Personally, I increasingly doubt that BSD+PATENTS is even GPL-compatible -- and so potentially Automattic may be violating the GPL by using React integrated with WordPress.
What's especially sad about this is that React isn't even that good compared to other vdoms like Mithril and Inferno and others. React just has a lot of name recognition and mindshare from the Facebook association (which then translates into a rich-get-richer effect with more tutorials and components).
If Facebook has a patent on React, it's almost certainly going to be on the vdom concept.
If Facebook has a patent on the vdom, then all the projects in your list violate the patent, and none of them come with even a conditional patent grant from Facebook.
If Facebook does not have a patent on the vdom or other React technology, then those other projects are safe, but so is React, since termination of the patent grant has zero cost to you.
My personal belief is that Facebook has no patents on React, so I feel safe to use React, Mithril, or any other vdom based library. But I can certainly understand people who feel like they need to play it safe, assume Facebook does have a vdom patent, and avoid all such libraries.
But I'm not really following your logic at all. It's like you think Facebook has a patent, but then you only want to use the libraries that maximise your ability to get sued over it? What am I missing?
You're missing the fact that if you sue Facebook for any patent infringement, even a legitimate one (say, you're the creator of some new hardware), Facebook will revoke your React license.
Also, Facebook has no vdom patent. It's not like you can be granted a secret, hidden patent (even the word "patent" itself means "open").
> You're missing the fact that if you sue Facebook for any patent infringement, even a legitimate one (say, you're the creator of some new hardware), Facebook will revoke your React license.
Incorrect. (This has been clarified many times, including in Facebook's official FAQ about React licensing.)
> Also, Facebook has no vdom patent. It's not like you can be granted a secret, hidden patent (even the word "patent" itself means "open").
I agree. Many people have looked; no one has found one. Hence why I believe there's no risk to using React.
They revoke the React patent grant, which effectively downgrades "the React license" to just a stock BSD 3-clause license. At that point they will likely counter-sue you for patent infringement.
In my mind that situation is effectively identical to losing "the right to use" license on grounds of patent suit (like Apache). Interestingly, in Apache you'd still be sued for patent infringement (not copyright infringement) because "right to use" is provided as a patent license.
> They revoke the React patent grant, which effectively downgrades "the React license" to just a stock BSD 3-clause license. At that point they will likely counter-sue you for patent infringement.
Yes, but for what patent? People have looked; none have been found. :)
Patent applications are secret, not to mention that software patents can be very difficult to interpret and search for. RMS gave a fairly long talk about the various problems with software patents[1], and the difficulty in being able to find all software patents that may be related to a project is one of them.
Patent applications are public for a minimal time period, 18 months at the very most. But obviously patents are public. React has been open source for over 2 years now. It's highly-likely, almost certain, that any React-related Facebook patent would now be public.
The second part of my comment is probably more applicable (maybe I should've just excluded the point about private patent applications). Even if a React-related patent was public, it wouldn't be called "Patent on React Framework". It probably wouldn't even use the words JavaScript, HTML, or DOM. You would need to hire a patent lawyer for an extended period of time to have a reasonable amount of certainty that no such patent exists (and even then, it's just an educated guess).
"Facebook, Inc. ("Facebook") hereby grants to each recipient of the Software
("you") a perpetual, worldwide, royalty-free, non-exclusive, irrevocable
(subject to the termination provision below) license under any Necessary
Claims, to make, have made, use, sell, offer to sell, import, and otherwise
transfer the Software...The license granted hereunder will terminate, automatically and without notice..."
The PATENTS file affects more than just React. It's found in their other projects too.
you mean their patent grant? How can an open source license like apache, MIT or bsd be "revoked"? Do facebook have a public blacklist of people who aren't allowed to use react?
Apache revokes your rights under the patent section of the license if you sue anyone for patents granted under said license:
> If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
Note that the "Grant of Copyright License" of Apache doesn't grant you the right to use the work, so revoking the patent license is effectively revoking the whole license (though you can still redistribute the work).
Correct. Once released under an OSS license, that cannot be revoked. They can change/restrict the license on future releases, but you can also choose an older release, which uses the more favorable OSS license.
Not practically, because once you make a library with an mit license available to anyone, they can give to anyone you didn't "want" to give it to, per the mit license.
Being sued, whether the patent is valid or not, is really expensive. Unless you're Google, or of similar size, you're going to lose just due to the costs.
Using React just opens you up to liability, with no real benefit (other than using React). Why would you use it?
> Using React just opens you up to liability, with no real benefit (other than using React).
How?
Again, if they have a patent, they can sue you if you use one of the alternatives mentioned. If they don't have a patent, they can't sue you if you use React.
What's your thinking behind saying using React adds liability? Because to me, it looks like either it does nothing or it reduces liability.
The fact that we even have to have this discussion is a reason not to use it. I'd have to a hire a lawyer and disclose it to my investors to be cleared up. It would cost us money to validate because it does something different compared to any other similar project. My investors were very specific about software licenses - we aren't allowed to use GPLv4 or AGPL at all.
> I'd have to a hire a lawyer and disclose it to my investors to be cleared up
That seems extremely weird. Normal startups do nothing of the kind; do you have extremely weird investors?
> My investors were very specific about software licenses - we aren't allowed to use GPLv4 or AGPL at all.
Ah, there we go. First off, there's no such thing as GPLv4. Second of all, you do realise that avoiding even the AGPL puts you in a vanishingly rare crowd in these parts, right? Eg, MongoDB is AGPL; of all the reasons I've seen given for avoiding Mongo, the license is a new one on me.
If you've decided to only use GPLv2 or vanilla MIT licenses software that's totally fine, but it is unusual.
If that's your concern, then you should comb through the source code of all your open source libraries and be certain that none of it violates any of Facebook's patents, including the MIT licensed stuff, which may very well.
> If you have a patent, and use React, you can't sue Facebook if they use your patent.
Citation needed. Let's say I have an awesome VR patent, and a React based website. I find out the Oculus violated my patent, what happens next?
Answer: I sue them. :) Nothing about the React license stops this; I will even still have a right to use React. What I won't have is a right to use any patents that Facebook might have on React. But Facebook, as far as is known, has no such patents.
> The license granted hereunder will terminate, automatically and without notice, if you [...] initiate [...] any Patent
Assertion
The key part is that if you don't have a license to use the patented technology (or more pertinently - that license is explicitly revoked), you can't legally use that technology, no matter what the BSD license might say: the patent grants supersedes the BSD license.
So, to respond directly to your answer - you lose the right to use React; Facebook can sue you for your use of React, since they own the patents to that technology.
So if you want to operate under the belief that Facebook has no patents to assert, then yes, you will consider yourself to be safe. The fact is that many lawyers, including the Apache Foundations lawyers, disagree with this assertion.
> The fact is that many lawyers, including the Apache Foundations lawyers, disagree with this assertion.
Incorrect. The ASF's objections had nothing to do with believing Facebook had any patents, and many ASF projects are looking to move to Preact, which is presumtively covered by the same patents React would be (if any).
But you can still sue Facebook. Nowhere does the PATENTS file require grantees to waive their right to sue. But if you do sue, Facebook gains the right to counter-sue you with any react related patents.
I.e. the exact situation you would be in if you sued Facebook and there was no PATENTS file.
Not quite - if there was no patents file, the BSD license would have a implied grant associated with it which would not be revoked by the lawsuit.
The "implied" license doesn't have a strong legal finding backing it up yet. Even so, most lawyers are comfortable with the idea that if a company tells other people to freely use their software, they can't then come back around and sue those same people.
just because you may have enough resources to sue facebook for patent infringement doesn't mean you can afford to halt all new development and rewrite/rebuild what has become the reason that you have enough resources to sue facebook
It's speculation what patents Facebook has for React or what they cover. I've heard of claims of prior art for vdom-like concepts, so it is possible even if Facebook has React-related patents, only narrower interpretations of any claims might hold up (if that). React has a specific way of updating state which, for example, Mithril does not use. So, it is possible other vdoms may be far enough away from React to not be covered by any patents claims Facebook might try to make. Granted, that is no 100% guarantee of anything.
Personally, I feel templating approaches to making JavaScript-powered UIs like React's JSX or Angular's own templating approach or the templating systems in many other UI systems are obsolete. Modern webapps can use Mithril+Tachyons+JavaScript/TypeScript to write components in single files where all the code is just JavaScript/TypeScript. Such apps don't need to be partially written in either CSS and some non-standard variant of HTML that reimplements part of a programming language (badly). (Well, there may be a tiny bit of custom CSS needed on top of Tachyons, but very little.)
So, by writing UIs using HyperScript (plus a vdom library), you can potentially (with some work) replace a backend like Mithril with almost any other vdom or even a non-vdom solution. So, that is another way I mitigate this risk when I have a choice.
Granted, I know many web developers grew up on tweaking HTML and love HTML-looking templates and so they love JSX or whatever and are happy to ignore how hard it is to refactor such non-code stuff in the middle of their applikcations or validate it (granted, some IDEs are getting better at that). But I came to web development from desktop and embedded development working with systems where you (usually) generated UIs directly from code (e.g. using Swing, Tk, wxWidgets, and so on). I like the idea that standard tools can help me refactor all the code I work on and detect many inconsistencies.
Maybe a deeper issue for me is that with BSD+PATENTS Facebook is redefining what "open source" means in a way that is harmful to the open source community -- and also free software community as well like with Automattic using React on top of a GPLd WordPress. Which is why the Apache Foundation rejected the React license.
Here is a prior art reference by erichocean: https://news.ycombinator.com/item?id=14784983
"To anyone concerned about React's virtual DOM and diff'ing stuff, and a potential Facebook patent thereof, in early 2012 I wrote and published (under a GLPv3 license) a virtual DOM implementation with efficient diff'ing when I forked SproutCore[0] to become Blossom.[1]"
Most of those twenty probably infringe on Facebook patents. You can choose to use a library with an explicit grant, or a library with unclear patent status.
We don't know for sure what React-related patents Facebook really has or if they would claim any other libraries infringe them -- or whether those patents would stand up in court given prior art. There are vdom-like approaches that predate React.
That said, I would expect that vdom libraries like Mithril that work in a very different way than React would be less likely to be claimed by Facebook to infringe a React-related patent than, say, Preact which tries to duplicate the React API.
Of course, this is all speculation with a lot of unknowns. It all is another example of why software patents are very problematical ways to "promote the Progress of Science and useful Arts".
You're right overall (at least for developers who prefer React). React Native is a compelling technology. That said, I can hope that over time, lightweight JavaScript libraries like Mithril along with better mobile browsers with better support for occasionally-connected web applications will continue to reduce the relative benefits of a native approach. Apache Cordova and NativeScript are other options as well.
"Replace React with Mithril for licensing reasons" https://github.com/Automattic/wp-calypso/issues/650
Personally, I increasingly doubt that BSD+PATENTS is even GPL-compatible -- and so potentially Automattic may be violating the GPL by using React integrated with WordPress.
What's especially sad about this is that React isn't even that good compared to other vdoms like Mithril and Inferno and others. React just has a lot of name recognition and mindshare from the Facebook association (which then translates into a rich-get-richer effect with more tutorials and components).
Here is a list of more than twenty alternative vdoms I put together in January 2016 (although Mithril remains my favorite): https://github.com/dojo/meta/issues/11#issuecomment-17679024...