FOSDEM: State of the GNUnion

The Free Software Foundation (FSF) has received criticism in recent months for its copyright assignment policies and for being slow in dealing with reported GPL violations. In a talk at FOSDEM on February 3, John Sullivan, the Executive Director of the FSF, addressed some of these issues. In his "State of the GNUnion" talk, Sullivan highlighted the FSF's recent licensing and compliance activities and described challenges that are important to the organization for 2013.

Licensing and Compliance Lab

Sullivan started with an overview of the members of the Licensing and Compliance Lab and its activities. The team is led by Josh Gay, the former FSF campaigns manager, and Donald Robertson, who has been handling copyright assignments for some time. While Sullivan helps to define the overall strategy employed for licensing in order to promote freedom, the team is supported by Richard Stallman, Bradley Kuhn (a Director of the FSF) and lawyers from the Software Freedom Law Center, in particular Aaron Williamson and Eben Moglen. Finally, there's a team of volunteers that helps out with questions that come in through the licensing@fsf.org address. Sullivan noted that it is important for the FSF to communicate with people about license choices and related topics.

The Licensing and Compliance Lab focuses on a number of areas. A big one is the production of educational materials about GNU licenses. It also investigates license violations, especially for code entrusted to the FSF. Finally, it certifies products that use and require only free software.

Licensing is important, Sullivan said, because all software is proprietary by default. The GPL grants rights to users and he believes that the GPL is the right license to boost free software adoption. He mentioned claims that the use of the GPL is declining, but criticized those studies for not publishing their methodology or data. His own study, based on Debian squeeze, showed that 93% of packages contained code under the GPL family. He noted the difficulty of measuring GPL adoption: does a package count if it contains any GPL code, or should you count lines of code? And what about software that is abandoned? Sullivan noted that his interest in GPL adoption is obviously not because the FSF makes money from licensing but because of his belief that the GPL provides the "strongest legal protection to ensure that free software stays free".

Sullivan highlighted a new initiative to create more awareness of GNU licenses. The lab has started publishing interviews on its blog to share insights about the license choice of different projects. Recent posts have featured Calibre and Piwik.

Compliance efforts and copyright assignment

The FSF collects copyright assignments in order to enforce the GPL, Sullivan said, but there are a number of misconceptions about that. He explained that the GNU project does not mandate copyright assignment and that individual projects have a choice when they join the GNU project. However, if a project has chosen to assign copyright, all contributions to that project have to be assigned to the FSF.

The FSF hears frequent complaints that the logistics of copyright assignment slow down software development within the GNU project. It has made a number of changes to improve this process. Historically, the process involved asking for information by email, then mailing out a paper form, getting it signed, and then sent back. These days, the FSF can email out forms more quickly. It also accepts scanned versions in the US and recently expanded this option to Germany after getting a legal opinion there. Sullivan noted that the laws in many places are behind the times when it comes to scanned or digital signatures. Having said that, the FSF is planning to accept GPG-signed assignments for some jurisdictions in the future.

Sullivan lamented that the FSF's copyright assignment policy is often used by companies to justify copyright assignment. He noted that there are significant differences between assigning copyright to an entity like the FSF and a company with profit motives. Not only does the FSF promise that the software will stay free software but it would also jeopardize FSF's non-profit charity status if they were to act against their mission.

One reason the FSF owns the copyright for some GNU projects is to perform GPL enforcement on behalf of the project. He discussed recent complaints that the FSF is not actively pursuing license violations, notably the issues raised by Werner Koch from the GnuPG project. Sullivan explained that this was, to a large degree, a communication problem. The FSF had in fact gone much further than Koch was aware of, but they failed to communicate that. He promised to keep projects better informed about the actions taken. Unfortunately, a lot of this work is not discussed publicly because of its nature. The FSF usually approaches companies in private and will only talk about it in public if no agreement can be reached. Also, if it comes to legal action, the FSF once again cannot talk about it in public.

The lab closed 400 violation reports in 2012, Sullivan said. Out of those, some turned out not to be violations at all, but the majority of violation reports were followed up by actions from the lab that resulted in compliance. He also noted that the FSF is planning to add additional staff resources in order to respond to reported violations more quickly.

JavaScript and non-free code running in browsers

Sullivan then went on to cover a number of challenges facing the free software world. Richard Stallman described the "JavaScript Trap" a few years ago, which is the problem of non-free code running in web browsers.

Sullivan explained that these days browser scripts can be quite advanced programs but "for some reason we've been turning a blind eye" to their typically non-free nature. The FSF is spending a lot of time on tackling this problem and has created LibreJS, which is an extension for Mozilla-based browsers. LibreJS identifies whether JavaScript files are free software, and it can be configured to reject any script that's not free.

In order for this to work the FSF developed a specification that web developers can follow to mark their JavaScript code as free software. Developers can either put a specific header in their JavaScript files or publish license information using JavaScript Web Labels. Gervase Markham pointed out that Mozilla uses web server headers and Sullivan agreed that LibreJS could be enhanced to support that method too.

Sullivan added that many JavaScript files are free software already, but that developers have to start marking them as such. They are working with upstream projects, such as MediaWiki and Etherpad Lite, on doing so.

Certification program

The FSF has launched a certification program to identify hardware that only uses free software. It wants to make it easy for people to care. Sullivan emphasized that the label has to be attractive and hopes it will cause manufacturers to respect user freedom more. He showed a different label similar in style to the warning note on a cigarette package ("This product may contain material licensed to you under the GNU General Public License") and explained that this "is not what we want to do". The actual logo (seen at right) shows the Liberty Bell along with the word "freedom". The first product to achieve certification is the LulzBot 3D printer.

User freedom

As an alternative to Android, Sullivan recommended Replicant—a fully free Android distribution—for those willing to sacrifice some functionality (such as WiFi and Bluetooth on Sullivan's mobile phone) for freedom. He also encouraged Android users to take advantage of the F-Droid Repository to download free software apps for their devices. F-Droid also provides the option to make donations to the authors of the free software apps.

Sullivan also briefly commented on UEFI secure boot. He said that while the FSF is obviously "annoyed by it", it is not fully opposed—there is nothing inherently wrong with secure boot as long as the power remains with the users. However, it's important to make a distinction with what he called "restricted boot". Restricted boot can be found on ARM-based Windows devices which lock down the device and don't give users any choice. This is obviously not acceptable, according to the FSF.

Concluding remarks

Sullivan gave an interesting overview of the FSF's recent activities and upcoming challenges it intends to tackle. He is aware of concerns that have been expressed by members of the GNU community in recent months and is keen to improve the situation. The talk showed that the FSF is working on many activities and that it hopes to improve and expand its work as funding allows.