Here's a trivial example:

<svg height="100" viewBox="0 0 100 100" width="100" xmlns="http://www.w3.org/2000/svg">
   <circle cx="50" cy="50"  fill="#f00" r="50"/>
</svg>

That code produces this circle:

You could print that out with a kilometre radius and it would still be a perfect circle - unlike a traditional raster image which is just a grid of blocky pixels.

But suppose you wanted to freely share your SVG with others - and ensure that they also freely share it. What sort of "Copyleft" licence would you give it?

Creative Commons

The obvious choice seems to be a Creative Commons Share-Alike licence. SVGs are images. Images are creative works. Creative Commons is suitable for creative works. Job done!

But…

SVGs are not images. The are code which produce images. If we assume that an SVG is software, this entry in the FAQ becomes relevant:

Can I apply a Creative Commons license to software?

We recommend against using Creative Commons licenses for software.

[…]

Unlike software-specific licenses, CC licenses do not contain specific terms about the distribution of source code, which is often important to ensuring the free reuse and modifiability of software.

[…]

Additionally, our licenses are currently not compatible with the major software licenses, so it would be difficult to integrate CC-licensed work with other free software. Existing software licenses were designed specifically for use with software and offer a similar set of rights to the Creative Commons licenses.

At the end of that FAQ, they also say:

While we recommend against using a CC license on software itself, CC licenses may be used for software documentation, as well as for separate artistic elements such as game art or music.

So, that's a perhaps?

GPL

But let us assume that an SVG is a piece of media rather than software. Would it be suitable to use a software licence for it?

The various Gnu Public Licences have this to say:

Can I use the GPL for something other than software?

You can apply the GPL to any kind of work, as long as it is clear what constitutes the “source code” for the work. The GPL defines this as the preferred form of the work for making changes in it.

A photo JPEG might be derived from the RAW image file. In which case, the RAW is suitable for being GPL'd, not the resultant JPEG.

Similarly, the Photoshop file of a complex and multi-layered illustration would suitable, but not the outputted PNG.

An SVG can straddle both worlds. It's possible to build an SVG with layers, groups, and transformations, and then simplify it for output. You could edit the optimised version, but it's hardly the preferred format.

I read the GPL (so you don't have to) and right at the start it says:

The GNU General Public License is a free, copyleft license for software and other kinds of works.

(Emphasis added.)

But do they mean that?

Licenses for Other Types of Works

[…]

We don't take the position that artistic or entertainment works must be free, but if you want to make one free, we recommend the Free Art License.

But, as delightful as the Free Art License is, the FSF say:

Please don't use it for software or documentation, since it is incompatible with the GNU GPL and with the GNU FDL.

Is an SVG software or not?

I think so.

• It's written in plain text.
• It contains definitions, variables, and instructions.
• It can contain scripting.

That sure looks like software to me!

But, at the same time, the user experiences it as a graphic. An animated GIF, for example, contains a small amount of code-like data to say how long each frame should last for and when to stop running. Is a GIF software? Is the basic circle above software? How much code do you need before something becomes software?

Are SVGs Libraries?

Licences like the LGPL and MPL allow copyleft libraries to be integrated into non-free software.

A proprietary application could treat an SVG as a library by asking the SVG to render the output and then displaying that. A bit of a reach, perhaps?

What about embedded raster graphics?

Just to complicate things, an SVG can also contain raster graphics. That is, it is possible to embed a PNG, JPEG, or any other traditional image within an SVG.

In this case, the embedded image can be Creative Commons licenced because CC BY-SA is compatible with GPLv3.

When someone creates an adaptation of a BY-SA licensed work and includes it in a GPLv3-licensed project, both licenses apply and downstream users must comply with both licenses. However, Section 2(a)(5)(B) of BY-SA 4.0 allows anyone who receives the adapted material downstream to satisfy the conditions of both BY-SA and GPLv3 (i.e. attribution and ShareAlike) in the manner dictated by the GPLv3.

(Emphasis added.)

The barest of SVGs containing only an embedded image probably wouldn't count as software. But what if you started applying programmatic transformations to them? This SVG embeds an image and uses software to rotate it upside down.

<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="64" height="64">
  <image x="0" y="0" width="64" height="64"
    transform="rotate(180)"
    href="data:image/png;base64,iVB…" />
</svg>

Is that enough code to count as software?

Wisdom of the Crowds

I conducted a rigorously accurate public survey. Here are the results:

@Edent@mastodon.social

Terence Eden

An SVG is an image.
It is also executable code.

If you wished to make an SVG open, would you choose a Creative Commons licence or an Open Software licence?

---

Obviously CC licence, because…: (62)
62
Duh! It needs an OSI licence, because…: (5)
5
You're both wrong, it should be…: (3)
3
Either is fine.: (35)
35

---

Final Thoughts

Personally, I think SVGs are software. I understand the argument that they're suitable for Creative Commons, but I disagree with it. Even the simplest SVG is distributed in a way that its contents are executed by the computer.

While SVGs may be minified and stripped of comments, they still retain the essence of source code. I suppose you could try to obfuscate them, or package them up in a quasi-binary form, but I maintain the source is still viewable and editable.

If you choose to use a Creative Commons Share-Alike licence, it probably won't cause any harm. But given CC's reluctance to endorse its use on software, it probably makes sense to use a copyleft source-code licence.

It is, thankfully, surprisingly cheap! In part, that's because it is a relatively simple tech stack - PHP, MySQL, a couple of API calls to external services. It was designed to be as low cost while also being useful. Here's the breakdown:

Hosting - £171 per year

Our biggest expense but, I think, our most reasonable. Krystal charges around £342 for a 2 year contract. That includes unlimited bandwidth and storage, as well as the domain name. We have nearly 400GB of photos and bot scraping means we can use over 900GB of bandwidth per month - so Krystal give us a rather good deal!

Use this affiliate link and code EDENT to get a small discount.

Stadia Maps - US$20 / month

Geocoding is surprisingly hard to do locally. We need to transform latitude and longitude into addresses, and then back again. Stadia Maps cost about the same as our hosting! What's rather annoying is that we only use about half the API calls in our plan. We need to find a cheaper solution.

Mapping - Free!

When we used Stadia for drawing maps, we regularly ran over our quota. So we switched to OpenFreeMap which produces gorgeous interactive maps.

The service has been rock solid and very responsive to bugs on GitHub.

Logo - US$5

I'm not a good designer, so we bought a logo from The Noun Project and then coloured it in. Bargain for a fiver!

Image CDN - Free!

Although we have unlimited bandwidth with Krystal, we're only located in one region - the UK. WeServ. It's also pointless serving full resolution images to small screens.

So WeServ offers free image resizing and global CDNs. Personally, I'm not a fan of CloudFlare (their CDN partner) so I'm looking to change provider.

OCR - Free!

People don't want to type in the inscription of the photo, so we use Google Cloud Vision.

We send less than 1,000 requests per month - so we're inside their free tier. If we get more popular, that'll get more expensive. But I don't know of a local-first OCR which is as good as Google's. Sadly, Tesseract is rubbish for extracting text from photos.

Authentication - Free!

We don't want to store anyone's passwords. The free tier of Auth0 allows us to do social login for up to 25,000 monthly users. Which is more than enough for us.

Sadly, Auth0 don't support the Fediverse, so I had to build my own "Log-in with Mastodon" service.

As much as we'd like to run social login locally, we simply don't want to be responsible for securing users' details & API keys.

Software - Free!

As per the OpenBenches colophon we use a lot of cool FOSS. Small JS libraries, big PHP frameworks, and everything in between.

Income

Thanks to GitHub Sponsors we make a whopping US$3 per month!

Similarly, our OpenCollective Sponsors brings in about £3 per month.

Merchandising! You can buy OpenBenches branded t-shirts, mugs, and hats. That nets us about £20 per year

Call it roughly £80 income. OK, it is better than nothing - but doesn't even cover a quarter of our costs. Sometimes people give us a higher donation privately, which is also very welcome. These people are listed on our README.

Total

On the assumption that our time is worthless (ha!) and that we only rarely go over our providers' API limits, and we get in some revenue, the cost of running OpenBenches is less than £300 per year.

That's not bad for a fun little hobby. People certainly spend more than that on Funkopops, vaping, and mechanical keyboards!

Nevertheless, I'm always slightly worried that we'll go viral and have an unexpectedly high bill from our API providers.

I would love to be able to hire a proper designer to make the site look a bit nicer. I also want to be able to buy a modern iPhone so that I can test it in the latest Safari.

If you have any suggestions for cutting costs, or non-scummy ways to help us raise funds, please drop a comment below.

The problem is - Matrix is shit. Not just on a protocol level, but on an organisational level as well.

I joined Matrix at FOSDEM - the largest gathering of open source nerds in Europe. We were all encouraged to use it - every talk had its own channel, all the official comms came from there, I was even invited to a top-secret private channel for speakers. This was going to be epic! Viva la rèvölūçïón, right? Wrong.

It was dead. Even among the most seasoned geeks on the planet, most people preferred to use other services like Signal, Telegram, and Slack. Why? Because those other tools actually work.

Matrix has two official Android apps - one of which is old and unsupported, the other is new and doesn't work with many of the basic chat features.

I want to be absolutely clear about this - the company behind Matrix have put out an app which doesn't work with their own product! Lest you think I'm exaggerating, here's a typical view of the official FOSDEM speaker room, using the official Matrix app:

It was embarrassing. People would pipe up in channels and say "this doesn't work" only to be told they were using the wrong app and should go back to the one marked unsupported. So they left, never to return. Even in the large talks, where people were encouraged to use the official Matrix chat, most of the conversation happened on other platforms. It was just too hard to use Matrix.

A few thousands geeks, all used to recompiling their own kernels and participating in the Fediverse, and most thought that Matrix was too much of a faff.

After FOSDEM, I kept the Matrix app on my phone. Occasionally receiving a ping from some long-forgotten channel.

And then, one day, I got hit with the most vile spam. A dozen notifications suddenly appeared on my phone with abuse, torture, and transphobic slurs in them.

You can view the screenshot - but, fair warning, it is grim.

This shouldn't be possible. It doesn't take an expensive team of moderators to add some keyword monitoring. It doesn't take a massive AI model to work out that a stranger shouldn't be able to bombard users with multiple notifications. You don't have to sacrifice your dream of a decentralised future - you just need to care about your users.

This stuff is basic.

I moaned about it on Mastdon and was surprised to receive a private reply from the official Matrix account.

Please do not encourage the spammer by giving them a platform and propagating their spam; you may want to consider deleting your post.

This is classic victim blaming. It is my fault for giving the spammer attention. I am the one who needs to take responsibility and delete the evidence. I shouldn't warn people that Matrix is actively dangerous to use.

Bullshit.

Here's what I expected them to say:

"We're sorry you had such a bad experience on Matrix. Rest assured we're working hard to block these spammers - here's a link to show what we're doing. You can protect your account further by doing x, y and z. Once again, sorry and we hope we can win back your trust."

I'm not saying scrappy open source projects have to hire anodyne corporate communications specialists; they just need to have a little empathy.

But, no, just constant whining about how it isn't their fault and how I am the one who needs to change my behaviour.

This is pretty typical behaviour from the team. Find any post complaining about some aspect of Matrix and you'll see their instant woe-is-me replies.

So I deleted the app. I would have liked to have nuked my account but apparently that's not possible.

I'm not the only one who feels like this. Here's an epic post by Marius, which concludes:

Between the slow performance, the increasing amount of spam, the miserable web client, and the unfinished state of Element X, the Matrix.org network is not something I am willing to continue to recommend, especially to non-technical users. Normal people are simply tolerating it to communicate with idealistic nerds like myself who insist(ed) on using it.

Matrix just isn't focussed on users. I'm not talking about user-experience tweaks like which shade of cornflower blue to use - I mean basic user needs like apps that work and a way to combat spam.

There's a long list of ways the protocol contributes to a poor user experience. It almost seems designed without regard for how it will actually be used.

While the protocol may be conceptually interesting and their intentions noble, I'm not prepared to suffer abuse in the name of technical purity.

Open Source and Open Standards nerds like me ought to know by now that the protocol is the least compelling thing about a service. Who cares if your home is built using only Stallman-blessed tools, when the walls are full of rats?