Apache Software License, Hippo, and BlueNog

July 9, 2009 hippo

When I first got interested in open source software there was a lot of talk about the restrictions and liberties of various licenses and the risk that free-riders posed to the system. I have to admit that I never found these topics very interesting and usually referred the conversation to my colleague Stephen Walli (who is way more qualified in this area than I am — lawyers even listen to him!). For the most part, these (as well as the whole indemnification and SCO hysteria) have turned into non-issues, particularly for my clients who are users of the software and will probably never read a license anyway. Things tend to work themselves out.

But every once in a while, something interesting in the topic of licenses does pop up. You may remember I wrote a post describing how Bluenog took Hippo CMS, slapped their logo on it and sold it as commercial software. Well, they are still at it and they have even gone further as to remove any acknowledgement that they are repackaging someone else’s software. The Apache Software License, which Hippo CMS uses, is very permissive and only requires that redistributions of the software contain a notice file giving credit to the original developers. Bluenog isn’t even doing this. And, as you would probably expect they are not contributing back to Hippo either.

Bluenog is clearly in violation of Hippo’s licensing terms so it may not matter what license Hippo is distributed under, but it did get me thinking about licenses again. The Apache Software License has been used very successfully for infrastructural components like the famous Apache HTTP Server and all those great Java frameworks and components. The key benefit there is achieving broad adoption. The terms are so generous that there is virtually no downside to including an Apache licensed component in your software. Adoption is a good thing for frameworks and components because lots of users help find bugs and help the project move forward. Even if a very small percentage of developers contribute back, the scale of the user base translates into a lot of support. This low barrier to adoption is particularly good for reference implementations of standards. Tomcat, Slide, and JackRabbit were all critical to the success of the standards they promoted.

As good as the ASL is for components and frameworks, I question its efficacy for business applications. Business applications, like Hippo, compete in a different market than infrastructure. They are going after a smaller (higher touch) install base and they are more actively competing against other products. Business applications need to innovate and differentiate from their competitors while infrastructure wants to be stable and standard. The potential for free-riders to undermine your investment to be unique is too great. This is why most other CMS on the market are licensed under the GPL or a similar license.

From a consumer perspective, it feels like Bluenog customers are getting ripped off. They are buying a software application that should be free. Customers are essentially paying Bluenog to ask questions on the Hippo mailing list that Hippo and the community are answering for free. It feels like Bluenog’s refusal to acknowledge Hippo is an attempt to protect this arbitrage. Had customers worked directly with Hippo, they would not only save money, they would also know that Hippo has an entirely new product: Hippo CMS 7 that is a ground up rewrite from the 6.x series that Bluenog forked. I do think that this issue will eventually be worked out. Bluenog will probably not be able to continue practicing business in this manner: even if lawyers don’t get involved. But, as you can probably tell, this drama does rankle my developer and open source sensibilities.

  • Pingback: Apache Software License, Hippo, and BlueNog « Content Here - Software Management

  • http://www.jahia.com Stephane Croisier

    Great post!

    I must say that my open source sensibilities was also impacted when I see that certain content experts relay certain information about Bluenog’s proactivity in the Open Source (eg: http://www.cmswire.com/cms/enterprise-20/bluenog-contributes-back-makes-open-source-easy-004906.php).

    Becoming an Hippo VAR is their perfect rights. Same is true for forking. But at least they should keep paternity and ownership disclaimers…

  • Pingback: 451 CAOS Links (caostheory) 's status on Friday, 10-Jul-09 16:39:40 UTC - Identi.ca

  • Kevin Cochrane

    Great post! Like Stephane, my open source sensibilities are hit here … they should either take the core Apache components that Hippo uses and build their own CMS entirely, or they should become a Hippo VAR and add value atop Hippo and abide by the terms of their licensing by acknowledge provenance. Also like Stephane, I think a press release announcing that the “will” contribute back is specious – will Hippo accept their “contributions”? Have they been granted any commit rights to any of the Apache projects they plan on contributing back to? Open source is not a dumping ground for any code someone wants to throw over the wall. Successful projects like those developed in the Apache Software Foundation (HTTP server, Jackrabbit, Lucene) are professionally managed and accept contributions only from developers with the strongest credentials whose code is thoroughly vetted and qualified and whose extensions are in-line with the general mission of the project. If Bluenog chooses to become a true member of the open source community rather, I applaud that – but first they need to get that real open source is a collaborative ventures amongst peers – I think their history with Hippo and presumption that their code can be thrown over to wall to various open source projects suggests they don’t get it.

  • http://www.bluenog.com Scott Barnett

    Seth’s July 9th blog post, “Apache Software License, Hippo and Bluenog” contains numerous inaccuracies that we would like to address:

    Contrary to Seth’s assertions, our use of Hippo 6.x in our ICE CMS is acknowledged on our web site (http://www.bluenog.com/site/products/content/website/products/opensource), together with citations for another dozen open source projects. It is also spelled out in our source code. There is no attempt to hide the use of HippoCMS. Bluenog does not intend to fork HippoCMS and has stated so publicly (http://www.cmswire.com/cms/web-cms/bluenog-content-platform-gains-fame-sticks-with-hippo-004494.php).

    Moreoever, open source software has improved because companies such as Bluenog find creative ways of using and enhancing the core open source project for their customers. In addition, Bluenog ICE is far more comprehensive than Seth’s post would suggest. Bluenog ICE combines content, collaboration, presentation and reporting into a single integrated suite – with Single Sign-On, Search, Workflow, Integration and other important features. The components of HippoCMS that we use are primarily for the content portion of our suite – it is not used for the presentation, collaboration or reporting pieces. One of Bluenog’s biggest value propositions is the integration of these many different open source projects into a cohesive and supported product, something Seth fails to mention in his post, but others have mentioned publicly after being briefed by Bluenog such as the 451 Group – https://www.bluenog.com/NewsAndEvents/451%20Group%20Report%20Jun%2023%202009.pdf and Basex – http://www.basexblog.com/2009/06/25/in-the-briefing-room-bluenog-ice/.

    It’s important to note that Bluenog has invested several thousand developer hours in adding value and pre-integrating those projects into one seamless package for our clients. Bluenog’s SLA requires response to support questions within typical commercial levels of response, something that cannot be accomplished simply by posting questions to message forums.

    Another salient misrepresentation is Seth’s assertion that we have violated Apache licensing. We retain all copyright and license notices of all the open source projects including Hippo. Our component matrix clearly identifies the components and their licensing.

    Bluenog is very committed to the open source community. As proof, we have announced our intentions to give back to the community (http://www.bluenog.com/site/particle/content/website/news/press/contributingback.xml). We invite anyone, including Seth, to meet with us so that they can fully understand our company philosophy, product architecture and commitment to being a full and transparent member of the open source community.

  • http://www.chrismaresca.com Chris Maresca

    Scott,

    I appreciate that you are trying to respond to these criticisms, but the fact it, BlueNog is doing some things which is unacceptable at the very least.

    While I haven’t done an in-depth analysis, there is at least one glaring example right from when you install BlueNog.

    Where are the licenses for the products you are including? Your giant proprietary EULA barely makes any mention of them and an end user has no chance to agree or disagree with the licenses attached to the software you include. On top of it, there are several clauses in the EULA that are highly anti open source.

    I know your lawyers may tell you this is all OK (BTDT), you should not be surprised that the open source community reacts badly to this sort of thing. My advice (coming from advising 60+ startups and 20+ F1000′s on open source), just heavily acknowledge the projects you are pulling from, expose their licenses to end-users. That will have little impact on your business and a whole lot of open source people will be off your back…

    Chris.

  • http://www.onehippo.com Jeroen Verberg

    We are currently looking into this matter and will react based on our findings.

    But we do think it’s noteworthy to mention that Scott’s/Bluenog claim that BlueNog ICE consists of a lot more than Hippo CMS is based on the fact that it’s an integration between Hippo CMS and Apache Jetspeed Portal. Indeed combining the two products creates a powerful suite.

    Interestingly enough we provide such a integration: Hippo Portal. But there’s more to it, again, as with Hippo CMS, Bluenog never committed anything to Apache Jetspeed. In contrast Hippo employs 5 Apache Jetspeed committers, including the lead developers of the Jetspeed project.

    Hippo provides this integration (with SSO, Workflow,etc,etc) as a cohesive and supported product, including commercial grade, up to 24 x 7, support. And we have many happy customers both in Europe and the US, as we have been doing this for over 10 years.

    We believe Seth’s post is important as it at least shows (combined with the information about Jetspeed here) that Bluenog has no influence on the code and direction of the open source projects they are using. Therefore in the long run, they will be unable to provide their customers with a viable and lasting solution.

    Jeroen Verberg
    Hippo

  • Pingback: The Cheap Computer Geek » Blog Archive » Bluenog angers Hippo

  • Pingback: CMS Watch: Bluenog angers Hippo | CMS Critic

  • http://www.bluenog.com Scott Barnett

    We would like to thank Chris Maresca for raising a valid point in his July 10th comment. Chris is correct that Bluenog in its SLA does not make attributions to the open source projects it draws from. We do agree that attributions should be made and we have done that in all of the source distributions that our customers receive. All of the notices and copyrights are indeed preserved in our source repository. However, the attributions were inadvertently missed in the binary distribution. We have rectified this in our download and we have also added more information on the Open Source Projects section of our website (http://bluenog.com/site/products/content/website/products/opensource) to indicate the open source licenses used in our products. We stand 100 percent behind our products and none of them are licensed to our customers under any of the open source license terms. All of our ICE customers are covered by Bluenog’s SLA.

    We remain steadfast in our commitment to add value to all the projects we draw upon and contribute this value back to the community in the form of new features, improvements, how-to’s, bug fixes and more. Our recent announcement (http://www.cmswire.com/cms/enterprise-20/bluenog-contributes-back-makes-open-source-easy-004906.php) on 6/24/2009 was intended to formalize our efforts in this area. Contributing back is a critical part of our relationship with the open source community and we promise to focus on doing this more intently in the future. We encourage continued constructive feedback from both our customers and the larger open source community.

  • Pingback: Bluenog replies to “Bluenog angers Hippo” post | CMS Critic

  • HippoJetSpeedBluenog

    I bet my house that this statement from “Scott” at Bluenog was written by Bluenog’s PR firm. It is interesting that Bluenog has a PR firm cranking out press releases but don’t have the time/money to edit their EULA.
    “We remain steadfast in our commitment to add value to all the projects we draw upon and contribute this value back to the community in the form of new features, improvements, how-to’s, bug fixes and more. Our recent announcement (http://www.cmswire.com/cms/enterprise-20/bluenog-contributes-back-makes-open-source-easy-004906.php) on 6/24/2009 was intended to formalize our efforts in this area. Contributing back is a critical part of our relationship with the open source community and we promise to focus on doing this more intently in the future. We encourage continued constructive feedback from both our customers and the larger open source community.”

    My Experience
    When I first saw Bluenog, I was under the impression that it was a new product. Based on these posts and my futher research I now know that Bluenog is not a new product. Their marketing is frankly misleading at best.

    Why Bluenog Obfuscates Open Source
    Bluenog obfuscates open source projects because:

    1) If their existing/prospective clients (like me) found out that Bluenog was just a bunch of open source components being marketed as Bluenog ICE they (Bluenog) would not be able to sell much product in the short run. Would I want to buy Bluenog knowng that they are a venture backed start-up?No. or that ICE it is mostly (95%+) just mostly Hippo+JetSpeed? No.
    2) If their existing/prospective investors found out that Bluenog was mostly just marketing vs owning any intellectual property they would likely not invest in Bluenog.

    My Analysis:
    Bluenog is just a start-up marketing company. Their hope is that their marketing creates enough of an install base to enable them to build enough value add in the future (this is much like a Ponzi scheme). (You need revenue to build software. Develpers are not cheap ;) ) Right now they are just burning through their venture capital. I wonder what their burn rate is. I wonder what their revenue is. How long will that venture capital last?

    Outcomes:
    Although we got excited when we saw Bluenog’s marketing initially, we have decided to pass on this solution for our organization due to some of the technical/business factors outlined above.

  • Simplify This

    Packaging OSS and wrapping it in commercial services is no crime and often does good things for the OSS efforts. Obfuscating the fact that you’ve built your business on someone else’s work will get you burned, just like this.

    The Bluenog credibility test is simple: Let’s see clarity in communications and real contributions to the Jetspeed and Hippo projects.

  • http://betterfasterbigger.blogspot.com Boris

    There is a difference between taking infrastructure components and build a product out of them and taking products and rebrand them as your own. Vendor-driven open-source products like Hippo, Open-CMS or (our own) Magnolia CMS live off the product they built and related services. Starting a company to wrap an existing solution into your own – even if you add value – is the wrong way to go. If you really have value to add, do so within the original space the vendor provides – a VAR is a good example, or build modules that add value and sell these. Another option is to invest directly in the original company – if they let you – and such make the long-term outlook for your business and your customers much more stable.

  • http://blogs.hippo.nl/arje/2009/07/bragging_rights.html Arje Cahn, CTO of Hippo

    [..] Distributing our product without retaining the required notices does not only go against the spirit of the open source community, it also hampers our efforts to build the larger community of which Bluenog and its customers are a part [..]
    http://blogs.hippo.nl/arje/2009/07/bragging_rights.html

  • Pingback: Links 18/07/2009: GNU/Linux Benchmarks, Mandriva 2009.1 USB Release | Boycott Novell

  • http://www.onehippo.org Mark Woodward