Fedora and OpenH264 [LWN.net]

By Jake Edge
December 10, 2014

Did we ever mention that software patents are a serious pain for free-software projects? The usual problem is in trying to avoid them and, thus, the lawyers, lawsuits, and other exciting trappings of the patent-war landscape. But, even when the danger fades for a particular patent due to a seemingly open-source-friendly licensing arrangement, there may still be hiccups. Fedora has recently "resolved" a problem with the BSD-licensed H.264 video codec that Cisco announced in October 2013—by disabling its automatic installation.

Cisco has generously offered its OpenH264 codec for the heavily patented (and strongly enforced) H.264 video format without passing on the MPEG Licensing Authority (MPEG-LA) fees. That effectively makes the codec have zero cost if it is obtained from Cisco. Taking the source and building your own version of the codec doesn't convey the waiver of the patent licensing fee.

There is already an open-source H.264 codec in FFmpeg (and the Libav fork), but some distributions (like Fedora) don't ship it due to patent concerns. The OpenH264 project looks like a way around that problem, but the fact that it must be distributed by Cisco causes problems of its own.

For Mozilla, which was looking for non-patent-encumbered way to ship an H.264 codec with Firefox, using OpenH264 made perfect sense. So it integrated a way for Firefox 33 to automatically download and install the codec from Cisco. Doing so enabled Firefox Hello, which is a video chat feature using WebRTC that will even work between different browsers (e.g. Firefox and Chrome/Chromium).

The problem for Fedora is that downloading semi-random binaries from the internet and installing them where they will be executed based on content from elsewhere on the net could be seen as a potential attack vector. Even if there is nothing malicious about the binary (and there is no evidence that there is), it is not the way that most Linux distributions deliver software to their users. For Fedora, at least, it violates the packaging policy to install a binary that is not built in the distribution's infrastructure.

Florian Weimer filed a bug toward the end of October, noting that in addition to the build issue there were two problems with the license that Cisco provides: it is not presented to the user correctly in Firefox, but the bigger problem is that it has a restriction on the use of the codec (only allowing "USES IN WHICH IT DOES NOT RECEIVE REMUNERATION", which is an element of the MPEG-LA license). It is not exactly clear how the restriction should be interpreted, especially given that the OpenH264 FAQ explicitly says that Cisco competitors can use the codec in their products. Perhaps MPEG-LA believes that the purchasers of those products cannot use them for money-making enterprises?

The immediate problem for Fedora, though, was to stop Firefox from downloading and installing the codec binary. A Fedora Engineering Steering Committee (FESCo) ticket was filed around the same time as the packaging bug. At its November 12 meeting, FESCo decided to request that the Fedora Firefox-package maintainers disable the auto-download feature. That has since been done, though there was a misstep along the way and no update that disables the auto-download has been released to Fedora users.

There is a Fedora wiki page with instructions for those who would like to manually install the codec. It will not auto-update (as Firefox does), though, so users will need to be vigilant about updating when Cisco releases security alerts for OpenH264 (though the most recent is said not to affect Firefox).

Even though OpenH264 is, indeed, open, there is no way for a distribution (or anyone else) to determine that the binary downloaded corresponds to the source code provided. This is a general problem and is part of why distributions tend to build all of the packages they ship—or provide ways for users to build their own. Beyond just Fedora, Gentoo and Debian are also working on the Firefox auto-download problem.

Longer term, Christian Schaller is working with Cisco on a way to build OpenH264 on Fedora's infrastructure and provide a way for Firefox on Fedora to auto-download that version from Cisco. Presumably, if that works out, other distributions can also take advantage of it. There is some possibility that the Firefox trademark restrictions could rear their head if distributions head down that path, but there is a belief that Mozilla will not force Fedora to go the Iceweasel route.

It is likely an irritating situation for all involved. There may be a reasonable resolution at some point along the lines of what Schaller reported, but it still means extra hoops for Linux distributions (and Cisco) simply so that those distributions can ensure that their users are getting the code that they expect. It's open source, so that should be easy, but patents—once again—get in the way.

[ Thanks to Scott Dowdle for giving us a heads-up about this issue. ]

to post comments

Fedora and OpenH264

Posted Dec 11, 2014 13:35 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (8 responses)

Basically, If I understand the MPEG-LA stance right, as soon as you try to use anything encoded with their codec in a money context, you have to buy a separate license.

Thus for example a camera manufacturer needs to pay MPEG-LA to include H.264 in its products, and the users of those products need to buy a separate license if they try to use the produced files in a money context. The first license only covers the file creation, not their commercial reuse. Which is why MPEG-LA loves the Cisco proposal : it creates many new "must pay or desist" opportunities.

I suppose it also means that any commercial entity that supports desktops with Firefox installed better disable the Cisco stuff or be prepared to eventually pay MPEG-LA (OpenH264 only works for end-users in non money-producing contexts. Any user part of an org that pays support for his desktop is not such an end-user legaly, even if IANAL).

The IETF webrtc codec discussions can be quite enlightening. For example, this recent statement :

> In case of H.264, as far as our company is concerned, this implies that we
> cannot license H.264 IPR.
>
> To work around this, we are planning to offer
> H.264 in client software on the platforms where H.264 is provided by the
> platform itself or via OpenH264. In both cases, we consider H.264 licensing
> will be something that will occur between the end user and the platform
> provider, or, in case of OpenH264, between the end user and Cisco.
>
> If end
> users decides to ignore the H.264 licensing terms, as they typically do, this
> is between the end user and whoever provided them with the H.264
> license.
>
> We will not license H.264 ourselves or provide any H.264 licenses
> from us to our customers. In anything that we license directly to
> our customers or operate ourselves (which typically means professional
> conferencing services), we are planning to support VP8 only and will not
> claim WebRTC compliance.

https://www.ietf.org/mail-archive/web/rtcweb/current/

Since a distro *is* a platform provider, OpenH264 is poison (the more so for RHEL and other commercial variants). You can argue like this person that OpenH264 makes it the user+Cisco problem, but that's really not nice of you – you're putting your users in harm's way.

Fedora and OpenH264

Posted Dec 11, 2014 19:31 UTC (Thu) by dlang (guest, #313) [Link] (7 responses)

I believe that the situation with the Cisco provided codec is that Cisco is paying for the license for it (basically, Cisco already had an all-you-can-eat license and is using it to cover this code)

so there should not be any additional costs related to using it, the dane has already been paid

Fedora and OpenH264

Posted Dec 11, 2014 20:56 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (6 responses)

You are wrong. Read OpenH264's license. It contains the usual MPEG-LA clauses. Did you think Cisco could avoid them ? Cisco didn't reinvent MPEG-LA business model, it paid a standard MPEG-LA license with a very specific and narrow scope.

> Cisco provides this program under the terms of the BSD license.
> Additionally, this binary is licensed under Cisco’s AVC/H.264 Patent Portfolio License from
> MPEG LA
…
> THIS PRODUCT IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE FOR THE
> PERSONAL USE OF A CONSUMER OR OTHER USES IN WHICH IT DOES NOT RECEIVE
> REMUNERATION
(more limits follow)
…
> NO LICENSE IS GRANTED OR SHALL BE IMPLIED FOR ANY OTHER USE. ADDITIONAL
> INFORMATION MAY BE OBTAINED FROM MPEG LA, L.L.C. SEE HTTP://WWW.MPEGLA.COM

http://www.openh264.org/BINARY_LICENSE.txt

Funny how many people take promises at face values without even reading such short legal blurbs. I don't expect much from tech journalists but I'd have though lwn readers knew better.

Fedora and OpenH264

Posted Dec 11, 2014 20:59 UTC (Thu) by dlang (guest, #313) [Link] (1 responses)

lay off the personal attacks, nobody has enough time to read everything.

Fedora and OpenH264

Posted Dec 11, 2014 21:15 UTC (Thu) by nim-nim (subscriber, #34454) [Link]

The actual licensing text is shorter than this article. It's not lack of time that stops people from reading it.

Fedora and OpenH264

Posted Dec 11, 2014 21:09 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (3 responses)

And if the noncom part of the license was not nasty enough, MPEG-LA can sue you if you're caught reading a video produced by someone who didn't paid its fees!

> THIS PRODUCT IS LICENSED UNDER THE AVC PATENT PORTFOLIO LICENSE … TO … DECODE > AVC VIDEO THAT WAS … OBTAINED FROM A VIDEO PROVIDER LICENSED TO PROVIDE AVC
> VIDEO.

Not a licensed video provider, no license to use openh264 to read the result…

Fedora and OpenH264

Posted Dec 11, 2014 21:18 UTC (Thu) by bradh (guest, #2274) [Link] (2 responses)

Then doesn't that exclude using it for WebRTC (except in the unlikely event of a one-way transmission from a separately-licensed source)?

Fedora and OpenH264

Posted Dec 12, 2014 7:02 UTC (Fri) by nim-nim (subscriber, #34454) [Link] (1 responses)

That does preclude it from use in webrtc, except between noncom end-users or between them and someone using the services of a member of the MPEG-LA cartel

Which is why people are stating on the webrtc list that they will only support H.264 in commercial variants of their products, or when the H.264 support is provided by someone else.

And yes they understand it means their commercial products won't be webrtc compliant.

Mozilla does not care they only view Firefox as a personal use entertainment platform.

Fedora and OpenH264

Posted Dec 12, 2014 7:57 UTC (Fri) by nim-nim (subscriber, #34454) [Link]

Sorry, I should have written
> they will only include H.264 in NON-commercial variants

Fedora and OpenH264

Posted Dec 12, 2014 19:19 UTC (Fri) by flussence (guest, #85566) [Link] (1 responses)

I was pretty alarmed to find Firefox had dropped an executable binary in my home directory without seeking *prior explicit informed consent*. Not even a single word of that phrase.

...how did that get past Fedora's SELinux setup?

Fedora and OpenH264

Posted Dec 13, 2014 9:01 UTC (Sat) by jamielinux (subscriber, #82303) [Link]

Firefox on Fedora is not restricted by a specific SELinux policy. It runs as unconfined_t on a default install of any recent Fedora. Run `ps xZ` to check.

I think the reasoning is that a good SELinux policy for Firefox would be far too restrictive and annoying, whereas a policy that stays out of the user's way would actually be too full of holes to provide reasonable security.

Fedora and OpenH264

Posted Dec 19, 2014 20:48 UTC (Fri) by DavidS (guest, #84675) [Link]

Before reaing the details of the poison this license is, I wanted to add that this would be a great usecase for repeatable builds: fedora could build it on their infrastructure, onle keep the checksum and download the actual binary from Cisco.

Now I hope i'll never need any h264 content.