Kuhn: The Anatomy of a Modern GPL Violation

[Posted December 9, 2009 by jake]

Bradley M. Kuhn of the Software Freedom Law Center (and Software Freedom Conservancy) writes about the evolution of GPL violations on his blog. Originally, the violations were from vendors shipping free software tools for proprietary UNIX systems, but now violations have mostly moved into the embedded realm. "But, if you produce a mass market product based on BusyBox/Linux, some smart software developer is going to eventually buy one. They are going to get curious, and when they poke, they'll see what you put in there. And, that developer's next email is going to be to me to tell me all about that device. In my ten years of enforcement experience, I find that a company's odds of 'getting away' with a GPL violation are incredibly low. The user community eventually notices and either publicly shames the company (not my preferred enforcement method), or they contact someone like me to pursue enforcement privately and encourage the company in a friendly way to join the FLOSS community rather than work against it."

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 15:19 UTC (Wed) by sylware (guest, #35259) [Link]

"...encourage the company in a friendly way to join the FLOSS community rather than work against it."
Binary drivers do not work out as a friendly way.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 16:41 UTC (Wed) by HelloWorld (guest, #56129) [Link] (8 responses)

In my ten years of enforcement experience, I find that a company's odds of 'getting away' with a GPL violation are incredibly low.

That sentence doesn't make any sense, since nobody knows how many people got away with a GPL violation by definition.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 16:47 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link] (4 responses)

He is referring to known violations obviously.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 18:00 UTC (Wed) by gowen (guest, #23914) [Link]

Well, yes. But since we don't know what proportion of violations are even detected, Kuhn's statement is largely meaningless.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 18:56 UTC (Wed) by ledow (guest, #11753) [Link] (2 responses)

There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we know we don't know. But there are also unknown unknowns. There are things we don't know we don't know.

:-)

Due diligence

Posted Dec 9, 2009 19:54 UTC (Wed) by dmarti (subscriber, #11625) [Link]

There are violations that only come up in due diligence when a software company gets acquired. (There are services around this process, such as Black Duck's: Mergers and Acquisitions Require Technical Due Diligence.) Those violations get settled quietly, but what about all the companies that don't get acquired? Their "proprietary" code is likely full of cut-and-paste problems.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 21:43 UTC (Wed) by ncm (guest, #165) [Link]

What gets you are the things you think you know that ain't really so.

It's deeply significant that R. left that one out.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 9, 2009 19:54 UTC (Wed) by andrel (guest, #5166) [Link] (2 responses)

There are well established statistical techniques for estimating unknowns such as population size. One could use them to estimate the odds of a violation being detected.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 10, 2009 9:52 UTC (Thu) by dgm (subscriber, #49227) [Link] (1 responses)

Interesting. Excuse the off-topicness, but can you give some pointers (names or introductory articles) for the benefit of the less educated in statistics?

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 10, 2009 22:25 UTC (Thu) by andrel (guest, #5166) [Link]

A search on phrases like "estimating population size" or "estimating number of undetected crimes" should get you started.

Here's how we might estimate the number of devices using GPLed software. First collect a random sample of devices, say by buying randomly chosen products at Fry's. Then get one of Kuhn's smart developers to poke at each device in the sample to determine if it contains GPLed software. The percent of devices in the random sample using GPLed software is an estimate of the percent of all devices using GPLed software. Now find out the total number of devices on the market, either by looking it up in the trade press, or estimate it by counting how many devices are sold at Fry's. Multiply the two numbers.

Granted, this may not be easy to do in practice. But it could be done, and I wouldn't be surprised if someone has.

Kuhn: The Anatomy of a Modern GPL Violation

Posted Dec 15, 2009 12:59 UTC (Tue) by kpvangend (guest, #22351) [Link]

"And, that developer's next email is going to be to me to tell me all about that device."

Sure, that may be effective in the USA...
I suggest you contact gpl-violations.org if you live in Europe ;-)

And... I guess everybody noticed the timing of his post? One day before the SFLC filed the big suit against 14 embedded companies?
Coincidence? I guess not...