The problem is that this can happen at anytime. As a user of OpenSSL, I have no guarantee that a contributor won't, at some point in the future, decide to sue over this. Once that happens, I would have to remove their contributions from my copy [0], or risk being sued. Further, if enough time passes, and there are contributions under the new license, I would have to comply with both licences (which are incompatible).
The core problem here is not that they are changing the license. It is that it is now not clear what license is actually in effect; and it could very possibly end up being both.
The upside to this is that no one enforces these licenses anyway.
[0] Which might be a bigger deal in other contexts, for a security library, I should be staying up to date anyway.
The core problem here is not that they are changing the license. It is that it is now not clear what license is actually in effect; and it could very possibly end up being both.
The upside to this is that no one enforces these licenses anyway.
[0] Which might be a bigger deal in other contexts, for a security library, I should be staying up to date anyway.