An open letter to SCO

The SCO Group has made repeated claims that Linux contains code taken from proprietary Unix. On the basis of these claims, a $1 billion lawsuit has been filed against IBM, and letters have been sent to many Linux users warning that they may face legal liability. You have publicly compared the Linux community to thieves and liars. What you have not done is to back up your claims in any way, with the result that you have now been hit with legal notices for unfair competitive practices in two countries.

The Linux and free software communities take great pride in their ability to develop code which is inferior to none. They have no interest in stealing code from anybody; Linux hackers are not so dishonest, and, frankly, most of them believe that they can do a better job themselves. Linux is an implementation of a number of well-published standards, but it is an original work.

That said, if it turns out that there is stolen code in the Linux kernel (or elsewhere) the community very much wants to know about it. We would like to remove that code and find out how it came to be included in the first place. Anybody who turns out to have contaminated Linux with proprietary code will, to say the least, not be welcome in our community in the future. If this has happened, we want to get to the bottom of it even more than you do. We do not want it to happen again.

You have made grave accusations against our community and caused a great deal of concern in that community and beyond. You now owe it to us to back up those accusations.

You need not - at this point - reveal any proprietary code of yours. But you owe it to us to point out which code in Linux is, by your claims, stolen from you. This code, by virtue of having been distributed by many (including you) in source form, can no longer be held to be confidential; SCO's claims to that regard are unconvincing. You will not violate any confidentiality by simply indicating which code you are taking exception to.

SCO claims that the Linux community would use any such disclosure to remove the evidence ("That's like saying, 'show us the fingerprints on the gun so you can rub them off.'" - Darl McBride in the Wall Street Journal). This claim, too, is unconvincing. The development history of Linux is public and cannot be erased; all the evidence you need can be found on SCO's own distribution disks. There is no way to "rub off" those fingerprints. Yes, the Linux community would quickly remove any code that was shown to be proprietary, but that would not change the evidence for your case and you know it.

Making a demonstration for a limited number of reporters under NDA is inadequate. Your NDA excludes the people who can best make judgements on the origins of code and prevents the development community from addressing any wrongs that may have occurred.

Instead, if you point out the code the Linux community will track down its origins far more quickly and effectively than your lawyers ever could. Your refusal to do so only suggests that you fear exactly that: a careful investigation could show that any common code comes from a freely available source. If your claims are honest and legitimate, you owe it to the community to back them up.

If SCO is serious about its claims, it is time to show some integrity and expose those claims to general scrutiny. Please, SCO, show us the code.

We did actually get a response back from them. Here's SCO's statement:

An SCO representative has since stated that the offending code is in the Journaling Filesystem (JFS), NUMA, and SMP support. JFS is an obvious, large contribution from IBM, and, though it originally comes from OS/2, it could conceivably contain some of SCO's code. JFS is good stuff, but its loss would affect very few Linux users.

The initial NUMA support was contributed by Kanoj Sarcar, then at SGI. IBM has since improved that code, of course. It is well known that Linux SMP support was initially helped by the company then known as Caldera. It has since seen work by a great many people. It is conceivable, though improbable, that a significant amount of proprietary code could have been sneaked in somewhere.

But, without knowledge of the code that SCO objects to, it will be impossible to independently verify whether any of it has been copied or not. SCO continues to hide behind the "confidentiality" of code which has been publicly distributed, with the result that nobody can ascertain whether its claims have merit or not. Perhaps that is the point.