Open washing – why companies pretend to be open source
theregister.com
theregister.com
Say you're deciding between two programs (or AI models)[0], you prefer an open source one, a colleague prefers one that just pretends to be open. You say your choice is preferable because it's open, he says the same about his choice. Then you say the dreaded "well, actually" and either you sound like a fundamentalist or an asshole.
[0]: None of those are truly open source because they're all trained on stolen data. And see? Now I sound like a fundamentalist.
Now, with LLMs, anybody can launder my code and use it to build proprietary software for his own benefit without giving anything back. That is a violation of the spirit of AGPL and hopefully the law too.
When CBS lets you watch a show on their web site, even for free and anonymously, they still own the show and did not grant you any right to re-distribute or re-use it.
What AIs do is also not fair use, because that isn't just about the size of a quote but about usage. A discussion is fair use, excerpting simply to pluck a cherry and present it as your own is not.
I shall write a book titled "The wizdom of BKW", and it will contain merely a single sentence plucked from many other famous and deeply insightful authors. Not a discussion or examination of them, and not even credited to any of them. The book will look like you asked me for advice and insights into human nature and philosophy, and all these gems of insight are my direct answer.
No single quote will be more than a sentence or two. A teeny tiny fraction of the 400-page books they came from.
I don't care if any law currently recognizes that as wrong, it is wrong.
What we need is those open source people with integrity to put the smack down on those willfully abusing and destroying the terms.
If you can't do it with trademarks/certifications/licensing/memberships/etc., do it with mainstream journalism. Like might be being done here, except The Register has long had rare insider knowledge, and is relatively niche. You need to get the message out to everyone who's not already in the know, including lawmakers.
(Incidentally, the FSF also has integrity, but, besides prompting open source by being zero-compromise -- which is fine in their case -- they have an additional challenge of seeming to be clinically incapable of advocacy in situations that are aligned.)
But today, such nuance doesn't exist. The commercial ones have gone full commercial and making no qualms about it (thus the title of this post).
If this attitude continues, all commercial interests in FOSS will be seen with high scepticism unless they have a proven track record of being a good actor.
Free software > open source.
Companies like the flexibility in "open source", even companies who release code as GPL rarely talk about "free software", they are open source companies.
Is freeware free software? It is rather murky term for me.
If it's just free in price, then "freeware" is the correct term.
Or I download something like Irfanview for free from internet. That for consumer is free software to use...
It is clearly bad term when it can be used to mean entirely different thing in regular and common use.
The point here is that that linguistic peculiarity in just one language doesn't make the word 'free software' invalid or unsuitable, as long as 'free software' is a recognizable term (which it is). This is why FSF makes this explicitly clear with an entire article.
Free Software licenses and Open source licenses are essentially the same (apart a few odd examples).
The difference between the free software movement and the open source software movement is essentially philosophical.
Apart from every example of GPL software, which can't be used under the permissive terms of Open Source. The last person I replied to about this used the word "essentially" here, also. Is there a common source slogan for this belief?
Also, somebody should tell all of the people who keep rewriting GPL stuff in order to have an MIT version.
eh, no, but it's a quite common word to express that idea.
Also:
> for this belief?
> Also, somebody should tell all of the people
Would you consider you might be wrong here? We are several people telling you so.
It's because, in my experience, the majority of businesses want to take but do not want to feel any obligation to give back or support.
No, Open Source and Free Software are two names for essentially the same thing. The Free Software Foundation has a preference for licenses which go beyond its own Free Software Definition [0] and which are also "Copyleft" [1], but does not define Free Software in a way which requires that it also be Copyleft.
[0] https://www.gnu.org/philosophy/free-sw.en.html [1] https://www.gnu.org/licenses/copyleft.en.html
This is not substantially true, which is why I assume you've added "essentially" in here. Open Source is Free Software, because anybody can take it and make it anything they want as long as they comply with the minimal license terms. Open Source can be proprietary, too, if somebody takes it, complies with the minimal license terms, and makes it proprietary.
No, it is. The OSI Open Source definition and the FSF Free Software definition are framed differently but require substantially the same things, and for virtually every license on which both have expressed an opinion, they have cone to the same conclusion as to whether it meets each organization’s requirements.
Free Software does not require a license that prevents proprietary re-licensing, that is an additional separate concern beyond the Free Software definition (Copyleft); the FSF generally prefers copyleft licenses, but recognizes non-copyleft licenses as Free Software licenses.
You seem to under the mistaken impression that copyleft is a requirement to meet the Free Software definition, but that has never been the case.
The property of being able to keep changes to oneself is the property of permissive licenses, not opensource. Open source software under copyleft licenses cannot be modified and distributed while withholding changes. The inverse is applicable to FS under permissive license too.
The real difference between free software and open source is in how they treat the software. FS camp considers software as something that should give the users total freedom over the computing devices they own. The software shouldn't constrain or exploit the end user in any manner. This of course needs the source to be open.
OSS camp established open source because they realized the advantages of 'open' source, but didn't like the emphasis on freedom. That's more in line with corporate philosophy - take advantage of unaffiliated talent to increase code volume and quality, without making any commitment to user freedom. This is why many companies completely avoid the term free software. It's also easy to find 'open source' code that's very exploitative towards users, despite being open and using FSF-endorsed licenses.
I thought tech startups were started to con people into thinking they might earn money.
Regardless if – once OSI establishes their definition(s) – Meta will choose path of adherence or not, they still deserve a paragraph of praise for what they're doing.
As a side note OSI should also recognize that in the era of giant cloud providers protection from predatory market participants is also a thing and should exist as clear licensing option. Mongo, Elastic and Redis drama could be avoided in the future if there was a clear option to protect author side sustainability without affecting open source spirit for end users.
ps. I also believe that "Open <something>" should be protected phrase similar to how "Police", "Federal", "Government" or "Organic" is protected to not mislead the public so we don't have things like "OpenAI" nonsense.
But if you accept contributions from the community for years, and ingrain your product in hundreds of thousands of workflows around the world, and only then decide "holy shit, salaries cost money, best yank our license" that should be a case of fraud and you should be civilly liable, in my opinion
OSI readies controversial open-source AI definition (26.10.2024)
https://github.com/thirdweb-dev/engine?tab=readme-ov-file https://portal.thirdweb.com/engine/self-host
It makes me sad becuase I was working on a getting a team together to build a real opensource and free alternative but once they found thirdweb they all got discouraged thinking that no one will understand why our real open product is diffierent
It's absolutely wild to think the deranged BigScience RAIL license, under which the Bloom LLM was released, is open in any way shape or form. It has more user-harming restrictions than basically any other LLM license out there.
So even they might believe in open-source they put protections in place that ultimately lock it down and thus make it closed source but trying to keep the impression of being open.
In our journey at AirGradient towards becoming fully open-source hardware (all code and hardware licensed under CC-BY-SA), we had the same concerns but ultimately decided to go full-in and open up everything with an officially approved open-source license.
I believe there are a few important aspects and "protections" that are open-source compatible that help companies protect their investments.
Firstly, requiring Attribution is compatible with open-source and can help companies get a lot of visibility and competitors probably don't want to attribute another company and thus are often not likely to clone.
Secondly, using a share-alike license also makes it unattractive for many other companies using the code.
Lastly, I believe the code itself is often not the valuable part compared to the brand value, employees, reputation, business model, network and implicit knowledge that a company builds up.
It really worked for us to go that way with a true open-source license and I hope many others will do it too.
There are already some easy to understand licenses like CC in place and I do hope that they also create awareness around "open washing".
Microsoft has a decent LLM that I'd consider to be "open source": Phi-3.5, under the MIT license: https://huggingface.co/microsoft/Phi-3.5-vision-instruct
I find it funny how OpenAI was only indirectly mentioned. Still, I'm glad that this columnist is taking a principled stance by arguing aginst one of the more borderline cases.
Anyone know specifically what he is talking about here?
The only things I'm seeing that I would consider to be clauses on litigation are one that terminates your license if you sue them claiming Llama 3 or its output violates your IP, and the have a choice of venue and choice of forum clause.
Several OSI approved licenses have "terminate on patent suit" clauses. Llama 3 is termination on IP suit rather than just on patent suit but I don't see anything in the OSD where that would make a difference.
There's stuff about trademarks, which I assume are the branding clauses he mentions. But I don't see anything obvious on the OSD that such clauses violate.
Hence, the question.
Simonw's response points out some unusual clauses, and at least one of them looks like it might go against one of the requirements in the OSD but it is not a litigation or branding clause and the article specifically called out the litigation and branding clauses.
From https://www.llama.com/llama3/license/
> If, on the Meta Llama 3 version release date, the monthly active users of the products or services made available by or for Licensee, or Licensee’s affiliates, is greater than 700 million monthly active users in the preceding calendar month, you must request a license from Meta, which Meta may grant to you in its sole discretion, and you are not authorized to exercise any of the rights under this Agreement unless or until Meta otherwise expressly grants you such rights.
This seems harmless... until you ask what happens if you start a startup on top of Llama 3, do really well and later try to get acquired by one of the companies that had more than 700m active users on that date (Apple, Microsoft, Google etc)
> You will not use the Llama Materials or any output or results of the Llama Materials to improve any other large language model (excluding Meta Llama 3 or derivative works thereof).
That's a pretty huge restriction on ways you can use the models. The language "to improve any other large language model" is also incredibly vague.
> (B) prominently display “Built with Meta Llama 3” on a related website, user interface, blogpost, about page, or product documentation. If you use the Llama Materials to create, train, fine tune, or otherwise improve an AI model, which is distributed or made available, you shall also include “Llama 3” at the beginning of any such AI model name.
I love this one, it means that if you fine-tune a model for erotic furry fan fiction you HAVE to call it "Llama 3 Erotic Furry Fan Fiction Writer" or similar.
How exactly would they know if I do?
Also, it doesn't make any sense that they trained this model using whatever stuff they could download from the Internet but we somehow could bot do the same with their models.
personally, I think the term should be avoided if its not what the open source community has made a culture around
but I cant say its weasely corporate “open washing”, either. because its the open source community that appropriated the term to mean a subset of free, open, commercial use licenses and everything digital thats necessary to replicate the product, not the other way around where corporations are suddenly using some legalese to turn it into a marketing term thats technically okay
One can debate "clear" but the the AI Act https://eur-lex.europa.eu/eli/reg/2024/1689/oj does say in Recitals 102-104 (mini open source license definition *highlighted*):
---
(102) Software and data, including models, released under a free and open-source licence that allows them to be openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market and can provide significant growth opportunities for the Union economy. General-purpose AI models released under free and open-source licences should be considered to ensure high levels of transparency and openness if their parameters, including the weights, the information on the model architecture, and the information on model usage are made publicly available. *The licence should be considered to be free and open-source also when it allows users to run, copy, distribute, study, change and improve software and data, including models under the condition that the original provider of the model is credited, the identical or comparable terms of distribution are respected.*
(103) Free and open-source AI components covers the software and data, including models and general-purpose AI models, tools, services or processes of an AI system. Free and open-source AI components can be provided through different channels, including their development on open repositories. For the purposes of this Regulation, AI components that are provided against a price or otherwise monetised, including through the provision of technical support or other services, including through a software platform, related to the AI component, or the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software, with the exception of transactions between microenterprises, should not benefit from the exceptions provided to free and open-source AI components. The fact of making AI components available through open repositories should not, in itself, constitute a monetisation.
(104) The providers of general-purpose AI models that are released under a free and open-source licence, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available should be subject to exceptions as regards the transparency-related requirements imposed on general-purpose AI models, unless they can be considered to present a systemic risk, in which case the circumstance that the model is transparent and accompanied by an open-source license should not be considered to be a sufficient reason to exclude compliance with the obligations under this Regulation. In any case, given that the release of general-purpose AI models under free and open-source licence does not necessarily reveal substantial information on the data set used for the training or fine-tuning of the model and on how compliance of copyright law was thereby ensured, the exception provided for general-purpose AI models from compliance with the transparency-related requirements should not concern the obligation to produce a summary about the content used for model training and the obligation to put in place a policy to comply with Union copyright law, in particular to identify and comply with the reservation of rights pursuant to Article 4(3) of Directive (EU) 2019/790 of the European Parliament and of the Council (40).
---
In the articles open-source is expressly referred to as release under an open-soruce license (see definition in recitals above):
---
[Article 2: Scope]
12. This Regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50.
[Article 25: Responsibilities along the AI value chain]
4. The provider of a high-risk AI system and the third party that supplies an AI system, tools, services, components, or processes that are used or integrated in a high-risk AI system shall, by written agreement, specify the necessary information, capabilities, technical access and other assistance based on the generally acknowledged state of the art, in order to enable the provider of the high-risk AI system to fully comply with the obligations set out in this Regulation. This paragraph shall not apply to third parties making accessible to the public tools, services, processes, or components, other than general-purpose AI models, under a free and open-source licence.
[Article 54: Authorised representatives of providers of general-purpose AI models]
6. The obligation set out in this Article shall not apply to providers of general-purpose AI models that are released under a free and open-source licence that allows for the access, usage, modification, and distribution of the model, and whose parameters, including the weights, the information on the model architecture, and the information on model usage, are made publicly available, unless the general-purpose AI models present systemic risks.
Externally done to give a kick to sales efforts.
And internally done in an attempt to get someone with AI resources to build blatantly non-AI functions by sticking then onto something with no or very little genuine AI angle.
It's just a very wide category that is basically meaningless nowadays because it applies to everything.
Marketers are even restrained in using it, because applying it everywhere it could go would sound insane and cringe. But it is a technical term, that technically applies to all those things people put it on.