Eclipse Foundation Blog

No, it's not a fork.

Theia reuses some components (like the Monaco code editor), but the reason it looks and feels a lot like VSCode is mostly that they decided to copy it.

They explain the reasons for creating a VSCode clone here [1]. In short, they don't consider VSCode to be fully open source, and Theia wants the code to be both free and unencumbered by Microsoft's licensing and proprietary code, and also available to commercial vendors to use as the foundation for commercial products. That includes an open extension system that isn't owned by anyone, unlike Microsoft's marketplace.

Secondly, Theia is two things. One is an IDE positioned to compete with VSCode and every other IDE out there. The other is as an extensible platform to build IDEs, either open source or proprietary. This is exactly the same strategy as the Eclipse platform, except built in web tech.

This earlier HN discussion has a lot more discussion [2].

I think the Eclipse people could have communicated all of this a lot better. When you put a VSCode clone in front of developers, your first task needs to be to explain how it's not a fork, and why it exists. The Theia site's front page [3] doesn't even mention VSCode by name.

[1] https://blogs.eclipse.org/post/mike-milinkovich/eclipse-theia-and-vs-code-differences-explained

[2] https://news.ycombinator.com/item?id=22738607

[3] https://theia-ide.org/

I think it is (sort of) and the best signal may be not a legal analysis alone but the actual shift in the enterprise-backed communities.

Ever since https://en.wikipedia.org/wiki/SCO_Group,_Inc._v._International_Business_Machines_Corp. Eclipse Foundation required what they call "Type B" IP scan for all projects (Eclipse F. is not just an IDE but a competitor to the Apache F.), essentially a deep scan of the code searching for any bits of GPL (our Eclipse project had a dojox dependency flagged because its MIT-licensed code contained a small snippet of GPL, that was the only time we got a rejection of a library). In late 2019, the change was made to make "Type A", a deep scan of the licenses only, to be the default (https://blogs.eclipse.org/post/wayne-beaton/updates-eclipse-ip-due-diligence-process).

To me it signals that the common sense in the enterprise community now is that there is not much risk in that scenario, worst case would be that the original IP holder can force you to remove their code if they convince the court the developer had no right to publish it as opposed to getting crazy amounts awarded. I think it is also judged that the likelihood and the amount of trouble are relatively small compared to full code scan of all deps transitively at all times (incl lost productivity).

TL;DR The EU is working on the Cyber Resilience Act (CRA) which will be voted on the 19th of July. The current wording makes it look like it will affect open source projects that receice donations; which have contribution from corporate developers; and might break coordinated vulnerability disclousure.

If you live in the EC area, there's a link on the blog to contact to MEP.

The blog also links to other posts from OSS organisations sharing the same concer.

* https://blogs.eclipse.org/post/mike-milinkovich/european-cyber-resilience-act-potential-impact-eclipse-foundation

* https://pyfound.blogspot.com/2023/04/the-eus-proposed-cra-law-may-have.html

* https://blog.opensource.org/the-ultimate-list-of-reactions-to-the-cyber-resilience-act/

More reactions on the same subject:

- From the Eclipse Foundation: https://eclipse-foundation.blog/2023/01/15/european-cyber-resiliency-act-potential-impact-on-the-eclipse-foundation/ and https://blogs.eclipse.org/post/mike-milinkovich/cyber-resilience-act-good-intentions-and-unintended-consequences

- From the Internet Society: https://www.internetsociety.org/blog/2022/10/the-eus-proposed-cyber-resilience-act-will-damage-the-open-source-ecosystem/

With more to come... This is a serious situation.