in reply to Re^10: Why non-core CPAN modules can't be used in large corporate environments.
in thread Why non-core CPAN modules can't be used in large corporate environments.

The only real legal answer to that if you are concerned is talk to a lawyer (which I am not). As far as I understand these questions are still very much in the defining stage for the programming world, and the law varies quite considerably from country to country. There are far older forms of expression to which copyright law also applies which still suffer from the same definability problem. For example, the fact whether a certain piece of music is a derivative work from another can be governed by the length of a melody they share (in bars or seconds) as well as the length of the music in it's entirety. As far as I understand that is considered to be a pretty well nailed-down definition :-). I don't know if similar definitions will become commonplace for code (or what definitions are used in courts at the moment), but the problem seems to me to be much harder.

The bit about commercial organisations using CPAN modules in their entirety is relatively clear though. The modules license itself states under what terms and how you can and cannot use the module, abide by those rules and there should not be a problem (as long as no-one challenges the license in court in future and it is found to be invalid in itself). If a module does not come with a license, a paranoid company lawyer might want to contact the author and make sure that the license your company is presuming to use the module under (e.g. the Artistic License) is granted by the author.

My sarcasm filter seems to be slightly faulty atm, I can't really tell which part of your question was facetious and which wasn't. Once you "derive" from a piece of code you are copying from it and changing the variable names doesn't alter that fact more than playing "Johnny B.Goode" on a harp makes it your original work. If you look at an algorithm in a piece of code and then go away and reimplement it yourself you should be allright. I think. It depends. Ask a lawyer.

Oh, and if you were asking for my opinion on what's ethical as opposed to what's legal, it's quite simple, I try to respect an authors wishes to the best of my abilities.

Update: Trying to actually answer the questions:

  • And again, I am not a lawyer, any opinion I give here is my interpretation of laws and based solely on others (often non-lawyers themselves) interpretation of the law.

    Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. -- Brian W. Kernighan
    • Comment on Re^11: Why non-core CPAN modules can't be used in large corporate environments.
  • Replies are listed 'Best First'.
    Re^12: Why non-core CPAN modules can't be used in large corporate environments.
    by BrowserUk (Patriarch) on Dec 07, 2005 at 02:12 UTC
      My sarcasm filter seems to be slightly faulty atm, I can't really tell which part of your question was facetious and which wasn't.

      Believe it or not as you will. The entirety of my 3 part question was in earnest. I would seriously like to know the answer to those questions that you carefully avoided.

      Oh, and if you were asking for my opinion on what's ethical as opposed to what's legal, it's quite simple, I try to respect an authors wishes to the best of my abilities.

      I thought that the purpose of the Perlish "Artistic licence" was essentially that the author was saying

      "Here it is. If it is useful to you, use it as you see fit for whatever purpose including commercial ones. Don't remove my copyright notice, and I'd appreciate attribution should you produce a derivative work."

      The funny thing is that this thread started out describing technical limitations on why some corporates might be reluctant to use CPAN modules in there code-bases. These have been mostly refuted.

      What you have done with your post is to provide ample reasons why I, as a former consultant architect, could never recommend that a client that they use any CPAN module, or maybe even perl itself on any commercial project. The effort required in contacting, negotiating and getting legally binding clearance from all those copyright holders would be a nightmare. Simply impossible and untenable for any company to risk having to fight legal battles in country after country all around the world as every author of every CPAN module takes your stance that they must be contacted for every use of their modules, or any derivative works arising from them, on every Perl project they undertake.


      Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
      Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?
      "Science is about questioning the status quo. Questioning authority".
      In the absence of evidence, opinion is indistinguishable from prejudice.
        The entirety of my 3 part question was in earnest.

        Okay, sorry for doubting that. I've updated my post and tried to answer your questions to the best of my abilities.

        I read the PAL similarly to you, albeit with the small difference that the author does not wish his code to be changed and redistributed without the changes being clearly marked (and the change made available, which is pretty much a noop for Perl anyway). I've always thought the PAL essentially asks the same things as the GPL, only it asks that the user complies, whereas the GPL demands it.

        What you have done with your post is to provide ample reasons why I, as a former consultant architect, could never recommend that a client that they use any CPAN module, or maybe even perl itself on any commercial project.

        WTF? I never said the things you apparently understood. Specifically I never said you need to contact every module author before using or integrating their code, nor need you respect their wishes further than what the license of the module clearly says (which permit integration into commercial codebases under clearly defined conditions).

        If a module does not contain a license you are on somewhat shaky ground and you can either

        • take the pragmatic approach and assume you can use the module under the same terms as other CPAN modules, which is reasonable enough for many purposes
        • take the paranoid approach and try to contact the author and ask him to clarify the license under which the module is available. That clarification doesn't need to be a triplicate document signed in blood however, the simple sentence "available under the same conditions as Perl itself" is enough.

        This is why it's important that modules contain license files or statements, it actually makes things easier for the user.

        And what makes you think this problem is unique to the Perl world? If you take a piece of code out of the Microsoft knowledgebase, that code is copyrighted and you need to know under what conditions you can use it. If you take something from a book, the same. If you take a usenet posting from a random programmer, that is copyrighted and you need to theoretically clarify whether you can use it. Hell, if your colleague across the corridor sends you an email that email is copyrighted to him(unless his employment contract has a clause which transfers copyright ownership to his employer) and you need his permission to use it in any way. At least with CPAN modules you have the license which clarifies how you can use the code.

        Tell you what though, there does seem to be some confusion on this topic (and it is highly likely I am misunderstanding or misinterpreting licensing issues in some way as well), which is not entirely unimportant. Ovid posted a question on what the Perl Foundation could do for us, and maybe it would be a good idea if it could obtain some clarification on these issues. I'll go post I've posted a request for that.


        Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. -- Brian W. Kernighan

          The point is, that up till now, I was reasonably confident that it was legally "safe" for anyone to use CPAN modules for their own purposes--whatever those purposes may be.

          The length, depth and intracacies of all the various forms of GPL licence agreements are such that it is impossible for any indiviudual or company to arrive at a conclusion: "Yes I can use this in my commercial project".

          Such conclusions will require years of case law. And that case law will need to be repeated in every jurisprudence. The case law is simply not available for any form of GPL yet. And the variations of GPL are myriad and rising, and the problem isn't getting any easier.

          I was under the impression that the Perl Artistic licence was different. I believed it to say "Here it is, make money with it if you can". It adds a few moral obligations too, but essentially it was the essence of "Free, as in free of risk and burden".

          It seemed so clear to me that this was the intent of the Artist licence, that anyone adding those words, "under the same licence as Perl itself", was accepting that other people were quite likely to take their work from CPAN and use it, in whole or in part, and make money from it.

          Sure, most people would frown upon someone taking their module, replacing the author's name with their own, and re-publishing it, it would be a morally objectionable act--but not cause for a law suite. This view is supported by there being a number of packages on CPAN already that basically take an existing module, reduce the code, simplifying it or it's interface and then re-publish it as X::Y::Simple.

          However, the moment any one author starts throwing the terms "morally wrong" and "illegal" around when someone starts re-using code from CPAN, it calls the validity of my "assured layman's understanding" into question. And when I can no longer trust that layman's understanding, for one author or one package, it raises the spectre of requiring lawyerly intervention for each and every use made of any CPAN module, including all thise distributed with Perl itself. From that point on, all opinions not tested in case law, are off.

          In a world where Xbox-360 owners have issued class-action law suites on the second day of the products availability, can any company risk CPAN authors deciding that they have cause to do something similar?


          Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
          Lingua non convalesco, consenesco et abolesco. -- Rule 1 has a caveat! -- Who broke the cabal?
          "Science is about questioning the status quo. Questioning authority".
          In the absence of evidence, opinion is indistinguishable from prejudice.