Bruce Perens: Statement on Busybox Lawsuits [LWN.net]

Bruce Perens, creator of Busybox, comments on Busybox related lawsuits (for GPL violations). "First, I'd like to point out that I'm not represented in these lawsuits, and that the parties and the Software Freedom Law Center have never attempted to contact me with regard to them. As far as I am aware, and under advice of various attorneys, I still hold an interest in Busybox through both content and compilation copyrights."

to post comments

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 19:59 UTC (Tue) by bangert (subscriber, #28342) [Link] (14 responses)

perhaps a more catchy snippet from the article:

> Much as other Busybox developers wish to support the general cause of getting companies
> to comply with simple Free Software Licenses, some of the other developers and I are
> becoming annoyed with Mr. Andersen and Mr. Landley's apparent violation of our own rights,
> and SFLC's treatment of our interest. We have held off, to date, to avoid confusing issues,
> but our patience is limited.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 20:12 UTC (Tue) by JoeBuck (subscriber, #2330) [Link] (13 responses)

Bruce, if you're reading this discussion, could you point out where this detailed analysis goes wrong? What part of the current BusyBox do you claim authorship of? If you're arguing that you still have ownership because of they way they transformed away your code, leaving nothing left, wouldn't that put you on the USL side of the BSD lawsuits of the early 1990s?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 20:50 UTC (Tue) by joey (guest, #328) [Link] (1 responses)

That analysis ends with a "still todo" section listing 50+ files, and the
current release of busybox still has 8 C files with Bruce's copyright on
them.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 9:41 UTC (Wed) by niner (guest, #26151) [Link]

That analysis is also more than three years old. I'd guess things went on
since then.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 21:30 UTC (Tue) by BrucePerens (guest, #2510) [Link] (8 responses)

Rob is mis-interpreting Judge Walker's means for determining the presence of non-literal copying. There is literal copying present. There is also a compilation copyright present.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 21:57 UTC (Thu) by landley (guest, #6789) [Link] (7 responses)

There is literal copying but not _from_bruce_.

The idea of "one binary many functions dependent on name" came from _gzip_, which acted as gzip or gzunzip based on the name it was called as, and was one of the applets in the original debian bootloader.

The compilation copyright would be in the selection of which code to include. Ten years later we've thrown out several of the old applets completely, swapped out completely different implementations of a bunch, and added literally hundreds more.

By all means, if he'd like to make a compilation copyright argument in court, I'd happily be a witness _against_ him if asked. I made some of those changes and the "compiliation" was based on what the public susv3 spec listed plus the man pages of Red Hat, Ubuntu, SuSE, and Slackware. What the current code was doing wasn't particularly relevant, and that was a half-dozen years after he abandoned his bootloader aid and moved on. (Remember, Bruce never addressed the embedded space at all. That was Erik Anderson launching a _new_ BusyBox project.)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:14 UTC (Thu) by BrucePerens (guest, #2510) [Link] (3 responses)

Rob the idea did not come from gzip and no person who has any idea about early Unix would say so. Using argv[0] to bring up different programs, with more than one program name linked to the same executable, was present in Version 6 unix. This came about in the 1970's.

I never claimed to have invented that feature, Rob. And in any case, it would be subject to a patent if I did, not copyright.

Your "forensic study" was nonsense, as far as I can tell. First, you used a method for identifying non-literal copying from CAI v. Altai when literal copying and a straight derivative of past work was present. Second, you ignored the presence of both code and copyright statements in multiple files that still exist today. Thus, I'm forced to conclude that you wrote that without ever looking.

We just made a compilation copyright stand in JMRI. The court ruled for summary judgement in Jacobsen's favor last week. I'm one of the experts on the prosecution's side.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 0:23 UTC (Fri) by paulj (subscriber, #341) [Link] (2 responses)

This is not meant in a disrespectful manner, but I have to ask:

Is there not a conflict of interest if you are testifying as an expert witness in one case involving compilation copyright, when you are involved in a separate dispute that hinges on validity of such copyright? I.e. would you have the opportunity to influence case law in the one case favourably towards your interests in the other case in which you have a direct stake?

I do not mean to impugn your reputation with this question. Rather, this question arises from what you've written, in the mind of at least one LWN reader, and I just wanted to highlight that for you so that you could clarify it (this theoretical conflict of interest may matter not a jot to a court with an adversial system - I guess, but I don't know).

--paulj

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 0:27 UTC (Fri) by BrucePerens (guest, #2510) [Link]

Is there not a conflict of interest if you are testifying as an expert witness in one case involving compilation copyright, when you are involved in a separate dispute that hinges on validity of such copyright? I.e. would you have the opportunity to influence case law in the one case favourably towards your interests in the other case in which you have a direct stake?

As it happens I probably won't have this particular conflict. But I would think it happens all of the time, in that a plaintiff can bring multiple cases regarding something of theirs which has been infringed, and can cite the previous cases in the pleadings of the later ones.

I think this is the way that the court intends it to work.

Thanks

Bruce

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 5:19 UTC (Fri) by landley (guest, #6789) [Link]

> Is there not a conflict of interest if you are testifying as an expert
> witness in one case involving compilation copyright, when you are
> involved in a separate dispute that hinges on validity of such copyright?

I'm not involved in the current case. (I posted a link to my December 15 blog entry explaining why.) All the SFLC cases I was involved in were resolved a year or more ago.

Also, Bruce is not a party to any current busybox-related case I am aware of. (That's what he's upset about, the SFLC's total lack of interest in him. They seem to think he's irrelevant too.) I'm just saying that if he was, I would be opposed to his participation, to the extent of testifying against him if asked.

That's not news, either: http://lwn.net/Articles/202106/

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:26 UTC (Thu) by BrucePerens (guest, #2510) [Link]

(Remember, Bruce never addressed the embedded space at all. That was Erik Anderson launching a _new_ BusyBox project.)

This is totally ignoring the role of Dave Cinege in the Linux Router project. He maintained Busybox for two years in that context.

Also, the one-floppy Debian installer had all of the qualifications of an embedded system - very limited resources, etc., - with one difference which was that it was ephemeral. Which as far as I can tell doesn't disqualify it.

For that project, I also made a program to cut down shared libraries to only the functions that were actually called for in a given set of executables. This allowed us to have an embedded-sized C library without new development.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 2:21 UTC (Wed) by Baylink (guest, #755) [Link] (1 responses)

Bruce is right: "decide which function to perform by looking at argv[0]" predates gzip.

I have here in my hand Kernighan and Pike, _The_UNIX_Programming_Environment_, which suggests the idea on page 85, as "a novel use".

Publication date?

1984.

Anyone wanna go back any further than that?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 22:51 UTC (Wed) by landley (guest, #6789) [Link]

My point was merely that gzip's use of the technique predated busybox.

Otherwise: dead thread, by the editor's request.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:03 UTC (Tue) by ncm (guest, #165) [Link] (1 responses)

USL vs BSD was a very different kettle of fish, because USL was caught with dirty hands. That doesn't negate Joe's first question, though. I'd hate for historical confusion to interfere with getting a clear explanation from Bruce.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 1:38 UTC (Wed) by BrucePerens (guest, #2510) [Link]

I think that USL did things to weaken their copyright that don't apply in my case, simply because of the date. Works are now copyrighted the moment they are set on paper, unlike back then.

It's hard for me to see how the program could not be derivative, given that it is an uninterrupted progression from my code base.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 20:36 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link] (75 responses)

I have some code in Busybox (udhcp) and have been involved in a GPL dispute in the past involving various router manufacturers. None of what Bruce Perens says matches up with my experience with the SFLC or Eric Andersen.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 21:32 UTC (Tue) by BrucePerens (guest, #2510) [Link] (63 responses)

In what way?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 21:33 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link] (62 responses)

They had no problems including me, and were very receptive to any and all requests.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 21:47 UTC (Tue) by BrucePerens (guest, #2510) [Link] (61 responses)

In contrast, when they changed the license statement to prohibit use of GPL3, against my wishes, Rob Landley put up a long mis-interpretation of Judge Walker's methods for identifying non-literal copying as an assertion that all of my work had been removed from the program. When another busybox developer and I contacted SFLC regarding the previous spate of lawsuits, their response was not to include us.

Most GPL violations aren't planned, they're just sloppy. Similarly, these guys are being sloppy with someone else's rights.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 21:59 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link] (59 responses)

AFAIK, the GPL3 change doesn't apply to any prior releases, just releases from that point forward. I don't see the problem. Nobody is stopping you from taking whatever busybox version you last released with all your copyright ownership and doing with it whatever you want.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:13 UTC (Tue) by stevenb (guest, #11536) [Link] (12 responses)

I think Bruce's point is: I published and hold copyright on this-and-that code, under such-and-so license -- and they change the license without my permission. That's not permitted, and the resulting damage cannot be repaired by going back to the last release with the original license.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:23 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link] (11 responses)

"This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version."

So if I have something licensed under the GPL without a version specified, I am free to distribute it under the terms of the GPLv2. If I make modifications to that source and license those modifications GPLv2, then the derivative work can only be distributed under the GPLv2. The original work can still be distributed under any version of the GPL desired. No?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:26 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link]

(Oops, copy pasted from the wrong version of the GPL, but you get the idea)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:29 UTC (Tue) by rahvin (guest, #16953) [Link] (8 responses)

So if code is dual licensed BSD/GPL it's ok to issue a future version of the file as GPL only?

The answer is no. You can't change the license, if it doesn't specify version you can't change that without the copyright holder's permission. The change from GPL to GPLv2 is an additional restriction.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:34 UTC (Tue) by Russ.Dill@gmail.com (guest, #52805) [Link]

coreutils/pwd.c:

/* vi: set sw=4 ts=4: */
/*
* Mini pwd implementation for busybox
*
* Copyright (C) 1995, 1996 by Bruce Perens <bruce@pixar.com>.
*
* Licensed under GPLv2 or later, see file LICENSE in this tarball for details.
*/

Again, I don't see the problem. Busybox is a derivative work of GPLv2 later and GPLv2 only code. It can thus only be distributed under the GPVv2.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:53 UTC (Tue) by Simetrical (guest, #53439) [Link] (6 responses)

If code is dual-licensed BSD/GPL, of course it's okay to issue a future
version of the file as GPL only. Or as completely proprietary, in fact.
BSD permits this; it's not copyleft. This doesn't remove the BSD licensing
on earlier versions of the file, obviously, but you can always fork a BSD
project and release your version under any license you like. BSD only
requires that you attach a copyright notice, which is a requirement
compatible with basically every other license except public domain.

Likewise, if something is licensed as "GPLv2 or later", you can release your
changes as GPLv2 only, GPLv3 only, "GPLv3 or later", or any other compatible
license (like GPLv3+APLv2, or whatever). That's what "GPLv2 or later"
*means* -- you can redistribute it under the GPLv2, or any later version of
the GPL, or any combination (like v2+v3 but not later, etc.).

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:15 UTC (Tue) by Wol (subscriber, #4433) [Link] (4 responses)

NO IT ISN'T.

You CANNOT change the copyright holder's licence.

You can mix it with proprietary code, distribute the result, and not distribute the source. That still hasn't changed the previous code to proprietary.

You can mix it with GPL code, distribute the result, and that still doesn't change the previous code to GPL.

If you don't modify the file, you can't change the licence. If you modify the file, your licence change applies ONLY TO YOUR OWN CODE. It may, however, create a new *compilation* licence which then applies to the new file (BUT NOT ITS CONTENTS) as a whole.

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 0:32 UTC (Wed) by Simetrical (guest, #53439) [Link]

You cannot change the copyright holder's license. That's exactly what I
said. However, you do not need to release any modifications under a BSD
license. This means that if you release a copy of a file with some
modifications licensed under the GPL, the file as a whole will only be
redistributable under the GPL.

If anyone can figure out which lines were released under the BSD, they could
take those out and use them under the original license, but you don't have
to tell them which exact lines are which. Thus it's effectively impossible
to do this unless you have a copy of the original work to begin with, in
which case there's no point. So *effectively*, the new version is *usable*
only under the GPL, even if some lines are still technically BSD.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 13:29 UTC (Wed) by liljencrantz (guest, #28458) [Link] (2 responses)

It seems to me you are misrepresenting the issue. The full copyright statement reads

«or (at your option) any later version.»

In other words, the copyright statement specifically says that it is up to the user to pick which post-GPL2 version of the GPL he wishes, not the copyright holder. I repeat, the «at your option» makes it specifically clear that the copyright holder is giving the _user_ the right to pick the GPL version. So a user may download an older release of BusyBox and then relrelease it under GPL3-only, GPL2-only or any other such combination.

This does not mean a user who does this is changing what license a copyright holder is releasing software under, it simply means the user is picking one of the (potentially inifinitely many) licenses that the holder has chosen to release his software under.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 19:28 UTC (Fri) by Wol (subscriber, #4433) [Link] (1 responses)

Yabbut ...

The GPL gives the user the right to choose which licence *he* wants to apply to *him*. That's fine. If I'm given some GPLv2+ code *I* can choose to use v2, or v3, or v4(when it exists) etc etc.

What that clause does NOT GIVE ME is the right to tell the next guy in line what licence HE can choose.

It CANNOT mean that. Because if I receive v2+ code, I *HAVE* to choose *ONE* licence to apply to me. If that then strips the next guy of the right to choose, what's the point of having the "+" option?

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 15:28 UTC (Sat) by anton (subscriber, #25547) [Link]

As I understand it, you as distributor can choose to distribute the software under a subset of the licenses that you received (at least with the GPL2+, GPL3+, and LGPL wordings). Of, course, if you distribute a verbatim copy (or your changes are not significant wrt copyright), then the recipient of your copy can get a copy from the original source to get the additional licenses. So the difference is only relevant in practice if the changes you made are significant.

Licensing Best Practices

Posted Dec 16, 2009 13:34 UTC (Wed) by pboddie (guest, #50784) [Link]

If code is dual-licensed BSD/GPL, of course it's okay to issue a future version of the file as GPL only. Or as completely proprietary, in fact.

Just to clarify what you're trying to communicate here, in a dual-licensing situation where the recipient has the option of saying "I prefer the BSD licence", they can distribute a proprietary derivative, but they still have to comply with the BSD licence: preserving the copyright notices and disclaimers.

This is how releasing works derived from BSD-licensed code also works: the BSD licensing notices must still be preserved - the SFLC has a good document on this, by the way - but it's possible to apply the GPL "on top" of the whole thing (provided that you, as the person doing this, are actually contributing something and becoming a party to the derived work) because the preferred licence on the new code (the GPL) doesn't contradict the licence applied to the existing code (the BSD licence), and the latter doesn't undermine the former by stipulating terms that the GPL can't permit.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 2:24 UTC (Wed) by Baylink (guest, #755) [Link]

Yes, *if* the code was released with the "or any later version" language...

which is *purposefully* optional.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:18 UTC (Tue) by rahvin (guest, #16953) [Link] (45 responses)

They can't change the copyright on Bruce's code, that's illegal. He doesn't want the "or later" option removed from his code, that means it can't be removed from any code to which he still holds copyright. This isn't something people should even consider doing let alone attempt.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:30 UTC (Tue) by rahvin (guest, #16953) [Link] (1 responses)

shouldn't not should, darn contractions.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 3:44 UTC (Wed) by xanni (subscriber, #361) [Link]

No, should is correct unless you change the "isn't" to "is" as well. Your correction is incorrect. :)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:41 UTC (Tue) by JoeBuck (subscriber, #2330) [Link]

If it were up to me, people would say "GPLv2 or later", however, it's legal to combine GPLv2-only code with GPL2-or-later code. So the current maintainers can license their work GPLv2-only, even if there are some files that should be "GPLv2 or later" left over.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:42 UTC (Tue) by dlang (guest, #313) [Link] (5 responses)

nobody is disputing that Bruce can release his code under whatever license they want.

what is being disputed is the following

1. does Bruce have any copywritable code left in BB. If not, then his opinion doesn't matter anymore

2. if you take GPLv2+ and add any patch of GPLv2only code to it, the result is GPLv2only. Bruce cannot tell someone not to do this. he has already given permission for the code to be released under GPLv2

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:19 UTC (Tue) by bug1 (guest, #7097) [Link]

if you take GPLv2+ and add any patch of GPLv2only code to it, the result is GPLv2only.

Not 100% correct, and difference is what is causing the problems.

If you take GPLv2+ and add a GPLv2 only code, the result is code that is licensed under the GPLv2+ and GPLv2.

To distribute code licensed under both the GPLv2+ and GPLv2 you have to conform to the GPLv2, in doing so you are also conforming to GPLv2+.

The GPLv2+ hasnt gone away, its license hasnt changed, its become like a silent partner.

The effect of licesing the code under GPLv2 and GPLv2+ is that it is effectively, but not literally licensed under only the GPLv2.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 1:41 UTC (Wed) by BrucePerens (guest, #2510) [Link] (3 responses)

1. does Bruce have any copywritable code left in BB. If not, then his opinion doesn't matter anymore

Not so simple, because some of the other work is directly derivative of mine.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 6:59 UTC (Wed) by frazier (guest, #3060) [Link] (1 responses)

Is all that code under "or any later version"?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 1:55 UTC (Fri) by BrucePerens (guest, #2510) [Link]

It's all derivative of code that was under "any later version".

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 19:31 UTC (Fri) by Wol (subscriber, #4433) [Link]

If it's derivative of yours, then you have copyrightable code ...

If EVERY LINE of what you wrote has gone, then whether the original was yours or not is irrelevant, there's nothing of yours left so you have no copyright.

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:57 UTC (Tue) by Simetrical (guest, #53439) [Link] (11 responses)

He released the code under several licenses, of which one is the GPLv2.
Redistributors are free to redistribute the code under any version of the
GPL they like as long as it's 2 or later. In particular, they can
redistribute it under GPLv2 alone. That's why it's "GPLv2 *or* later", not
"GPLv2 *and* later".

Even if they distribute the exact same file with no changes, if they
distribute it under the GPLv2 alone, they're only required to note that
it's licensed under the GPLv2. The GPLv2 doesn't require you to tell
anyone about other licenses the code you're distributing might be under.
Thus you can simply remove the "or later" text if you want from the file
you distribute. Of course, that doesn't affect whether the file is
actually under another license as well.

This is all legally speaking. Whether it's the right thing to do is
another story.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:13 UTC (Tue) by rahvin (guest, #16953) [Link] (1 responses)

You are incorrect.

This is no different than the recent spat with OpenBSD about some files that the license was changed from BSD/GPL to GPL only. The license on Bruce's files cannot be changed, the ones he holds code to are and forever shall remain GPLv2 or later + whatever other licenses he applied to them. Removing the or later addition is changing the copyright by adding an additional restriction to the terms of the copyright. I'm not saying that they can't be distributed with other files that are GPLv2 only, I'm saying if anyone changed the copyright on his files they are liable for copyright infringement.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 0:53 UTC (Wed) by Simetrical (guest, #53439) [Link]

The license can't be changed, but the license is different from the license
notices. The GPLv2 requires that you "keep intact all the notices that
refer to this License", but "this License" is the GPLv2, not any other
licenses the work may additionally be licensed under. I don't see why you
couldn't legally remove the "or any later version" part if you're
distributing only under the GPLv2, although I wouldn't recommend it unless
necessary to incorporate GPLv2-only changes.

(If you have a file that's partly licensed GPLv2-only and partly GPLv2-or-
later, you surely can't say at the top of the file that the whole file is
GPLv2 or later; that would be factually incorrect. But you're certainly
allowed to combine GPLv2-only code in the same file with GPLv2-or-later.)

Do you have any sources, like statements by a lawyer? I don't, and could
be entirely wrong. If so, it would be nice to know it, since I've written
an awful lot of "GPLv2 or later" code . . .

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:24 UTC (Tue) by Wol (subscriber, #4433) [Link] (8 responses)

This is a complete muddle of copyright law ...

If Bruce says "v2 or later", that means, if you want to distribute Bruce's code, YOU have to CHOOSE which of those licences you want to abide by. You can choose v2, v3 now it exists, v4 when it exists.

If a Judge asks you "what is your licence?", he won't accept an ambiguous answer of "the GPL", he'll want to know "which one?". You can't choose bits of one, and bits of another, and bits of a third ...

So, if you use v2 to distribute Bruce's work, UNmodified, that means you are also distributing BRUCE's choice of licence to YOUR recipients, and they can choose v3 instead. And their recipients can go back to v2 ... ad infinitum.

If you change JUST the COPYING file to say "this is now v3 only" then you are distributing an UNmodified work with a MODIFIED licence, and I think you'll find this is illegal ... (false representation and all that...)

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 0:46 UTC (Wed) by Simetrical (guest, #53439) [Link] (7 responses)

Is it illegal? What obligates me to inform recipients about *all* licenses
that apply to the code? If I distribute something under the GPLv2, I must
say it's under the GPLv2 because the GPLv2 explictly requires that. What
requires me to also say it's under the GPLv3? The GPLv2 doesn't require
that AFAICT, and I can do whatever you want with the code as long as I meet
the requirements of the GPLv2 alone.

I'm not misrepresenting anything. That would imply something I'm saying is
false. It's not; the code is all licensed under the GPLv2, just as I say.
I'm not saying it's *not* licensed under the GPLv3 or later. Likewise, if
I distribute public-domain code in any way, I'm perfectly permitted to
remove any copyright notices. Only a licensing restriction would prohibit
that, and the license doesn't.

But IANAL. Do you know of any people who *are* lawyers and have given an
official opinion on this? I'm confused now. The FSF's FAQ doesn't seem to
have anything useful to say. If someone releases something as "GPLv2 or
later", *can* you remove mention of "or later"? What if you make changes
to a file that are GPLv2-only, so the modified file as a whole can no
longer be used under GPL>2 anyway?

The "or later" clause

Posted Dec 16, 2009 14:03 UTC (Wed) by pboddie (guest, #50784) [Link] (1 responses)

You can surely choose to redistribute the code under the GPLv2, not exercising the option to adopt any later version of that licence. This effectively removes the "or later" clause and is the alternative complementing the choice of GPLv3 (or later) which does actively exercise the option.

The "or later" clause

Posted Dec 19, 2009 0:34 UTC (Sat) by Wol (subscriber, #4433) [Link]

You *can* choose?

No! Before v3 came out it was "you MUST choose *version*2*".

YOU need a licence to distribute. The grant of licence allows YOU to choose which licence applies to YOU. It does NOT allow you to choose which licence applies downstream from you.

If your argument is valid, then the "or later" wording is worthless, because as soon as the first recipient distributes they have to choose which licence they are going to distribute under (this is just a practical/legal necessity), and if choosing a licence negates the choice for the next person in line, then the only people with the right to choose the "or later" licence will be those people who got it directly from the copyright holder.

So if you're right, pretty much all code initially distributed as "v2 or later" is in practice "v2 only" because it was distributed under v2 in the past and the recipients today can't choose v3 because the recipients "yesterday" didn't (couldn't) choose v3.

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 8:54 UTC (Thu) by hppnq (guest, #14462) [Link] (4 responses)

If someone releases something as "GPLv2 or later", *can* you remove mention of "or later"?

If GPLv2 and all the later GPL licenses say that you can't change the license notice, then you can't, unless you are the copyright holder. All the existing GPL versions address this point quite precisely.

I don't think it is more complicated than this. But fortunately, IANAL.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 12:49 UTC (Thu) by pboddie (guest, #50784) [Link] (3 responses)

From the GPLv3:

If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation.

It's roughly the same text in the GPLv2. Now, if one were inclined to only follow the GPLv2's conditions when making a derived work, it would surely be inappropriate for one to offer that work under a later version of the licence. Thus, the "or later" offer would have to be dropped, since one wouldn't be offering the work under, say, the GPLv3.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 17:20 UTC (Thu) by hppnq (guest, #14462) [Link] (1 responses)

Surely you can release "GPLv2 or later" code as "GPLv2" [*]. I am not sure if that means you are allowed to change the original license notice though, without the consent of the copyright holder. If you can, it would mean that you can take "GPLv2 or later" code and make it incompatible with itself or the project it is a part of (if that is GPLv3 compatible, for instance). Or is this a classic ENOCOFFEE? ;-)

[*] Also see the compatibility matrix used to describe these matters during the GPLv3 draft process.

Changing the notices (or adding new ones)

Posted Dec 18, 2009 12:46 UTC (Fri) by pboddie (guest, #50784) [Link]

Well, as the creator of the derived work, you could add a new notice saying that your code is GPLv2 only and thus recipients have to disregard the "or later" in all the other notices. I'd rather advocate that than start editing licensing notices.

In fact, according to the SFLC, when contributing GPL-licensed code to a BSD-licensed project, thus making the derived work GPL-licensed, the original notices should be left in place (which is actually stipulated in those notices). So, to do the same with GPL-licensed code is consistent with that. What people are missing is something in the GPL instructions which says that one can edit the licensing notices to make a licensing change easier to follow.

I've developed stuff under a copyleft licence that originally had a permissive licence, and as well as preserving the original notices intact, I also pointed out where the original work came from, and I've also preserved the licensing on individual files which I didn't change. I'm not likely to pin any flexible version GPL-licensed code to a particular version - I think those insisting on precise versions of the GPL are misguided - but I'd do the same with the licensing notices in such a situation. It's safer to keep everything as transparent as possible.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 2:37 UTC (Wed) by Baylink (guest, #755) [Link]

It might clarify things if everyone remembered that the license controls *how you distribute the code after you've modified it*, and only that.

And that each person who distributes code is controlled by *the licenses attached to that code*.

So if I receive the code -- it doesn't matter how -- and *all the files say GPLv2+*, then I can distribute it under the terms of any version I like.

Clearly, this means that the only thing which might change the terms under which someone taking *my* distribution can distribute the packge is *the licenses on any files I add*.

If I take a GPLv2+ package, and substantially extend and modify it, and place my changes under a 2-only license, then in practical terms, I've restricted downstream distribution of *the package with my changes* to 2-only, because (as Bruce -- I think -- notes above) in order to use a later license, you'd have to take my work back out... and why bother? You could just go back to my upstream, and use that.

IocANALe.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:09 UTC (Tue) by Wol (subscriber, #4433) [Link] (23 responses)

SPOT ON !

It's a common misconception that the GPL, and the BSD, and various other licences, allow you to change the licence. THEY DO NOT.

Most licences DO NOT allow you to change the licence.

What actually happens in practice is as follows: ...

Bruce has released his code as GPL v2+. Let's say I then modify his code and licence my changes as v2only. Bruce's v2+ applies to his code, my v2-only applies to mine, and a NEW copyright, a *compilation* copyright (which ONLY applies to the EXECUTABLE) has appeared which is also v2-only.

It's v2-only because it *has* to be the proper subset of all the licences on the code that has been "compilated" together. Actually, that's why sometimes it's illegal to distribute Free Software :-) If you mix licences for which the proper subset is the null set, although you are free (as an end user) to mix the code, you are left with no licence permitting you to distribute and share the result.

From what I gather from Bruce's comments here, it sounds like they are representing HIS licence as being v2-only, and that certainly is illegal. If they are merely saying his code has been mixed with other v2-only code, therefore the resulting product is v2-only, then I think he's flogging a legally-terminated horse :-)

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 23:23 UTC (Tue) by bug1 (guest, #7097) [Link] (5 responses)

It's v2-only because it *has* to be the proper subset of all the licences on the code that has been "compilated" together.

Superset, not subset.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 10:44 UTC (Wed) by sbakker (subscriber, #58443) [Link] (3 responses)

It's v2-only because it *has* to be the proper subset of all the licences on the code that has been "compilated" together.
Superset, not subset.

Intersection, not superset.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 13:11 UTC (Thu) by bug1 (guest, #7097) [Link] (2 responses)

No...

Take this scenario

License A requires action X and Y
License B requires action Y and Z

If a work is licensed under A and B, then action X, Y and Z must be performed to satisfy both licenses.

If a work is licensed under A or B, then its either X and Y, or Y and Z.

I can think of no scenario where just Y would be required.

How about a real life example, say there is some BSD code, some adds a GPL patch, the intersection of the BSD and GPL would place almost no obligations on users. Its is obviously incorrect.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 14:47 UTC (Thu) by hppnq (guest, #14462) [Link]

Convolution then? :-)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 16:53 UTC (Thu) by sbakker (subscriber, #58443) [Link]

True, but the whole set analogy is broken anyway. A license is not a set of elements like numbers, but a collection of restrictions and rights. First we'd need to sit down and mathematically define a license, _then_ look at how to find the common ground in them (which, I still maintain, is an intersection :-)).

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 2:41 UTC (Wed) by Baylink (guest, #755) [Link]

Nope, it is in fact subset -- intersection.

Please understand that we're talking about "subset of the granted rights of distribution". Not a subset of the *licenses themselves as objects*.

The alternative would be superset or union, and that could logically never produce the "so you therefore have no legal way to distribute the code at all" situation, which we all know happens.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:21 UTC (Thu) by landley (guest, #6789) [Link] (16 responses)

1) The old releases still exist, from before we dropped the dual license. If he wants to cherry pick clean versions from source control that can still have the other license applied to them, from before GPLv2-only code got merged in, he's welcome to do so. (We told him this, but he remained in hysterical chicken-little mode.)

2) If you merge GPL code into an LGPL project, you can then distribute the result under the terms of the GPL, but not under the LGPL. (Note that it's the text of the GPL that's insisting its terms apply to the whole project or none of it.) This is not controversial within the community. Why merging "GPLv2-only" code into a "GPLv2 or later" project is viewed as any different from this is a question for the ages. (Hint: it generally isn't by people actually writing and releasing code under the GPL.)

3) GPLv2 section 9:

> Each version is given a distinguishing version number. If the Program
> specifies a version number of this License which applies to it and "any
> later version", you have the option of following the terms and conditions
> either of that version or of any later version published by the Free
> Software Foundation. If the Program does not specify a version number of
> this License, you may choose any version ever published by the Free
> Software Foundation.

We specified a version number, just like the kernel guys did a decade ago. The license left open that possibility. It was the version number we'd been using all along, we just made it official.

Why Bruce has trouble understanding this is a question to ask _Bruce_, which I am no longer interested in doing.

Rob

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:52 UTC (Thu) by BrucePerens (guest, #2510) [Link] (9 responses)

My objection was to 1) the license change for the overall project and 2) the license change regarding any stuff of mine which is still in there. It seems I still have code in the latest version, and stuff derivative of my previous work. My objection still stands.

My favorite part of the whole thing, though, is when you said you couldn't participate any longer because whenever you looked at my code you saw my face. IMO this qualified as divine punishment. And I don't even believe in the divine.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 7:44 UTC (Fri) by landley (guest, #6789) [Link] (3 responses)

This whole SFLC thing was fallout from something I did while maintainer, securing proper legal representation to replace the old "hall of shame" which never worked. See the March 27, 2006 entry at
http://busybox.net/oldnews.html for details.

That's why I was still involved for a while after I stepped down as maintainer: because I'd set it up in the first place (and got Erik on board). The point was to clean up after the old "Hall of Shame", which as maintainer I felt it was my duty to handle, so I did. Three years later, I've moved on, and am not involved with the current round of lawsuits. (I think Denys Vlasenko probably should be, on general principles, or it's not really representing the busybox project. But that's just my opinion.)

Bruce: you were not involved with the project at that time. The hall of shame languished for years without your interest. (Similarly Denys Vlasenko hasn't been a party to any of these suits because he wasn't maintainer _yet_ when we contacted the SFLC.) You're _stunned_ that a project you hadn't interacted with for almost a full decade didn't bother to track you down.

You're also amazed that we didn't welcome you with open arms when your first posts to the busybox.net mailing list _ever_ were not about code, but about belated license trolling over an issue we'd already discussed for _months_ and come to a final conclusion on before you ever _noticed_.

Examples of the topic intermittently reared its head for a long time (there's more, and both of these are the start of long threads):

http://lists.busybox.net/pipermail/busybox/2006-April/054...
http://lists.busybox.net/pipermail/busybox/2006-July/0571...

The topic was explicitly raised for actual decision August 18th 2006:

http://lists.busybox.net/pipermail/busybox/2006-August/05...

I started looking at the status of some of the existing busybox code already marked GPLv2-only on September 8th:

http://lists.busybox.net/pipermail/busybox/2006-September...

And then your first post to the list ever, in the entire history of the list archive, was on September 13th, and was titled "Please tone down the GPLv3 paranoia":

http://lists.busybox.net/pipermail/busybox/2006-September...

Well hail the conquering hero. (Shortly thereafter, someone taught me the word "Schlamiel" when attempting to describe your behavior.)

> My objection was to 1) the license change for the overall project

GPLv2 was a valid license to distribute it under when it started, and GPLv2 is the valid license to distribute it under today. The old versions from back when you were relevant are still available in the archive. You're objecting that new work done by volunteers isn't what you would have done, and are attempting to steer the volunteers "from the grave", without actually participating.

You're also rehashing an argument you lost in 2006.

> 2) the license change regarding any stuff of mine which is still in
> there.

Nobody ever said you couldn't grab your bits and use them elsewhere, you just had to be sure they were _just_ your bits, and not tangled up with other people's bits under different licenses. Easiest way to do that was to grab old versions before other people's code got merged in. (When other people's code gets merged in, dual licenses often get dropped.)

BusyBox developers merged GPLv2-only code into the project years before we _acknowledged_ it. Thus the project as a whole could only be distributed under the terms of GPLv2. Some upstream sources may have had additional dual licenses, and some code we incorporated may even have come from public domain sources. But that doesn't mean you can distribute the releases of the modern BusyBox project under any license terms _other_ than GPLv2.

As a courtesy, I offered (back in 2006) to replace any code that had your copyright notice with a fresh implementation, even though legally we weren't required to do this. You got all offended and changed the subject.

> It seems I still have code in the latest version, and stuff derivative
> of my previous work. My objection still stands.

I covered that in 2006. I offered to volunteer my time to remove code you objected to, if you would just identify it, but you weren't interested. I also pointed out you could maintain your own fork, and you did the "well maybe I will, mister!" flounce but never followed through.

Actually, there was no "maybe" about it. You said, and I quote, you "feel that a fork is necessary and will put in the work to make one":

http://lists.busybox.net/pipermail/busybox/2006-September...

And then you didn't.

Meanwhile I did my own restart for _fun_ at http://landley.net/code/toybox and fed bits of that into busybox once I got over my visceral reaction to your SCO-like claims. (I need to push more code into busybox, but at this point it's structural and design changes which require convincing the busybox community that http://landley.net/code/toybox/code.html is a better design than having to touch five different files to add each new command.) But since it's a mature project where all new development is optional (modulo susv4 coming out), it's hard to prioritize proposing major design changes.

So I responded by writing code, you told other people what to do and then flounced off in a huff. Wake me when you do your promised fork. I should stop feeding the troll on this issue.

I think that's enough rehashing of ancient history, though. (Those laurels comfy? Seems like they started to smell a bit ten years ago.)

> My favorite part of the whole thing, though, is when you said you
> couldn't participate any longer because whenever you looked at my code
> you saw my face. IMO this qualified as divine punishment. And I don't
> even believe in the divine.

Punishment?

Um, dude, it really wasn't _about_ you. "You caused the problem" and "it's about you" are two different things, please get that through your head _one_ of these days. (If you knocked a bookcase over on somebody and they were bleeding, the focus of interest would be helping the person who was bleeding. There might be a secondary interest in making you go away or otherwise preventing you from causing more damage, but it wouldn't be _about_ you.)

I certainly wasn't intending to "punish" you, I was trying to get _away_ from you, because I got burned out on SCO and you started acting like SCO. You're confusing "this isn't fun anymore" with "that'll show Bruce!"

Shortly before your Triumphant Return To BusyBox, I spent a couple years focusing on defending the Linux community from SCO. (Lead author on http://www.catb.org/~esr/halloween/halloween9.html and co-author on http://catb.org/~esr/hackerlore/sco-vs-ibm.html were some of the more public parts, but I put a lot of other work into that topic way back when.) These guys were nasty and evil and the most frustrating part was that whenever you pinned them down they claimed that wasn't what they'd been arguing about and changed the subject. They had a theory of ownership I referred to as "sco disease", under which code that had touched code they had touched had their ownership transmitted to it by osmosis, so that their code could never be detected and removed.

Your positions reminded me strongly and uncomfortably of SCO's, which took all the fun out of my _volunteer_ work for the BusyBox project. I said so explicitly at the time:

http://lwn.net/Articles/202120/

But before I left, I found somebody else with energy and drive who would take good care of the project, and handed it off to a new maintainer. I felt I had an obligation to do this for the good of the project. You apparently never felt such obligation.

This wasn't about "showing bruce", and it wasn't "taking my ball and going home". I no longer had enthusiasm for the project, so it was in the best interests of the _project_ (not necessarily best for me personally) to make sure it was in good hands before going off to do other things.

(I note that Erik Andersen advised me to take a few months off and see if I felt better first, but I didn't want to stall BusyBox development even that long.)

BusyBox is Denys's baby now, and I respect that. Are there elements of his maintainership that I disagree with? Sure, he's not me and thus not doing everything I would do exactly the way I'd do it. (The code is turning into an #ifdef forest again, for example.) But I'm not going to tell him how to do his job, and if I really wanted to clean it up I would _contribute_. I could submit patches to the existing project like any other developer, I could maintain my own fork, or I could write a new version from scratch (ala toybox).

I try to change things by _writing_code_, not by arguing about what _other_ people should be doing in a volunteer organization like you do, Bruce.

By the way, these days, I no longer think of you as SCO. I think of you as David Dawes of xfree86.org: irrelevant through your own actions.

And that's about the duration of my interest in the topic.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 21:38 UTC (Fri) by docwhat (guest, #40373) [Link]

http://www.somethingpositive.net/sp03032009.jpg

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 1:15 UTC (Sat) by BrucePerens (guest, #2510) [Link]

Bruce: you were not involved with the project at that time.

This is correct. It's important to delegate.

The hall of shame languished for years without your interest.

Actually, I was OK with the shame-with-publicity strategy. Bringing suit did have a cost for us, as you are well aware given your collateral damage from the Cisco suit. The main reason that the Software Freedom Conservancy is interested in Busybox is that the Linux kernel copyright holders aren't making use of the Conservancy.

Shortly before your Triumphant Return To BusyBox, I spent a couple years focusing on defending the Linux community from SCO.

That you are lecturing me on this might indicate a bit of near-sightedness, also the fact that you had no idea of the involvement of the Linux Router Project in Busybox, or the fact that you didn't realize that GZIP does not contain the invention of argv zero switching. I understand that you have ESR as a neighbor, but it is a really big world out there whose contributions you don't seem to even have been aware of.

Your positions reminded me strongly and uncomfortably of SCO's

SCO really did believe that Linux was directly derivative of their work. They thought so because they had the evidence of BPF being duplicated in Linux, but they didn't realize that they hadn't written BPF because the information in Legal's file cabinet hadn't stayed with the software when the company was sold. IMO, once I published the analysis of their press slide-show demonstrating that they had not written BPF, their case was essentially over, the death throes just took a long time.

USG v. BSD is the other similar case. Today, USG would have won. Back then, the laws were different and their work was not copyrighted by default.

And that brings us to Busybox. Busybox really is derivative of my earlier work on Busybox. Every exact line that I have written could be removed and it would still be derivative. The reason this is different from SCO is that Linux really did not start with SGO's code base, Busybox really did start with mine. You might not like that, but it's the way it is.

which took all the fun out of my _volunteer_ work for the BusyBox project.

I just can't help but smile when I read this. Sorry, but if you're going to have a dispute with someone, it's fun to have that dispute with someone who is this visibly self-limiting.

I try to change things by _writing_code_, not by arguing about what _other_ people should be doing in a volunteer organization like you do, Bruce.

Writing code is very important. But not to the exclusion of the painful discussions around charting our course. One big problem with Free Software and Open Source is that too many of us are more comfortable in our cubes hacking than dealing with the big issues. We get taken advantage of because of it.

I never knew David Dawes, but my impression was that he wasn't a significant contributor to the X server development. Unlike David, I am not the one attempting to change the license - you were.

There was at the time a reasonably long list of people urging me to fork the project and pledging help - I don't even know why, and hope that Dennis has addressed whatever the problem was at the time. I had bigger fish to fry.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 20, 2009 20:38 UTC (Sun) by efexis (guest, #26355) [Link]

" I also pointed out you could maintain your own fork"

With blackjack? And hookers?!!

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 18, 2009 19:37 UTC (Fri) by Wol (subscriber, #4433) [Link] (4 responses)

IMO, you have no standing to the change of licence on the project as a whole. That's a compilation copyright "owned" by the project maintainer and (within legal limits) they can do what they like. And if they decide to mix your 2+ code with 2-only code from someone else, then "legal limits" mean they HAVE to change the licence to "2 only".

As for tampering with the licence ON YOUR CODE - that is a NO NO NO.

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 9:36 UTC (Sat) by landley (guest, #6789) [Link] (3 responses)

> IMO, you have no standing to the change of licence on the project as a
> whole. That's a compilation copyright "owned" by the project maintainer

Wake me when you've learned the difference between a license and a copyright.

Rob

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 22:52 UTC (Sat) by Wol (subscriber, #4433) [Link] (2 responses)

That's a bit harsh ... okay I did muddle my terminology a bit.

But what I was trying to say was that the compilation copyright belongs to the project maintainers, and the licence they apply to that is constrained by the licences applying to the code they've compiled.

And in this case, seeing as the compilation is a mix of v2-only and v2+, the compilation licence has to be v2-only.

(imho, but that's only ho, they should have said "we've accidentally mixed some v2-only into a v2+ project, so all new code must be v2+ as per the original but the project is actually v2-only unless and until somebody bothers to do something about it.)

Cheers,
Wol

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 20, 2009 4:13 UTC (Sun) by landley (guest, #6789) [Link] (1 responses)

It's hard because I'm tired of arguing about it with people who don't bother to do their homework.

And it's not that your selection of terms is unclear, it's that your understanding of copyright law in general (and Title 17 in particular) seems to be unclear.

> And in this case, seeing as the compilation is a mix of v2-only and v2+,
> the compilation licence has to be v2-only.

In the phrase "compilation license" you're confusing at least three distinct concepts: compilation copyright, derived works, and issuing a license to a copyright. (And you're probably unaware that a fourth related concept, joint copyright, even exists.)

Look, if you're really going to care you should talk to a lawyer or take a course in business law or something. But here's a 10,000 foot overview that's worth what you paid for it:

First, let's talk about licensing. One copyright can have multiple, (completely incompatible) licenses granted on it. For example, the QT project lists three:

http://qt.nokia.com/products/licensing

(Although only two actually matter since the second is convertible into the third, they probably just did the third to get the FSF to shut up.)

So QT has a commercial license, and LGPL. If you ship a modified binary without offering source code, you've violated the terms of the LGPL. If you put your source up for download for free to all and sundry, you've violated the terms of your average commercial license. And this is _fine_, because you only need _one_ valid license under which to distribute the code. When there are multiple ones, you can choose the one that best suits your needs and obey the terms of that one.

The fact that everybody who buys the commercial license ALSO gets the code under LGPL means that the code is dual licensed when they get it, and they're intentionally discarding one of those licenses. This is _normal_.

So: one copyright can have multiple licenses, and those licenses can be completely unrelated, of diffent scope, duratinon, requirements, and so on. And some of those licenses may not apply to you. Clear so far?

Now let's look at different _kinds_ of copyright a work can have. Title 17 has a "definitions" section:

http://www.copyright.gov/title17/92chap1.html#101

> A compilation is a work formed by the collection and assembling of
> preexisting materials or of data that are selected, coordinated, or
> arranged in such a way that the resulting work as a whole constitutes an
> original work of authorship. The term compilation includes collective
> works.

What that means is a compilation copyright is a copyright on the selection of elements to include, such as a short story anthology or a CD containing a dozen music tracks from various authors. It mostly becomes relevant when the person who put together the compilation contributed no actual material to the result that could form a derivative work.

Compilation copyright is about "you included substatially the same public domain stories I did in your book, that organization was copied from me". In busybox, you might be able to claim the selection of commands to implement gives you a compilation copyright, except that we implement hundreds more now the selection of commands to implement is "what's in the Single Unix Specification plus the Linux man pages", which falls under scenes a faire:

http://www.ivanhoffman.com/scenes.html

One of the _other_ failings of compilation copyright is that if you cherry-pick out the individual elements and take a significantly different subset of them (or a compile them in a different way), the compilation copyright doesn't apply. Thus if Bruce had a compilation copyright on busybox 0.0.1 or whatever it was he released and somebody grabbed just one command from that (which Bruce didn't write), whatever license terms he decided to apply wouldn't matter unless he had code in that command. It would be entirely based on what the original author had licensed the work as. (See http://www.copyright.gov/title17/92chap2.html#201 part c.)

Because of this, I've never seen a GPL enforcement action based on a compilation copyright, and when I brought it up with the SFLC three years ago they didn't want to go there. Compilation copyright is generally fairly weak and uninteresting unless you're an anthology publisher.

Open source projects such as Linux have always based their legal status on derived works. Again from the definitions section of title 17:

> A derivative work is a work based upon one or more preexisting works,
> such as a translation, musical arrangement, dramatization,
> fictionalization, motion picture version, sound recording, art
> reproduction, abridgment, condensation, or any other form in which a
> work may be recast, transformed, or adapted. A work consisting of
> editorial revisions, annotations, elaborations, or other modifications,
> which, as a whole, represent an original work of authorship, is a
> derivative work.

(For example, somebody takes an existing mozart performance and puts a drum track over it, they've created a derivative work. Now to distribute recordings of the result they need to get a license to the mozart performance _and_ issue their own license on their drum track.)

Note that every compilation copyright is _on_ a derivative work, but not every derivative work has a compilation copyright claimed on it.

The thing about a derivative work is that the copyrights of the contributions remain distinct, and each is licensed separately. The copyrights on each contribution to the derivative work must be licensed under compatible terms in order for the derivative work as a whole to be copied and distributed.

So just as one copyright can have multiple licenses, one derivative work is made up of multiple copyrights, ideally each licensed under the same terms. (Simply put, multiple copyrights, one license.) Ok?

Derivative works are the "boolean and" of copyrights, and it fails closed. Violate the license to one component, and you have infringed that copyright, and the owner of that copyright has standing to sue. This makes the addition of new licenses extremely difficult, and makes dropping licenses in a multi-license scenario easy. Making it hard to add new licenses (such as proprietary commercial ones) is generally what open source projects want (unless they're using BSD licensing where the license itself is "do what you will, just don't sue me"), so it's how open source developers arrange their projects.

For example, if you put together a derived work combining public domain code, code dual licensed under GPL and some other license (such as Perl, which is dual GPL and Artistic), and code that's only under GPLv2, you have a number of different licenses on the _components_, but only one license under which the derived work as a whole can be shipped.

If a recipient of that derived work wants to pick it apart and grab individual chunks and argue that those components are in the public domain or usable under the terms of the Artistic, that's their right to do so. It's also their problem to do the analysis to prove the provenance of that part of the code.

The BusyBox project's git repository currently has 10,866 commits in it. That means Erik Andersen and his successors have created over 10,000 distinct derived works, and if you want to pull any chunk from the current version and go "this was originally BSD licensed, I want to use it in my BSD licensed project" (such as networking/traceroute.c) you have to go through and find all changes to that chunk since it was so licensed and either remove those changes or get permission to use them under BSD from whoever owns that change's copyright (the source control commit messages should record who wrote it).

Of course it's way easier (and more sure) to just go find the older copy before it was modified into a derived work that included changes from authors who only licensed their copyrights under GPlv2. And as I said, those old versions are still there in the downloads directory, and in the repository, and so on.

What open source projects generally try to _avoid_ is a "joint copyright", which is the "boolean or" case. That's where there's one copyright shared by multiple authors. That means each copyright holder has an equal right to the resulting work, and thus each of them individually can issue a license to the whole work all by themselves under any terms they like. (There's just the one copyright to be licensed, so any license covers the whole thing. Who's owed what share of any royaltaies from such licensing is another matter.)

The FSF never wanted to deal with any of this and forced all their contributors to sign over their copyrights (not just grant compatible licenses to them in non-centralied regimes such as Linux). That way FSF code has one copyright owner, which can thus issue new licenses on a whim.

Of course if you remember reading about the SCO/Novell case on Groklaw, signing over copyrights requires a "written instrument of conveyance", I.E. they have to keep actual signed pieces of paper on file in a physical filing cabinet, and that bureaucracy was one of the main limiting factors preventing their development process from scaling. (The other was Richard Stallman's ego, but let's not go there.)

(At least you're not one of the people who try to drag contract law into it. And I've skirted the whole "copyright doesn't cover _use_" morass. Some lawyer somewhere needs to do a "copyright and licensing for open source developers" class. I've arranged a few panels at Penguicon and Linucon, often with Eric Raymond's wife Cathy, who is a Lawyer. But that's just poking at the problem...)

Sigh. Let the SFLC or the Linux Foundation deal with it...

> (imho, but that's only ho, they should have said "we've accidentally
> mixed some v2-only into a v2+ project, so all new code must be v2+ as
> per the original but the project is actually v2-only unless and until
> somebody bothers to do something about it.)

You mean like we publicly discussed doing on the busybox mailing list three years ago, in a number of different threads I pointed to earlier in this discussion?

http://lists.busybox.net/pipermail/busybox/2006-August/05...

So your advice is we should have taken an option we discussed at length, for several months, and decided against months before His Special-ness ever showed up.

Rob

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 23, 2009 2:53 UTC (Wed) by Baylink (guest, #755) [Link]

FWIW, Rob, I've been following open source development since before it was called that; Lance-Taylor UUCP, HylaFAX, and a bunch of other projects few people remember anymore unless they're using them, going back to, oh, 1983 or 4...

and I'm having no trouble following your postings, and it's clear to me that you know what you're talking about.

Not that you *needed* external validation or anything, but... :-)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 8:33 UTC (Sat) by Arker (guest, #14205) [Link] (5 responses)

1) The old releases still exist, from before we dropped the dual license. If he wants to cherry pick clean versions from source control that can still have the other license applied to them, from before GPLv2-only code got merged in, he's welcome to do so. (We told him this, but he remained in hysterical chicken-little mode.)

I am imagining (and Bruce will surely correct me) that his counteroffer was that if you wanted a GPLv2 clone of busybox you should write it yourself instead of relicensing an existing project. It seems very reasonable to me. Regardless of how long ago that project was forked and how little of his code remained after so many years, it was indisputedly his project begun with his code that all the other coders have hacked on over the years. Why not respect his license?

IIRC he fairly early on made the mistake of accepting submissions licensed GPL v2 only? If that is correct, it might limit his legal ability to enforce his license here, but so what? Arent hackers supposed to have ethical standards and respect for other peoples work?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 19, 2009 23:58 UTC (Sat) by landley (guest, #6789) [Link] (4 responses)

> if you wanted a GPLv2 clone of busybox you should write it yourself
> instead of relicensing an existing project.

A) You can't relicense an existing project if you aren't the copyright holder. However, each new release is a fresh derivative work, which must be under a compatible license but isn't required to be under the _same_ license. GPLv2-only is a compatible subset of "GPLv2 or later".

It's sad that Bruce didn't understand that, but I don't care.

B) I wasn't the one proposing "relicensing", Bruce was. Busybox had always been distributed under GPLv2 because GPLv3 didn't _exist_. I simply dropped what had up until that point been a purely theoretical dual license, under which the code had never actually been distributed, and made it not apply to future derived works (I.E. the current release I was working on and future releases based on that).

Bruce was the one who wanted to distribute busybox under a new license that hadn't existed up until that point. I declined to allow my code, which I had written, to be licensed under those terms.

C) I did write a new one from scratch: http://landley.net/code/toybox

I wrote far more code in that than Bruce ever did in busybox, but that was pretty much just a hobby working out some leftover design ideas I had (much better underlying infrastructure than BusyBox was using). I wasn't particularly interested in competing with the ten year headstart Erik and I had given BusyBox, or the existing active development community Erik and I had grown around it, nor the energy Denys Vlasenko (the maintainer I recruited to replace me) was putting into it.

These days I have a todo item to push my design changes (and some of the toybox commands I wrote, such as patch and df) upstream into BusyBox, which would be somewhere between the third and the fifth complete rewrite of that infrastructure since Bruce's day (depending on how you want to count the scripts/individual stuff and moving the main.c code into libbb).

You seldom find Bruce arguing about the actual busybox _code_. That's because he's completely unfamiliar with it.

> Regardless of how long ago that project was forked and how little of his
> code remained after so many years, it was indisputedly his project begun
> with his code that all the other coders have hacked on over the years.

Nah, that was pretty disputable actually. I've never even _seen_ a version released by Bruce, the comparisons I did were against the oldest version Erik released (0.25), which was already pretty heavily modified from Bruce's time.

Erik Anderson took various forks of a project bruce had abandoned years earlier and stitched them together into a new project, which he proceeded to replace pretty much all of the existing code of within the first year or two. It probably would have been _easier_ for him to just start over from scratch, but that wasn't his style.

As to what Bruce originally did, he stitched together a dozen or so existing projects he hadn't written. The bulk of the original code was things like gzip, copied verbatim into his "new" project. Other projects (such as Red Hat's nash) did the same thing, but they didn't get turned into important embedded tools because they weren't repurposed and rewritten for seven years by Erik Andersen.

> Arent hackers supposed to have ethical standards and respect for other
> peoples work?

Dunno, ask Bruce. He certainly wasn't respecting the years I'd put into the project (at least twice what he ever had by that point), or the years Erik had (which was over three times as much as Bruce had ever done, without any input from Bruce, and that's just going by duration rather than lines of code which would give us an order of magnitude larger gap).

I made sure Erik Andersen had no problem with me going GPLv2-only, and if Erik had objected I wouldn't have done it, because I had (and still have) enormous respect for him as a developer. (As far as I'm concerned, Erik had veto power because he'd _earned_ it.) I also polled the list and discussed the issue for months publically with the busybox developer community. The fact that Bruce wasn't part of that community and had not been for a full decade, and thus didn't show up to complain until _after_ this process was Bruce's problem, not mine.

Also, Erik got permission from Bruce to relaunch the project way back, which was already a couple years after Bruce's involvement in the project had ended. (I.E. Bruce was long gone as a developer, Erik was just being polite and covering his bases.) Authority passed from Bruce (and a couple other developers who had maintained their own forks after Bruce abandoned the project) to Erik to me to Denys. But once authority has passed, it's passed. Erik never tried to order me around, and I can't order Denys around. (We can make _requests_, but "no" is a prefectly acceptable answer. The new versions are not put out by the old maintainer.)

The reason I have no respect for Bruce's "work" is because I've never seen him do any work for me to respect. In the five years I'd been poking at busybox (by the time I became maintainer and tried to clean up the license mish-mash) I had never interacted with Bruce as a programmer, and his contributions (if any) had never been discussed on the list or on IRC.

I had met Bruce once at a conference (in 2000 or 2001) back when he was working for HP, when I was going around interviewing potential guests for what became Penguicon. That was after he'd abandoned BusyBox and before I'd done more than casually poke at it, and we didn't talk about code. I mostly remember that HP could fly him in to be a speaker for free, which is presumably why he was there.

I think I worked on BusyBox for about three years before becoming aware Bruce had any historical involvement at all. Keep in mind that BusyBox contains code with Linus Torvalds' copyrights on it, and Linus has no personal involvement with BusyBox. Integrating external code and rewriting it to be smaller and simpler is one of the things BusyBox has always done. There were _hundreds_ of copyright notices in the busybox code.

Bruce simply isn't a coder. Hasn't been this decade, that I've noticed. He's an author and politician. (Hint: most people don't need an equivalent of http://perens.org/about/self-promotion/ on their websites.) His claims to fame are things like inheriting Ian Murdock's Debian project and giving it is current culture of hostility to newbies and close ties to the FSF. That isn't code, that's politics.

Other "political" figures in the community earned it. As much as I disagree with Richard Stallman, he's written tons of code that people actually use. I could tell you the projects Erik Raymond contributes to (currently GPSD and Battle for Wesnoth, historically bogofilter and fetchmail and the emacs lisp library and a dozen others.) But what code has Bruce written? Google is unhelpful here, so let's look at his own web page.

If you hunt around a bit on perens.org, you can eventually find http://perens.org/works/software/ (which is link #25 of 36 in the nav bar, obviously a high priority). That page starts by noting that back in the 90's he posted map data to the internet (which isn't coding, wasn't data he collected or created, happened in the floppy drive era, and he's pointing at work somebody else did on their website and somehow taking credit for it).

Next up is "Electric Fence", which is actual code but which the man page at http://linux.die.net/man/3/efence says was from 1987, and that man page ends with a "What's Better" section pointing at two other projects from the mid-90's. Wikipedia currently lists 23 separate projects that do this sort of thing (http://en.wikipedia.org/wiki/Memory_debugger) none of which are gcc's current built-in stuff like libmudflap. The efence implementation is a simple wrapper around malloc and friends that allocates a guard page before and another after each allocation. (Um, I've done that myself, back under OS/2 in 1996. You need a library for it?) Its project page at http://perens.com/FreeSoftware/ElectricFence/ says "a new version will be up shortly", but archive.org's oldest version of that page (from 2004) has it saying the exact same thing and pointing at the exact same version.

The next entry is his claim to busybox. Whatever else you want to say about it, the last actual coding he did on it was over a decade ago.

Then he has a page noting that some media center remote should work out of the box but didn't for him, so he had to tweak a config entry. (This is on his "software" page?). Then some javascript to pan and zoom some camera from firefox, and finally "convert vim outliner to various slide show formats".

That's it. I've seen undergraduates with a better programming portfolio. Heck, when I was an undergraduate I could have pointed you at various bulletin board systems I wrote (my first big C program and my first big C++ program were both bulletin board systems, back before ISPs), the bake build tool for OS/2 (which amazingly is <a href=http://www.os2bbs.com/download/gnu.html>still online</a>), the little mcga game I wrote in 8086 assembly, and all sorts of other stuff I can't even remember today. But I'm not the one claiming to be some great community leader, I just some developer who happened to be doing stuff that Bruce flipped out over.

Bruce did not show up on the busybox list to discuss code. Bruce doesn't seem particularly interested in code. It looks like Bruce _can_ code (although he might be a bit out of practice), but it obviously isn't nearly the priority in his life he makes it out to be. He's an "open source developer" who doesn't seem to _develop_ anything, but loves to order around those who do.

And you say I'm showing him insufficient _respect_?

Rob

(By the way, it's not about age. At Ohio LinuxFest in October, the keynote speaker was Doug McIlroy, the guy who wrote "diff" and "sort" at bell labs back in the 70's and also came up with the original idea for the Unix "pipe". I have enormous respect for him, and his presentation was as current and relevant as anything said at that entire conference, even though he retired from Bell Labs years ago and is currently 77 years old.)

Enough, please?

Posted Dec 20, 2009 1:27 UTC (Sun) by corbet (editor, #1) [Link] (3 responses)

On this thread, too, I would like to request that people just stop. The history, I think, has been sufficiently rehashed. LWN seems to have become a place where people go to throw things at each other; suffice to say that's really not part of my vision of the site. Please, let's move on.

Enough, please?

Posted Dec 21, 2009 6:10 UTC (Mon) by syspig (guest, #41889) [Link] (2 responses)

With all due respect, you opened the door when you chose to publish Mr. Perens' ill-advised press release. He's been soundly taken to task with some very informative posts, with cites to historical events that gives much needed clarity into his motives and claims.

While the tone may be somewhat harsher than is typical, this has been one of the most enlightening discussions I've seen here.

Enough, please?

Posted Dec 23, 2009 4:34 UTC (Wed) by BrucePerens (guest, #2510) [Link] (1 responses)

Sock-puppet alert.

Enough, please?

Posted Dec 23, 2009 8:54 UTC (Wed) by bronson (subscriber, #4806) [Link]

Cluelessness alert. :(

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:11 UTC (Thu) by landley (guest, #6789) [Link]

It was dual-licensed. We dropped one of the dual licenses by merging code under only one of the licenses (initially code that came from Linux kernel developers). We had a single valid license under which we could distribute the result.

This happened years before we _noticed_ and made it _official_. Our alternatives were to do a license audit and clean _out_ existing GPLv2-only code, or just accept that we'd gone GPLv2-only.

At the point this happened, Bruce had abandoned busybox completely for two years (leaving it to rot), and then never contributed to Erik Andersen re-launch of the project (not even posting a single message to Erik's new mailing list) for an additional seven years. The dude had been gone for most of a decade. The fact no code he'd written remained in the project was pretty _natural_ at that point, but lots of other people had contributed code under the original license terms: GPLv2.

When Bruce showed up out of nowhere to dictate terms to the current community, we listened politely. But he wasn't advising, or expressing an opinion, he was issuing orders.

BusyBox owes Bruce as much deference on licensing issues as the x.org project owes David Dawes of xfree86.org. Yes the x.org project includes code Dawes released under an older license he's no longer happy with. The older license is still valid, and the new project is moving forward based on the permissions it granted in spite of him. They are free to ignore the spiffy new license terms he's hallucinated up for himself, and he's free to continue his fork under any terms he likes.

I told Bruce at the time that he could create his own fork, and indicated the last version that hadn't _officially_ removed the "or later" language (telling him to do his own auditing of accidentally merged code from GPLv2-only sources). But that would involve work, so naturally he didn't do so. Meanwhile I went off and created my toybox project (from a fresh start) and did more work in that than Bruce ever did before abandoning busybox, and although I've lost interest in trying to replace busybox I've been feeding bits of it upstream to the current busybox maintainer as appropriate. I still get called in from time to time for questions about mdev switch_root and such, and I make the time for it.

Bruce is _irrelevant_ to busybox. Has been for a decade (in more ways than one).

Rob

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 15, 2009 22:47 UTC (Tue) by bug1 (guest, #7097) [Link] (10 responses)

Hi Rus, those early days of Busybox, good times...

I joined busybox when Eric took over, IIRC bruce hadnt dont much for a year or so, my 2c.

Bruce did make very important contributions to the project, he did work when the project was small and most likely to fail, before the strong community had formed around it. I also believe the design of busybox was well established when he left and i see that is one of reasons busybox has been successful.

Over time most of Bruce's work has been re-written (not because it was bad, but to optimise it for BusybBox's evolving functionality) im sure he still has a claim there.

But Bruce, the SFLC isnt negotiating on behalf of the project as a whole, it only needs one copyright holders, it doesnt need Rus's, yours or my permission to enforce the copyright.

I assume the SFLC is working on enforcing the GPL with as little external drama as possible, its very important that somone does it, and they have demonstrated they can do it.

AFAIK (not a lawyer) the action of the SFLC does not weaken the case for other copyright holders who also want to take seperate action, it probably makes it easier as they have made the case.

I can only speculate that your motive of wanting to be involved is different than the SFLC. If so it would be better to take a seperate legal action if for no other reason than to keep the image of the SFLC as clear as possible.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 1:47 UTC (Wed) by BrucePerens (guest, #2510) [Link] (9 responses)

AFAIK (not a lawyer) the action of the SFLC does not weaken the case for other copyright holders who also want to take seperate action, it probably makes it easier as they have made the case.

One of my concerns is that I can't see the terms of settlements if I'm not a party to them, because they're sealed. So, SFLC's work really isn't going to help me much.

I'm also concerned that I may have to get an attorney to pressure the organization that's supposed to help Free Software developers with legal assistance, because they have locked me out of this.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 2:29 UTC (Wed) by jsevy (subscriber, #37869) [Link] (1 responses)

It's more than a bit ironic if the organization pushing for free and open software is engaging in sealed settlements. I would think it would be a matter of course that the SFLC would be open about its interest in these cases. What level of financial compensation do they get? And how about the developers?

The complaint posted on the SFLC website regarding the most recent lawsuit against Westinghouse, Best Buy, Samsung, JVC, Western Digital, Bosch, and others asks the following in the "Prayer for Relief" section (p. 11):
"That the Court order each Defendant to account for and disgorge to Plaintiffs all profits derived from its unlawful acts;"
That seems likely to be a good-sized chunk of change. Not to question the integrity of the folks at the SFLC, but the combination of large amounts of money and secrecy tends to lead to bad ends (just ask your neighborhood legislator...)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 5:00 UTC (Wed) by cventers (guest, #31465) [Link]

It would be nice if the settlements could be open, but I think it's more of a legal reality that settlements tend to be closed. As for the prayer for relief, IANAL but I think the standard operating procedure is to sue for what the law entitles you to, and then depending on your objectives, negotiate settlement terms with the defendant.

I'm pretty sure the SFLC asks for enough money to pay for the next suit, plus a little bit more. Enough to self-fund. It's a great strategy... it's like a legal worm for bringing the software industry at large into compliance with the licenses of the code they are incorporating.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 4:26 UTC (Wed) by jmspeex (guest, #51639) [Link]

I won't get into the debate as to whether you own copyright to part of BB, I'll just assume that you *do*. What I'm not sure is why the SFLC would have to include every copyright holder or even more than one of them. On the other hand, I don't see how any settlement made with the SFLC would really help the company unless they can also somehow settle with all the other copyright holders.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 17, 2009 22:30 UTC (Thu) by landley (guest, #6789) [Link] (5 responses)

The SFLC's work isn't helping the BusyBox community at all as far as I can tell. And it's certainly not helping the BusyBox project, current maintainer Denys Vlasenko isn't a party either, and I'm unaware of a single line of usable code BusyBox was able to merge as a result out of any of the SFLC's previous actions. The SFLC is doing this for their own reasons, I'd say BusyBox is just an excuse.

I declined to be involved in this round of lawsuits, and thus can't see the new terms either. I blogged about all this before I ever saw your screed (which I still can't bring myself to read). Said blog entry is at:

http://landley.net/notes-2009.html#15-12-2009

I'm aware you believe you deserve special privilege here. More so than the project's current maintainer, apparently. The thing is, I don't care, and I don't HAVE to care. And I'm glad I don't. Go be "special" somewhere else, please.

I'm going to go do something productive now. Bye.

The Big Questions

Posted Dec 18, 2009 13:38 UTC (Fri) by pboddie (guest, #50784) [Link] (4 responses)

The blog entry raises a few interesting questions:

If Cisco got their toolchain from Broadcom and got sued by the SFLC, what does that say about Cisco's understanding of the licensing? If some bloke gives you a CD with some executables on it, do you not have this nagging doubt about it being legitimate? Thus, is it completely beyond the legal department of a major corporation to figure out whether they can distribute something or not?
Why didn't Cisco turn round and sue Broadcom over the same licence violation? (Probably because it would interfere with a game of "spot the cartel", I imagine.)
Is some corporation putting the Linux badge on their product more important than the whole freedom aspect: the expectation that contributors to such projects often have that end-users will finish up with the same opportunities instead of staring at blinking LEDs and wondering why the product doesn't work any more?
How is suing someone over actual copyright infringement the "equivalent of patent trolling"?

The SFLC can't act on these matters without doing so in the interest of at least one copyright holder, and the only reasonable argument I can think of against such apparently uncoordinated actions is either the potential uncertainty of further lawsuits on behalf of other contributors, or such actions taking on a "class action" label without legitimately representing the interests of those other contributors. Regardless of all this, however, it should be possible to contribute code to a project with the expectation that people honour the licence, without other contributors waving away licence violations because they are personally OK with such stuff.

Maybe this does make the average Free Software project a bit like a hedgehog/porcupine for careless licence violators - after getting pricked once, there's no guarantee that they won't get pricked again until they either put the animal down or learn how to handle it properly, but that's not an argument against Free Software: it's an argument for respecting software licensing regardless of the nature of the licence. Failing to respect the licence of a different kind of project or a differently licensed project could be the equivalent of putting one's arm into a tiger's mouth and then complaining about what happened next.

The Big Questions

Posted Dec 18, 2009 14:15 UTC (Fri) by paulj (subscriber, #341) [Link] (3 responses)

There's a new dynamic in play with Free Software.

It may have arisen out of an end-user-hacker ethic, typified by RMS being unable to fix a bug in his printer. However, today, now that many corporates have adopted free software for their products, many free software hackers see the corporates as *customers* or *employers* (potential or actual). No longer is the end-user's freedom to hack the concern, but the self-interest of maintaining good relations with those who pay your wages. E.g. in this particular case both Bruce and Rob Landley have explicitly stated that they have revenue-generating relations with various organisations that are adversely affected by this law suit.

I'm not trying to make any great value judgements here. It's not bad that people make money from free software and indeed it's a *requirement*, if free software is to be sustainable. Bruce and Rob both argue, as you note, that these suits affect adoption - and that could result in fewer jobs in free software down the line, which would hurt free software.

However, I have several devices (routers, laser printers, etc.) which contain sizeable amounts of free software, to an extent the product's functionality is dependent on it, yet I can not rebuild the software. Sure, I get the source to the Linux kernel and various generic utilities, but it's nearly missing the device and/or function specific stuff. Often there isn't even a working build system to create the firmware image format.

So it seems to me that, though free software has made progress in terms of jobs for engineers and re-use of code, it has not made much progress on the original end-user-hacker-freedom goal. Indeed, it seems that goal has mostly been abandoned by many free software hackers. This is perhaps a shame.

The Big Questions

Posted Dec 19, 2009 8:22 UTC (Sat) by landley (guest, #6789) [Link] (2 responses)

> There's a new dynamic in play with Free Software.

New? (Where were you during the dot-com boom?)

> E.g. in this particular case both Bruce and Rob Landley have explicitly
> stated that they have revenue-generating relations with various
> organisations that are adversely affected by this law suit.

Actually, I made more off the SFLC's various lawsuits than I did off of Cisco. (Despite never asking the SFLC for a dime.) The SFLC guys actually raised the money angle when I was breaking up with them, ala:

> meaning that Rob will not
> be named a plaintiff in any of the lawsuits and he will not be entitled
> to any potential recovery that comes from them.

(Gee thanks, hadn't noticed those were connected. Good to have that cleared up.)

Sticking with the SFLC would probably have been in my financial best interest, but obviously that's not what I did. (Anybody who goes into open source for the money is missing the _point_.)

Also, I kept working with Cisco for months after the suit was filed. (They understood that a lawfirm I'd worked with was taking action on behalf of another client, _I_ wasn't the one suing them.) I just wasn't _accomplishing_ anything anymore from an open source perspective due to management going into some sort of panic lockdown when lawyers were invoked, and Linux in general being massively de-prioritized within the company to limit their legal exposure to who knows what future lawsuits.

The thing was, they'd already been sued over the original Linksys router by the busybox developers (Erik Andersen's father's a lawyer) back in 2002 or so. That was the legal action that had gotten them to release their Linksys source code in the first place, from which OpenWRT and friends emerged. (Yes, Linksys responded to that first lawsuit by ceasing all Linux development and doing vxworks-based routers instead, and it took them about five years to get over it. But in that case the code release was worth it, as evidenced by OpenWRT and similar projects it allowed to happen.)

In that original lawsuit, the busybox developers hadn't _asked_ for the source code to the toolchain (because they didn't _need_ it, it was bog standard mips or arm depending on variant), so Linksys hadn't tracked it down back then. Now a _second_ group came around five years later and started rehashing the same old issues they thought were settled, and Cisco's management started going "if we settle with them, who _else_ is going to come out of left field and sue us?" And thus they started "limiting the company's exposure to Linux"...

So ENTIRELY PREDICTABLY the lawsuit drives Cisco away from Linux for at least another five years (possibly longer, twice may be considered a pattern), but this time we don't get valuable code and new open source projects on the order of OpenWRT and the half-dozen other projects that spun off from it. No, we get _nothing_ other than the FSF going "I'm still relevant, I'm still relevant, look I can file a me-too lawsuit five years late that accomplishes nothing!"

> However, I have several devices (routers, laser printers, etc.) which
> contain sizeable amounts of free software, to an extent the product's
> functionality is dependent on it, yet I can not rebuild the software.
> Sure, I get the source to the Linux kernel and various generic
> utilities, but it's nearly missing the device and/or function specific
> stuff. Often there isn't even a working build system to create the
> firmware image format.

You know what I considered the single most important thing I was trying to accomplish while I was at Cisco? The thing the SFLC's actions _really_ screwed up? Hobbyist access to serial adapters for their routers:

http://landley.net/notes-2008.html#05-12-2008

Cisco's engineers have a little dongle circuit that gives a serial console on an unmodified router. The one I got for the WRT610n hooks under one of the ethernet ports (the ethernet cable holds it in place), where it connects to some extra pins and translates the result into a serial port. (It's not just wiring, there an actual chip in the thing converting the TTL signals into rs232, I took one apart to see why it wasn't working and it turns out to be a nontrivial piece of equipment.)

The problem is, they only ordered a small number of them as debug adapters for in-house use during development, and at such low volume each of the suckers cost more than the router it connects to.

I convinced the CTO I spoke to that something he could do to make the open source guys happy was sell those adapters to the community cheaply through a web page. That way hobbyists could get a serial console on their routers without needing to soldier their own chips to the board, which most hobbyists aren't up for. (He suggested giving some away at OLS, which was nice, but I wanted to make sure _everybody_ could order them. It's important to ask how people are supposed to develop an interest in fiddling with these devices in the first place: barrier to entry must be low for people who have not previously expressed interest. And you must be prepared for demand for development tools to scale up.)

Unfortunately, end-user access to the debug adapters went out the window when the SFLC sued 'em and everything went "under review". (Making the open source community happy ceased being a priority overnight.) And thus if you want to reflash your router today, you have a way harder time of it than necessary thanks to the SFLC and the FSF.

The _sad_ part is the community already had working toolchains built from source that targeted all these boards, and had for years, so the SFLC's suit served no possible pragmatic purpose. Just as none of the lawsuits I was involved with ever resulted in a single line of code merged into the busybox source control repository. It was all ivory tower idealism with a _negative_ pragmatic result.

> It's not bad that people make money from free software and indeed it's a
> *requirement*, if free software is to be sustainable.

Just like it's a requirement for all those bloggers to be paid to continue blogging. And all those deviantart accounts will close if people don't make money off of their drawings. Webcomic artists must get syndication deals for the artform to remain viable. People posting video to youtube are all in it for the money. Gold farmers are the only _true_ World of Warcraft players.

That would be a "no". Being able to make a living off of your hobby is a good thing, but it's not actually required for the continued existence of the hobby.

Some of us actually enjoy programming.

> Indeed, it seems that goal has mostly been abandoned by many free
> software hackers.

I'm an open source developer, not a free software developer. (GPLv2, not v3.) Perhaps this is why I continue to do it even when I'm not paid to.

Rob

The Big Questions

Posted Dec 19, 2009 12:30 UTC (Sat) by paulj (subscriber, #341) [Link]

You seem to have mixed together 2 different comments in replying to me, e.g. I didn't write:

> meaning that Rob will not
> be named a plaintiff in any of the lawsuits and he will not be entitled
> to any potential recovery that comes from them.

That wasn't me.

Re dotcom boom, I didn't put a time-frame on "new". I was drawing parallels between the early 80s user-hacker ethic that started things off and todays situation. I.e. "new" in the sense that something changed. Perhaps I should have said "changed" instead of "new". :)

I don't have enough information to say whether your stance or the SFLCs is correct. I can though imagine a counter-argument to your stance:

a) Who cares if Cisco no longer use Linux? It's not like they were contributing much back (directly or via whichever embedded Linux developer they outsourced to, including putting pressure on them to release).

And the more persuasive counter:

b) If they can't be bothered complying with the GPL, why should they face no consequences? Imagine 2 companies:

- BigCorp
- GoodCorp

BigCorp uses Linux, cause it's cheap and saves them precious per-unit $$ in royalties. Their upper-management have no great appreciation for free software and/or open-source other than expediency. They will release only as little code and material as they have to. They have a relatively large in-house legal team who are certainly capable of figuring out what their responsibilities are in distributing such software.

GoodCorp is medium-sized. They also use Linux cause it's cheap. However, they still have founder-engineers in their upper-management, who still appreciate some of the ethical aspects of free software. The company doesn't have huge resources, but they are willing to put in a little engineering effort into longer-term issues, like going through the community processes to get code reviewed and integrated upstream, as they can see some longer-term value in doing so. They are meticulous about making sure they comply with the GPL, and they even GPL some (or, in the case of AngelCorp, all) of their device/function specific code.

Now, the argument is, if BigCorp fails to meet its obligations, again and again, and NO action is ever taken against it, you are effectively punishing GoodCorp. GoodCorp is spending resources on complying with the GPL and engaging with the community, which BigCorp is not. So GoodCorp is at a competitive disadvantage. The rational thing for GoodCorp to do is to emulate BigCorp and free up those resources and lower its costs. And eventually one of the more businessy types in GoodCorps' management will prevail in this argument over the founder-engineer.

It sounds, from what you say that, if the SFLCs' case is sound, that Cisco are a serial offender who intend to milk free software for as much as they can. They surely have the resources and expertise to ensure they discharge all their GPL responsibilities, yet they have (it is alleged) failed to do so, even several years after a previous dispute.

Why do you think the softly-softly approach is justified, given the adverse economic incentives it provides to companies like GoodCorp and AngelCorp?

The Big Questions

Posted Dec 19, 2009 12:37 UTC (Sat) by paulj (subscriber, #341) [Link]

Re free software as a hobby:

Good point. No doubt many enjoy free software (or open-source ;) ) as a hobby. No doubt they would keep enjoying it.

However, hobbies are common-place in many fields, and don't tend to spring up ethical and economic frameworks around them. The idea that free software is a fundamentally better (ethically, economically, whatever) way to build software *generally* must surely therefore encompass more than just hobby programming. So it must surely encompass and *encourage* professional programming too. For if it did not then it would, as you allude to, be a hobbyists manifesto, which makes little sense.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 5:30 UTC (Wed) by jeff@uclinux.org (guest, #8024) [Link] (3 responses)

I'm all for bringing people into GPL / LGPL license compliance, of course.

These law suits are scaring the crap out of my customers too.
If you're going to do it, you have to make the details public.
Otherwise, the supposed point is moot. People cannot not just take a
look at say "Oh, ok all I have to do is... That ended Good for everyone,
I want to be in compliance!" Right now, this is just ripe for FUD.

STOP DOING THIS... or at least doing it this way. How is anyone to know
if SFLC is pulling a shakedown here or if this is actually being done correctly?

Sure, we may Trust, but we absolutely must also Verify your enforcement actions.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 5:47 UTC (Wed) by cventers (guest, #31465) [Link]

I totally understand why some people might be a little concerned. I'd like to suggest that for those who haven't, check Youtube for some of Eben Moglen's recent speeches / interviews. He talks about his strategy, and though I think the swings he takes at capitalism are really problems with corporatism, he has a hell of a message and a plan.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 11:45 UTC (Wed) by MKesper (subscriber, #38539) [Link]

As licensing is still a problem for many vendors, FSFE's Freedom Task Force has compiled some useful compliance tips for vendors. It's always better to inform yourself before risking being dragged to court. It's also possible to book some training or consultancy concerning Free Software.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 13:54 UTC (Wed) by pboddie (guest, #50784) [Link]

These law suits are scaring the crap out of my customers too.

Then the legal departments at those customers, presumably the people in any given company having the most crap scared out of them, should consider doing their job a bit more effectively and/or helping the engineers respect software licences. It wouldn't surprise me if various corporations shipped bits of proprietary software illicitly ("Hey, I found this great DLL on the net - let's include it in the product!"), but corporations with numerous legal people on staff don't really have many credible excuses for non-compliance. They end up sounding a bit like restaurant owners whining at health inspectors because their restaurants got closed down, and deserve about as much sympathy.

And note the the named corporations were all contacted, but I suppose they thought that as (representatives of) mighty, important corporations, giving the brush-off to a bunch of people they'd never heard of was a smart move, rather than follow up on the complaint. If your customers are the kind of businesses that behave like this, then maybe they should be worried, because they could be sued in numerous ways for a bunch of other, completely unrelated stuff if that's their attitude towards, say, safety and liability issues.

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 7:41 UTC (Wed) by jamesh (guest, #1159) [Link] (6 responses)

I'm trying to understand what the value of the waiver Bruce Perens is offering here.

I haven't done any investigation into the spat between Bruce Perens and Robert Landley, but it seems pretty clear that the SFLC is representing some people with a copyright interest in BusyBox, and that copyright is being infringed.

I don't see how a waiver from Bruce could absolve any party from that infringement.

As long as the SFLC is clear about who it is representing and what they have standing to sue about, then what is the problem?

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 7:50 UTC (Wed) by dlang (guest, #313) [Link] (5 responses)

for the record, Rob Landley is not being represented by the SFLC here.

Bruce can issue a statement promising not to sue over anything he owns the copyright on, but he cannot do so for code that other people own the copyright on.

That's not to say that a waiver from Bruse has no value. There's always the chance that it will confuse someone enough to actually take a case to court and get a formal ruling on the GPL ;-)

Bruce Perens: Statement on Busybox Lawsuits

Posted Dec 16, 2009 8:30 UTC (Wed) by jamesh (guest, #1159) [Link] (4 responses)

So the waiver means those companies don't need to worry about Bruce filing a follow up lawsuit after they've finished settling with the SFLC?

I guess it is too bad that they can't claim to have been distributing BusyBox under the GPLv3 and then rely on the 30 day grace period to fix the violation.

Yes, it's like RMS's waiver...

Posted Dec 16, 2009 14:52 UTC (Wed) by khim (subscriber, #9252) [Link] (3 responses)

I don't see what the hoopla is all about. We've been through this before. I don't see why everyone is so excited about this. Illegal change of note is violation of GPL: GPL gives you certain rights, but it does not give you right to change copyright notes (You may copy and distribute... provided that you ... keep intact all the notices that refer to this License and to the absence of any warranty). Once you've changed notes and redistributed the result you've lost you right to use the code in question. Permanently. Irrevocably. (Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License). GPLv3 is more forgiving in this regard but GPLv2 is not: minor violation - and you are out.

This waiver just says: I don't think this small misunderstanding is enough to make license void. I give you permission to use my code in Busybox if the change of copyright notice was the only violation.

Yes, it's like RMS's waiver...

Posted Dec 20, 2009 5:21 UTC (Sun) by dmag (guest, #17775) [Link] (2 responses)

> Illegal change of note is violation of GPL:

Sounds good, but I'm still confused. Everyone agrees we can convert "V2 Or later" to "V2 Only" but nobody agrees HOW to do it.

In practice, keeping the "or later" clause at the top of the file after you merge in "v2 only" code is dangerous.

Or the reverse: I've got a "v2 only" file, and merge in a few lines of "or later" code. Do I put "or later" at the top of the file now?

I think both sides would like the FSF to identify exactly how to merge V2+ and V2-only code.

> GPL gives you certain rights, but it does not give you right to change copyright notes (You may copy and distribute... provided that you ... keep intact all the notices that refer to this License and to the absence of any warranty).

I'm still confused. I thought "this License" meant the v2 GPL. The "or later" clause is NOT part of "this License" (because it actually refers to multiple licenses).

> GPLv3 is more forgiving in this regard but GPLv2 is not: minor violation - and you are out.

"you are out" means I get sued, right?

Suing people (after talking to them of course) might be bad in the short-term, but it is a good long term strategy. (reminds me of RMS -- look at the future, not today).

The fact is that companies are pathological. They will gladly make cribs that kill babies until the government makes it unprofitable by making those cribs illegal to sell.

Companies will stick their heads in the sand about the GPL until forced to deal with it. (I know, I've been an engineer telling my boss we should comply with the GPL, and the boss says "we can deal with that later".)

It was done many times before.

Posted Dec 20, 2009 7:54 UTC (Sun) by khim (subscriber, #9252) [Link]

Sounds good, but I'm still confused. Everyone agrees we can convert "V2 Or later" to "V2 Only" but nobody agrees HOW to do it.

Take a look on OpenSSL for example. This package changed licenses 2 or 3 times. You keep copyright notices from old owners around and just add a new one in files where new, "V2 only" code is added. Looks ugly, yes, but it's the only way to do legally it.

The only legal way to remove or change copyright notice without consent of copyright owner is if you remove the file and/or replace it with a brand new one.

I'm still confused. I thought "this License" meant the v2 GPL. The "or later" clause is NOT part of "this License" (because it actually refers to multiple licenses).

License is V2 GPL, but as you've pointed out "or later" clause is NOT part of teh license and it's NOT part of the licensed material. It's COPYRIGHT NOTICE and it's modifications is discussed in GPL separately (as in: it explains how to add the note and makes it impossible to change it).

"you are out" means I get sued, right?

No. You can be sued (since you are distributing the stuff without license), but this is not automatic.

Companies will stick their heads in the sand about the GPL until forced to deal with it. (I know, I've been an engineer telling my boss we should comply with the GPL, and the boss says "we can deal with that later".)

Looks like "the later" is "now". Most companies now publish sources like GPL requires (of course they can not be used as most hardware out there is TiVoized, but that's another story), but few holdouts will probably not change their ways till goods will not be confiscated for copyright violations.

Yes, it's like RMS's waiver...

Posted Dec 23, 2009 4:28 UTC (Wed) by Baylink (guest, #755) [Link]

I posted a comment earlier tonight that might clarify this for you.

The issue is not individual file licenses, which it's clear you cannot change; it's how you can validly distribute an assembled package, which depends on both the incoming licenses (to you) and the licenses you apply to your changes (since the only time this matters is if you're changing or extending a package *and then distributing it yourself*.

Linux Driver Gode

Posted Dec 16, 2009 10:36 UTC (Wed) by sylware (guest, #35259) [Link] (1 responses)

And the other coders? busybox has copyrights olders who would go for the code. Bruce Perens did write busybox alone?
Apart from that, those suits should be used to retreive optimal Linux driver code.

Linux Driver Gode

Posted Dec 17, 2009 21:52 UTC (Thu) by nix (subscriber, #2304) [Link]

Apart from that, those suits should be used to retreive optimal Linux driver code.

These lawsuits which... have nothing to do with the Linux kernel? How does that work?

A question and a thought.

Posted Dec 16, 2009 12:13 UTC (Wed) by zotz (guest, #26117) [Link]

Question: if someone violates the GPL license on code whose copyright is vested in a number of persons and is sued by one of the copyright holders. When they settle with the person who sues them, it would be my guess that they still lack the right to distribute the code, am I correct? (Discussions welcome.)

Thought:

Bruce, how about a suit whose aim is to unseal the agreements? 9If I am correct above, would that complicate this play?)

drew

Too many lawyers are bad for a country

Posted Dec 16, 2009 13:05 UTC (Wed) by kragil (guest, #34373) [Link] (5 responses)

I am a strong believer in that if a country has too many lawyers it is bad for a countries "health". While you need a certain amount of lawyers to have a working democracy with bureaucracy etc at some point the benefits turn to deficits. At the end of the day the producing part of the county has to feed the whole legal system and that is where certain countries have crossed the line (certainly the US and I guess also Germany)

There are insane business models in our legal systems today .. it really is a big problem which nobody seems to talk about.

Monsanto suing corn farmers for patent infringement and the porn industry suing kids for file-sharing is just the tip of the iceberg.

I guess the problem is that most politicians are lawyers themselves ..

Too many lawyers are bad for a country

Posted Dec 16, 2009 17:16 UTC (Wed) by terber (subscriber, #3311) [Link] (4 responses)

Too many lawyers are bad for a country

Posted Dec 16, 2009 17:25 UTC (Wed) by kragil (guest, #34373) [Link] (2 responses)

Cool thanks! OK, I guess I was right about Germany .. not so about the US and I really wonder how France is able to sustain such an amount of lawyers ..

Too many lawyers are bad for a country

Posted Dec 16, 2009 17:59 UTC (Wed) by rsidd (subscriber, #2582) [Link] (1 responses)

That was "people per lawyer" not "lawyers per people". France has a low density of lawyers, if those numbers are right.

Too many lawyers are bad for a country

Posted Dec 16, 2009 18:12 UTC (Wed) by kragil (guest, #34373) [Link]

Oh doh, sure. Then my assumption about the US was right and about Germany/France was wrong.

I guess the US is doomed, gene and software patents are obviously a symptom of lawyer infestation.

Too many lawyers are bad for a country

Posted Dec 17, 2009 13:03 UTC (Thu) by janneke (guest, #15012) [Link]

People per lawyer
US: 265

I think that, technically, laywers also count as people; did you account for that? Otherwise the numbers may change a bit, eg

People per lawyer
US: 266

See? ;-)