OSI mired in bureaucracy and backlog, critics say

– by Tina Gasperson –
Some applicants are weary from waiting up to a year or more for action from the Open Source Initiative, which reviews and either approves or rejects submitted software licenses as officially Open Source. Critics say that OSI may make itself irrelevant if it doesn’t start making decisions faster.The Eiffel Forum License has been under consideration for certification for “well over a year,” according to Roger Browne, a project leader for the Eiffel Forum, a community of programmers who use the Eiffel language to create software.

The Eiffel Forum Archive is hosted at SourceForge, (a site that is owned by NewsForge’s corporate parent, VA Linux) which accepts projects that are released either with an OSI-certified license, or a license that would comply with the terms for OSI certification in the event that it has not yet made it through the review process.

Eiffel’s OpenGL SDK, also hosted on SourceForge, is released under the Eiffel Forum License, but shows up as Public Domain. There is no specific, browseable categorization of projects on SourceForge that are released under a license that has not yet been approved or rejected by OSI. The OSI-approved licenses listed on Sourceforge, and the OSI-approved licenses listed by the OSI itself, are identical.

But Browne says that if the OSI doesn’t clear its backlog, “OSI certification will become irrelevant, and SourceForge acceptance will become the preferred test for whether a license is Open Source.”

Browne was joined in his sentiments, posted on the license-discuss mailing list, by other complainants. “I’ve found three ways to get someone from the OSI to respond: provide specific suggestions on the website, and the webmaster will respond; make specific legal claims, and Larry [Rosen, OSI’s attorney] will respond; or get in a huff and Russ [Nelson, an OSI board member] will flame you. General discussion, pointedly asking the OSI for a response, etc. is insufficient,” said one list member.

In response to speculation that Rosen was making all the decisions for OSI behind the scenes, the OSI lawyer wrote, “I don’t make ANY of the decisions about approvals. I’m not on the OSI
board. I do advise the board, however.”

“Like other OSI volunteers, I have limited free time. I try my best as do
the board members. I’m sorry we’re not doing a very effective job yet
of approving licenses. For what its worth, my frustration level is also
high about that.”

Board member Russ Nelson says that people who are complaining should put forth more effort to help the board by fulfilling the purpose of the license-discuss list: to discuss the merits of submissions and offer suggestions to the board. “I submitted three licenses on 8/31 for
review to the license-discuss mailing list. Has anybody reviewed
them?” says Nelson in an email to NewsForge. “No. Not a word. Not one. Maybe I’m not being patient enough,
but still, you’d think that people who were bitching about our backlog
would be willing to stop bitching and put some effort into helping us
reduce it.

“So okay, my feeling is to write these folks off as whingers. My
opinion is subject to change, but first I want to see some discussion
about the submitted licenses.”

Members briefly bandied about a suggestion to form volunteer focus groups for each pending license; but there was no official public response from the OSI to the license-discuss list, and it seemed that was what the list was waiting for. “It always astounds me how many of the real world bureaucratic processes end up having equivalents in electronic/virtual world,” said Daniel MD, who submitted his license last month for review. “I think that an open license review system should be implemented. My guess is that with the implementation of volunteer focus groups, the backlog would be reduced to ZERO by the end of the year.

“I have two products that I wish to license under [the proposed ‘Daniel MD’ license],” he told NewsForge. “One is GIFF (Game Foundation Framework) and the other is an exokernel for possible use as a fast services/web server. I find myself in need of help, so I decided that, instead of hiring developers, I’d make the project open source and get some help from the community.”

The unofficial response to the license was along the lines of “put it away until you figure out what you really want to do” — but there was no official response from anyone on the board. Others mentioned that, with so many Open Source licenses approved already, new projects should make every effort to select an existing license instead of swamping the OSI with new requests.

The World Wide Web Consortium (W3C), the group founded by Tim Berners-Lee that develops standard protocols and design standards for the Web, submitted its W3C license to the OSI for approval back on January 4, 2000, and there has been no response to the request. Joseph Reagle of W3C resubmitted the license on August 31. List member David Johnson, who says he uses W3C-licensed software, thinks the OSI should “approve this license forthwith.”

“I would call
attention to the fact that this license is already approved by the Free
Software Foundation as being GPL compatible,” continues Johnson, “and suitable for the use in Free
Software projects. The text of the license itself is remarkably similar to
existing Open Source licenses. I have not found any phrase, clause or section
in this license that is contrary to the Open Source Definition.”

Another post in support of certification of the W3C license asked the board why it had not been listed. “Actions the W3C would apparently like to take — including hosting Amaya
on sourceforge.net — depend upon this approval, which has been pending
for over a year.

“Although I have no stake in this license, it seems it should be a
higher priority and easier decision than some of the other licenses
recently approved, since they actually need the approval to continue
with some of their plans,” wrote Matthew Weigel.

Nelson fired off this response:

“Why isn’t it listed? Because it’s not approved.
Why isn’t it approved? Because we got hideously backlogged.
Why did we get backlogged? Because approving licenses is a lot of
work, and we’re all working on open source with just as much on
our TODO lists as anybody else in the field, if not more.
So now what? We changed the license submittal procedure to take some
of the work off of our shoulders and put it on those of the people
submitting licenses. This has the beneficial effect of making it
harder to create Yet Another open source license.”

M. Drew Streib, who says he was part of the “original decision to require projects to be licenses under an OSI-approved license” for SourceForge, provided some perspective from the other side to the list:

“Of course, we ran into projects that wanted to use licenses that met the
definition but weren’t yet approved, and ones that ‘almost’ met the
definition, but didn’t or couldn’t for one reason for another. We
began the practice of looking at these on a case-by-case basis for
good faith, sticking to the OSI definition for about all of these cases.

“I’d like to note that there are sort of three categories of licenses that
we care about:
* Ones that are OSI approved
* Ones that meet the OSI definition (and DFSG/FSG for that matter)
* Ones that don’t, and won’t

“The first two are acceptable. One doesn’t have to be ‘OSI-approved’ to
meet the definition, and I personally believe that the approval isn’t
a completely necessary step to feel good about a license under which
you have released software, although it is great validation.

“We do _not_ intend to be a validation for ‘Open Source’, but are rather
trying to apply strict guidelines for projects hosted on SourceForge.net.”

Recently there had been some questions on the list about the infrequency of updates to the OSI Web site, which lists the currently approved Open Source licenses. Members pointed out that a few licenses which had been approved for several weeks had not shown up on the site yet, such as the IBM Common Public License. Since then, OSI has brought the Web site current.