Unclear about the License

[sofrosune]

The project is not clear about the license(s) of the source code. For instance, ther is no LICENSE file. Yes, some files begin stating the license of the file, but not of the entire project.

One could assume that all code excluding branding is released under the MPL 2.0, or that it follows the same licensing and restrictions than Pale Moon. But in a matter like this (legal), it's better not to assume anything.

I believe the project needs to be clear, unambiguous about it, both in the source code and in the website (compare Pale Moon). This will also help contributors to know what kind of project this is. (a README would be good as well.)

[athenian200]

Honestly, this is one of those annoying "adult" tasks associated with having a project that I've been dreading dealing with, because I wonder if it's okay to link to Mozilla's copy of the MPL, do I have to go out of my way to host it on my site, do I have to draw up my own redist license like Pale Moon?

The only thing I can say for sure is that the source code is all intended to be MPL, but the branding is mine. I haven't really given much thought to a binary redist license... but that's the part I have down so far.

Also, while looking at Pale Moon's LICENSE file, I noticed a few odd things:

This URL doesn't seem to lead to anything: http://www.palemoon.org/licensing.shtml

And it also fails to note that toolkit/content/license.html is in the platform directory with UXP, rather than in the Pale Moon directory with the application itself. So that's already a couple of things I will have to revise when it comes to using that for Epyrus.

Anyway, here's what I have so far:

https://repo.palemoon.org/athenian200/e ... er/LICENSE

[Moonchild]

Epyrus' about box has a link to its internal about:license which lists all the applicable licenses.

[Moonchild]

Also, while looking at Pale Moon's LICENSE file, I noticed a few odd things:

This URL doesn't seem to lead to anything: http://www.palemoon.org/licensing.shtml

And it also fails to note that toolkit/content/license.html is in the platform directory with UXP, rather than in the Pale Moon directory with the application itself. So that's already a couple of things I will have to revise when it comes to using that for Epyrus.

Thanks for reminding me about this. I've updated it to fix the references

For our code base, the platform is a mixed license situation with a mix of compatible copyleft licenses, primarily the MPL 2.0 (I've explained some things on the website in https://www.palemoon.org/legal.shtml) with a smattering of Apache, MIT, BSD and other licenses throughout, also dependent on how the base was configured when building, which wis why in general it's better to not use a legacy plaintext LICENSE file but rather the internal about:license schema in a compiled binary to get a better overview for a final application, although the more complete license with all the conditionals is of course better if you're asking purely about the source code license.

By the way, Athenian, if you need help writing licensing text, just ask.

[sofrosune]

Epyrus' about box has a link to its internal about:license which lists all the applicable licenses.

I can't believe I missed that, this is great. I wonder if the file used to render about:license, which is in the UXP source code, is being extended by the projects built on top of it, when those projects include non-MPL software.

Anyway, here's what I have so far:

https://repo.palemoon.org/athenian200/e ... er/LICENSE

Nice, it's a good start. Where is the Hermopolis branding located?

Off-topic:
Also, I'm glad you replied. I thought you wouldn't because I sent you a PM about this last week. Did you receive it by any chance?

By the way, I found some "funny" things in the about box:

• It states:

  Epyrus is designed by athenian200, a global community [...]

• The Privacy Policy link sends you to Thunderbird Privacy Notice, a page which was last updated on May 9, 2025.
• In about:license it says

  Binaries of this product have been made available to you by the Mozilla Project [...]

• In About Your Rights:

  Mozilla does not grant you any rights to the Mozilla and Thunderbird trademarks [...]

  and has a link to Mozilla's trademark policy.

[athenian200]

Off-topic:
Also, I'm glad you replied. I thought you wouldn't because I sent you a PM about this last week. Did you receive it by any chance?

Yes, I saw your name on it, but I was preoccupied with other things and didn't read... honestly, now I kinda wish I had replied because having all this out in the open and me feeling obligated to address each thing whether I am in the mood or have time or not is... not ideal. I'm sure in that context I could have told you how long I thought it would take. LOL. But it is what it is. You may have accidentally (probably not intentionally, this seems like an attempt to help) created a situation that actually puts legal obligations on me to address all this quickly or pull down my binaries... I'm not sure at this point. But being served notice and me acknowledging it could mean the clock starts on me having to either pull down binaries or fix everything. Though I may just be paranoid.

I'm now scrambling to try and figure out how this embedded license file works, those links at the bottom that were pointed out are the one thing I never checked for Mozilla references and now I feel like I'm going to have to rush out another emergency release... I really wish I'd never bothered with Epyrus sometimes, there's too much licensing, release engineering, and adult stuff that I find as tedious and unpalatable as the real-life tasks I can't perform consistently that keep me from holding down an actual job. Not mad at you, just mad at how much this project demands of me for a result I've never been happy with from the day it started.

That LICENSE file in the repo, granted I wasn't too worried about that not matching up, but if there's one embedded in the binaries that doesn't, I have a bigger problem.

EDIT: Just decided to remove all downloads of Epyrus until I get this resolved. Releasing binaries is such a legal minefield that I'm too afraid to leave them up, especially when I've been served notice of the issues. I know there's certain people who will be all shocked and upset about "a lapse" with the implication that I need to "keep this going smoothly," but this was never that kind of project and I never had that much to give to it. I'm not Moonchild and I'm not... you-know-who. This kind of stuff isn't what I'm good at and I don't like dealing with it at all. And I was just handed a mountain of it (not upset with you, it would have been worse if Mozilla legal had showed up to take me down) to wade through that I should have had handled before ever launching this in the first place. This feels like having to appear for jury duty or go to the DMV... and miss work or appointments or other plans because you can't avoid it.

[sofrosune]

I did not expect that response!

athenian200, if it helps you to be less worried, pretend that this thread is just another one of the many that this forum has, and that nothing has changed in the expectations of the world towards Epyrus. Trust me, I am not an authority waiting for you to do any of this soon, or before a deadline. I am a regular user from a far country next to the Antarctic.

The way I see it, it doesn't matter that you do this quickly, only that you plan to do it.

You could just copy what Pale Moon does, if that simplifies things.

[athenian200]

I did not expect that response!

athenian200, if it helps you to be less worried, pretend that this thread is just another one of the many that this forum has, and that nothing has changed in the expectations of the world towards Epyrus. Trust me, I am not an authority waiting for you to do any of this soon, or before a deadline. I am a regular user from a far country next to the Antarctic.

The way I see it, it doesn't matter that you do this quickly, only that you plan to do it.

You could just copy what Pale Moon does, if that simplifies things.

That is reassuring, that at least you in particular are not waiting for me. I kind of figured you were just trying to help... the anxiety is admittedly more because of bad past experiences and not really knowing exactly who else outside of the forum might be monitoring this thread and whether they will be less forgiving about involving the authorities and/or Mozilla legal. That's why I'm glad you found it, and not someone who actually wants the project taken down.

EDIT:

https://repo.palemoon.org/athenian200/e ... c6e6923114

This is the big red flag that made me want to take down the binaries for now. It was effectively a claim that Mozilla was making binaries of Epyrus available to people, which is not true and could be seen as misrepresentation on my part. Should be able to put out another release soon, I think that was the only issue really bad enough to require me to immediately pull them, if it had just been the others I likely would have just fixed all this as I went.

[Moonchild]

A bit of an overreaction there but I understand where you're coming from. In all fairness what was pointed out is true: your notice given triggered the right response in that you would fix it, sometime and preferably soon.

Just because someone points this out casually doesn't mean a "clock starts running" though, and you didn't have to take down the binaries as you did, since it isn't like you received a cease and desist from Mozilla (which is where you would need to take immediate action), however, doing so anyway while you correct a textual oversight in the application is naturally your choice and shows vigilance.
So, you didn't have to, but a mark of excellence, legally speaking, that you did!

[athenian200]

So, I think I've almost got it in a state where I could release binaries safely again...

I ran into another interesting landmine that isn't directly related to licensing confusion with me accidentally misrepresenting myself as Mozilla, but falls in a very similar category. Essentially, it turned out that buried somewhere in a service agreement that isn't obvious at all how to make visible... there's a choice-of-law clause that basically says any disputes involving the add-ons server or the updates server would be governed by California law. Worse, it doesn't say Mozilla, it actually is configured to use my application name and branding so it would have looked like I wrote it in there. When in fact Mozilla left it in there. The reason why that's bad is... well, California law is very, very consumer-protection heavy and would give people all kinds of excuses to sue the person providing the Epyrus add-ons server and update server. Which... is not even me. The result of these hidden terms that are not even easy to find without clicking on a link in "About your rights" was essentially... people could, in theory, sue Moonchild under California law if they were not happy with how he was running the Epyrus add-ons server, without even realizing it.

I sort of changed that to Delaware law instead of California law in a panic because I know the corporate default is actually Delaware for a reason... you get more predictable outcomes and they tend to limit liability in a way that's friendly to corporations and LLCs, which is why so many places incorporate there and/or use them in a choice-of-law clause. I don't know for sure if that was the right choice, or if I should have just deleted the choice-of-law clause, but my instinct said Delaware was the safer choice.

[Moonchild]

I don't recall seeing that. I know there are a few third party libraries licensed differently, but the platform and application licenses should not fall under California law, at all.
Is that specific to the mail client?

[jobbautista9]

It's in about:rights, under the terms for "Epyrus Web Site Services":

Epyrus also offers optional services, such as the add-on update service; however we cannot guarantee they are 100% accurate or error-free. More details, including information on how to disable the services, can be found in the service terms.

[clicking on "service terms" shows the following text below]

Epyrus offers optional services ("Services"), such as the add-on update service, that are available for your use with this binary version of Epyrus as described below. If you do not want to use the Services or the terms below are unacceptable, you may disable the add-on update service by opening the application preferences, selecting the Advanced section, followed by the Update tab, and unchecking the options for "Automatically check for updates to".

[...]

6. These terms are governed by the laws of the state of California, U.S.A., excluding its conflict of law provisions. If any portion of these terms is held to be invalid or unenforceable, the remaining portions will remain in full force and effect. In the event of a conflict between a translated version of these terms and the English language version, the English language version shall control.

[athenian200]

I don't recall seeing that. I know there are a few third party libraries licensed differently, but the platform and application licenses should not fall under California law, at all.
Is that specific to the mail client?

Well, Pale Moon itself has a similar section, but it actually lists Sweden instead of California:

Sweden.png

The change was apparently made here:

https://repo.palemoon.org/MoonchildProd ... 09e9ffeab8

Which means that this was changed for Pale Moon at some point, but I never changed it for Epyrus originally because I didn't know it was there in the first place... Mozilla hid it three links deep in a section I didn't look closely at. And my repo apparently had its own aboutRights.dtd.

In my repo, I changed it to Delaware for now while deciding what to do, because I knew for sure California wasn't the right choice, and my Dad seemed to agree Delaware was a better choice, but had no idea at the time what MC had picked for Pale Moon. I haven't done another release yet, though, in part because I'm now thinking about a few key points.

Essentially, should I have this as Sweden like Pale Moon does? And can I even legally pick a jurisdiction outside my own country as my choice-of-law as a US citizen? I know I can pick Delaware or my home state safely, but not sure about any other jurisdiction. I could in theory pick Sweden if I had a company there or a contract with a Swedish company, if I understand the law correctly. But I'm kind of in a bind here because I'm worried if I do pick Sweden, then that might make the contract unenforceable because I don't have legal standing to pick a foreign country as a choice-of-law, but if I can't or don't pick it, then it may accidentally be exposing you to US legal obligations.

It... kinda seems like that one nasty little clause made this go from a simple question of making sure I don't appear to have impersonated Mozilla, to now having unresolved international legal questions surrounding updates and add-ons for Epyrus. Granted, Delaware is much less risky than California by US standards, but I have no idea how any of that compares to Swedish legal protections for a server operator.

The awkward part is realizing I never would have noticed this if someone hadn't come along and told me that I'd missed some stuff buried off in about:license and about:rights while removing Mozilla branding.

There is also the possibility that I'm worrying too much about this and that pretty much all jurisdictions in question would see that we aren't charging any money, that the service is "best effort," and basically throw any attempt to litigate out.

[Moonchild]

Well, since this section deals with services you aren't actually operating, it would actually suffice just fine to mention that it relies on "third party services that are subject to their own licensing" and leave it at that. I decided to pull the preferred legal framework and venue explicitly to my country of residence so I wouldn't have to deal with any litigation requiring me to go abroad and be subject to foreign law as a result (not that I ever expect it to become a problem). I could have also chosen my country of citizenship, or the country where the server is hosted... The reason Mozilla chose California is, I'm pretty sure, also because their legal bulwark will be in Silicon Valley.
But since the Epyrus add-ons service isn't actually operated by you, I don't even see why you'd have to pick a venue (unless you really want to). It's fine to not have that clause at all and leave it up to the legal system to suggest a proper venue, (which you can always motion to have changed if litigation is a problem), or, as I said, let them be deferred to the third party (if you ever decide to change it to a different hoster, it can be in effect without you needing to change anything in the license)

[athenian200]

Yeah, I think that might be best, just mention third-party services, and leave it up to the legal system to pick the venue. That was my other idea, and I think it may well resolve a lot of the complexities.

[athenian200]

thirdparty.png

So, here's what it looks like now... I think it looks okay, hopefully the rest of it is minor enough to be addressed later. This is the last one I was semi-worried about.

[Bilbo47]

Agree; for services you're not hosting nor operating, you're not responsible / liable. Just mention that any legalities belong to whoever controls those services (and not to users nor clients of those services, which you and EP are). The big boys get away with practically no consequences, so it's only proper that the little guys bear the same level of exposure as their benefit from the effort - which is to say monetarily none, after expenses.