The Ubuntu community challenges the Firefox EULA
Posted by Percy Cabello on September 16th, 2008 • Tags: , ,
ShareThis

When Firefox Mac and Windows users install Firefox, they are prompted with a screen to accept the End-User License Agreement. As usual, we don’t read a thing, assume everything is OK and just do whatever necessary to have it installed and be done with it.

Here’s the EULA.

Ubuntu (and about every Linux distribution) ships with Firefox already installed so users are not prompted with the EULA at any time. Mozilla wants Ubuntu 8.10 (due next month) to include a patch to display the EULA on its first run to ensure users sign the EULA, which as said before doesn’t mean most of them will actually read it. Instead, most of them, will just click on whatever they need to.

Point one: why include an annoying EULA prompt?

There are two other points: does an open source product needs an EULA?, and, are the terms of the EULA appropriate?

So, does Firefox needs a EULA? I am not a lawyer or anything close but my understanding is that this is all about protection: your computer could crash, hardware could fail, which could lead to data loss, which if happens to include your precious wedding pictures, will also lead to psychological damage. You may lose time, and hence, money. You may feel too confident with the antiphishing and malware protection services and suddenly realize your identity was stolen after all. There may be a delay in serving a Firefox or extensions update to you and be infected by a known and already patched vulnerability, etc., etc.

In short, you may feel disappointed (specially f you loose money) and feel a sudden itch to sue Mozilla. Maybe not you, but there must be a troll or two among the millions of Firefox users. But he won’t be able to do so or at least not just everyone, depending on your local specific legislation, because the troll would have signed the EULA and accepted its terms.

So, is there a need for such protection? My gut feeling says yes. I don’t know how offering a product for free or letting everyone see how it is done would relieve Mozilla from being held responsible for any damage it may do. That other open source projects (or even if all of them) aren’t getting this kind of protection doesn’t make it the right thing.

Another factor is scale. Firefox is the most used open source product, so it has the largest area of exposure (to lawsuits that is).

So I believe the EULA is necessary.

What about the terms of the EULA terms? Mitchell Baker, Mozilla Foundation, has recognized that the current (as shipped in Firefox 3)  terms fail to clearly state that the software is open source in all its forms: code and binaries. An updated EULA has been posted to make this crystal clear.

I’ve read the EULA in discussion several times now and I just can’t find something that I as a user wouldn’t sign (fortunately because I’ve already had). Aside from releasing Mozilla of any liability for causing you any loss, you agree to their privacy policy, to comply with with import/export regulations (like, you are not supposed to send it to Syria or Cuba, ROFL), and to respect the Firefox logo and name trademarks.

The Firefox logo and name trademarks, were subject to another heated discussion with the Debian community a few years ago because it’s their policy not to ship anything with trademarks. It couldn’t be settled and Firefox code was rebranded as Iceweasel.

This is another necessary evil. If it wasn’t, I for example, could abuse of unknowingly Firefox users who visit Mozilla Links and point them to my special “Firefox Mozilla Links Edition” seeded with spyware, rootkits, and cool affiliate links to fill my bank account. Mozilla policy is you can do that as it is open source code, but you can’t call it Firefox or put the Firefox log on it. The trademark allows Mozilla to go after this kind of scammers, but also after people who could just want to add a couple of mega-helpful features. As said, a necessary evil.

So, back to the original issue, which after reading so many comment in Mitchell’s blog, Slashdot and several other blogs, seems to be the main one here: an annoying dialog with a legal document no one reads.

Mitchell says Mozilla will also look for alternative ways to ensure the user is aware of the terms in the least obtrusive way.

So what do you think. Does Mozilla needs an EULA? Are the terms correct? Is there a point in having an EULA if the user is not aware at least of its existence?

Comments
Michele C. S. said on September 16, 2008, 3:08 pm:

Dear Percy,
you make a bad example when speaking about loosing your data because of Firefox. Ubuntu is already prompting that the software comes without any warranty, and of course this include Firefox.
I’m supporting Firefox as much as I can, but as a Linux user I still cannot understand why we are forced to face the License at the first start instead of putting it in the “About” window. Which, btw, is what many other open source programs already do.

Percy Cabello said on September 16, 2008, 3:19 pm:

Michele, as I said I am no lawyer so I am not sure just putting the EULA “somewhere” is enough for the user or Mozilla. Also, I don’t know if the Ubuntu EULA would cover software of other vendors, or their associated services. Would be great if it were the case though.

The risk of losing data with Firefox or any other software is a fact. That’s why it is, at least, in every commercial software EULA. Hiding this from the user doesn’t make it less real.

My understanding is Mozilla, or any other software vendor for that matter, needs to ensure the use of the software implies the EULA was signed.

I would say there is no way to be 100% sure that the user read the EULA. For example people who download the zip version haven’t signed anything for sure, but this doesn’t mean Mozilla shouldn’t try.

[...] The Ubuntu community challenges the Firefox EULA – Mozilla Links [...]

Jakob Petsovits said on September 16, 2008, 4:29 pm:

If all you believe in is your gut feeling without any further backup of why that is absolutely necessary (and it should be, as there are lots of reasons against showing an EULA), then why try to persuade other people by posting this lengthy blog entry?

I’m not a lawyer too and don’t know about the legal foundations apart from what I read here: http://spot.livejournal.com/299409.html – but in that case the sensible approach is to just report on the happenings and articles of people with actual legal insight. If we’re not lawyers, let’s refrain from making suggestions that should only come from lawyers.

orlando_ombzzz said on September 16, 2008, 5:46 pm:

percy

do you really think that there is more than 0.000000001 of probability that an user of Ubuntu ( free/open source software ) decide to sue Mozilla because he lost data? do you think that someone would throw any money in this gamble?

we are being a bit paranoic here.. may be the mozilla top guys are getting too much in touch with Apple ( Asa is fanatic of Apple and hates Linux … as many mozilla top guys ), Google , Microsoft or other corporate big fishes, what a pitty

David Naylor said on September 16, 2008, 6:57 pm:

Plenty of trolls here today… Sadly, we live in a legal world and Mozilla needs to *not* get sued.

user01 said on September 16, 2008, 8:14 pm:

Hey. OpenOffice not requires EULA. Pidgin not requires EULA. Ubuntu does not requires EULA. Whatever else not requires EULA. Firefox DOES REQUIRES EULA. The one and the only. How cool. That hardly can be considered user friendly move. And after all, Ubuntu bundles with ton of software BUT only Firefox allows such levels of annoyance. The only program with such nasty behavior I know is Adobe Acrobat Reader. Proprietary adware program. Which somehow popular only in Windows since in Linux there is decent PDF viewers without ads and slightly faster than this bloated adware from Adobe (for example I like KPDF much more than Adobe crap and only bad thing is that it is NA for Windows but in Linux it clearly winner so Adobe crap for Linux is pretty unpopular).

Also, word EULA is probably one of most hated words in open source world. Ever. Surely, Mozilla can rather follow needs and demands of their crazy lawyers rather than respect their users. But who will be use it? Lawyers? Huh, funny :)

I’m thinking that lots of opensource zealots who helped Firefox to became popular by advertising and improving it it now really angry and feel like Mozilla fooled them. Used them to get popular. And … what? EULA? With ALL these restrictions? Such users always liked Mozilla for freedom and innovations. I have no idea why Mozilla is going to kill this impression and rather stick to (potentially very harmful in long term) view. But I’m pretty sure that now people realized than they need truly free browser. Which lacks THIS level of bureaucracy, idiocy and annoyance. Debian guys were able to see into future a bit further than anyone else. So there is IceWeasel. But … hmm… WebKit already got a huge work on it. Google recently proved that WebKit is not a joke but rather quite promising and powerful engine. I bet now almost all opensource people will turn to forging and polishing WebKit to have a really free browser. Is this begin of the end for Gecko? I’m unsure, but maybe it is.

As for me, I’d advocated and advertised Firefox a lot. But now I will think twice before doing so. Mozilla has proven that it is not really open source corporation and their long term goals are looking questionable for me since my (user) convenience valued lower than moron demands from lawyers. I do not need f…ng EULAs. I need free and innovative browser. If it worked for years as is, why now there is urgent need to screw anyone up? Just because Mozilla got popular enough and can afford it? Then, Mozilla will be strongly backslashed by angry zealots and let’s admit they have a good reason. I’m unhappy with such move too and will consider using another browser if all this crap means I will see (most hated) word “EULA” in Linux regularly. Surely I can afford it as there is nice browsers already and development of another good browsers surely will be fostered by such unfriendly Mozilla move.

user01 said on September 16, 2008, 8:25 pm:

And yeah. If you (yes, “you” not “we are”) REALLY need to display your crappy EULA why not to display it as webpage in browser? Slightly less annoying way.

Percy Cabello said on September 16, 2008, 9:43 pm:

Perhaps, but who will take that tiny risk? Who’s willing to insure Mozilla on this? I certainly wouldn’t.

Paranoia? Don’t think so. We don’t see germs but still wash our hands, right?

Metalstream said on September 16, 2008, 10:22 pm:

Ok, lets see…
The problem heres is not the quality of software… I don’t see anything bad that Mozilla protects itself on that thing, but the real problem is that Ubuntu Community can’t make any change to the code… because if code is different from original, then it couldn’t name that software Firefox. That’s the Mozilla point. And Mozilla needs an EULA but in another terms.

BTW I see this article was written by a Firefox’s fan… not from an objective point of view… this is just my feeling.

Thanks.

Percy Cabello said on September 16, 2008, 10:38 pm:

Just installed Pidgin on Windows, and yes it has a license agreement, the GPL, that users must accept in order to install it.

Mozilla EULA is the GPL, MPL, LGPL plus terms covering trademarks, web services (updates, add-ons, antiphishing, antimalware protection) and the privacy policy.

All the titles you mention have a license. Some of them may not show it to you. Is it a better policy not to show them?

It would help the discussion if people actually state why they believe an EULA is unnecessary, or how it disrespects Firefox users.

Just to clarify, I’m not saying the EULA is necessary. I am saying I can see why it may be necessary. At the same time I don’t see how it couldn’t be necessary.

Orlando made a point that chances that someone may actually sue are very small. But Mozilla has a chance to reduce it even more with the EULA.

There is at least a precedent that Mozilla will take the risk if there is no way to avoid it: Firefox 3.1 will bundle Ogg Vorbis and Theora open source codecs which has the potential of violating a submarine patent. There’s not much Mozilla can do to reduce risk and still it’s taking it.

Percy Cabello said on September 16, 2008, 10:43 pm:

There’s another suggestion. That may be enough.

Annoyance aside, can someone tell why it’s the EULA is not necessary?

Percy Cabello said on September 16, 2008, 10:51 pm:

That’s not the Mozilla point. The Firefox version that is bundled with Ubuntu is somewhat different than the one Mozilla makes available at mozilla.com: it includes a few bookmarks to Ubuntu sites, it is transformed into a Ubuntu package, it handles updates differently, add-ons are available through Ubuntu’s package system, and from what I’ve read, libraries linking is also different.

“BTW I see this article was written by a Firefox’s fan… not from an objective point of view… this is just my feeling.” If you mean a person very interested in the Mozilla project, yes you nailed it. If you mean a zealot, definitely not. How objective my point of view is… I do my best but that’s… well… subjective.

Metalstream said on September 16, 2008, 11:25 pm:

Well, I’ve always read your articles and I say that you have done a great job… but a little bit of criticizes if you are really interested on Mozilla Project, would be good so they can get better…

And an EULA is necessary but not on those conditions.

“That’s not the Mozilla point. The Firefox version that is bundled with Ubuntu is somewhat different than the one Mozilla makes available at mozilla.com: it includes a few bookmarks to Ubuntu sites, it is transformed into a Ubuntu package, it handles updates differently, add-ons are available through Ubuntu’s package system, and from what I’ve read, libraries linking is also different.”

That’s what I’m saying… and I don’t see any problem on that.

Cheers.

David said on September 16, 2008, 11:25 pm:

Pidgin does not have a EULA! Look at it again. It displays the GPL, followed by “Pidgin 2.5.1 is released under the GNU General Public License (GPL). The license is provided here for information purposes only. Click Next to continue.” As you can see, there is nothing to accept, and you are not accepting anything by clicking Next. Why? Because the GPL (and LGPL, and MPL) is a copyright license: this is a license that is binding upon you no matter what, whether you agree or not, whether you know about it or not. As soon as you’ve violated it, you are legally barred from distributing it, and are considered a copyright infringer by the software’s copyright holders. Not only that, but all these licenses already state the lack of any sort of warranty–making the EULA not needed for such disclaimers. And, in fact, these licences have already been held up in court, again making the threat of a lawsuit covered by the MPL/GPL/LGPL.

So, having a EULA (that requires agreement) not only violates Freedom 0, but is also completely redundant. I am not a lawyer. You really need to read the post to which Jakob linked. It’s quite informative, and dispels a lot of FUD you’re spreading here (which is a shame, since your blog is excellent).

Percy Cabello said on September 17, 2008, 12:14 am:

David, it seems it’s coming to what you expect about a EULA. I think the problem is that the general conception is that a EULA limits your right of use, distribution, etc. when in reality it is just an agreement on how the relationship with the vendor and its product will happen, what you as a user can expect of the product, and what the vendor expects from you (because yes there are obligations on the user part like you have to include the GPL if you intend to distribute).

You’re correct about Pidgin: it doesn’t require to accept the GPL to install it, it is just informative. So, you’d prefer to have this same behavior in Firefox? I guess it could be just as effective.

I’ve read the post and comments Jakob linked (thanks!). Yes it is informative. And it agrees that points 5 and 6, related to web services and web services are beyond the GPL and Mozilla may need to address them.

However it seems to me Mozilla’s point is not only covering its behind (which the licenses already do to some large degree) but also informing the user.

Mitchell has already announced that a license agreement will be worked out (http://blog.lizardwrangler.com/2008/09/16/firefox-without-eulas-update/), most likely won’t be called an EULA, but will address Mozilla’s web services and privacy concerns. It will also try not to “block the flow”, which is of course welcomed.

People on Slashdot are already feeling she’s just describing a EULA after all.

This funny comment makes a point on the trademark notification:
Do they honestly believe I can use Coke’s trademark anyway I want merely because Coke doesn’t come with a EULA?! – http://tech.slashdot.org/comments.pl?sid=965877&cid=25029365

Percy Cabello said on September 17, 2008, 12:28 am:

Regarding Freedom 0, I don’t see how it violates it: “The freedom to run the program means the freedom for any kind of person or organization to use it on any kind of computer system, for any kind of overall job and purpose, without being required to communicate about it with the developer or any other specific entity.”

You may run Firefox for whatever you want.

David said on September 17, 2008, 4:05 am:

Yes, informing is infinitely better than forcing an agreement. As was stated in Jakob’s link, in Fedora 9, Firefox opens up a new tab the first time it’s launched, where this information is displayed. You don’t actually have to agree to restrictions beyond the standard license(s) in order to use the browser. I find that to be the humane way of doing things.

Regarding Freedom 0, if you have to agree to certain restrictions in order to use the software, then you are potentially being limited in your use of the software. It depends on what those restrictions are, but, if they restrict your usage, there’s a problem. Do I have to start worrying that I’ve accidentally violated some implied contract by playing around with the anti-phishing features enabled? This sounds like something that should be discussed, and I haven’t seen any satisfying informative comment on this issue yet.

There’s also another Freedom-limiting part of Firefox that people seem unaware of: the logo. The logo is not licensed with the rest of the code. It’s All Rights Reserved. It’s also protected by trademark law. Making the artwork proprietary limits the four freedoms beyond trademark law’s (mostly reasonable, consumer-protecting) limits. So, to be more precise, I do not have freedoms 0-3 with Firefox. I do, however, have them with Minefield…maybe.

Björn said on September 17, 2008, 4:57 am:

“Mitchell Baker, Chairperson of Mozilla has admitted that it is silly that Firefox runs an EULA and an open source license.”

This is from: http://www.fudzilla.com/index.php?option=com_content&task=view&id=9472&Itemid=1

muisje said on September 17, 2008, 7:39 am:

The GPL gives already no warranty to the product. The EULA is not necessary.

Tu Linux said on September 18, 2008, 12:00 am:

Mozilla Firefox admite que EULA es defectuoso…

Lyes said on October 25, 2008, 7:08 pm:

You need just to use Iceweasel, developed by Debian teams, and you won’t care about EULA. You can also install Icecat from GNU ftp server. Why Mozilla insists with its licence. It has a product which is used more and more.

Kiss Firefox EULA goodbye - Mozilla Links said on November 6, 2008, 10:16 am:

[...] to show Firefox’s End User License Agreement on Firefox first start, the Ubuntu and other free software advocacy communities cried foul, because for some reason, stating the obvious (that Mozilla is not liable for whatever happens to [...]

A Future Less Litigious? « Jonas Bohlin said on November 6, 2008, 12:52 pm:

[...] I digress. All I really wanted to do was give a big hand to the Mozilla Foundation for getting rid of the Firefox EULA and to Ubuntu for forcing their hand! [...]

ELUA no more in Firefox « What I Think said on November 8, 2008, 4:59 am:

[...] Ubuntu to show Firefox’s End User License Agreement on Firefox first start, the Ubuntu and other free software advocacy communities cried foul, because for some reason, stating the obvious (that Mozilla is not liable for whatever happens to [...]