software licensing open-source-software
Who is held accountable in case of violation of JSON license&#39;s specific &#39;no evil&#39; clause - the end user, the distro, or both?
<p>The JSON license, as well as the jslint (and the 'jshint' derivative) license, is an otherwise unmodified version of the <a href="https://en.wikipedia.org/wiki/MIT_License" rel="nofollow noreferrer">MIT License</a> except for one peculiar clause which reads:</p>

<blockquote>
  <p>The Software shall be used for Good, not Evil.</p>
</blockquote>

<p>As a result, some software developers and distributors take the (IMO) unfortunate route of not using, or not distributing, the software components licensed under these terms <sub>(that is, except for those who managed to get <a href="https://www.youtube.com/watch?v=-hCimLnIsDA" rel="nofollow noreferrer">an exception clause added to them</a>)</sub>.<br>
One such example is Debian. In a open <a href="https://github.com/jshint/jshint/issues/1234" rel="nofollow noreferrer">issue</a> to the <em>jshint</em> repository, some users voice their complain that the atypical clause prevents Debian from packaging jshint in their official repositories.</p>

<p>What I want to ask is: say the Debian Project were to distribute <em>jshint</em> in their official repositories. Assume this act is qualifiable as 'good' (not <em>evil</em>). No violation of the license so far, I suppose. Now consider the case of a Debian user who uses his Debian computer to practice evil (for instance, extortion, terrorism, you name it).</p>

<p><strong>Who would be liable for violation of the license terms? The Debian user</strong>, who performed the wrongdoing; <strong>the Debian Project</strong>, who distributed the software; <strong>or both?</strong></p>

<p><strong>In other words: if a court were to take the clause at face value and enforce it, would the user be the sole defendant, or would the Debian Project also?</strong></p>

<p>The clause states "<em>The Software shall be <strong>used</strong> for Good, not Evil</em>" - but I assume the <strong><em>distribution</em></strong> of the software by the Debian Project qualifies as <em>use</em> (right?). In that context, is the Debian Project liable for whatever evil their users might be willing to execute by means of a computer running the Debian OS?</p>

<p>Or, I suppose, the same question in other words would be: <strong>Is it a risk for the Debian Project to distribute <em>jshint</em> in their official repos?</strong></p>

<p>That “shall be used for Good, not Evil” clause is a moral category, not a legal category. From a legal perspective, it is likely meaningless and/or unenforceable. Neither Debian nor users of that software should expect any legal risk for using or distributing the software.</p>

<p>However, software under that license will never make it into Debian because it violates the Debian Free Software Guidelines. The DFSG is not a contract in the legal sense, but it forms part of the <a href="https://www.debian.org/social_contract.en.html" rel="noreferrer">Debian social contract</a> with its users. It is not in the interest of the Debian project to include software unless the software is free to use for any purpose. While the JSON license's usage restriction is likely meaningless in practice, it clearly tries do do exactly what the DFSG wants to prevent.</p>

<p>In the Open Source community, there is a broad consensus against the JSON license. The DFSG, slightly edited, was adopted as the Open Source Definition. Consequently, the JSON license also fails to be an Open Source license. The Free Software Foundation also <a href="https://www.gnu.org/licenses/license-list.html.en#JSON" rel="noreferrer">looked at</a> the license, and concluded: “This is a restriction on usage and thus conflicts with freedom 0. The restriction might be unenforcible, but we cannot presume that. Thus, the license is nonfree.”</p>

<p>"Say the Debian Project were to distribute jshint". That's distribution, not use. The distinction matters. This line is appended to the MIT license, which starts by enumerating different rights including both "use" and "distribute". Hence it's reasonable to assume that the term "used" in both clauses means the same.  In other words, your assumption that "distribution" is the same as "use" is wrong, else the MIT license wouldn't have spelled that out. </p>

<p>While the MIT license allows relicensing under narrower terms, and JSON's license does not change that, removing an obligation is relicensing under broader terms. That's why IBM needed another license straight from the original author.</p>
