Alternative Licenses

[gdude2002]

As mentioned in Kord-Extensions/kord-extensions#311 - I'm looking at relicensing KordEx code to the AGPL, and providing binaries under both that licence, a commercial licence (that must be paid for) and a non-commercial licence (that may be applied for).

I think it's time to start thinking about the terms of each licence, to figure out what terms would make the most sense for the project, and also what best matches the wishes of our community without making too many compromises.

Notes

• Would not apply to source code or decompilations - forks will still be AGPL
  • I really want to encourage organisations to contribute to KordEx if it doesn't quite meet their needs, or at least raise issues so that improvements can be made for everyone in the ecosystem, not just for a single organisation
• Would only apply to binaries (and the contents of the binaries)

Unanswered Questions

• Should we leverage the existing Maven repo for licenced binaries?
  • Like, maybe it'd make sense to provide "licence keys" that are Maven access tokens, where the accessed repository contains binaries licenced with the corresponding licence?

---

Commercial Licence

Unanswered Questions

• What metrics will be used to gauge pricing?
  • Possibilities include total guild count, total user count (potentially per process?), total shard count, profits made using KordEx
  • It'd probably make sense to use a metric that KordEx can gather on its own, I imagine
• Once we have a metric, what pricing model should we use?
  • I'm thinking most likely monthly payments for a relatively low cost, likely starting with something like €10/month for the smallest projects and scaling based on the metric agreed upon

Requirements

• Organisations must have a public-facing presence (such as a website) that may be inspected without an account, detailing:
  • The name of the organisation
  • What their primary business or activity is
  • Their privacy policy
  • Their GDPR policy, showing GDPR compliance and including information on how to request your data, and how to have your data removed
• Organisations must provide the following (either publicly or privately):
  • A reliable way to contact them if there's a problem, ideally a non-public email address on their organisation's domain

Allowed

• Use of binaries (and their contents) without requiring consumers to be open-sourced
• Distribution of licenced binaries within the organisation, in a manner that requires authorisation - for example:
  • An internal Maven repo that either isn't exposed to the public internet, or requires a valid username and password
  • An internal file-sharing solution (including a cloud-based one) that may not be accessed without logging into a staff account

Disallowed

• Distribution of licenced binaries (and their contents) outside the licenced organisation, regardless of whether they're sold or given away
  • This also means that the organisation wouldn't be able to distribute their own wrapping libraries without requiring the consumer to provide their own licenced copy of KordEx
• Using KordEx to do things that are immoral or unethical (viewed through a progressive lens), such as:
  • AI-based content generation, where the media generated is either image, video or audio content
  • AI-based content generation, where the primary goal is to provide a "virtual friend", "AI companion", or similar
  • Crypto scams, NFTs, DAOs, or other cryptocurrency-aligned activities
  • Exploitative projects, such as hard-core gambling bots, pyramid/MLM schemes, etc
  • Generation, dissemination or execution of disinformation, hate speech, targeted harassment, etc
  • Projects that exist to put regular people at a financial disadvantage - for example, bots that automatically purchase high-demand items to resell them at a profit
  • Projects that may reasonably be considered tools of warfare, including weapons and weapon control systems, military communications, cyber warfare, etc.
• Using KordEx to do things that break Discord's Terms of Service or Community Guidelines
• Using KordEx to break local laws (outside a progressive activist context) - for example:
  • Bad: Making piracy tools, using KordEx to scam or extort people, or creating command bots for illegal botnets or malware
  • Good: Promoting LGBT+ rights in countries that legally discriminate against LGBT+ people

---

Non-Commercial Licence

This licence's terms match the terms of the above licence, with the following changes:

Unanswered Questions

• How should we really approach donations?
  • In my opinion, donations are a one-way transaction that doesn't provide the donator with anything more than a shout-out or access to beta testing.
  • Should we set a limit on accrued donations for orgs that aren't registered non-profits?
    Like, if an organisation is consistently making a certain amount of money above their operating costs, should we require they move to a paid plan?

Requirements

• Organisations may not be a country's government, or part of one
• Organisations may not use licenced binaries to make any form of income, except:
  • Donations (accepting money without providing anything in return) below a certain profit margin
  • Non-monetary sponsorships (for example, companies taking an advertising spot and giving free hosting services in return)
• Organisations must do at least one of the following:
  • Prove that they are a registered non-profit in a way that can be verified by a member of the public
  • Provide a public, transparent breakdown of their permitted income (for example, via Open Collective)

[gdude2002]

I've received a DM from a KordEx user, and they brought up a salient point - how do I deal with projects that meet the commercial licencing requirements but are organisationally located in an EU sanctioned country, such as Russia?

Let's say for the sake of example that someone living in Russia wrote a Discord bot using KordEx, and that bot includes media, text or resources supporting the LGBT+ community. The AGPL's requirement to open-source would put the developers in danger of fines/jail time for uploading anything supporting the LGBT+ community, and if they're providing paid services along with the bot, they'd need a commercial licence.

The commercial licence would solve the AGPL issue, but they wouldn't be able to pay for it due to the EU sanctions!

---

In this situation, I think it might be a good idea to have a third licence type, or to allow all organisations in sanctioned countries to apply for the non-commercial licence, which would need to include commercial-use exceptions for organisations in sanctioned countries.

Does anyone have any thoughts or ideas on this?

[gdude2002]

It might be best to separate the requirements from the licence itself - combine both licences into a single licence with a single set of terms, and then leave the requirements to obtain the licence separate, so I'd be able to, for example, provide the licence for free if needed without having to tie eligibility to the licence text.

In that sense, I'd be able to provide the licence at my discretion when a difficult situation crops up.

[gdude2002]

Closing for now as circumstances around the licensing change have, well, changed - the AGPL ain't the way to go. There'll be a new one soon!