LWN: Comments on "Garrett: The ongoing fight against GPL enforcement"

Clarification on a few points

khim — Fri, 10 Feb 2012 12:45:08 +0000

Whether or not this is really required by the GPL is a question which (as far as I know) no court has ever ruled on point.

And I doubt it'll rule on it any time soon. SFC does not sue companies which tried to comply with GPL and just forgot to include couple of scripts in a tarball. It sues companies who blatantly violate it (that is: they neither give you source with binaries nor give you a written offer to provide such sources). When SFC is involved GPLv2 terms are no longer in play: offenders violated it, lost their rights and now must beg for forgiveness.

Of course it does not mean that the your question (is it fair to demand scripts used to build the image with GPLed component?) suddenly evaporates. But at this point it's morphed to the area of moral and conscience, not law.

How to avoid this problem? It's simple: publish the sources of the GPLed components. Toybox is not a solution. It may be first step on the path to the "true solution" (abandonment of all the GPLed components), sure. But if the plan is to remove all the GPLed components altogether, then I'd like to see the project with milestones and roadmaps.

Clarification on a few points

laf0rge — Fri, 10 Feb 2012 10:40:39 +0000

Is it really true that there was a requirement for audits of future source code releases? I spoke with Bradley Kuhn a couple of days ago, and he explicitly stated that there never was such a requirement or demand. Apparently they unilaterally _offer_ doing such reviews in the future. but that's completely unrelated to whether they reinstate the license or not.

Garrett: The ongoing fight against GPL enforcement

raven667 — Fri, 03 Feb 2012 19:24:28 +0000

> It only takes ONE supplier to make a mistake, and ALL of those products could be vetoed and off the market.

I don't think that is a legitimate statement of risk although clearly some people believe it.

> I'm quite happy to describe them as a victim.

I think that to be a victim requires a the abuse of a power imbalance of the stronger against the weaker which is obviously the opposite as the described situation. That's just my opinion though and reasonable people could disagree.

Garrett: The ongoing fight against GPL enforcement

Wol — Fri, 03 Feb 2012 19:18:11 +0000

You seem to be ignoring the elephant in the room.

As Tim points out, they are a big company. They have hundreds of products that use linux. It only takes ONE supplier to make a mistake, and ALL of those products could be vetoed and off the market.

Yes I know Sony Entertainment and Sony Hardware are totally separate divisions, and the hardware side is tarred with the entertainment brush, but the fact appears to be that the hardware side want to play fair.

Let me use a footballing analogy. I have no qualms with a sending off for a deliberate foul (and indeed, think that that should be the *automatic* penalty!). But I DO have an issue with a player getting sent off for an innocent mistake - for example if the keeper is out of his area and gets hit on the arm by a ball he may not even have seen coming...! As I understand the rules, if your hand or arm makes contact then it's handball. And if a keeper commits handball it's an automatic red card. Why should the keeper get sent off for that?

THAT is Tim's point. One player makes a mistake, and the entire team cops a penalty. And THAT is why I'm quite happy to describe them as a victim. (Sony as a whole, well... I was one of the people who's PC was trashed by the rootkit, so they are on my "do not buy" list, but just because I don't like them is no reason to ignore them when they are victims of what I perceive as manifest unjustice!)

Cheers,
Wol

Garrett: The ongoing fight against GPL enforcement

raven667 — Fri, 03 Feb 2012 19:05:07 +0000

> I also have the option to withdraw their authority to act on my behalf, if they violate that trust.

I think something that could make understanding this difference of opinion clearer is that they _did_ withdraw support form SFC for enforcing their copyrights on Busybox but SFC has other authors who continue to consent to SFC enforcement and so were unable to stop the enforcements after they lost trust.

Garrett: The ongoing fight against GPL enforcement

dwmw2 — Fri, 03 Feb 2012 12:13:24 +0000

"What do you think is actually going to happen if some random product your company makes were to be found in violation of copyright?"
"In the case of a busybox violation, I don't know. The information I have seems to indicate that the SFC will want to audit all of my products, going on a fishing expedition for GPL violations. I'm willing to expend resources to avoid finding out if that's the case."

I'd be very interested in how you came about this "information", and just what lengths you've been going to already to avoid finding out whether it's accurate.

Have you avoided attending any of Bradley Kuhn's presentations in the last year, and reading his description of the things that SFC actually does request?

"I think this really comes down to the fact that you trust the SFC to behave reasonably, and I don't.

I do. But I also have the option to withdraw their authority to act on my behalf, if they violate that trust. If all the unfounded hyperbole about the SFC's behaviour did turn out true, I would do so.

As it is, though, this hand-wringing just seems like a crude manipulating tactic to discourage copyright holders in other projects from joining with SFC, so that the cynical approach of silencing busybox developers actually does achieve the overall goal of letting GPL violations go completely unpunished.

Garrett: The ongoing fight against GPL enforcement

bronson — Fri, 03 Feb 2012 08:22:49 +0000

Or the MIT License, a personal favorite. It looks basically the same.

Garrett: The ongoing fight against GPL enforcement

dlang — Fri, 03 Feb 2012 01:34:44 +0000

you are forgetting that Rob is one of the people who started the busybox lawsuits.

He is not saying that there is never a case for lawsuits, but he is saying that the way the SFC is handling the lawsuits is not something he agrees with, and he has directed them to stop doing so on his behalf.

In other words, he tried doing it their way and didn't like the result. This isn't just armchair quarterbacking from him

Clarification on a few points

bronson — Thu, 02 Feb 2012 23:13:02 +0000

Have you negotiated with suppliers? Tried to evaluate their complex and hacky toolchains and whether your project should rely on them? It can get nightmarish even without worrying about GPL compliance.

Garrett: The ongoing fight against GPL enforcement

etienne — Thu, 02 Feb 2012 13:18:32 +0000

A lot of hardware is currently being sold which do not comply with the GPL, take the example of tablets with graphic cards controlled by closed source drivers/modules.
The closed source stuff is known to be non compliant, but has been acquired, with the hardware, under a NDA - so the company producing that tablet has no right to show the driver to a SFC representative (who probably will not sign a NDA).
So the only solution for the company targeted by SFC is to stop selling the tablet.
IHMO the result will be that some other third party company will start producing a graphic chipset which can have a GPL driver/module, that will be slower (difficult to display HD MP4 movies) but at least legal (to sell, use or buy a tablet).

OTOH, maybe some Linux distributions should more take care of the license of the software they are using, even if that bothers their users (startup messages telling where the BSD code is coming from...)

GPL in Android userspace

simonkelley — Thu, 02 Feb 2012 12:58:11 +0000

Android also has dnsmasq, which is GPLv2/GPLv3, in userspace. When they first started talking about removing GPL userspace I offered Google a license on pretty much any terms they wanted but covering use in Android only. They wouldn't take the "Android only" part, and dnsmasq is still in Ice Cream Sandwich under the GPL.

Garrett: The ongoing fight against GPL enforcement

gioele — Thu, 02 Feb 2012 12:57:22 +0000

Or maybe there's a minimal, only-no-warranty license out there somewhere that requires nothing except to agree to the no warranty thing.

The Unlicense license (<http://unlicense.org/>), derived from the SQLite license.

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or
distribute this software, either in source code form or as a compiled
binary, for any purpose, commercial or non-commercial, and by any
means.

In jurisdictions that recognize copyright laws, the author or authors
of this software dedicate any and all copyright interest in the
software to the public domain. We make this dedication for the benefit
of the public at large and to the detriment of our heirs and
successors. We intend this dedication to be an overt act of
relinquishment in perpetuity of all present and future rights to this
software under copyright law.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.

For more information, please refer to <http://unlicense.org/>

Garrett: The ongoing fight against GPL enforcement

Trelane — Thu, 02 Feb 2012 11:32:30 +0000

(Particularly, since we're talking about binary-only distribution,
> Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
)

Or maybe there's a minimal, only-no-warranty license out there somewhere that requires nothing except to agree to the no warranty thing.

Garrett: The ongoing fight against GPL enforcement

Trelane — Thu, 02 Feb 2012 11:26:40 +0000

No, BSD still has requirements to be met.

If what you're saying is true, then what he is wanting is public domain.

Garrett: The ongoing fight against GPL enforcement

paulj — Thu, 02 Feb 2012 11:14:31 +0000

He sees the "fix" of lawsuits as being detrimental to the use of GPL software by corporates. He makes his living from working for such corporates on such software. To my view, what Rob wants is a sort of honour system - where people release their changes to free software if they can, but where there should be no real enforcement consequences for those who don't.

In other words, what Rob really wants is to use the BSD-no-advert-clause licence.

Clarification on a few points

paulj — Thu, 02 Feb 2012 10:50:48 +0000

Google's already excluding all GPL code from userspace,

Hmm, Android's bluetooth support relies on Bluez, which is GPLv2+. Google stuck some IPC in between the Android stuff and the Bluez libraries, but I doubt that achieves the GPL-washing effect that Google are trying for, should BlueZ copyright holders ever care to do something.

So unless that's changed, your statement above appears to be incorrect.

Clarification on a few points

paulj — Thu, 02 Feb 2012 10:41:45 +0000

I am working on this in my role as an embedded Linux industry advocate, who tangentially happens to be a Sony engineer.

Are you saying that this work is not approved of or funded in any way by Sony (i.e. the corporate management infrastructure that oversees you)?

Otherwise, if you're doing this as part of a role funded by Sony, then you're acting in Sonys' interests as their agent. And in which case, you can't seriously think you can divorce what you do for your work from those who fund it?

Garrett: The ongoing fight against GPL enforcement

zyga — Thu, 02 Feb 2012 09:27:47 +0000

If you have 3rd party suppliers that provide almost everything for you then this is a real problem. If you think everything is rebuilt then you surely have an idealistic view of how production works. Often all you do is build your app on top of a toolkit ant 3/4 of the "open source" code there is just whatever was provided by the supplier.

Now suppose a tarball you got does not properly match the binary (which you don't really care about as long as it works, you also don't have the time expertise or time to rebuild and test all components). Now you have a license compliance issue that puts your product at risk.

Sealed

BrucePerens — Thu, 02 Feb 2012 05:16:04 +0000

Bradley wrote today about what the terms are, in this blog posting. It is unfortunate that most defendants are more willing to settle if the terms are sealed. But you can look at the IRS filings which Bradley linked to from his blog posting, and find out what money there was, and where it went.

Garrett: The ongoing fight against GPL enforcement

raven667 — Thu, 02 Feb 2012 02:32:56 +0000

I think calling large manufacturers "victims" when they are discovered to be engaged in copyright infringement and when the remedy is to comply with the very easy license terms is absurd, laughable. The whole purpose is to make license compliance easy and automatic while preserving reciprocity.

The "itch" that is being scratched here is the existence of the GPL and it's requirement for reciprocity. Many people are offended by the implicit assumption that enforcing the reciprocity terms of the GPL is a bad thing, that we should look other way if the offender is a big vendor. It's also offensive to suggest that the GPL is dangerous and that its license terms are too onerous or risky when that is clearly not true. There are many reasons to choose other licenses like BSD but I think in this case its not really a positive thing.

Sealed

Trelane — Thu, 02 Feb 2012 01:31:25 +0000

Because it's sealed. They're not allowed to. I would guess that it's Best Buy's request, but only the SFC knows for certain, and they probably can't say.

Garrett: The ongoing fight against GPL enforcement

Wol — Wed, 01 Feb 2012 23:24:57 +0000

Well, if the victim has been dropped in it by someone else, and made reasonable efforts to comply, then I *would* classify them as a victim.

Are YOU squeaky-clean absolutely-white in all your dealings?

At the end of the day, we all make mistakes, we all do things we shouldn't. And if, at the end of the day, some company decides that rewriting busybox is cheaper than risking a mistake, then they'll rewrite it.

That's my personal attitude to life as well - if I can, I *avoid* risk, I *avoid* temptation. Rob is seeking to provide a risk-free alternative, and Tim - whether on behalf of his employer or off his bat - sees it to his advantage to help.

At the end of the day, most Free Software people write software to scratch an itch. Rob and Tim are scratching their itch - who are we to complain?

Cheers,
Wol

Sealed

jiu — Wed, 01 Feb 2012 22:11:39 +0000

And why does SFC not insist on publishing the terms of these settlements? It would make things more straightforward.

Clarification on a few points

Wol — Wed, 01 Feb 2012 21:57:35 +0000

Whoops - I missed your comment about *if* Oracle choose the patent challenge route.

But, as you'll see from my other post, they DID choose the patent challenge route. And it seems the nuke detonated on launch ...

I can't remember all the figures, but they tried to sue over about 250 claims. The Judge said "that's too much, whittle it down to your best 15" or something like that. Google returned a major broadside and it seems out of those 250, Oracle is unlikely to find 15, or whatever it was the Judge said, to bring to trial! They might even get to trial only to find they don't have any valid patents to claim!

Cheers,
Wol

Clarification on a few points

Wol — Wed, 01 Feb 2012 21:52:08 +0000

Just to add to this - READ GROKLAW.

Firstly, Oracle launched this as a patent suit. Unfortunately for them, the patents have been comprehensively gutted.

Secondly, they threw in the copyright stuff as a side dish. Unfortunately, it seems to be all they've got left. And it's pretty irrelevant, because Google (a) never used the code in question, and (b) only distributed it by accident. It's a few lines of code (measured in hundreds of LOC if that), and it's part of the test suite that should NEVER get onto any shipping device.

Cheers,
Wol

Clarification on a few points

HelloWorld — Wed, 01 Feb 2012 21:42:36 +0000

How is this a "complex subject"? It's really not that hard to ship a leaflet that explains the customer's rights with the product and put a tarball on an ftp server. All I keep hearing is lame excuses.

Nothing personal, just business ?

khim — Wed, 01 Feb 2012 21:41:46 +0000

Sorry, but this is exactly how we've ended in this mess: reasonable if not downright nice people work for nasty companies with justification that it's Ok because it's big company and they can not do anything means that companies feel free to continue to harass customers, lobby for draconian laws, etc.

Sorry, but no. Justification that you just have sleazy colleagues who ultimately answer to the same CEO does not make it Ok even you personally have done nothing atrocious. Now, I'm not saying everyone should forget about their life, family and declare jihad against nasty companies despite onerous personal costs. If you have no reasonable choice and are forced to work for the nasty company then noone will condemn you. And if you were just offered 50% bigger compensation - then that's fine, too (if companies will know that their nastiness can cost them real money they will adjust, they are not stupid). But in all cases you should be slightly ashamed and look for the other opportunities if possible, not try to explain that "this SONY is not like that other SONY, no, they are totally different". This is your SONY and your actions will be viewed in light of "that our SONY" decisions.

Clarification on a few points

bronson — Wed, 01 Feb 2012 21:30:06 +0000

Thanks for that insight on a complex subject.

I guess a similar approach to software quality would be, "just don't write bugs."

Garrett: The ongoing fight against GPL enforcement

raven667 — Wed, 01 Feb 2012 20:58:01 +0000

Do you think a Cisco or a Sony would stop shipping product just because of baseless threats from the little SFC when they can demonstrate license compliance.

> What comeback does the victim have?

Aside from the silly tactic of characterizing the company as being a victim I would say the comeback for a bogus infringement suit would be to take it to court and smack the crap out them for wasting everyones time. If the SFC tried this they would probably go out of business instantly.

Garrett: The ongoing fight against GPL enforcement

raven667 — Wed, 01 Feb 2012 20:50:05 +0000

> I think this really comes down to the fact that you trust the SFC to behave reasonably, and I don't.

Yes, I think that is part of our disagreement, also I have the (maybe unfounded) belief that they really don't have the ability to enforce unreasonable actions. If they tried to veto software in bad faith for example then I would ignore their request and punt it to the courts to sort out. It seems likely that the SFC would lose badly if they tried anything in bad faith such as ignoring evidence of license compliance. I don't really have any reason to believe they would try something in bad faith though as it would be all cost and no upside for them.

I guess I don't think there is a need to "trust" the SFC to not turn into a copyright troll and the courts have been showing very little patience with copyright trolls recently.

Garrett: The ongoing fight against GPL enforcement

davide.del.vento — Wed, 01 Feb 2012 20:39:40 +0000

Oh man, you talk like these tarballs are coming out of the blue! These is the stuff you are supposed to use when you develop your prototypes. If you can't deal with them in the first place, your product will not work. You just need a website where people can download them, which, sure would cost too much, because, you know, websites can cost up to few bucks per month these days..

I'm sure you won't use these tarballs to create the production stuff you ship, but that stuff doesn't come out of the blue either. You must have a prototype first, which at a given time you freeze.

Your excuses sound pathetic.

Garrett: The ongoing fight against GPL enforcement

Wol — Wed, 01 Feb 2012 20:35:26 +0000

NO.

It's that if the SFC *THINK* you are infringing, they can stop you shipping the product.

What happens if the SFC are mistaken? What comeback does the victim have? Especially if, all along, the victim has been acting in good faith?

THAT is the problem - the SFC (quite reasonably) wants to make sure there is no future infringement. But the victim doesn't want to risk a (quite possibly time sensitive) product being delayed.

So Rob's attitude of "let's provide a product that doesn't give rise to that risk" is a very pragmatic, and in the circumstances sensible, approach.

Cheers,
Wol

Garrett: The ongoing fight against GPL enforcement

tbird20d — Wed, 01 Feb 2012 20:30:05 +0000

What do you think is actually going to happen if some random product your company makes were to be found in violation of copyright?

In the case of a busybox violation, I don't know. The information I have seems to indicate that the SFC will want to audit all of my products, going on a fishing expedition for GPL violations. I'm willing to expend resources to avoid finding out if that's the case.

And about your Mayor Metaphor, you can plainly see from the SFCs tax documents that they are not asking for million dollar fines.

That's not what they ask for, but if you total up all the tangible and intangible costs (product delays), that's what a big company hears. That's a simple ballpark placeholder for engaging in any litigation at this level.

that spending a thousand dollars on compliance efforts as in your example

I should have clarified that the $1000 dollars is not spent on compliance - that's already being covered by our compliance policies. That money in the metaphor refers to the amount we'd spend on re-implementing busybox with a BSD license. It's not insurance in the traditional sense. It's more like a payment to someone else, to make the person requesting a million dollars go away permanently. And no, I don't think we can reimplement busybox for $1000. But 10 companies could implement something usable for $10,000 a-piece.

I think this really comes down to the fact that you trust the SFC to behave reasonably, and I don't.

Garrett: The ongoing fight against GPL enforcement

raven667 — Wed, 01 Feb 2012 20:01:33 +0000

Which is why your position is even harder to understand because your company is already doing everything that would be requested of it by the SFC as part of a voluntary settlement. If there was a new accidental copyright violation, which in a big company it is always posible for something to fall through the cracks, then fixing that one issue and moving on would seem trivial considering all the infrastructure for doing so is already in place. What do you think is actually going to happen if some random product your company makes were to be found in violation of copyright?

If you think that the SFC would start arbitrarily trying to shut down products, and that a court would enforce those actions, well I think that's nonsense. Based on the written statements by the SFC I don't see them as a bunch of moustache twirlers who are itching to screw companies over using their compliance agreements as a lever, and I don't see any reasonable court enforcing injunctions against unrelated copyright (see RightHaven for how well this would go down in court)

In fact, judging by the SFCs written statements, their whole goal is to work themselves out of existence by getting compliance programs instituted at manufacturers and pushed up the supply chain so that these kind of casual violations don't happen because everyone knows the rules. The problem is that many people think that just because you can download something off the Internet that copyright doesn't exist, convincing your supply chain that this is not the case can fix the problem.

And about your Mayor Metaphor, you can plainly see from the SFCs tax documents that they are not asking for million dollar fines. If we presume this is just a convenient round number for the sake of argument then I guess I don't understand what the complaint is, that spending a thousand dollars on compliance efforts as in your example is somehow a bad thing relative to ignorance until you are caught.

Garrett: The ongoing fight against GPL enforcement

tbird20d — Wed, 01 Feb 2012 19:31:02 +0000

That seems like an irrational fear, I can't imagine the copyright owner getting an injunction against or even pursuing code that you can trivially show the provenance and licensing for.

Well, since the SFC requests audit rights for all of a company's products that include GPL, I don't think the fear is irrational.

The issue is that, for an organization that is ignorantly shipping code in violation of copyright, the problem is likely not just one software on one product but probably all software on all products and instituting comprehensive license compliance is the simple and efficient option.

I keep hearing this suggestion. Sony HAS a comprehensive license compliance policy, and a compliance committee (which includes me!), and to my knowledge all of our products are compliant. See my mayor metaphor on the other thread for why this is not enough to address the risk.

Garrett: The ongoing fight against GPL enforcement

dlang — Wed, 01 Feb 2012 19:18:40 +0000

Rob has never said that is is Ok with people not complying with the GPL (or any other license).

He has said that he sees the 'fix' of lawsuits being worse than the problem it's trying to solve.

In particular, he's annoyed because he was hired by a company to work on Linux, including making sure that there was license compliance, and then the company was sued, in his name, while he was working there.

Frankly, I would be rather annoyed in that situation myself.

Garrett: The ongoing fight against GPL enforcement

jra — Wed, 01 Feb 2012 19:16:08 +0000

Full disclosure - I'm a member of the Board of Directors of the SFC.

Jeremy.

Garrett: The ongoing fight against GPL enforcement

jra — Wed, 01 Feb 2012 18:59:35 +0000

Conservancy position on GPL enforcement:

http://sfconservancy.org/blog/2012/feb/01/gpl-enforcement/

From the horse's mouth, as it were :-).

Garrett: The ongoing fight against GPL enforcement

raven667 — Wed, 01 Feb 2012 18:34:15 +0000

> What is intolerable is having a 3rd party hold your entire product line hostage, based on some issue with an unrelated product.

That seems like an irrational fear, I can't imagine the copyright owner getting an injunction against or even pursuing code that you can trivially show the provenance and licensing for. The issue is that, for an organization that is ignorantly shipping code in violation of copyright, the problem is likely not just one software on one product but probably all software on all products and instituting comprehensive license compliance is the simple and efficient option.

Would it be any different if the problem was, for example, the copying of images off of websites for product art rather than properly licensing images from iStockphoto. Just because you can download something off the Internet doesn't mean you can ignore copyright, which is a common misconception for many businesses.

Can we stop this sub-thread?

dashesy — Wed, 01 Feb 2012 18:16:05 +0000

Thanks a lot for the links, and all the useful comments. It was fun to read and very informative. I had stumbled upon your website before, just to get Aboriginal Linux, but this time I find it a valuable resource not only for software, but also for the history of computing. And the best part; it is written with the mindset of a programmer who has not turned to the dark side :)

I wish you can always make good money from your programming skills.