Abusing the GPL? 771
"How, you may ask?
Integrate the highly useful GPL code we're eyeing into our only slightly more complex (but much more lucrative) project, thereby saving us at least 30% of the coding involved. The company then go all the way to production with it, but instead of finally compiling the actual project for distribution, they instead compile a bunch of incomprehensible gobbledygook that just happens to compile to the same bytecode. You know the game: globally replace every function name, variable name, and so on from our code with nonsensical names (or random characters), remove all of the comments, and any other form of obfuscation they can introduce. They will then GPL the obfuscated gobbledygook, which isn't much more useful to anyone than reverse-engineered bytecode would be (it is a complex project). 'Voila!' All the benefits of a huge GPL project and countless thousands of volunteer hours and unreadable, incomprehensible source tree.
For the record: I do not think this is right yet, I have not been able to find any precedent for why the GPL should protect against this kind of abuse.
I'm not trying to snitch on my company -- or lose my job, which is why I am posting anonymously -- but hopefully some lawyers out there could point out some iron-clad legal reason preventing this sort of thing. I've read the GPL through at least a dozen times since yesterday, and so far it looks like our lawyer is right. I have not found any relevant linkage either, as I have mentioned. Links to extended legal analyses of the GPL from a technical standpoint (if any exist) would be the most helpful. All help is appreciated."
No Ethics == Outathere (Score:2, Informative)
Life is too short to work for lowlife scum.
Source code = preferred form for modification (Score:5, Informative)
To find out whether the gobbletygook you distribute is source code or not is simple: if you normally add features to the program by editing the gobbletygook, it's source. If you instead edit the stuff that you compiled to gobbletygook and then recompile it, then the stuff you distributed isn't source and it's a clear-cut GPL violation.
Preferred form (Score:4, Informative)
Deliberately obfuscated high-level language code (which is no longer preferred, or even useful, for modifications) does not appear to meet this requirement.
Can't do it. (Score:1, Informative)
Obfuscated code violates this license clause. End of story.
Why did it take so many posts? (Score:5, Informative)
Why did it take so many posts for someone to point this out? Do people not read the GPL?
What a day to be without moderator points...
For those too lazy to read the whole thing, read section three, point #3 [gnu.org] very carefully. Just because something compiles does NOT mean that it is source according to the GPL. That you would not do development on the obfuscated gobbledegook clearly shows that the obfuscated version is NOT the preferred form for modification. I would be highly suspicious that your lawyer is insufficiently anal when reading contracts if they missed this.
As for precedent, can anyone find a discussion of GPL'ed yacc/bison grammars? This would fit exactly the case above - the original source that must be distributed is the .y file, not the result of compiling the .y to a .c file. Unfortunately, I don't think that anyone has ever been tempted to rip off a GPL'ed grammar.
You company does not have permission (Score:4, Informative)
(BTW, I am not a legal advisor. This is my understanding of the GPL).
If you are including other people's GPL'd source code in a program which you distribute, then you must abide by the terms of that license. Section 3 of the GPL is precise enough to disallow scrambling the source code:
There is nothing to stop you changing all the variable names, or the style of someone else's code. However, if you distribute a GPL'd binary then the source you distribute with it must be the source that you prefer to use for modifying the program yourself. You may be called upon to prove this in a dispute.
For reference, section 3:
And then what? (Score:3, Informative)
The primary question of the article was "Is this legal or actionable with respect to the GPL?"
Even if the FSF knew about it, what could they do? There has to be a clear violation of the wording of the GPL, not just some gut reaction.
So the question stands: What can be done about this type of situation given what we know?
If there is something that can be done, then talk about reporting them.
FWIW: The BSD advertising clause would require at least one comment remain in the code, the original authors name. That would at least give someone a hint as to where the code came from when trying to interpret the "garbage" source.
It's a GPL violation, and more (Score:5, Informative)
The GPL states:
That term was written to prevent exactly the sort of obfuscation the attorney is proposing. Obfuscated code is demonstrably not the preferred version for creating modifications. So, what is being proposed is a GPL violation, and your company's attorney missed that part of the license. The talk about incidental resources isn't germane, it actually seems to be intended to confuse, because what is being proposed clearly is a derivative work, and the company attorney is acknowledging that when he suggests that the obfuscated code be GPL-ed.But there are simpler remedies than legal ones. If the free software developer community hears about a product using obfuscated code to circumvent the GPL, they will retaliate by creating a non-obfuscated version and using it to compete with your company's product. They are experienced at reverse-engineering, they have excellent tools for code reformatting and analysis, and there are a many programmers who will be angry enough to work on this.
If your employer wants to unashamedly take advantage, they are simply buying a lawsuit. The free software community does have the resources to bring one - it would probably be brought by law professor Eben Moglen of Columbia University. He wants more legal tests of the GPL, and would love to make an example of your employer. Don't go there.
Bruce
Selling GPL Software (Score:1, Informative)
The end software product binary is GPL licensed.
This means 1 person can buy it, and give it away to everyone else, as he is entitled to under the GPL.
Since you are giving away no cost software, what do you expect to gain from hiding the source.
No infraction until release (Score:3, Informative)
Threatening mass resignations from engineering, btw, is one tactic I'm currently seeing used to prevent a GPL violation at another company. Buyer's market though engineering talent may be right now, I expect it'll be effective -- turnover is just too expensive. Quitting right away (as soon as idea is raised) -- simply put, why?
Re:Why did it take so many posts? (Score:5, Informative)
So, not only do that have to release the unobfuscated code, but they have to release the scripts that obfuscated it. What fun!
The GNU GPL has a clause against this (Score:3, Informative)
It would be hard to write an anti-obsucation clause I imagine
Not that hard; in fact, it's already been done. The GNU GPL [gnu.org], section 3, states: "The source code for a work means the preferred form of the work for making modifications to it." I don't think any reasonable U.S. district court judge would consider robo-obfuscated C to count as the "preferred form" for that purpose. See #3117740 [slashdot.org] for another explanation.
Re:Total obfuscation is not possible (Score:0, Informative)
Re:Your lawyer is a fucking retard (Score:2, Informative)
What the author said was:
So, yes, they are intending to munge the GPL source they've incorporated, along with their own source, into a final, monolithically obfuscated product.A two part problem (Score:5, Informative)
1. Is it in violation of the GPL? This question is not a simple one, but such actions may very well be violation of the GPL. If this matter reached court, the question would center on whether the process applied to the GPL'd code constituted part of the process to create the derivative work, as derivitive work is defined in the GPL. For example, an expert might argue that code obfuscation can be part of the compilation process. It is oversimplified to say that laws are reinterpreted on the fly to capture the intent of the law. What is true is that these sorts of questions - for example, what constitutes compilation - are likely to be viewed in a manner which assists the obvious intent of the applicable contract/law.
2. If it is a violation, can it be proved? Probably. Our company works for lawyers on code plagiarism cases all the time. There are many algorithms you can apply to show statistically significant relationships between a body of code and its obfuscated counterpart. The same should be possible with bytecode. Once a reasonable basis for suspicion is established, plaintiffs could get discovery of the company's code repositories and depose employees under oath.
Christian Hicks
Elysium Digital, L.L.C.
http://www.elys.com [elys.com]
Re:Your lawyer is a fucking retard (Score:0, Informative)
I think you are thinking about the nvidia drivers [www.nvidia], developers of Beos drivers [nanorevolution.com] were always complaining they could make no to little sense of the released source. Not a violation in my opinion, everyone could see what de drivers where doing, it was just to complex to learn from looking at the code anyway (instead of real documentation). I still think someone should licence the geforce line of chips, build boards based on the reference design like all other vendors but release real open drivers based on the documentation they got along with the chip licence. These may not have the speed of oficial nvidia detonator drivers but with an opensource developers community they could a least be tweaked for the os(and subsequently be ported to other operating systems, and maybe even architectures(quake 3 on alpha anyone
To bad nvidia will never let this heapen, they should really be more forthcoming with help if they want to get more succesfull in the chipset arena.(nForce)
Re:You don't understand the spirit then. (Score:2, Informative)
I know that this is not the same but if I want to edit your GPL program in APL (my preferred form) but it is only available in C does that mean that you are violating the GPL? Does the original author always get to decide what the preferred form for all future uses of the code is? In some ways that doesn't seem very open to me.
Re:Cut and dried Copyright violation (Score:4, Informative)
The GPL does address the issue of what constitutes "source code" at some length. From section 3:
The source code for a work means the preferred form of the work for making modifications to it.
I'd hardly think that obfuscated source would qualify as "the preferred form of the work for making modifications to it."
Not really... (Score:3, Informative)
of course, IANAL
GPL Loophole (Score:0, Informative)
This is the third time I have mailed you. You are taking a long time to wake up to this problem.
I first mailed about a GPL violation with my company (under ND, so cannot discose - details follow). We then had hte PowerVR issue, where htey did not release source. And then we had hte FSFs comment on RTLinux (http://www.gnu.org/press/2001-09-14-RTLinux.html
So, there are three issues. RTLinux & patent, PowerVR not releasing source, and the linux binary driver GPL loophole described below. The primary copyright hoder, torvalds, is doing nothing about any of them. This is NOT what the linux community wants.
Speaking of GPL violations, I found a pretty flagrant one at work a few weeks ago...
Microtest (now XStore [xstoreonline.com]) put together a mess of GPL software - a modified Linux kernel 2.0.27, Samba 1.9.x, Apache, the MARS_NWE netware emulator, and GNU C libraries (libc5), among others, stuffed them on a flash chip in a drive-bay-size embedded 486-based computer, and sells it as their "DiscZerver [xstoreonline.com]" product line. Nothing wrong with the method, but there's plenty wrong in their implementation.
Previous 'Ask Slashdot':
We have some problems in the linux world. First, we jave the issues of RTLinux and their patent, wiht FSF commenting on it recently: http://www.gnu.org/press/2001-09-14-RTLinux.html)
Then we have PowerVR where they are not releasing the source (also a recent slashdot post).
And now, we have a loophole allowing these people to get away with it. There is a company already explooiting this loophole. Read on:
I work in the embedded hardware field. Today we received some hardware from a manafacturer, who uses linux to run on their hardware.
In the past I was given all source code to their product, as they are obliged to, given that their code is derived from the linux kernel itself.
However, today I was told that they will no longer be distributing their source,
since they have managed to incorporate all of them into a loadable kernel module (which they are referring
to as a "binary only runtime loadable driver". Apparently linus torvalds has recently said that binary
drivers can be
distributed in binary only form. From my knowledge of the previous source this company released, they have gone to considerable effort to move all of
their code into this "binary driver". It is not so much a binary driver, as a real time linux system hacked into a driver. I suspect they intercept certain system
calls to achieve this - I am in the process of checking the binary to find out.
I am under an NDA so cannot disclose more information, nor my name.
But is this against the GPL? I think it is, and given that my name exists in the linux kernel too, I am upset and would like
to do something about this - but apparently only Torvalds has the right to sue them - is that true?
(But he won't, since he has said binary only drivers are OK).
And where exactly do we draw the line between a derived linux kernel and the same thing implemented as a loadable
module?
reverse the change (Score:1, Informative)
prevent the company from doing this, I wouldn't
worry too much. The kind of obfuscations you
mention can probably by reversed by some
pattern matching code that "aligns" the original
GPL'd and the obfuscated code, much the way
current cheating-detection code can detect student
software submissions that have carried out similar obfuscations. It would serve the
company right to discover that their cleverly
obfuscated code had been de-obfuscated and all
their important changes revealed to the world.
Re:You don't understand the spirit then. (Score:2, Informative)
But preferred is what the GPL requires.
There can be some interpretation, but the clause states preferred form for modificaton, not compilation. Obfuscated source will still make the compiler happy, but not anyone who has to change the code. That the -company itself- would not make modifications to the code in obfuscated form would clearly indicate what the "preferred" form is.
Re:"viral license" (Score:2, Informative)
This could be the answer (Score:2, Informative)
IANAL, but I think this is the answer, although it has not been interpreted in the right way in the previous posts:
If we interpret "the preferred form of the work for making modifications" as "the form the company uses for making modifications" then the company has only two choices after the first release of the software:
I have a feeling it should be possible to get them with this...
Re:Cut and dried Copyright violation (Score:2, Informative)
You do not recall correctly, see the GPL [gnu.org].
However, note this from the GPL: The source code for a work means the preferred form of the work for making modifications to it.
If the company intends to keep a non-obfuscated version, this would be "the preferred form", and their lawyer is dead wrong...
Re:You are not anal enough either. (IAAL) (Score:3, Informative)
Re:Sounds wrong to me (Score:5, Informative)
Now, the fact that this intermediate bytecode is legal C or whatever other language the original was written in doesn't make it source. It just means that that is the internal syntax of this intermediate stage. This is because the defining characteristic of source code is that it is human readable. It is what the developer wrote and would use to modify it himself. WHen you preprocess this in such a way that it is no longer suitable for human reading and maintaining, it ceases to be source...and ceases to meet the GPL source requirement.
I highly recomend that anyone who is going to talk about this actually READ the GPL [gnu.org]
From the GPL:
-Steve
Your clarifying language... (Score:4, Informative)
Re:Well I would you steal a commercial programs co (Score:1, Informative)
Now 'shared source', and companies that provide Perl/PHP/JSP code with a commercial license *would* loose income!
There are very few companies that would voluntarily let loose or release income. Of course, it is possible that they could fail to retain income due to piracy. The word you were looking for is lose.
Congratulations! You have been participant #46 in my campaign to rid Slashdot of this error.
Obfuscating C Code (Score:3, Informative)
A context diff of the "obfuscated" code against the code it's derived from would rather quickly show that the only changes from one to the other was symbols and the lack of comments. Unless, that is, they resorted to some rather serious Obfuscation like operator and function overloading, or trick use of preprocessor errors, in which case, a diff of the preprocessor output from the two code trees would also damn the offender pretty quickly.
I AM a (recovering) Lawyer (I am non-practicing) and I would advise your company that they are playing with fire by trying this. You didn't reveal which GPL Code your company finds so useful, but there are MUCH smarter ways to play this game, especially if the authors of the code you like so much HAVE assigned their copyright to the FSF. (See, FSF v. NeXT Computer, (over gcc) for instance).
I question the degree of "tech-savvy"-ness of your company's counsel if he's advising them to go "full speed ahead" on such a transparent, bad faith abuse of the GPL (can't call it a violation
Re:No it isn't. (Score:2, Informative)
The subject of the verb "prefer", that is, the entity or entities doing the preferring, is not specified. Therefore we have to infer it.
I would say you have shown that when "people in general" or "people in the industry" are the preferrers, the word has no objective meaning. I agree, and note that any definition we give here could cause the unmodified distribution to be in a non-preferred form, and thus not source.
However, there is another reasonable grammatical possibility for who the preferrer is, namely the person(s) modifying the code.
Now, if the modifier is the preferrer, preference is easily determined by his/her/their past actions. We can ask what form they used to modify the code (i.e. put them on the stand, and if they lie and say they modified the obfuscated code, ask them to explain what various sections of the obfuscated code do). In this case at least there is exactly one set of documents which fit the criteria.
So we have two interpretations, one of which leads to a meaningless statement, and one of which leads to a meaningful one. This is a common situation in English, and the general convention among English (or other language) speakers is to go with the interpretation which makes sense. Under this ubiquitous convention, I would agrue that the "preferred" form for modifications can only be that which the modifier him/her/thierself has used.
I've copped out a bit and omitted the possibility that it is the original author who is the preferrer (what happens if a word is ambiguous, but every possible interpretation leads to the same conclusion?), but if that could be set aside, would a judge be likely to buy this sort of argument?
Re:OT: Modern Judges (Score:3, Informative)
It's not so much that "preferred form" is obvious, it's that "the preferred form" is obvious. Note, not "a preferred form". The common meaning of "the preferred form" allows for exactly one form to fit this description. In other words, out of all of the available forms, the one that is the best possible form for modification is the one that has to be distributed. Quite clearly, if the company is continuing to modify the program in form X, then form X is, prima facie, the only possible form that fits the phrase "the preferred form".
The only way this could be negatived (yes, that is a verb in lawyerspeak) is by demonstrating that the form used for development is a form not convenient to others, and the translated form is actually preferable for those others.
IANALY, but I did top the year last year, and this is a simple question of interpretation that a first year law student could deal with.