own childhood and copyright becomes “bad”.

As a game developer, going on over two decades now, I have _complicated_ feelings about copyright. ;)

Exactly my first thought. With a libertarian hat on, of course anyone can do anything with whatever they create. That's someone's right. But to call it "open source" with some license that attempts to define morality? Good luck with that.

Right. I'm the good guy and will gladly help build autonomous killer robots for my government.

The road to hell is paved with good intentions, but throwing out freedom zero is a lovely way to get there in short order.

SQLite is public domain, but offers a blessing instead of a license:

"The author disclaims copyright to this source code. In place of a legal notice, here is a blessing:

May you do good and not evil.

May you find forgiveness for yourself and forgive others.

May you share freely, never taking more than you give."

Source: https://sqlite.org/src/artifact/df5091916dbb40e6

No, of course you can't. If nothing else, evil doesn't feel obligated to obey copyright laws. If it's open source, they can get the source, and do whatever they want. Laws? Why would they care?

I'm on the "do not call" registry. That doesn't seem to stop spammers.

They cover this in the article -- while some underground evil organizations might not care, there are also companies like Palantir. They work with the government, they probably want to avoid any legal headaches where possible.

I'm aware of Palantir, though I have no actual detailed information about their internal workings. But my impression is that they would probably be willing to violate a copyright if it enabled them to do what they were asked to do. They might even do it with the (perhaps unstated) blessing of the part of the government they were working with.

As I said, I don't have actual information. I may be misjudging them.

Well, if you delve just a tiny bit into the source material, you see that they use evil as a shorthand for "perfectly legal things that a plurality (if not a majority) of people have absolutely no problem with but that they do", like immigration enforcement - in which case, some legal maneuvering might actually help them, although I personally consider their goals to be more evil than the uses they're trying to prevent.

For someone with difficulties to see the grays of the world (like Coraline Ehmke, the source of the article) it must be very comforting to think there might be a scenario where the answer is “yes”.

However, by definition, open source cannot

I don't know if software can be written in a way that cannot be used for harm. There are several issues with this, among them being (1) there is always a "shadow side" (a reference to the Jungian shadow), and (2) this is a form of "Do Less Harm" paradigm, and it is problematic because morality is not universal, monolithic, or consistent. Imposing what "less harm" means on someone else, will always polarize somewhere. It's the same problem with the "Do More Good" paradigm.

I have been lately thinking of a different way of developing and funding improvements of software, by adding on top of the idea of open source of free software. That is, "community-supported software", similar to the idea of "community-supported agriculture". No one is going to get rich off of it, but it should allow developers to get their fair share (a reference to the permaculture ethical principles).

This doesn't stop software from being used in harmful ways. However, what I'm thinking is that it helps software developed in ways that are beneficial for local communities instead of being hijacked by large corporate interests in markets that are not directly connected with the community (national stock exchanges). The end-users and local community decides what is harmful or beneficial, and pool resources to maintain and expand features.

No. But you can release software code under a license that places usage-based restrictions on the code. Some may ignore it, yes. It won't be open source under the usual definitions. But it may prevent organizations you disapprove of (along with many others) from using your code. Whether is still makes sense as mostly a source-available project at that point is up to you.

Tangentially, what is the limit of what can be put into a license or contract (that remains enforceable)? Can you just put any arbitrary requirements, as long as it's not against the law?

Like, if I lease my house, but with a clause that the resident should never change their name to "Jack" in their entire life, will that be laughed out of the court?

I don't know if it's too conspiratorial but this does seem like a sideways attack to "embrace, extend, extinguish" FOSS.

By couching it in terms of FOSS being "unethical", FOSS licenses can be whiddled away until there's either enough non-libre licenses to cause confusion or have a widely adopted alternative license that's unusable for business.

I do notice that Stack Overflow is using a Microsoft technology stack. The author of the article has been part of Microsoft Research [1].

[0] https://en.wikipedia.org/wiki/Stack_Overflow#Technology

[1] https://stackoverflow.blog/author/david-gray-widder/

Don't use a FOSS license.

You can still open your source, take pull requests and everything, and use a proprietary license with a clause that says the code is not to be used for evil, where you (the author) hold the sole final judgement of what constitutes evil.

Basically, copyright the shit out of your code, but selectively enforce it, and hint to the community that you are unlikely to enforce it on people who you think aren't evil.

Most people will likely steer clear of your code, except for a handful of hobbyists and maybe some academics.

Short answer: no.

Long answer: still no. you have zero control over what anyone chooses to do with your open-source project. You gave up any control you had when you released the source code to the world.

No, because not many (perhaps none at all) people have objective measures of morality. Is waterboarding torture? You say yes, I say yes, but if it's 2003 and the Iraq War is in full swing, do you think enough people are going to agree with us to mount an effective lawsuit? Maybe you can instead choose to explicitly enumerate all things you consider "evil" in the license, but that license is going to be prohibitively long.

I'm generally not a fan of paternalistic license clauses, but I dunno, I think I could get behind an open source license clause that prohibited click-through user agreements.

In my opinion, they are a complete nuisance with no upside. Nobody is reading them and I doubt they are even enforceable. From what I can tell, they are nothing but economic drag introduced by the corporate lawyers.

Whoever originally invented the wheel ultimately is responsible for all weapons of war.

once the cat is out of the bag, it's not going back.

This smells like someone inventing a moral dilemma because the FUD didn't work on the users to make them stop using open source, so they're gonna try to get the developers to stop making it.

To further riff on this could your license prevent evil outcomes regardless of whether the original intent?

Riffing even more, what if the usage is through a chain of dependencies and I sit in the middle with my project?

This article makes the mistake of conflating open source and free software. Open source software may be distributed under licenses that prohibit use by orgs/industries that the developer finds unsavory. But the resulting software is proprietary - not FOSS.

It does not. "Open Source" and "Free Software" are pretty much synonymous, with the difference between them being mostly political rather than practical (which doesn't mean that the difference isn't important, it's just not what you think it is). If the software isn't Free, it can't be Open Source. Consult the definition for more details: https://opensource.org/osd

this is a pet peve of mine because we should be able to distinguish between closed source software and open source but non free software. its extremely useful to be able to see/verify what some code does on your computer even without any other rights to that code.

Such software is usually called "source available".

"source available".

> It does not. "Open Source" and "Free Software" are pretty much synonymous

It depends who you ask and who the decision maker is.

No, you are mistaken. That is not the commonly accepted definition of open source, see the OSI:

https://opensource.org/osd

> 6. No Discrimination Against Fields of Endeavor

> The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

You could develop SkyNet and have it invade every computer on the world to monitor usage. It still leaves many problems like codifying the definition of evil, airgapped systems, detectability and how evil would you consider invading everyone to be.

As a society, we have laws for this kind of thing. If you want to ban something, go to the legislature and ban it. Abusing our position as creators to illiberally force our own personal "ethics" on others is nothing but petty tyranny.

Interesting article timing since github just removed the Tornado Cash project as well as all of the developers accounts from the site. I guess github doesn't think open-source code that can be used for evil should be allowed to stay up.

There's a difference between licensing a project to try and limit what users can do, and being legally obligated to stop hosting a copy of it.

Once your intellectual work is out there in the open, it is no longer yours. It is effectively public domain, regardless of the license -- because the license assumes that the user actually cares about it, and that it is actually enforceable. But there are a variety of scenarios where this is not true.

This applies to any IP. Remember: sharing is caring

let's ask the developers of the open-source deepfake program what they think is an ethical use of their tool.

I have yet to see a single piece of evidence that deepfakes are actually harmful and not simply distasteful.

People cited the one of Zelensky telling soldiers to surrender - but did any actually simply as a result of such a video? It's a stretch. Show me specific, real harm from a deepfake, or let's stop the hand-wringing.

> let's ask the developers of the open-source deepfake program what they think is an ethical use of their tool.

We... did? Like, that was 90% of the comments when it was posted.

Yes. OSI's ridiculous and unsuccessful attempts to legally own the phrase "open source" not withstanding.

When considering license measures for this purpose, remember that evil people don't care about software licenses or copyright. So if your license inconveniences good people to "hurt" evil ones, you're probably screwing up.

The person making NFTs of Uyghur prisoners, for example, definitely doesn't care about whether that action was legal and didn't go secure likeness rights or check the license.

Reply on news.ycombinator.com