Netfilter gets a GPL-enforcement injunction
| From: | Harald Welte <laforge-AT-netfilter.org> | |
| To: | coreteam-AT-netfilter.org | |
| Subject: | [PRESS RELEASE] Court grants Preliminary Injunction to enforce GPL | |
| Date: | Thu, 15 Apr 2004 16:06:11 +0200 |
FOR IMMEDIATE RELEASE --------------------- Of interest to editors and journalists covering: Linux, Free Software, Open Source, Copyright Law MUNICH COURT GRANTS PRELIMINARY INJUNCTION FOR INFRINGING USE OF GPL LICENSED SOFTWARE BERLIN, Germany - Apr. 14, 2004 -- The Munich district court granted (http://www.netfilter.org/) a preliminary injuction (http://www.netfilter.org/) against Sitecom Germany GmbH (http://www.sitecom.com/). This injunctive relieve has been applied by the netfilter/iptables project. Sitecom is offering a wireless access router product (WL-122) based on software licensed under the GNU General Public License (GPL), developed by the netfilter/iptables project. The GNU GPL is a license commonly used for many free software projects, such as the Linux Operating System Kernel. The GPL licenses software free of cost, but requires any redistributor to provide the full source code. According to the court order, Sitecom did not fulfill the obligations imposed by the GNU General Public License covering the netfilter/iptables software. In particular, Sitecom did not make any source code offering or include the GPL license terms with their products. Following a warning notice, Sitecom refused to sign a declaration to cease and desist. Thus, the netfilter/iptables project was compelled to ask the court for a preliminnary injuction, banning Sitecom from distributing its product, unless Sitecom complies with all obligations imposed by the GNU GPL. "To my knowledge, this is the first case in which a judicial decision has been decreed on the applicability and the validity of the GNU GPL", says Dr. Till Jaeger, partner of the Berlin and Munich based law firm JBB Rechtsanwaelte (http://www.jbb.de/) that represented the netfilter/iptables project in the litigation. This preliminary injunction follows a series of out-of-court settlement agreements that the netfilter/iptables project has concluded within a short period of time. When asked about the reasons for the sudden rise in legal pressure for GPL compliance, Harald Welte, Chairman of the Netfilter Core Team states: "We are not in any way opposing the commercial use of free and open source software. Specifically, there is no legal risk of using GPL licensed software in commercial products. But vendors have to comply with the license terms, just like they would have to with any other, even proprietary software license agreement." About the netfilter/iptables project The netfilter/iptables project provides state-of-the-art network security software for Linux firewalling, packet filter and network address translation (NAT), distributed as Free Software under the terms of the GNU General Public License. Being part of the linux operating system kernel, the software is running on virtually every Linux installation. For more information on the project or the software, visit http://www.netfilter.org/ Media contact: netfilter core team Harald Welte Phone: +49-30-24033902 Email: laforge@netfilter.org -- - Harald Welte <laforge@netfilter.org> http://www.netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie
Posted Apr 15, 2004 17:45 UTC (Thu)
by QuisUtDeus (guest, #14854)
[Link] (22 responses)
Did they modify the source for their firmware? Did they say they did? or do people assume they did? Is there any way to get to the binary code in the device? or is it only doing its job of making the device function? If the latter, then it would not seem to be "distributing the code" in the normal sense. If HP sells Linux pre-installed on a computer, are they expected to distribute the source as well? Maybe they do on CDs. If the installation CDs are included, and they contain the source, then that would be the case, but if they left out the source CDs thinking they weren't a big deal, would people be harassing them the way the embedded Linux device companies are being harassed? I just don't see the connection between selling pre-fitted hardware packages with Linux in them to a limited group of clients and making the source code available to everyone, even those that didn't buy the hardware package. If the source is already available in the well-known places, do they need to distribute it as well? If I help someone maintain a system with Linux on it and write custom scripts and build customized kernel configurations or maybe custom kernel modules, am I expected to provide the world all the source needed to recreate that custom system? If I turn this into a replicateable setup that I offer to others, does the expectation change? If vendors are harassed too much by Linux people, they may develop hard feelings and stop helping as much as do (or don't) now.
Posted Apr 15, 2004 18:00 UTC (Thu)
by talahin (guest, #4595)
[Link] (4 responses)
I think this is at the core of the problem. If they did modify Netfiler then it would be expected that the modified sources would be made available. Not only for Sitecoms customers but also for the Netfilter team, so they can learn from it. After all that's what the GPL is all about. Gerrard
Posted Apr 15, 2004 18:18 UTC (Thu)
by piman (guest, #8957)
[Link] (3 responses)
This is not true. They must provide the source code (or a written offer for it) themselves, not via the Netfilter site. Please read the GPL.
Posted Apr 16, 2004 8:28 UTC (Fri)
by Duncan (guest, #6647)
[Link] (2 responses)
Posted Apr 16, 2004 9:40 UTC (Fri)
by dcoutts (guest, #5387)
[Link] (1 responses)
[You must a), b) or c) ] c) Accompany it[the binary] with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) In other words comercial distributors must always provide full source code or a written offer to provide full source code. You only get to point to a URL/postal address if that's all you got in the first place and you're distribution was noncomercial.
Posted Apr 22, 2004 17:55 UTC (Thu)
by Duncan (guest, #6647)
[Link]
Posted Apr 15, 2004 18:12 UTC (Thu)
by dd9jn (✭ supporter ✭, #4459)
[Link] (5 responses)
It does not matter whether they modified the software, they are distributing it and thus they have to distribute the source too. It doesn't matter whether there is an easy way to get the software onto this device. If you distribute it on an soldered ROM on a mainboard, you still have to comply with the GPL. It is up to the user to tinker with the hardware to get the software updated. HP has to deliver the source with a preconfigured GNU/Linux box. If you maintain a system and change parts of the Linux kernel, you need to hand out the source to the owner of that machine. He will demand that anyway. You do NOT need to give your changes to the WORLD: The rule is simple: everyone who gets the binary has the right to get the source too.
Posted Apr 15, 2004 18:30 UTC (Thu)
by welinder (guest, #4699)
[Link] (1 responses)
Anyone hiring you to work on the box ought to ask for source, of course.
Posted Apr 15, 2004 22:30 UTC (Thu)
by tomsi (subscriber, #2306)
[Link]
If someone has deleted the changed source code, you can't release a kernel based on that code. Period. Read the GPL again; distributions does'nt have anything to do with it.
Posted Apr 16, 2004 17:38 UTC (Fri)
by bas (guest, #7043)
[Link] (2 responses)
Posted Apr 16, 2004 22:44 UTC (Fri)
by nix (subscriber, #2304)
[Link]
Posted Apr 16, 2004 23:59 UTC (Fri)
by piman (guest, #8957)
[Link]
If you do b), the offer must be given only to the people you distribute source to, even if the offer is valid for any third party. This is so the people you give source to, can pass along your offer if they in turn give the source to someone else.
Posted Apr 15, 2004 18:52 UTC (Thu)
by QuisUtDeus (guest, #14854)
[Link] (4 responses)
This would seem to make it a hefty task for someone packaging a Linux system: naming every GPL package and offering to provide the source for each one. I don't know that I have ever seen that, unless it is on a CD included, and the user would have to know to look there to find them all in the directory structure. So, what about SiteBuilder (or anyone) using the rest of the GPL code that is in the system? Netfilter is pressing the issue for their package, but the vendor could expect many more to happen as well if it doesn't do something similar for all other GPL'ed packages.
Posted Apr 15, 2004 19:44 UTC (Thu)
by dlang (guest, #313)
[Link]
if they don't do this a simple 'this product contains software licenced by the GPL, for details see http.......' they don't have to list each package individually in their documentation, just on the web/ftp site that contains the source.
Posted Apr 15, 2004 20:20 UTC (Thu)
by marduk (subscriber, #3831)
[Link]
Yeah, most people won't even read this (who really reads copyright notices), but the point it those who are looking for it will find it and know that it's GPLed and the source is available. I'm not sure if that fits under advertising. What exactly is advertising?
Posted Apr 16, 2004 2:49 UTC (Fri)
by mbp (subscriber, #2737)
[Link]
Whatever configuration-management or build system you use to assemble the system presumably knows the names of all the open-source packages that go into it. (Hopefully you are not just installing random things by hand with no traceability. If you are, you have more urgent problems than licence compliance.) A sane setup for building Linux appliances is to have a version-controlled (CVS, SVN, ClearCase) directory containing all the open source components as tarballs plus any patches you need to apply. When making a release, you just need to build an ISO image from that directory and either pop it in the box, or put it up on your web site. In addition, add a note to the documentation telling people where to get the source. 20 lines of shell. Too easy.
Posted Apr 16, 2004 4:36 UTC (Fri)
by JoeBuck (subscriber, #2330)
[Link]
The old BSD advertising clause required that in every advertisement for the product, a line like "contains software from the University of California, Berkeley" (or someone else) appear. Not just in the product itself, but in any advertisement.
Posted Apr 15, 2004 22:07 UTC (Thu)
by neoprene (guest, #8520)
[Link]
Is this _distribution_? If so, read the GPL carefully. >I just don't see the connection between selling pre-fitted hardware packages with Linux in them to a limited group of clients and making the source code available to everyone, even those that didn't buy the hardware package. If the source is already available in the well-known places, do they need to distribute it as well?< "Selling" a product is obviously distribution. Why don't you decompile Microsoft Windoze and use choice pieces for your product and sell it. See if Microsoft gets interested. Embedded or not, its code >If vendors are harassed too much by Linux people, they may develop hard feelings and stop helping as much as do (or don't) now...< If "vendors" wants to use code they did not produce themselves they should look into the licensing terms.
Posted Apr 16, 2004 2:43 UTC (Fri)
by mbp (subscriber, #2737)
[Link] (4 responses)
How can you think shipping a binary of the software is *not* distribution? Whether it is shipped on CD-ROM or a flash ROM, it's still being distributed.
If HP sells Linux pre-installed on a computer, are they expected to distribute the source as well? Maybe they do on CDs. If the installation CDs are included, and they contain the source, then that would be the case, but if they left out the source CDs thinking they weren't a big deal, would people be harassing them the way the embedded Linux device companies are being harassed?
Yes, if you get a computer from HP with Linux (or any GPL'd software) on it, you will get a CD of the source. If you don't, complain to HP and you will get it, and probably an apology as well.
Why do you call it "harassment" when somebody enforces their legal copyrights? I am pretty sure that the netfilter team were not less reasonable and patient about it than e.g. Microsoft would be if somebody were shipping PCs with pirated copies of Windows.
I just don't see the connection between selling pre-fitted hardware packages with Linux in them to a limited group of clients and making the source code available to everyone, even those that didn't buy the hardware package.
They are not required to provide source to people who didn't buy the hardware. Read the GPL.
If I help someone maintain a system with Linux on it and write custom scripts and build customized kernel configurations or maybe custom kernel modules, am I expected to provide the world all the source needed to recreate that custom system?
No, because those things do not create a derived work. Read the GPL. However, if you modified the kernel or a GPL'd module, then yes, you would need to give the source to your customer.
If vendors are harassed too much by Linux people, they may develop hard feelings and stop helping as much as do (or don't) now.
So you're saying, if I object to people infringing my copyright, they might not do it in future. That sounds pretty good to me.
Sitecom are welcome to use GPL'd software, as long as they obey the law. Is that too much to ask?
Posted Apr 16, 2004 11:06 UTC (Fri)
by tgb (guest, #745)
[Link] (3 responses)
You said: Section 3 (b) of the GPL states:
3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: ... b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, So, in fact, you do have to give the code to anyone who asks for it.
Posted Apr 16, 2004 11:44 UTC (Fri)
by dwalters (guest, #4207)
[Link]
> So, in fact, you do have to give the code to anyone who asks for it.
See the official GPL FAQ on this subject here. It says that "Valid for any third party" means that anyone who has the offer is entitled to take you up on it. IANAL, but I think this means that only those in possession of the copy (and therefore also the written offer) are entitled to ask for the source code.
This requirement only holds if you did not ship the source code with the product. The reason for this requirement, by the way, is so that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer. The GPL FAQ puts it like this: "The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you."
I recommend everyone who isn't a lawyer, but who has any dealings with the GPL, to read the FAQ in full. If you think you already know it all, I challenge you to take the official GPL quiz here.
Posted Apr 16, 2004 11:57 UTC (Fri)
by ballombe (subscriber, #9523)
[Link]
Posted Apr 16, 2004 23:35 UTC (Fri)
by mbp (subscriber, #2737)
[Link]
Note that clause 3 says "do *one* of the following" things.
I am not sure I see how shipping a device with firmware running in it is the same as distributing the software itself, like in binary format for someone to use on their computer. Maybe someone can explain it to me.Netfilter gets a GPL-enforcement injunction
"In particular, Sitecom did not make any source code offering or include the GPL license terms with their products."Netfilter gets a GPL-enforcement injunction
If Sitecom uses unmodified netfiler sources it would be enough to point a URL to the original netfilter site and including a printed version of the GPL.
> If Sitecom uses unmodified netfiler sources it would be enough to point a URL to the original netfilter site and including a printed version of the GPL.Netfilter gets a GPL-enforcement injunction
No, not if the code is /unmodified/ (as the poster to which you replied Netfilter gets a GPL-enforcement injunction
specified). In THAT case, a distributor only has to provide a pointer to
the original code from where THEY got it (or on up the line to the
original project site or developer).
Of course, if they DO modify the code, their modifications to the source
must be open-sourced, that is, they'd need to provide them, since no one
else would be because it was their own mod. However, once again, if those
mods are incorporated back into the main source, the original mod
developer would no longer have to provide source as they could point to
the main source code tree in which they were incorporated.
That, BTW, is one MORE reason to get patches submitted and incorporated
upline.. once they are, you no longer have to offer the source to them
directly, only publicly offer a pointer to the project's own sources in
which your patches have been incorporated.
Duncan (from my understanding of the GPL, altho IANAL..)
Quoth he from the GNU GPL, verse 3, point c)Netfilter gets a GPL-enforcement injunction
Aye, but (b) is also a choice: Netfilter gets a GPL-enforcement injunction
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange;
A "medium customarily used for software interchange" would by any modern
definition include the internet as one such medium, PARTICULARLY given the
use of the internet for just such interchange, of Linux and other GPL
licenced software, in general. Thus, a URL would be sufficient.
Then comes the question of whether pointing to the source hosted by
someone else would be sufficient. I think it could be, certainly in a
simple redirect from your site to the other site, so the URL would be
yours, but I could be wrong. However, in any case, the problem if it WAS
hosted by an unrelated third party would be ensuring that it remains up
for the necessary three years. Obviously, you'd be liable if the third
party failed to host it for whatever reason, and most businesses wouldn't
find such liability acceptable. That said, what they /could/ do would be
simply provide a mirror of the original software site, which would neatly
alleviate site update and administration issues, except for the hardware.
Now that I think about it, perhaps that's one reason mirrors of anything
widely used in open source are generally not so hard to find.
Duncan
Duncan
The GPL is pretty clear on that: If you distribute the software (or a product using the software) you must either include the complete source or accompany it with a written offer to deliver the source on demand, valid for at least 3 years.Netfilter gets a GPL-enforcement injunction
Netfilter gets a GPL-enforcement injunction
If you maintain a system and change parts of the Linux kernel, you need to hand out the source to the owner of that machine. He will demand that anyway.
That doesn't sound like distribution to me. Each to these steps sound
ok to me:
No distribution, so the GPL does not come into play as far as I can tell.
(Well, one could argue that step 2 is some kind of distribution, but at
that point there really is source, so no problem.)
The moment you release the compiled version of the modified kernel, you must also be able give the modified source code the those who have recieved the compiled kernel.Netfilter gets a GPL-enforcement injunction
Netfilter gets a GPL-enforcement injunction
> You do NOT need to give your changes to the WORLD: The rule is simple:
> everyone who gets the binary has the right to get the source too.
This is not true. Please read the GPL:
[you must (a), (b) or (c)]
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange;
Yes, that says "any third party", not just the people who got the binary.
But just above that, the GPL states
Netfilter gets a GPL-enforcement injunction
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
...
i.e., if you provide the person you give the binary with the source code, b) does not apply to you. You only need to do *one* of those things.
You can also do a), or c) if you distribute noncommercially.Netfilter gets a GPL-enforcement injunction
I have heard people talk about an "advertising clause" and that it was not compatible with the GPL. Maybe I am mis-remembering parts of different thoughts. Including a GPL notice for all (or for each?) GPL packages in the device sounds like a very clear advertising clause, at least for the GPL itself. I guess advertising clauses are not a problem after all?Netfilter gets a GPL-enforcement injunction
they don't need to print anything at all about linux or the GPL in any documentation if the CD that comes with the product includes the source.Netfilter gets a GPL-enforcement injunction
This is not difficult. Commercial licenses are done this way all the time. You see a page, or About dialog or whatever with various (broad) copyright notices. It shouldn't be that difficult to add a GPL notice something to the tune of "Contains software licensed under the GPL. A copy of the GPL can be found at ..."Netfilter gets a GPL-enforcement injunction
Distributing source for GPL'd components is a pretty easy task compared to building the system in the first place.Netfilter gets a GPL-enforcement injunction
Netfilter gets a GPL-enforcement injunction
>If I help someone maintain a system with Linux on it and write custom scripts and build customized kernel configurations or maybe custom kernel modules, am I expected to provide the world all the source needed to recreate that custom system? If I turn this into a replicateable setup that I offer to others, does the expectation change?<Netfilter gets a GPL-enforcement injunction
GPL is _NOT_ "public domain" free-for-all grab-what-U-want and sell it.
The GPL specifically was written to avoid the BSD black hole.
If "vendors" want to sell their junk to me it better has a Penguin on it first, else it will stay on the shelf. If hardware makers don't at least provide information for the Open Source community to build drivers from they will not sell much [like zero] of their stuff to a growing Linux market.Netfilter gets a GPL-enforcement injunction
Netfilter gets a GPL-enforcement injunction
They are not required to provide source to people who didn't buy the hardware. Read the GPL.
Consult the GPL FAQ
Contrariwise, GPL says 'provided that you also do _one_ of the following:' Netfilter gets a GPL-enforcement injunction
You may choose to redistribute under the term of alternative 3a) instead.
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange;
For example, by bundling a source CD-ROM together with the hardware.
Given that most hardware come already with a CD-ROM, this is not a huge
burden.
You are not *required* to give the source to anyone who asks for it, because you can avoid that obligation by giving source directly to people who get the binaries.Netfilter gets a GPL-enforcement injunction