License Review

[Jesse Keating]

IANAL, so I need somebody to help me review this license to see if we
can include software licensed by this.

I'm going to put up a package review request for metasploit version 2.5,
as the 2.x tree is licensed with Perl Artistic/GPL, however the
developmental branch, metasploit 3.0 is licensed with a new license to
try and protect themselves from the difficulties recently experienced by
nessus and snort.

Can you look over
http://www.metasploit.com/projects/Framework/msf3/download.html?Release=a... for The
Metasploit Framework License v1.0 ?

-- 
Jesse Keating
Release Engineer: Fedora

[Matthew Miller]

On Mon, May 01, 2006 at 01:09:35PM -0400, Jesse Keating wrote:
>  Can you look over
>  http://www.metasploit.com/projects/Framework/msf3/download.html?Release=a... for The
> Metasploit Framework License v1.0 ? 
Without going into legal technicalities, that license clearly has the
following problems:

- Commercial use restricted (2b) -- Can't be used in any commercial application or
     product.

- Anti-forking clause (4) -- Modifications must be distributed separately,
     as patches -- no forking. Technically, that's what good RPMs do anyway,
     but this doesn't meet the normal standards for Free or Open Source
     software.

-- 
Matthew Miller           mattdm(a)mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>

[Rex Dieter]

Matthew Miller wrote:
>  On Mon, May 01, 2006 at 01:09:35PM -0400, Jesse Keating wrote:
>  
> >Can you look over
> >http://www.metasploit.com/projects/Framework/msf3/download.html?Release=alpha-r3 for
> The Metasploit Framework License v1.0 ? 
>  Without going into legal technicalities, that license clearly has
> the
>  following problems:
>  - Commercial use restricted (2b) -- Can't be used in any commercial application or
>       product. 
Yep.  This one is a deal-breaker for inclusion in Fedora.

-- Rex

[Jesse Keating]

On Mon, 2006-05-01 at 13:22 -0500, Rex Dieter wrote:
>  > Without going into legal technicalities, that license clearly
> has the
>  > following problems:
>  > - Commercial use restricted (2b) -- Can't be used in any commercial application
> or
>  >      product.
>  
>  Yep.  This one is a deal-breaker for inclusion in Fedora.  
Ok, they were afraid of that, but knew it was a possibility.  However
they really want to prevent incorporation of the framework into a
commercial product.  They really just don't want people to sell it, even
if they contribute back.  Oh well, the 2.5 tree is usable and has an
acceptable license.

-- 
Jesse Keating RHCE      (geek.j2solutions.net)
Fedora Legacy Team      (www.fedoralegacy.org)
GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)

[Rex Dieter]

Jesse Keating wrote:
>  On Mon, 2006-05-01 at 13:22 -0500, Rex Dieter wrote:
>  
> >>Without going into legal technicalities, that license clearly has the
> >>following problems:
> >>- Commercial use restricted (2b) -- Can't be used in any commercial
> application or
> >>     product.
> >
> >Yep.  This one is a deal-breaker for inclusion in Fedora. 
>  
>  
>  Ok, they were afraid of that, but knew it was a possibility.  However
>  they really want to prevent incorporation of the framework into a
>  commercial product.  
That's unfortunate.  It's #1 on the opensource criteria on opensource.org:

http://www.opensource.org/docs/definition.php
1.  Free Redistribution
The license shall not restrict any party from selling or giving away the 
software...

-- Rex