License Change from standard Apache 2.0 license

[davidjgraph]

From today the license applied to the project will be the Apache 2.0 license with an extra line forbidding usage of the codebase as an integration or app to Atlassian's Confluence or Jira products.

We fund the project entirely from sales of the Confluence integration. I've taken a reasonably lassiez faire approach to date, generally ignoring draw.io integrations to Confluence that use our codebase.

However, last week we received a review on the app:

Most of it I'm not overly fussed about. If anyone does anything with the codebase that affects the amount of money I make from it, that's a different story.

[davidjgraph]

In terms of the Confluence app, our license grant to Seibert Media to sell in the Atlassian ecosystem is nothing to do with this license grant in this repo. Seibert Media are entitled to sell the draw.io for confluence and jira products as before. If you don't understand the concept of diverging license grants, please speak to a software licensing lawyer.

[fkohrt]

Just reading this now and I understand your anger and frustration very much! I have been a draw.io/diagrams.net user for a few years now and have been enjoying its open source nature from the very start. Good open source diagramming applications are still a rarity and diagrams.net in particular is a gem!

I don't know about the Confluence marketplace (I only use the online editor at app.diagrams.net), but wouldn't your situation be better remedied through trademark protection?

While I understand the situation that led to the license change and I feel for you, I also find the non-open source nature of the new license quite unfortunate. I tend to avoid software that's not free/open source for reasons of sustainability and for the love of the commons.

Is there any chance you can keep an open source license, for example, by instead switching to a license that requires competitors to keep the open source nature downstream (by applying a copyleft license) and have competitors not use the draw.io/diagrams.net trademarks?

Regards,
Florian

[fkohrt]

Thanks for taking the time to respond!

And even then you have to enforce the trademark legally if you wish to stop that.

As is the case with copyright breaches.

GPL doesn't help here. API calling vs linking during compile step hasn't really been tested properly in court yet, but Atlassian's Connect architecture is clearly a distinct API, it even has a formal bridge that does message passing to the API.

I think I had a weak copyleft license like MPL 2.0 in mind, which (to my understanding) would require that forks of diagrams.net need to be put under the same license if distributed to others. I reckon users of Confluence receive the JavaScript code, so this would trigger the copyleft mechanism. This would avoid the questions of API calling vs. linking that come with (A)GPL.

I think it would be appropriate to make it clear what your interest in this is (and it's not that you just love open source, people only write when they have a specific pain point).

I work in academia and use diagrams.net to collaboratively work on models and theories. When they make their way into publications I provide the source files along with the images in order to allow re-use by others. I only work with open formats (i.e., those for which a free/open source implementation exists) so the possibility of re-use does not depend on the fate of one company. After all, the license holder may decide, at any point, to discontinue development or public availability (e.g., after being bought by someone else who incorporates it into their existing portfolio). With a GPL-incompatible license, there's not a chance that anybody else will take over (GPL-compatible projects cannot incorporate the codebase and copyleft code cannot be incorporated into a fork). And regardless of any discontinuation, GPL-incompatible software tends not to be integrated into other open source projects (e.g., as with Kroki).

[davidjgraph]

As is the case with copyright breaches.

Not quite that straightforward in the Atlassian world. Atlassian makes something in the region of $10M a year selling our app in their marketplace. Another app used "draw.io" in the title of their app, we informed Atlassian and Atlassian enforced that the title was changed.

If we have clear text in our license that says you may not integrate with Atlassian and someone did, our first point of call would be Atlassian to have the app removed. They'd be no linking/API/copyleft discussion, everyone understands the new section 10, there is no room for confusion.

I think I had a weak copyleft license like MPL 2.0 in mind, which (to my understanding) would require that forks of diagrams.net need to be put under the same license if distributed to others. I reckon users of Confluence receive the JavaScript code, so this would trigger the copyleft mechanism. This would avoid the questions of API calling vs. linking that come with (A)GPL.

Even with full copyleft, others could create a free app of draw.io and list it on the Atlassian marketplace. Whether they have to provide source makes no difference here.

I only work with open formats (i.e., those for which a free/open source implementation exists) so the possibility of re-use does not depend on the fate of one company. After all, the license holder may decide, at any point, to discontinue development or public availability (e.g., after being bought by someone else who incorporates it into their existing portfolio). With a GPL-incompatible license, there's not a chance that anybody else will take over

I'd read that again maybe :). You're saying projects should be open/free source so if the original author kills the open/free project others can continue. You're describing exactly what just happened. The project was Apache and the open source project was killed. So what now? Where is the community rushing to take over?

[fkohrt]

So what now? Where is the community rushing to take over?

Well, the mere possibility to still view and edit my diagrams continues to be protected by the previous Apache license, even if you shut down the public facing server (at least to some extent¹). But sure, continued development requires a community in the first place. I am not saying there's a guarantee, but it can happen (like with the HedgeDoc fork of HackMD). But yeah, lesson learned, I guess...

¹ of course, depending on the obsolescence of web apps, about which I know little about

[davidjgraph]

Eventually, the web app will break in all browsers, it'll take years, but that day will come.

Just to extend the conversation, the change implements one thing, it protects our revenue in the atlassian ecosystem. That's the only requirement and it's the only revenue source, so there's no obvious reason any further changes would be required.

That's the new contract here, effectively, project -> users. What it does it protect the future development of the project by protecting the revenue. That's more useful to you than the license being fully open source. Open source is fine if the project is simple enough, HackMD is simple enough. draw.io is far too complex, being open source does not provide you with any benefit if nobody else can maintain the project.

The primary losers of this change is anyone wanting to integrate draw.io into the Atlassian ecosystem. That's intended.

[fkohrt]

I respect your decision, and I find the way you treat your supporters admirable (see #4679). I also understand that finding a sustainable business model is hard and that the decision potentially also benefits users who rely on the gratis editor you provide.

But you asked why I take issue with your decision. You just made your point that a free/open license is not enough and I will consider that when looking for a suitable alternative now. But even a thriving open source community may die at some point. Still, it leaves a legacy anybody can continue, like you did and which I am thankful for.