Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 22:40 UTC (Tue) by zyga (subscriber, #81533)
In reply to: Garrett: The ongoing fight against GPL enforcement by donbarry
Parent article: Garrett: The ongoing fight against GPL enforcement

It is far easier to comply to proprietary license than to libre/free licenses. The primary difference is (as someone had already put this elsewhere in the intertubes) that the supply chain is reversed.

In proprietary world if company A licenses something from company B then company A does nothing wrong and all the fault for what company B did falls on company B. This is because licenses say nothing about distribution (other than, say, per unit/volume price).

In libre/copyleft world this is reversed. If company A licenses/acquires something from company B and company B is a crappy/shady license violator _ALL_ of the legal problems fall on the large and complex company A. This is because our beloved copyleft licenses are distribution licenses.

In that case you must control all your suppliers (and in a typical large company that list seems infinite, often including a bag of tiny/small shops). What if a supplier goes out of business. Do you really think they have all the legal paperwork for each piece? In the world that chases time-to-market that is utterly impractical.

Hence, the less of this copyleft license 'risk' in your business the better for you. It's not about being evil, it's about covering your bases. Less exposure to potential legal issues == cheaper == better product.

to post comments

Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 22:59 UTC (Tue) by HenrikH (subscriber, #31152) [Link] (4 responses)

So go ahead and distribute a lot of boxes containing Windows 8 and see if you still can claim that Microsoft (or BSA) would only go after Company B and not you...

Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 23:33 UTC (Tue) by zyga (subscriber, #81533) [Link] (3 responses)

If company B sells a library for 0.01$ per unit and company A incorporates that in their next product that sells by the million they don't have to worry about people suing them for whatever B did. They have a contract, a library and some header files.

With GPL, company A also need a tarball from company B. They have an obligation to put it somewhere and keep it there for a few years after their product ships. If the tarball does not match the binary they are in trouble. This applies recursively.

Now multiply that by each piece of copyleft code in a typical distribution (I can understand why Android wants to get rid of much of GPL). See, that _is_ more complicated.

As for your Windows 8 example. Sure I'm certain if you started selling laptops with pirated Windows you'd get a call from Microsoft legal. My reasoning was about how licensing product component works.

Now, if Microsoft purchases an asset from a third party, do you see Microsoft getting sued for something the third party did illegally?

Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 23:59 UTC (Tue) by BrucePerens (guest, #2510) [Link]

If company B sells a library for 0.01$ per unit and company A incorporates that in their next product that sells by the million they don't have to worry about people suing them for whatever B did. They have a contract, a library and some header files.

Actually, this is not the case. Users of infringing software (both patents and copyright) can be sued for the infringement even if they didn't create it. This is not unusual for big-ticket commercial software. They may have indemnification as part of their contract. But in general an indemnification term from a small company is tantamount to a promise to go bankrupt upon lawsuit.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 0:47 UTC (Wed) by Duncan (guest, #6647) [Link]

> Now, if Microsoft purchases an asset from a third party, do you see Microsoft getting sued for something the third party did illegally?

Actually, yes. That's what has the smartphone market in such chaos ATM. The penalty is banning the product from being sold in whatever market where the laws were violated.

And in that regard, yes, the FLOSS world tend to be softies when it comes to license violations. I'm glad a few folks are standing up for their rights.

Meanwhile, a couple other points made well by others are worth repeating:

1) Whose copyright would /you/ choose to be found guilty of infringing, if it came to the choice, Sony's or SFC's? Sony doesn't exactly have a reputation of being soft on copyright infringement when it's there's, so why are folks trying to get them some slack for infringing that of others? (And the separate subsidiaries argument doesn't cut it either; if they wanted to be identified separately they'd not be using the same Sony brand name. Obviously they want the reputation that goes with the name, so they got it! Sony, the rootkit people! Sony, the people who sell a product with a set of services, then rip one of them away, after purchase! Sony, the folks known for making the lives of various customers a living hell, due to copyright infringement suits. THAT Sony!)

2) Never-the-less, if someone wants to create a BSD styled Busybox replacement to be free of the GPL obligations or for fun or for any other reason, as long as it's not using the same code, great! Let them do it! But, others in the community can note it and ask people with rights interest in other projects to step upto the plate, which is exactly what's happening. And if those people decide to or not, well, they're the ones with the copyright interest in the other projects, it's their decision to make.

So IOW, everything seems to be moving along pretty much as one might expect. An obstacle to the proprietary interests of some company becomes too much a thorn in the flesh for them and they move to avoid it. Normal and expected. Someone else doesn't like the way enforcement on a project they were involved in went and decides to create a new one with a licence that avoids the problem as they see it. Normal and expected. (Actually, that applies both to Landley and toybox, and the FSF and GPLv3.) This new project happens to fill the need created by that proprietary interests company looking for another alternative. What's unexpected about that? Other people in the community calling attention to all this and asking people who hadn't yet stepped up to the plate enforcement-wise with their copyright interest in other projects to do so. Well, that would be normal and expected as well.

What remains to be seen is if some of these other people /do/ decide to step up to that plate. If they weren't doing so before, perhaps they still won't, and violations will get more egregious. OTOH, perhaps it was just easier to let someone else take the heat, and now that they're not as effective any more, various other people with interests will fill the need.

Either way, it's their decision. And if they do enforce, then we'll see the cycle start again. And if they don't, well, perhaps at some point almost everything will be Tivoized and there won't be enough open products at a low enough cost to continue development, at which point the tragedy of the commons will prevail and all those proprietary companies will end up paying more for proprietary solutions. After all, they wouldn't have been using the FLOSS solutions if the FLOSS solutions weren't a good cost/benefit to them, so if they cause them to disappear thru locking everything up, they'll only have themselves to blame when their own costs go thru the roof due to FLOSS dying out because everything /is/ locked up.

But in practice, there does seem to be a dynamic balance that has seemed to tilt toward FLOSS. There's always the danger of reversals in various areas, but they haven't stopped the FLOSS train yet, and with vigilance, I don't believe they'll stop it now. IOW, I expect others to step up, now that they're needed, and continue the fight.

Duncan

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 11:48 UTC (Wed) by HenrikH (subscriber, #31152) [Link]

>If company B sells a library for 0.01$ per unit and company A incorporates that in their next product that sells by the million they don't have to worry about people suing them for whatever B did. They have a contract, a library and some header files.

Of course they do, Company A infringes on the copyright regardless of the license deal they have with Company B. The only "thing" that they have is that they can sue Company B for the damages that Company A suffered due to Bs infringement.

Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 23:08 UTC (Tue) by nybble41 (subscriber, #55106) [Link] (10 responses)

> In proprietary world if company A licenses something from company B then company A does nothing wrong and all the fault for what company B did falls on company B. This is because licenses say nothing about distribution (other than, say, per unit/volume price).

> In libre/copyleft world this is reversed. If company A licenses/acquires something from company B and company B is a crappy/shady license violator _ALL_ of the legal problems fall on the large and complex company A. This is because our beloved copyleft licenses are distribution licenses.

That makes no sense. If the license says nothing about distribution then, per copyright law, no distribution is permitted. B thus had no legal right to provide the software to A, and A has no legal right to keep it (although, as mere recipients, they are not culpable provided they were not aware that B lacked a distribution license).

The libre/copyleft case is very similar. If B does not follow the license then it has no legal right to distribute it, which means B is in trouble for making unauthorized copies, not A. Under normal circumstances this would mean that A also has no legal right to keep the software, but most libre/copyleft licenses include the provision that anyone receiving the software has a direct license to the original, unmodified version from the original copyright holder, which they retain even if some intermediate distributor is found to be in violation. In other words, A is somewhat shielded from B's violations compared to situation with proprietary licenses.

Since libre/copyleft licenses typically restrict only distribution, not use, A only needs to ensure that A is compliant with the licenses in the event that A redistributes the software. That includes checking that B actually gave them everything they are required to provide to others per the redistribution terms, but that does not seem like a particularly onerous requirement.

Garrett: The ongoing fight against GPL enforcement

Posted Jan 31, 2012 23:52 UTC (Tue) by zyga (subscriber, #81533) [Link] (4 responses)

I meant that you usually (when dealing with non-copyleft code) have a simple compliance chain. You got a binary/source from some company. You paid once (or pay per volume, for which the required infrastructure/experience has been in place for as long as either company exists), end of the story.

You don't have to do anything more to comply with such a license. If the agreement includes GPL/LGPL code in the mix you need to do additional steps to stay compliant. You have to retain the source for a period of two (AFAIR) years. You must have the infrastructure to offer it to your customers. You have to allow re-linking of your binaries with different version of LGPL-covered code. You may have licensing conflicts (Apache + GPL + something else end up in one binary by accident).

If someone motivated comes along, peels through those 'open source' tarballs associated with a product made by company A and finds some problem then company A has to deal with it. They may risk loss of distribution rights. You just don't get those issues with proprietary licensing.

While Your reasoning is correct (it sounds better to use copyleft) the practical ramifications that copyleft licenses have for production say otherwise. From my experience they add new steps that companies are not familiar with and are not equipped to comply with, with the same ease as they are equipped to comply with proprietary licensing.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 1:07 UTC (Wed) by rahvin (guest, #16953) [Link] (1 responses)

What is different than a upfront cost of $x or $x per unit versus some record keeping (which you have to do with the proprietary license anyway to pay that per unit cost) and making available source?

You're saying one cost (proprietary) is acceptable and expected, but the cost of GPL compliance is this big unexpected completely unreasonable thing.

It's the cost of compliance, if you can't comply don't use GPL code. And again, although the steps might be different this is no different than all the expense and tracking that commercial software requires. Sure you might find a company out there willing to cut you a pile of commercial source of a fixed one time fee but the contract WILL include auditing, tracking and other requirements. Maybe there is a single software vendor out there that doesn't but I'd wager that the chances of compliance with commercial being easier and less work than the GPL being near zero.

Just because companies are lazy and don't track, document and perform due diligence on their requirements for compliance with GPL does not excuse that behavior. It's incompetence on their part, even GPL software has a cost to use.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 12:42 UTC (Wed) by sorpigal (subscriber, #36106) [Link]

> You're saying one cost (proprietary) is acceptable and expected, but the cost of GPL compliance is this big unexpected completely unreasonable thing.

It's not reasonableness. Upfront costs are predictable and well understood. GPL compliance costs are variable and not well understood. Once you're out of some executive's comfort zone it's a hard sell.

In addition, compliance failure for proprietary stuff tends to be "monetary damages" and, rarely, an injunction preventing further sales. Again, lump sum payments and nothing further to worry about. For GPL you move again outside of the comfort zone.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 20:39 UTC (Wed) by davide.del.vento (guest, #59196) [Link] (1 responses)

Oh man, you talk like these tarballs are coming out of the blue! These is the stuff you are supposed to use when you develop your prototypes. If you can't deal with them in the first place, your product will not work. You just need a website where people can download them, which, sure would cost too much, because, you know, websites can cost up to few bucks per month these days..

I'm sure you won't use these tarballs to create the production stuff you ship, but that stuff doesn't come out of the blue either. You must have a prototype first, which at a given time you freeze.

Your excuses sound pathetic.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 2, 2012 9:27 UTC (Thu) by zyga (subscriber, #81533) [Link]

If you have 3rd party suppliers that provide almost everything for you then this is a real problem. If you think everything is rebuilt then you surely have an idealistic view of how production works. Often all you do is build your app on top of a toolkit ant 3/4 of the "open source" code there is just whatever was provided by the supplier.

Now suppose a tarball you got does not properly match the binary (which you don't really care about as long as it works, you also don't have the time expertise or time to rebuild and test all components). Now you have a license compliance issue that puts your product at risk.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 0:02 UTC (Wed) by dlang (guest, #313) [Link] (4 responses)

the principal of first sale comes into play in the normal case.

If the supplier paid for the component, you don't have to even think about any issues related to that component.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 0:15 UTC (Wed) by nybble41 (subscriber, #55106) [Link] (2 responses)

The principle of first sale applies equally to copies of proprietary software and copies of GPL software. If you don't need a distribution license in the proprietary case, you don't need to accept the GPL either. On the other hand, if you *do* need a distribution license, then compliance with its terms is entirely your responsibility either way. For the GPL, all you really need to do is package up the source you used to build your own binaries and distribute it along with them. Making sure you can rebuild the binaries you're redistributing from the source you received isn't a particularly high hurdle.

If course, if you still think proprietary licenses are easier, you're welcome to avoid GPL software. It's your loss.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 0:23 UTC (Wed) by dlang (guest, #313) [Link]

as I understand it, the key is if the transaction is structured as a sale or as a license.

yes, there are conflicting cases on this that have weakened first sale, but there's still teeth in it.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 5:52 UTC (Wed) by dlang (guest, #313) [Link]

going in to more detail.

yes, first sale applies to GPL code as well.

If it didn't you would see people sueing wallmart, best buy, etc instead of Cisco (after all, you probably didn't buy the netgear access point directly from Cisco.

Looking at this from another way.

If someone doesn't copy anything, then there is no way for a copyright license to apply.

So if you were to buy devices with GPL code in them, not copy anything, and sell them again, there is no way that a copyright license can force you to do anything as you are not making any copy.

What "first sale" would _not_ give you is any right to make copies of the GPL code

This doesn't help the supplier problem because the supplier isn't providing you with a separate copy of the binary for each device, they are giving you source code (or a file binary) that you then copy on to each device.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 0:15 UTC (Wed) by BrucePerens (guest, #2510) [Link]

Vernor v. Autodesk limits the doctrine of first sale with regard to software.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 7:46 UTC (Wed) by nim-nim (subscriber, #34454) [Link] (3 responses)

> In proprietary world if company A licenses something from company B then
> company A does nothing wrong and all the fault for what company B did
> falls on company B.

That's why Apple is suing Google for the features it does not like in Android, and Microsoft is shaking up kernel devs for FAT patents.

Oh, wait. They're not doing that. They're going after the manufacturers of the final end-user products.

So how do things work differently in the proprietary world again?

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 8:33 UTC (Wed) by zyga (subscriber, #81533) [Link] (2 responses)

They are not going after those companies because of license issues. They fight for patent extortion money. That's different and does not change my case. I still think there is an advantage of building a product out of proprietary bits because then the vector for being sued is very small. In copyleft world you need to go the extra mile to comply (accurate source, object files for static linking -- anyone seen that around?) and you are wide open for patent trolls that can go after you because their lawyers found a for loop patent in the code that is a part of your product.

Garrett: The ongoing fight against GPL enforcement

Posted Feb 1, 2012 11:03 UTC (Wed) by nim-nim (subscriber, #34454) [Link]

Because the entities that do not want to care about free software licenses worry about the patent vs licence distinction?

They don't. It's all of a big 'IP rights' soup for them (the latest Oracle vs Google complaint is a good example; we make the distinction because we want to be clean and tidy, proprietary houses stuff all in the same bag).

For the practical use case presented here (assemble bits sourced elsewhere in an hardware appliance, without checking legalities) there is *no* distinction between patents (for hardware components) and free software licenses (for software). They behave the same way. If you put unclean parts in your products you can be sued directly.

The purposefully inept corporation

Posted Feb 1, 2012 11:17 UTC (Wed) by pboddie (guest, #50784) [Link]

The "advantage of building a product out of proprietary bits" is that you can put magic binaries on a device where the few people who are likely to be disassembling them are unlikely to be doing so in order to determine copyright infringement, and even if that were their motivation, the result would be to pass the buck to the proprietary vendor if any infringement were claimed. In short, it allows sloppy management of software licences under the blanket of existing business relationships.

I agree with all those people who find astonishment in the apparent inability of large corporations to properly account for the origins of their code, especially given those complicated supply chains those companies have for everything else. But then large corporations also seem to only have a pretty vague idea of where their raw materials come from, especially when those materials come from places where the extraction or production of such materials is damaging to the environment and harmful to the people involved in the actual extraction or production.

I guess it's a case of "could try harder but won't".