LWN: Comments on "Protecting the open-source license commons"

Protecting the open-source license commons

paulj — Wed, 28 Nov 2018 15:51:30 +0000

I don't know, I didn't hear from the Conservancy for 3 months after the month where I'd been told the application would be considered. Maybe it's my fault for being impatient, and not realising it would take 8+ months to even look at the application. ;) Doesn't matter anyway.

I wish you well. I do though hope you process my concerns on the Principles as they are, with regard to the lack of clarity (at least) on points that are very important to the practicality of enforcement in at least some places. It seems I am not alone. As you're now aware of those concerns, I don't see a reason why I need to post to another mailing list (I've been subscribed to that list for a good while FWIW, if you want to discuss further and post there I'll see it).

All the best.

Protecting the open-source license commons

farnz — Fri, 16 Nov 2018 16:49:08 +0000

It's not as simple as "violating copyright for commercial gain is a criminal offence". The offences in the Copyright. Designs and Patents Act 1988 only apply if the violator has reason to believe that they're not violating; in the case I'm thinking of, the violator believed that as they were copyright owner of one part of the combined work, their license supersedes the GPL. Had they also committed the offence named in 107 subsection 2A (which requires monetary damages to the owner of the infringed copyright, not just infringement), then our legal advisor thought a prosecution might succeed; as it is, the violator raised the SFC's "principles of enforcement" as reason that they did not commit that offence.

Protecting the open-source license commons

Wol — Fri, 16 Nov 2018 16:28:37 +0000

iirc, farnz, you're British? And in Britain, violating copyright for commercial gain is a criminal offence.

NDAs are unenforceable when they're used to cover up illegal behaviour.

Of course that's the theory. Practice may be different ... but I really think that if they sue you for breaking the NDA, and you come back to the Judge "hey, they are behaving criminally and asking us to cover it up", the Judge will at least have to investigate that claim, and chuck the case out if you're right.

Cheers,
Wol

Protecting the open-source license commons

bkuhn — Thu, 15 Nov 2018 18:13:15 +0000

paulj, I have an email from you on 2017-11-10 in which you say "there was no point in pursuing SF Conservancy" membership for your project. That's the reason we didn't proceed.

As for "inviting you to apply", as a matter of historical record, the first inquiry about joining was indeed from *you* in Feb 2017. I do see in April 2017 I joined the thread, responding to your Feb 2017 inquiry (which Karen and already answered twice in Feb and March) and encouraged you to submit the application materials. We do write back to project leaders and encourage them to apply after they've shown initial interest, but that's not the same as "reaching out" as a cold contact, which your prior posts seem to indicate. (I think the number of times Conservancy has contacted projects on a cold-contact basis and asked them to apply is less than three in our more than ten years of existence. Our typical experience is we have a large queue of inquiries and cannot possible accept all the projects who want to join us given our limited resources.)

It's not uncommon from the date the application is submitted to acceptance in Conservancy to take 6-8 months. We got your application on 2017-04-12 and sent you updates along the way, and then received the withdraw of your application on 2017-11-10 and removed it from the queue. We carefully vet applications and make sure the project is a good fit. I'm sorry that timeline didn't work well for your project; we are not the right fit for fiscal sponsorship of all projects by any means, and there are less involved fiscal sponsors with smaller service plans (i.e., who don't do GPL enforcement) that can accept a project faster. Our commitment to our projects is stronger than most fiscal sponsors so we have to be deliberate in our decision-making.

Anyway, thanks for your kind words for Conservancy and I wish you success in resolving GPL violations on your copyrights. If you have questions about the principles, there is a mailing list for it, principles-discuss, as I mentioned in an earlier thread.

Protecting the open-source license commons

Wol — Thu, 15 Nov 2018 18:04:14 +0000

The trouble with McHardy was (a) he structured the agreement so he made money, and (b) part of his strategy was to target companies who *wanted* to comply.

Cheers,
Wol

Protecting the open-source license commons

Wol — Thu, 15 Nov 2018 17:10:10 +0000

As a European myself, I look at it simply ...

If I had any copyrights, I would contact a violator and say "we need to fix this". If they engage with me and want to put things right, legal enforcement should be unnecessary.

If on the other hand, they come back with a "sue me" attitude, I'd sue for everything I could get. And I don't see that as conflicting with the ethos of the GPL at all! If they wilfully ignore it, why shouldn't I go for every penny? But if it was accidental, and they are genuine, it would never have got that far.

Cheers,
Wol

On funding and compliance

Wol — Thu, 15 Nov 2018 16:27:39 +0000

> Is there much consideration of using other ways to enforce compliance other than via civil copyright claims? Court cases are expensive.

In Europe - Britain at least - copyright violation for commercial gain is a criminal offence. Although I don't know of any prosecutions for it ...

Cheers,
Wol

Protecting the open-source license commons

paulj — Wed, 14 Nov 2018 15:58:22 +0000

The Conservancy doesn't hold any copyrights in these violations because the application to join the Conservancy went nowhere, for reasons never communicated to me. Even though you personally reached out to me in '17 encouraging me to apply. Eventually, after 9 months odd of waiting (and other reasons) I gave up waiting to hear back.

So yes, you don't hold the copyright.

On whether I can stick to the Principles in any enforcement I do myself. I have no idea. The Principles are - at best - contain statements in tension with each (if not self-contradictory) and need interpretation, and you refuse to give direct answers to requests for clarifications.

I do wish you and the Conservancy all the best, in furthering the interests of the community the Conservancy represents. (Regrettably, it doesn't include me, but you can't say I didn't try to join it ;) ).

Protecting the open-source license commons

paulj — Tue, 13 Nov 2018 05:43:03 +0000

No, no.. I have not argued for a proprietary licensing scheme at all! Read https://lwn.net/Articles/770625/ again.

In my personal case, even if *I* did take action against abusers to recover compensation for prior use of my code in the work concerned, outside the copyleft licence I gave, there are (many) other copyright holders, and *in no way* could any abusers I took action against ever receive a "proprietary licence" as a result!

That said, I am not against proprietary licensing at all, if it allows the developers of copyleft software to get the following types of corporates to fund and pay for the development of copyleft software:

a) Corporates who would otherwise avoid using and contributing to copyleft software, as much as possible.

b) Corporates who would otherwise parasitically use and abuse copyleft software

The non-profit model just isn't going to fly. If a non-profit gains traction, it will just be captured by the type-b corporates via donations. I've been in one and watched it happen. It just destroys copyleft software and communities. A few developers benefit perhaps, but the rest is destroyed.

Protecting the open-source license commons

pabs — Tue, 13 Nov 2018 04:47:01 +0000

It wasn't clear until now that paulj and yourself were talking about wanting/needing proprietary relicensing business models in order to achieve GPL compliance. I think this should have been stated much more clearly much earlier in the subthread.

Personally, a proprietary relicensing business model achieving GPL compliance sounds like an oxymoron to me.

Could you explain how this might work?

Is the idea to sell enough cheaper proprietary licenses to smaller businesses such that you can afford to take abusively non-compliant large corporations to court? You would then achieve GPL compliance by telling them that due to their license violations (both proprietary and GPL) you won't sell them the proprietary license and then take them to court to get compliance with both the GPL and with the more expensive large-corporation-sized proprietary license? So the end result of such an enforcement action, if successful, would be a number of smaller businesses with non-GPL-compliant codebases (due to proprietary licenses, for the time period specified by those licenses), one large corporation with a GPL-compliant codebase and more money to go after the next abusively non-compliant large corporation.

Protecting the open-source license commons

GoodMirek — Mon, 12 Nov 2018 19:00:08 +0000

As paulj explained in detail, in our jurisdictions we cannot perform sustainable (in terms of covering expenses) GPL enforcement without proprietary relicensing business models.

Protecting the open-source license commons

bkuhn — Mon, 12 Nov 2018 18:31:21 +0000

I don't think Conservancy's enforcement work for Linux, Samba, etc. is harming the enforcement efforts of others. The only enforcement efforts we've condemned are McHardy's (and general proprietary relicensing business models), because they are clearly prioritizing revenue above compliance.

I'm dubious of solicitors/lawyers who seek to make money from enforcement, mainly because they are likely to pressure a client to prioritize revenue over compliance. However, the Principles take no position against using for-profit law firms as part of enforcement, and you should do so for your copyrights if you think it will help. I urge you to follow the Principles when you do.

It seems the violations you're concerned about are not related to any copyrights Conservancy holds, nor any member project of Conservancy, so we're not really part of the conversations you'd need to have in any event.

Protecting the open-source license commons

paulj — Mon, 12 Nov 2018 18:08:44 +0000

It'd be: paul@ - I have emailed apply@ before, and karen@, and bkuhn@ the other day.

I don't think there is some magic money pot. I never claimed anything like that.

I think that - even if the principles work for the SFConservancy in the jurisdiction the SFC prefers - it's crippling to other copyleft developers in other jurisdictions. Given that you and Karen are clearly extremely busy and overloaded and can't deal with all the cases you have, clearly some of those developers are going to have to seek help elsewhere (e.g., commercial solicitors). What I'm saying is that the SFC principles render a difficult (financially) situation impossible there, based on my understanding of legal advice.

Protecting the open-source license commons

GoodMirek — Mon, 12 Nov 2018 18:05:21 +0000

bkuhn, I really appreciate your response. The valid point paulj makes and which is of my concern is that in many European jurisdictions including mine the Principles can never work the way they work in USA. In my understanding, paulj is asking whether lost profit damages are acceptable enforcement under the Principles.
The question is asked because only sustainable way to enforce GPL in my and many other European jurisdictions is via the lost profit damages.
In my eyes Principles are against that way of enforcement and you seem to second the Principles.
Am I misreading?

Protecting the open-source license commons

bkuhn — Mon, 12 Nov 2018 17:43:13 +0000

You're not likely to get useful replies if you swing around unsubstantiated accusations of corruption against Conservancy like you just did. Please do refresh any thread you have with compliance@sfconservancy.org and ask for status. As we've stated many times, we're usually tracking hundreds of GPL violations at any given time. I'm sorry that we didn't take action on the one that bothered you most, but if you have a violation report, regardless of who it is against, we want to know about it and triage it along with the hundreds of other ones.

You seem to think that if we did things exactly as you said, we'd have so much money to pursue enforcement we wouldn't know what to do with it. We've tried many the things you said. If you haven't read the entirety of the documents in the BusyBox cases, you should. We asked for actual and statutory damages both. It is just not worth anyone's time to engage in hypotheticals of what we might do if copyright law were different and we had different remedies available. We have the remedies we have in the USA: statutory and actual damages. Conservancy pursues both in enforcement cases, and there is detailed Court evidence to show that we did in the BusyBox cases.

I sympathize with what you are feeling. It angers me too that big companies get away with GPL violations because the GPL enforcement remains expensive and complicated. But I'm not sure alienating the only organization doing something about the problem by captiously attacking Principles they wrote in an effort to avoid corruption is going to yield an outcome that helps you or anyone else.

There is a place for discussion of the Principles and to air concerns about them; I invited you there. LWN is not really the right place.

Also, sending personal email to me is not the way to do it, and claiming that I am not engaging with the community because I don't answer your personal emails is just unfair. (BTW, I can find no emails from anyone with username paulj in my archives nor the violation report archives, so I don't know which emails you're referring to anyway.) Also, BTW, if I answered every email I get from the general public, I'd spend my entire day every day answering emails. It's just untenable to expect someone who is a public figure to do that.

I did engage heavily with this thread because people raised questions and I've addressed them. I know you don't like the answers, and you want more attention to your points. I wish I had time to engage for unbounded amounts of time with everyone who has feedback on GPL enforcement. But I have to get back to the work that you keep urging me to be doing. :)

Protecting the open-source license commons

paulj — Mon, 12 Nov 2018 17:14:17 +0000

You don't respond to private email. You refuse to give a direct answer here. What's the point joining an email list to have the question not answered there?

I don't know why you/the SFC has not responded to any of my emails seeking help on licensing. It's strange.

It's making me wonder if it was because in my first email to the SFC on this topic that I one of the corporates that I noted as being involved happens to one of your sponsors (I didn't think of that at the time of writing, have to say). And that's sad. :(

Protecting the open-source license commons

bkuhn — Mon, 12 Nov 2018 17:04:32 +0000

Feel free to join the principles-discuss mailing list if you want to discuss the efficacy of the Principles.

Protecting the open-source license commons

paulj — Mon, 12 Nov 2018 16:31:29 +0000

I've asked you a question in https://lwn.net/Articles/770915/ and between the bits of the Principles that say you should not seek damages beyond your compliance costs (which seems a recipe for being left with significant legal costs in jurisdictions where you will never be awarded all your costs), and the bits you're quoting that say you may seek punitive damages (but... there is no such thing as punitive damages in some jurisdictions), I still have no idea what the SFCs' position is. The question again:

“Are you saying that if I go to a corporate who I believe (based on advice) is abusing the licence on copylefted code of mine and tell them (roughly) "Any further use and/or distribution of my code outside the copyleft licence I granted will require compensation of x% of your revenue", and I later try act to recover that compensation, that the Conservancy principles are OK with that?>”

Yes or no?

(Note, I'm not saying where, if obtained, that theoretical compensation would go, after legal costs [see 'b' above] - it could go to a nice new TV, to charity, FOSS or more general, etc.).

Protecting the open-source license commons

bkuhn — Mon, 12 Nov 2018 15:47:10 +0000

> I would be really interested in reply of bkuhn on this

I have replied many times in this thread. paulj appears to be misreading what the Principles say, and keeps making arguments about what he thinks they say, and then arguing that if they said that, they'd be bad. I just don't have time to keep refuting that same point.

What we've seen is that companies like MongoDB who put profit above compliance end up acting corruptly. Monetary gain should never go ahead of getting compliance in Principled enforcement. I stand by that. I know some of Conservancy's donors are annoyed that we don't put money first, and they stopped giving because they feel we should. I'd rather have a few annoyed donors than be on the path to corruption.

The Principles themselves address this point that paulj keeps making:

> Logically, if the only penalty for violation is simply compliance with the original rules, bad actors will just wait for an enforcement action before even reading the GPL. That social model for copyleft and its enforcement is untenable and unsustainable. An enforcement system without a financial penalty favors bad actors over good ones, since the latter bear the minimal (but non-trivial) staffing cost of compliant distribution while the former avoid it.

The Principles do not preclude punitive damages. Elsewhere in this thread, I talk about the complexity of getting them in the real world. No one in this thread has yet to put forward an idea for how to do enforcement that Conservancy hasn't carefully vetted and investigated.

Protecting the open-source license commons

GoodMirek — Mon, 12 Nov 2018 03:45:35 +0000

I would be really interested in reply of bkuhn on this. I have also stopped supporting SFC on same basis as paulj. I have told them that, the answer I got from them did not address my concerns.

Protecting the open-source license commons

metasequoia — Fri, 09 Nov 2018 18:09:25 +0000

There needs to be more recognition of the threat to free software posed by the emergence of an entangling web of secretive trade and investment 'agreements' - a world within which natural people - (as opposed to multinational corporations) as well as the 'gift to everybody' that FOSS represents, have no 'standing' to speak, nor will FOSS be seen by these entities or its ideology as legitimate economic activity deserving of protection because its not for 'profit', the sole yardstick that it uses to measure all value. (a very disturbing aspect of it, IMHO.)

Instead FOSS is likely to be framed (and it seems has already been framed in documents presented to the WTO) as a 'taking' from entitled 'stakeholders'.

I can see this battle shaping up, and its not pretty.

FOSS and _people_, are being systematically excluded from participation in the important, supranational level of global economic governance.

And it seems many aren't even aware that this threat exists or the fact that these rules now are controlling 'services' approximately 75% of the global economy ('everything you cannot drop on your foot') impacting many aspects of our lives, such as the policy space we have to solve almost all of our most pressing problems.

Instead of compromise and democracy, we only have one choice, measures that are 'minimally trade restrictive' as defined by an ideology that none of us would ever have voted for. How did this happen?

It wasn't by accident that we, the people, were never told.

There is a discussion about standing for the public interest in the first panel of this long video about ISDS (a very bad thing) and an European Investment Court, (which I dont think is a good idea either). Its worth watching.

https://www.youtube.com/watch?v=LeHYMsGPx1c

We need to have representation for humanity in these fora, where our governments are totally controlled by the biggest corporations and their lobbies.

They are pushing for concepts like indirect expropriation which embed an extremist ideology which seems inherently to conflict with things like FOSS.

In short, even though it is a gift to everybody the new cult-like ideology will frame it as a theft of profits to some - who matter much more than everybody else, precisely because of their money.

All valuable public services, including the very existence, globally of public goods like higher education, water, health care, financial services like social security, medicare and health insurance are also coming under a stealth attack as is the public's ability to restore them in the future by the vote. Without paying for the restoration valued in terms of future expected lost profits. Its a theft of the commons, such as one exists. As well as the right to have one.

So there you have it.

It wont go away by our ignoring it. Democracy is in serious danger, globally.

Thank you.

Protecting the open-source license commons

mpr22 — Thu, 08 Nov 2018 19:06:52 +0000

If you do not offer proprietary licences at any price, then MEDIUMNUM and HUGENUM are not Inf.

They are NaN.

Protecting the open-source license commons

paulj — Thu, 08 Nov 2018 10:49:47 +0000

See my other reply to you: https://lwn.net/Articles/770625/ - you're mixing some stuff up.

See also mpr22's reply to you. You have to word things in a way that makes sense legally and will stand up. I'm not a lawyer, so you'll have to find one to get a real explanation. However, my hand-wavy, probably completely wrong, opinion is that you can't really define "damage" self-referentially - damage must refer to something else, something you lost or were deprived of, etc.

Protecting the open-source license commons

pabs — Thu, 08 Nov 2018 02:24:11 +0000

In the case we are talking about, there is no advertised fee for non-copyleft licenses and the copyright holder isn't interested in selling such licenses.

So $MEDIUMNUM = ∞, $HUGENUM = ∞ and damages = ∞ but I guess we must round that down to the value of the company, since money isn't infinite.

It seems likely that the court are more likely to accept setting damages to revenue (or a percentage) they made from violating the only available license than setting damages to ownership of the entire company.

If we are talking about non-∞ values for $MEDIUMNUM and $HUGENUM then that sounds like a proprietary relicensing business rather than what paulj was talking about?

Are there any other models for damages that would be appropriate and would be accepted by the courts?

Protecting the open-source license commons

mpr22 — Wed, 07 Nov 2018 18:34:37 +0000

You can define what you want the damages to be however you please.

Whether you can persuade the court to accept your definition is another question, and "I charge advertised fees of $MEDIUMNUM/copy (or $HUGENUM for a one-off licence) for a licence to make non-copyleft-compliant copies of my software, and this company has made BIGNUM non-copyleft-compliant copies of my software without paying my fees, so my total damages are either $HUGENUM, or $MEDIUMNUM * BIGNUM" is much easier to make a case for in court than "they made $BIGNUM from selling a product that included non-copyleft-compliant copies of my code, so my damages are $BIGNUM".

Especially if the offender is a hardware vendor.

Protecting the open-source license commons

pabs — Wed, 07 Nov 2018 16:39:06 +0000

Hmm, I would have thought that one would just define the damage as the total revenue the abuser made from sale of GPL-violating products, rather than the price of something that is usually not for sale at any price (a non-copyleft license to the code), unless of course you are running a dual licensing business like MySQL or MongoDB.

Protecting the open-source license commons

paulj — Wed, 07 Nov 2018 13:07:40 +0000

Oh, the other aspect to the jurisdiction I was in is that you _can not_ get all your costs awarded to you, should you end up having to take it to court. You /will/ be paying a significant amount of your legal costs, _even if you win_. (You don't want to go to court, but these types of considerations end up influencing pre-court action anyway, e.g. the extent to which the abuser can think you're likely to be able to go take it to court).

So the damage from the copyright infringement has to be significant enough for you to be able to pay your (non-trivial) legal costs.

If you're subscribed to a set of principles that say the only damages you should seek should be your legal costs, then you're going to end up with significant legal bills,
*even if you win*. So these principles may render any real enforcement out of reach for any non-wealthy private copyleft copyright holder.

There are other practical problems with the Conservancy's apparent "can't seek damages beyond compliance costs" that further put a non-well-resourced private copyleft copyright holder in a weak position, in at least some jurisdictions.

Protecting the open-source license commons

paulj — Wed, 07 Nov 2018 12:30:01 +0000

Punitive awards are not possible in the jurisdiction I am in, to my understanding. You can only seek compensation for damage. Which means you must demonstrate some kind of loss, and if that's to be in any way meaningful to deterring abusive corporates, there must be a relatively non-disputable way to put that loss into monetary terms. The advice I have from a commercial solicitor specialising in copyright is that the best/most-obvious/least-arguable way to achieve that in the jurisdiction I was in is to tell abusers that there is a price on non-copyleft-licence-conforming use (which arises from the value of the software, and copyright).

This would mean the copyleft copyright holder could gain monetarily though. If you say that that is fine, great - but the "principles" do seem to strongly discourage doing that. E.g., here's the text immediately after what you have quoted:

" Copyright holders (or their designated agent) therefore are reasonable to request compensation for the cost of their time providing the compliance education that accompanies any constructive enforcement action. Nevertheless, pursuing damages to the full extent allowed by copyright law is usually unnecessary, and can in some cases work against the purpose of copyleft."

Firstly, the copyleft copyright holder is instructed to only seek compensation for the /time spent on compliance/ - which is a smaller amount than the many years prior that may have gone into developing the software itself. And it then discourages seeking even that (??).

Are you saying that if I go to a corporate who I believe (based on advice) is abusing the licence on copylefted code of mine and tell them (roughly) "Any further use and/or distribution of my code outside the copyleft licence I granted will require compensation of x% of your revenue", and I later try act to recover that compensation, that the Conservancy principles are OK with that?

If you want to chat to me more in private, I tried to get help from the Conservancy before on my particular problem a good while ago. Feel free to reply. ;)

Protecting the open-source license commons

farnz — Tue, 06 Nov 2018 18:09:34 +0000

I no longer have access to the thread - I've changed employer, and thus don't have access to my old employer's email system.

At the time, IIRC, it all fizzled out because our legal advisor stopped us sharing with you (because we had agreed to the NDA, and were getting distribution from the vendor under the NDA), and you could not take action without more evidence of the infringement than we could provide given the NDA we had agreed to.

Protecting the open-source license commons

bkuhn — Tue, 06 Nov 2018 18:06:15 +0000

Please refresh the thread with Conservancy if you don't mind. Of those organizations, Conservancy is the only one that enforces the GPL for Linux (and I believe, at all). I'll mention to Denver to expect your email when next he works (he works only one day a week).

Protecting the open-source license commons

bkuhn — Tue, 06 Nov 2018 18:04:19 +0000

Not sure what you mean by punitive damages. Copyright cases in the USA have actual and statutory damages. In the BusyBox cases, Conservancy asked for both the maximum allowable. The cases settled, but our claim was for the most the court would allow.

Protecting the open-source license commons

farnz — Tue, 06 Nov 2018 09:06:26 +0000

At the time, we reported it to the SFC, SFLC and FSFE; none of you were able to take sufficient action to get the violator to do anything.

AFAICT, the violator we informed you of at the time is still functioning this way several years later - they've certainly approached my current employer with a similar setup, and been forcefully declined.

Protecting the open-source license commons

Cyberax — Tue, 06 Nov 2018 06:02:49 +0000

I can make a sizeable donation personally, but I probably won't be able to fund the whole lawsuit. How about a crowd-funding campaign though?

I understand that the actual lawsuits are not easy, but you do have to start somewhere.

It would be nice if you changed your policy to reflect that you WILL sue for punitive damages. To avoid moral conflict, pledge all the damages (minus lawsuit costs) to fund OpenSource development and further enforcement.

Protecting the open-source license commons

bkuhn — Tue, 06 Nov 2018 04:08:58 +0000

> Get a bunch of core kernel copyright holders (to make sure that they are not "minor
> contributors") and start lawsuits. Do it without resources from the Linux Foundation or any
> other violator-friendly body. It's really as simple as that.

Funding lawsuits is not easy, because even if you expect to win, you won't get your judgement and attorney's fees paid until the *end* of the case, which could be a decade away. If you'd like to make a very large directed donation to Conservancy for a GPL enforcement lawsuit, Karen would be glad to talk to you about it.

If additional lawsuits were done as easily as you say, we'd have done them already, of course. There are certainly bad actor violators who refuse to comply and are taking a "fine, sue us" attitude.

But keep in mind that in addition to the expense of doing the litigation, there are powerful political actors who are working regularly to discredit and attack Conservancy to prevent us from moving forward on enforcement as well. They aren't fully successful by any means, but dealing with those attacks is still non-trivial effort.

Protecting the open-source license commons

bkuhn — Tue, 06 Nov 2018 03:57:14 +0000

farnz, as I understand the situation you describe, it sounds likely that both parties involved are violating the GPL. (IANAL and TINLA and I'd need to study the situation closer to be sure of anything). I have heard about these kinds of NDAs, and even been shown them by GPL violation reporters. If you'd like to report the violation to Conservancy, compliance@sfconservancy.org is the address.

Protecting the open-source license commons

bkuhn — Tue, 06 Nov 2018 03:52:37 +0000

paulj, I think you haven't read the Principles carefully. I don't see anywhere that says punitive awards should be refused and never sought. The Principle says that monetary gain should never receive precedence over compliance. To quote:

> Financial penalties are a legitimate tool to achieve compliance when used judiciously.
> Logically, if the only penalty for violation is simply compliance with the original rules, bad
> actors will just wait for an enforcement action before even reading the GPL.

I urge you to read the rest as well. It doesn't preclude any of the things you are likely asking for, as long as the enforcer is also getting compliance first and foremost.

Meanwhile, it seems you keep asking for someone to do work that no one knows how to do. If you have a plan that will get compliance, and properly create deterrent punitive measures, then please share it.

I've spent a lifetime studying how to make copyleft succeed. I am willing to learn more from anyone who has something to teach, but I don't see anything in your posts that show a way to modify enforcement such that it will achieve what both you and I want: more compliance by more bad actors.

You keep talking about making companies more liable financially than they currently are to come into compliance. What method do you propose we do that? What path of legal action can we take that will yield that? How do we fund that work to begin with? How do we assure that work doesn't become corrupted by avarice and fail to reach the policy goals of copyleft?

It's easy to say: "everyone who has tried this is doing it wrong". It's much harder to participate in a real discussion on how to do it better. I encourage you to do the latter instead of the former.

Protecting the open-source license commons

pizza — Mon, 05 Nov 2018 10:43:33 +0000

There is another strategy that can sometimes be employed -- In some jurisdictions, removing copyright information/attribution from the work in question is a separate offence, with statutory penalties unrelated to actual damages.

Protecting the open-source license commons

paulj — Mon, 05 Nov 2018 08:15:38 +0000

The solution is easy: Put a (significant) price on use outside of the copyleft licence conditions.

Protecting the open-source license commons

jospoortvliet — Mon, 05 Nov 2018 07:48:18 +0000

Wrt your last point - I think bhuhn has been reasonably clear that if he had those volunteers and resources, you could expect a lot more enforcement. I would also like to see a large corp pay significant damages or see an exec jailed for violations as I agree the good guys pay and bad ones don't right now but I am sure it isn't as easy as you male it seem.

Protecting the open-source license commons

excors — Sun, 04 Nov 2018 23:22:14 +0000

I'd be very surprised if that was true, since I've worked with a few kernels for various SoCs and don't remember seeing anything in the kernel that wasn't built from source. The only exception I remember is that VTune supplied some profiling drivers as .ko files, but they were only used by a few people during development.

They do usually have kernel drivers that are designed to work exclusively with userspace binary blobs that the phone vendor doesn't have full source access to (for 3D graphics, cameras, etc), or to work with firmware blobs, but that's probably not a GPL issue since the kernel driver source is released and the binary parts are clearly separate from the kernel.