Cryptographic Autonomy License

= "why we need a new kind of open source license for distributed P2P software". [1]

Description

Arthur Brock:

"Holochain’s license boils down to this: You can run Holochain as free and open source software with a couple of conditions:

• The source code of Holochain and any derivative works must be provided under compatible open source terms which include this condition and the following condition related to privacy of cryptographic keys.

• You only have permission for “public performance” of Holochain (including use of its APIs for running your dApp) if you preserve each end-user’s privacy and autonomy of their private cryptographic keys.

If the privacy of user keys is compromised, then so is the ownership of their data, as well as user’s control of their own copies of the software." (https://medium.com/holochain/understanding-the-cryptographic-autonomy-license-172ac920966d)

Discussion

Arthur Brock:

"I’ve never seen a software license invoke this kind of “public performance” clause, so it may stir up some controversy and make it challenging to get our license accepted by OpenSource.org; but it is the only way we’ve found to release Holochain with responsible protections for end-users.

Why Do End-Users Need Special Protection?

Suppose someone releases a cryptocurrency which promotes itself as a peer-to-peer app that is extremely easy to use. You just install it on your phone, tablet, or computer, and it leverages the power of cryptographic keys to sign transactions to and from your account/wallet. You can do direct transactions with other users without those transactions going through any centralized servers.

That sounds pretty normal so far, but this particular application generates the crypto keys for your account from a key-server controlled by the software developer. It turns out the developer ALSO has a copy of everyone’s private keys that control their accounts, and can spend anyone’s funds whenever they want. Would you consider this a valid approach for a decentralized cryptocurrency?

Holochain is designed to give end-users control of their identity, their data, and their participation. It accomplishes this by peer-to-peer validation rules for data integrity across a shared and sharded data store which is orchestrated by cryptographic keys. Most non-technical end-users of such software have no realistic way of knowing whether they are the sole controller of their cryptographic keys.

If the privacy of user keys is compromised, then so is the ownership of their data, as well as user’s control of their own copies of the software.

Okay, But Why Use that Weird Performance Clause?

Legally, our license can only protect the code that WE wrote. Our software is being licensed by a DEVELOPER to run their app (the currency, chat, or social network they just built) on top of Holochain. We are trying to say: The only valid way to use our code is if that developer’s END-USERS are the sole authors and controllers of their own private crypto keys.

It is hard to shoehorn appropriate controls into the legal frameworks available to us today. We can’t apply copyright protections to keys that our licensee’s end users create because we didn’t write them. So our attorney suggested a creative work-around leveraging the public performance dimension of copyright. You don’t need permission from a musician to perform their work in private, but performing in public is another matter.

A corporation might want to implement a serverless P2P Slack chat where the company still controls the keys, seeds, or revocation keys so that they could read everyone’s chats and private messages, post as if they were some person, or revoke someone’s keys and access. I see why a company might want to do that for their internal employees; and as long as they keep it internal, we probably can’t stop them.

However, if they want to run their online community, on a PUBLIC network such as the Internet, Holochain enables them to eliminate all server and infrastructure costs by having each user provide a tiny portion of server power. Now we might be able to assert some protections on behalf of those end-users to make sure they at least control their own data on their own device.

Avoiding False Security and False Advertising

We want Holochain apps to be trusted as maximizing end-user autonomy and control. As that starts to happen, we can’t let someone claim their software is a “Holochain” app if they are actually maintaining central control of end-user cryptographic keys. Otherwise, people will think they’re in control of their accounts, money, personal information, or communications without realizing, at any moment, someone could strip them of their autonomy via revocation keys or a master seed.

Frankly, we don’t see any way to freely share Holochain with integrity, if we do not ensure these protections for the people who are not technical enough to make this determination for themselves."