Two simple CE-LGPL lincensing questions

RE: Two simple CE-LGPL lincensing questions

2013-10-22T16:22:39Z

Hi David,

Thank you for the quick and detailed answer! We will examine the CE from security point of view also, alongside with the licensing question.

Istvan

RE: Two simple CE-LGPL lincensing questions

2013-10-22T02:39:27Z

LGPL issues are not going to be your problem, so set them aside.

CE is intended to demonstrate what Liferay can bring to your organization, showing single signon capabilities, consistent theming, ...

But CE is not intended for internet hosting. It is not patched enough and security and other vulnerabilities abound. You can get away with using it in an intranet or extranet scenario, but it is just not secure enough for an internet-based system.

Now in some cases this may be just fine. If your 'service' is, say, a recipe trading site or something, the lower level of security/patching/etc. may not be a big deal at all, in which case you're back in the LGPL issues.

But for anything more sensitive (banking, some sort of shopping site, health care or other PCI information), CE is not going to be your target platform. You're going to need to step up to EE for your site in order to get the security releases and patchfixes.

To get back on point, LGPL is not an issue if all you're doing is hosting a website using Liferay. It is an issue if you're somehow repackaging or reselling any part of the Liferay code in any way.

Note that I'm not a lawyer nor do I play one on TV, and you should always consult a lawyer when you're talking about licensing issues because only a lawyer will be able to fully evaluate your use of Liferay and whether you are exposing yourself or your company through some sort of violation.

Note that regardless of any other answer you get here on the forum, the absolute only one you should consider is the poster that says the only answer is to consult a real attorney.

Two simple CE-LGPL lincensing questions

2013-10-21T21:31:30Z

Hi,

We are considering starting using Liferay CE at my company but I got lost in the tons of LGPL licensing issues/questions during reading the forum.
I have two basic questions, I hope somebody can help me:

1) If we create an application based on Liferay CE (suppose we modify the core of it etc... and that the strictest LGPL conditions apply to us), and we will be the only one who install and run it, on a dedicated server, and users can subscribe to our service provided through the Liferay based application, the users pay a monthly fee - is this case a "distribution"? Should we provide the source code to anybody? After all, we would not give even a single file (installer etc.) to anybody, just providing the service, the users could register, use the system and they would pay to us for our service.

2) If we should provide the source code to somebody, then to whom? To the users (who do not know a thing about programming)? That would be strange.

If anybody has any comments about the model I described above please feel free to share it.

Thank you in advance

Istvan