Enclosure by Good Intentions

by Leo Gaggl • WOL Notes

Every few years a piece of infrastructure I care about gets a new licence, and the reason given is some version of the same sentence: we need to stop the big players strip-mining this. I have written that sentence myself, more than once. The instinct is sound. A digital commons that nobody defends gets enclosed, and the people doing the enclosing rarely announce themselves.

So when Mark Qvist, the person behind the Reticulum mesh networking stack, replaced its MIT licence with a custom one built to keep the project out of corporate AI training sets and out of weapons systems, I understood the motivation completely. I just think it was the wrong move, and that the tool he actually needed was already on the shelf, tested, and free.

What actually changed

On 15 April 2025, one commit landed in the Reticulum repository with the message “Updated license”. It touched 51 files. It swapped the header MIT License, unless otherwise noted for Reticulum License, and it added two conditions a standard MIT licence does not have:

The Software shall not be used in any kind of system which includes amongst its functions the ability to purposefully do harm to human beings.

The Software shall not be used, directly or indirectly, in the creation of an artificial intelligence, machine learning or language model training dataset, including but not limited to any use that contributes to the training or development of such a model or algorithm.

The same commit made a smaller change that is easy to miss. Every file header went from Copyright (c) 2016-2025 Mark Qvist / unsigned.io and contributors to Copyright (c) 2016-2025 Mark Qvist. The words “and contributors” came out in the same edit that made the code non-free.

The problem it is aimed at is real

The threats behind the licence are not imaginary. Qvist has been clear about what worries him: a hosted service that swallows the code and gives nothing back, a corporate model trained on the codebase and then sold as a black box, a flood of machine-generated repositories filed as patent prior-art to muddy the field. He describes the goal as encouraging “real freedom, in a way that is not naive”. Anyone who has watched an open project get metabolised by a platform knows naivety carries a cost. Reticulum is also not a toy. People run it over LoRa and packet radio for emergency and off-grid communication, so “someone degrades the network” is a safety question, not an inconvenience.

The tool was already on the shelf

Here is the part that frustrates me. A licence built to stop a hosted service enclosing a codebase already exists, has existed since 2007, and runs in production under projects far larger than Reticulum. It is the GNU Affero General Public License, version 3.

Plain GPL has a gap that cloud computing drove a truck through: run modified code as a network service instead of shipping a copy, and the duty to publish your changes never triggers. AGPLv3 closes that gap. Its network-use clause (section 13) says that if users interact with the software over a network, they must be able to get the corresponding source. That is the anti-enclosure term, written by lawyers, tested in the wild, understood by every company’s legal department. I walk through the mechanics of it in a companion piece, explaining why my own Flutter project uses it.

This is not a fringe pick. Grafana relicensed its core projects from Apache 2.0 to AGPLv3 in April 2021 for exactly this reason. Nextcloud, Mastodon, Immich, and MongoDB before its later pivot all made the same call. AGPLv3 is approved by the Open Source Initiative, endorsed by the Free Software Foundation, accepted into Debian, and compatible with the rest of the GPL family. It has been argued over in real courtrooms and held up. If the goal is “a company cannot take this private”, AGPLv3 is the strongest instrument that still counts as open source.

What a custom clause costs

The moment you add a “not for harm” or “not for AI” condition, you have left open source behind, and not on a technicality. The Open Source Definition rules out licences that discriminate against people or groups, or against fields of endeavour. The Free Software Foundation’s freedom zero is the freedom to run the program for any purpose. A licence that names purposes it forbids fails both by design.

We have seen this film. In 2002 Douglas Crockford added a line to the JSON licence: “The Software shall be used for Good, not Evil.” It was half a joke. It has caused two decades of headaches. Debian will not ship it, Google Code stopped hosting projects that used it, and lawyers at large companies still send formal requests asking permission to be evil so they can use a JSON parser. The lawyer Heather Meeker calls this whole category “ethos licensing”, and its track record is not encouraging.

The practical costs stack up fast. Reticulum is now marked non-free by Debian, kept out of the main F-Droid repository, and awkward for Alpine and NixOS. It cannot be combined with GPL-licensed code, which breaks integrations that used to work. It is not eligible for most open-source grant funding. And the clause that triggered all of this is very likely unenforceable. As one Debian developer put it in the project’s own discussion thread, people who build harmful systems are not going to be stopped by a term they were always going to ignore. You pay the full price in distribution and collaboration, and you get an AI-training restriction a determined actor routes around in an afternoon.

The harm clause has a sharper problem still, and it is not hypothetical. The earliest Rust implementation of Reticulum, and still the most established, is reticulum-rs, built and maintained by Beechat Network Systems: a defence contractor founded in 2020, whose Kaonic tactical mesh radios are sold for military command and control, drone and autonomous-systems networking, and operation in “austere, contested environments”, and which has since been selected for NATO’s DIANA defence-innovation accelerator. It is MIT-licensed, it is an independent implementation of a protocol that is itself public domain, and its repository predates Qvist’s harm clause by nine months. The one restriction in the licence carrying real moral weight is aimed squarely at a use that took up Reticulum early and enthusiastically, through an implementation the licence was never in a position to touch.

Credit where it is due: there is one real gap AGPLv3 does not cover. It does not stop someone training a model on the code, and it cannot, because restricting the purpose you put software to is the one thing copyleft will not do. Qvist’s instinct that the standard licences leave that door open is correct. His fix trades a door nobody has worked out how to close for the loss of every distribution channel and every downstream collaborator who needs a known-good licence. That is a bad trade.

The fragmentation tax

The cost is not abstract. There is now a Reticulum_CE, a “community edition” fork that exists mainly to carry a redistributable licence. There is a Sideband_CE doing the same for the messaging client. There is RetiNet, an AGPL fork of the Python stack. There are side-loaded F-Droid repositories so people can install the apps at all. Every one of those is real maintenance work, done by volunteers, spent entirely on the problem of being allowed to share the software.

Meanwhile, as One Protocol, Many Engines covered, four independent teams have rebuilt Reticulum from scratch in Rust. The two that put enclosure resistance first, Leviculum and the rsReticulum stack behind Ratspeak, both chose AGPLv3. The one built by a defence contractor chose MIT. The one built for emergency-services agencies chose the Eclipse Public License. Every one of those teams looked at the same problem Qvist looked at, and none of them reinvented the licence. The people rebuilding the project to keep it alive have already answered the question, and the answer was the boring, tested one.

A licence is not governance

A 'keep out' sign on open Dartmoor moorland, by chrisinplymouth, on Flickr
"keep out" by chrisinplymouth (CC BY-NC-SA 2.0)

Underneath the licence choice sits a harder problem, and it is the one this site keeps coming back to: a system can be decentralised in its architecture and completely centralised in who decides things.

Relicensing a codebase other people contributed to, under MIT terms, with a single unilateral commit, is itself a small act of enclosure. The contributors made their work available under one set of expectations, and those expectations were rewritten without them. The “and contributors” line coming out of the headers in the same commit is a fitting detail, whether or not it was deliberate.

The pattern shows up off the codebase too. In late August 2026, after a badly-behaved crawler hammered his NomadNet git node with tens of thousands of requests, Qvist removed the volunteer moderator of the Reticulum subreddit, deleted roughly three years of posts, and closed it with a notice that ended “Well done, vibecoders. You ruined it for everyone.” Reddit reversed it within days and the network itself never went down. Around the same window the project’s Matrix room shut down and the GitHub issue tracker was hidden. One community member’s summary: for a supposedly decentralised network, the founder holds and uses a lot of centralised levers.

None of this is meant as a pile-on. A decade of unpaid solo work on hard infrastructure earns a lot of patience, and burnout is a real thing that happened to a real person. The point is structural. The Reticulum Licence is presented as a shield for the commons, but a commons defended by one person’s decree, backed by one person’s willingness to pull the plug on shared spaces, is not a commons yet. It is a project with a generous licence and a single point of failure.

What forward looks like

If you are stewarding a digital commons and you want it to stay one, the licence decision is close to solved. Pick the instrument that has already been through the lawyers and the distributions. AGPLv3 does the anti-enclosure work. If your users are European public bodies, the EUPL does similar work with better interoperability across other copyleft licences. Either way you get a licence Debian ships, grant funders recognise, a downstream developer can build on without a call to legal, and a court has already read.

Then spend the effort you saved on the part that is actually hard: governance that survives the founder losing interest. A contributor agreement so relicensing is a community decision and not a commit. A named group that can merge, release, and moderate. A written answer to “what happens when the maintainer walks away”, because for Reticulum that stopped being hypothetical in December 2025.

The commons is not protected by a clause forbidding bad uses. It is protected by how many people can fork it, ship it, and keep it running without asking anyone’s permission. Reticulum’s licence made that number smaller. The intention was to guard the commons. The effect was to fence off a piece of it.

Related reading: One Protocol, Many Engines on the four independent Rust implementations and the licences they chose, The Decentralisation Paradox on decentralised architecture with centralised control, and Don’t Let the Asphalt Bury the Garden on AI and the enclosure of open work.

Sources

←One Protocol, Many Engines: Reticulum's New Rust Implementations

Comments

Be the first to comment! Reply to this post from your Mastodon/Fediverse or Bluesky account, or mention this post's URL in your reply. Your comment will appear here automatically via webmention.

Follow this blog on Mastodon at @gaggl.com@web.brid.gy or on Bluesky at @gaggl.com