Do Build Environments Give Companies an End Run Around the GPL? 374
Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"
It would be nice to name names (Score:5, Insightful)
so we can vilify them, castigate them, and otherwise snark.
Re:It would be nice to name names (Score:5, Funny)
As if we don't know it's Cisco.
Re: (Score:3, Informative)
Do we? I've never seen a cisco or linksys device you could't load custom firmware onto.
My Linksys experience (Score:5, Informative)
After getting the "our developers are working on it" runaround for months and months when Linksys didn't issue new drivers without the Broadcom vulnerability for my WPC54G v.4 adapter [linksysbycisco.com], rendering it totally useless, I decided to never, never, again buy Linksys equipment.
So you might be right that the firmware of the Linksys device I bought was upgradable, but that's useless if you have no way to make custom firmware and the vendor doesn't issue bug fixes for its original firmware.
Re:My Linksys experience (Score:5, Informative)
Many Cisco/Linksys routers are, but I wouldn't call it "most" any more. They started building them using a closed-source OS about 3-4 years ago, and actually converted the WRT54G and WRT54GS to it mid-stream. Later, they re-released the Linux version of the WRT54G under the model name "WRT54GL".
Having said all that, Linksys has been pretty good about releasing the source code of those things they use GPL-licensed code for. Unfortunately, they tend to use the Broadcomm radios for which source code is not available, though they do publish their wrappers that control the Broadcomm binary driver.
Re:My Linksys experience (Score:5, Insightful)
Not true anymore. Many of them have been switched to the very restrictive vxWorks platform.
The big problem with GPL violations, and by extension poor customer service, is there is never enough backlash to deter these heinous practices. We can groan until we're blue in the face, Cisco/Linksys will continue to sell flaky hardware and buggy, unmaintained firmware/drivers and endless spin doctoring. These days their business is 90% sales & marketing, 10% development. That's why the router you buy today is no better than the one you bought a decade ago. They don't give a crap, they can just slap a new ugly plastic box around the same cheap old guts and print more money.
Even their enterprise gear has taken a nose-dive. They have about two dozen different 24-port switch SKUs, and they even have the nerve to give you detailed comparison grids, highlightly precisely how little they differ. How many ways can one shuffle managed vs unmanaged (why even bother anymore), and POE vs non-POE ? They need to fire half their marketing staff and beat the other ones until they stop telling the engineers what to build. Having a uniform product line means greater efficiencies in both production and support. Modern business 101, for crying out loud!
Re:My Linksys experience (Score:4, Insightful)
Re:My Linksys experience (Score:4, Insightful)
I don't get something in your reasoning - care to explain?
When Joe Shmoe downloads Corporation X's software from TPB, installs it and makes money using it, and they find out, they send a legal letter demanding that Joe removes the software and pays up $x (for very high values of x) or gets dragged through court (and ends up paying many times $x) for violation of the license. After that, Joe Shmoe is broke and Corporation X starts lobbying for new laws against software piracy.
When FooShmoo & Co. downloads Mr FLOSS Developer's GPL-licensed software from his website, puts it in their FooBox 2.0 and sells it without distributing the source code or allowing for its proper use, and he finds out, he first asks them to comply in an informal manner, then he tries to publicize the problem hoping that FooShmoo & Co. will comply to prevent bad publicity, and only when this fails, he goes to the FSF or the likes and asks for help, which usually means a legal letter demanding that they comply, or be dragged through court (and end up complying and paying the legal fees) for violation of the license. After that, FooShmoo & Co. can go on with its business and Mr FLOSS Developer is content that his rights as an author are finally respected.
And yet, you present the latter situation in a derogatory manner. Why?
Re:My Linksys experience (Score:5, Interesting)
Re: (Score:3, Insightful)
the original company still ends up getting the blame when user modifications break the product. I got really, really sick of dealing with those support issues over time.
Badly run companies run into this. I've worked at ISPs that have been Microsoft's unofficial support desk because they couldn't tell the customer that there's a signal at their cable, the rest is between them and their OS vendor.
Other companies in almost exactly the same demographics have happy users, without supporting their OS or playing weird games, simply by being upfront with the users about where problems lie.
The two situations are you describe are completely differnt ends of the process....
Different ends yes, of the same process though. Let me rework this a bit:
[upstream developer exerting control over] end user [distribution of] software and upstream developer exerting control over a downstream product.
You want control ove
Re:My Linksys experience (Score:4, Insightful)
Everything you describe is the right of the user. "Controlling" a product is a complete and utter ethical failure. Why should tech companies have this privilege ? No OTHER companies do. They just put on a sticker saying modifications will void the warantee (fair enough) but if I want to open my microwave oven and put in a 5-times more powerful magnetron - L.G. doesn't get to tell me it's illegal to do so, or for that matter, try to build a huge titanium box around the magnetron to prevent me.
Or to use the obligatory car analogy: if I tune up my engine for higher speed, I am probably shortening it's lifespan - but the car company doesn't get to tell me it's illegal to put in a faster exhaust system. They generally won't even try too hard to stop me replacing the software on the onboard computer to adjust the timings for maximum performance.
Short of safety features - no company gets to "control" how you use their products - it's against the principle of first sale (for starters, I can indeed sell my modified version - as long as I don't pretend it's unmodified [that would violate trademark law - and with good reason, it would be fraud and it's exactly what trademark law exists to prevent]).
Why the hell should tech companies get this privilege then ? Because they can claim software copyright ? Big whoop. Just because a part of a car is patented, BMW doesn't get to tell me I can't put in a different part there.
It shouldn't work that way - and it's wrong that it does. Furthermore - the decision of the original authors to use the GPL clearly indicate that those authors agreed with my perspective here, so violating the spirit of that agreement is against the grounds under which you got to benefit from their work. In most countries, violating the spirit of a legal agreement is exactly as wrong as violating it's letter, the US can get confusingly literal at times though so this may not hold there.
Finally - I'm quite sure that withholding the tools required to actually install modified firmware on the device counts as breaking the GPLv3's anti-tivoization clause so if any of this software is under GPL3 or GPL2-or-later clauses - a case could be made that they are giving source while preventing the installation of modifications and that this violates the license.
Re:My Linksys experience (Score:4, Informative)
That's more to do with vxworks requiring less memory (and thus the hardware can be made cheaper), you can still try to flash linux onto those devices but they don't work very well due to the limited amount of memory/flash...
They still sell linux based devices, but these are no longer the lowest and cheapest routers they offer - the vxworks ones are the new bargain bucket.
Re:My Linksys experience (Score:4, Informative)
That's more to do with vxworks requiring less memory (and thus the hardware can be made cheaper), you can still try to flash linux onto those devices but they don't work very well due to the limited amount of memory/flash...
They still sell linux based devices, but these are no longer the lowest and cheapest routers they offer - the vxworks ones are the new bargain bucket.
It's not just less memory - vxWorks is very frugal with CPU usage too. I've seen 486 clone at 33Mhz maxing out the bandwidth on a network card while running an FTP demon out of flash memory.
The reason is that vxWorks is a very simple OS. It doesn't have much in the way of protection - all the code runs in Ring 0 on x86. So calls into the OS are just regular calls - you don't need to switch from Ring 3 to Ring 0. It can use the MMU but it doesn't usually have per process address spaces. So you don't need to flush the TLB on a process switch.
The kernel is very small and simple - it's vfs layer is only a line of two of code before jumping into a filesystem. And read() in a filesystem is very simple too - 99% of the time it just returns data from a cache buffer. TCP/IP implements zbuf to avoid copying. So the end result is that the 486 fetching a file over FTP from flash is only executing a few thousand instructions for each read - mostly copying from a buffer cache to a packet. Most the code/data probably fits in the on chip I/D cache. Which was good luck in this case, because this particular board had rather slow DRAM.
Now vxWorks isn't free in any sense - I believe it costs a buck or so per unit which is rather expensive. Still if you were switching to Linux in this system you'd need a faster CPU, more flash and more Ram. That would cost more than a vxWorks license.
Re: (Score:3, Informative)
Which if you really want a linux router, you go the correct route instead of buying low grade dog food stuff like linksys.
http://shop.gateworks.com/index.php?act=viewProd&productId=53 [gateworks.com] is one of several out there that run linux and a linux router distro far better than ANYTHING that cisco makes. it allows use of mid and higher end hardware instead of low end broadcom for the wireless networking
Honestly, anyone that buys a consumer router and then bitches that their non standard OS is not working on it
Re:It would be nice to name names (Score:5, Interesting)
Copyright: non-issue (Score:3, Informative)
so you couldn't put that in the firmware anyway.
This is actually a non issue, as you already have a licensed copy in your current firmware (which you could obtain either with the "backup old firware before flashing" option, or get it straight from Netgear's firmware repository).
The problem will only arise if you decide to publish your upgraded firmware on the net: you could only distribute the GPL bits, not the proprietary ones. There are 2 legal way to do then :
- Provide a small utility to save the proprietary part out of a legal copy, and the final use
Re: (Score:2, Interesting)
Got stuck in exactly the same situation: Panasonic TX-P46G15E TV admits using (L)GPL code in their system menu and points to http://www.am-linux.jp/dl/EUIDTV7/ However no utility or script to install modified firmware. I asked gpl-violations.org to help but without hard proof that TV runs Linux they didn't pursue further (even though Panasonic admits using (L)GPL software in system menu and user manual as well).
Re: (Score:3, Interesting)
For the free market to work, information like this has to be made available. If people know which companies are doing bad things then people will stop buying products from those companies and the companies w
Find an author (Score:5, Informative)
For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
http://www.gnu.org/licenses/gpl-2.0.html [gnu.org]
It's a straight up violation. Go find the author of the software... any author of any part of the software will do.. and invite them to sue the manufacturer. Direct them to the Software Freedom Law Center.
The loophole is bigger... (Score:2, Informative)
However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.
(from same link)
If the compiler is a special case then you have a problem there. If the target device is some special dedicated OS, it all comes under this exception? Notice that they do not require to release the compiler (unless is was adapted for this target).
Also remember a term called Tivoization [wikipedia.org]. You are starting the same discussion all over again.
But they are missing the largeste advantage of the GPL. They can have free mod version and bug fixes if they release their complete environment.
Re:The loophole is bigger... (Score:4, Insightful)
Yes, because compilers are usually distributed with embedded operating systems. (not)
The part in question is the installation scripts.
Re: (Score:2)
Also remember a term called Tivoization [wikipedia.org]. You are starting the same discussion all over again.
Yes, GPLv3 addresses that one.
Re:Find an author (Score:5, Insightful)
Direct them to the Software Freedom Law Center.
Indeed, it's worth another reminder that the FSF is not in the job of policing GPL abuse. They publish the license for others to use, but they're only going to (only can) try to enforce it for code they actually own. Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.
Furthermore, while the GPL is intended to grant freedoms to you and other third parties, it is, by the fact that it leverages existing laws, difficult for a third party to enforce. It's easy to imagine the following dialog:
You: They won't give me all the code as required by the license.
Them: The license itself says its not mandatory and we don't have to accept it.
You: It also says that if you don't accept it, then normal copyright law applies, and they don't have permission to use the code.
Them: That's as may be, but you have no standing to sue us over the copyrights.
Judge: Agreed, case dismissed.
Of course, this means that they will have more-or-less admitted to copyright violation in open court, which is a pretty risky strategy, but suddenly, you're out a bunch of money and facing a dead end. Better, as QuantumG suggested, to get ahold of the copyright holders up front.
Re: (Score:2)
Doesn't the FSF own the code for the GNU userspace utilities? If someone is selling a device with the Linux Kernel, most certainly it contains utilities the FSF has ownership over.
Re:Find an author (Score:5, Informative)
Re: (Score:2)
Might as well take this all the way to the limits.
Since hardware the code is running on is part of the build process, you'd also need to have not only entirely OSS software (ALL OF IT, firmware, bios, everything) but you'd also need entirely open source hardware.
I'll bet a months pay no one can make a valid claim of truly GPL compliant binary distributions if you follow that rule to the letter.
When you truely follow the full (and not some arbitrary version you create) dependancy tree, it would appear to me
Re: (Score:3, Interesting)
Since hardware the code is running on is part of the build process, you'd also need to have not only entirely OSS software (ALL OF IT, firmware, bios, everything)
Coreboot.
but you'd also need entirely open source hardware.
The mostly-MIPS-compatible Plasma CPU [opencores.org] exists. If the binary produced by a compiler running on an x86 CPU is byte-identical to the binary produced by the same compiler running on a Plasma CPU, is it still a case of turtles all the way down?
Re: (Score:2)
That's the author of the software's decision. Great thing about copyright law, the copyright holders get to pick and choose who they sue.
Re: (Score:3, Interesting)
Even under the most stringent reading requiring the compiler to be freely available, companies could still build binaries for these.
GCC is not self-hosting on Windows last I checked but GCC can be cross-compiled to windows and that can be used as the developers' build compiler. So the full recursive chain s
Re:Find an author (Score:5, Insightful)
Since the OP has given us no details as to the specifics of the two cases, it's impossible to offer any kind of rational comment.
Though, for your information, the GPL does not "infect" anything. It is a copyright license like any other except that it puts most of the control in the hands of the beholder. To the extent that it "infects" anything, that's all the choice of the developer. Don't want to follow the terms of the GPL? Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license. If you don't agree to the terms, don't use it. It's not rocket science, and it's not some kind of virus that needs to be stamped out.
By the way, due to the lack of information from the OP, it's not even clear if the FSF has any standing here - mentioning that they are not willing/able/prepared to fight the good fight is worthless when they may not even own the copyright allegedly being infringed.
I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.
I'm more inclined to believe this is something the FSF simply don't have the right to push for the reason mentioned above.
they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.
Are you confusing commercial with proprietary?
You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.
You see, there's the problem right there: Exactly what clause are these alleged companies accused of violating? They've provided the source code, Hell, the OP doesn't even mention what version of the GPL they think the companies are violating. I mean, really - how are we supposed to discuss the issue in such a scenario?
Re:Find an author (Score:5, Insightful)
The problem with saying that GPL is not viral in that you just don't have to use it, is missing the point. The issue here is that it is hard to tell when one has violated the GPL.
Well, no, it isn't missing the point. It _is_ the point. If it is so difficult for you to understand if you're violating the license, simply don't go near GPL code. This makes it extremely simple to know you are not violating it.
The issue here is that it is hard to tell when one has violated the GPL. In your own discussion, you say that without specifics, you can't tell whether a violation occurred. In my opinion, the OP presented a reasonably generalized story.
The GPL is one of the easier licenses out there to understand, and there are reams of discussion about what it means. Try to understand the license that, say, Oracle grants you without a copyright lawyer at your elbow.
With other software, you can just buy the software, and know that since you paid money you have a reasonable right to use it.
Try arguing that with the BSA if they show up for an audit. Seriously.
More generally, the problem here, at least I think, is between chair and keyboard. Just because you think the license is weird does not make it so. If copyright law in general is complex and nonintuitive (and it is), that has nothing to do with the GPL.
If you're just dinking around with code and manage to make a mistake in how you release it, nobody is going to come after you with guns blazing and daggers flying - they'll point out the mistake and let you correct it. And even if they did (possible, I just don't think it would happen), you can stop distributing the code. If you're commercially distributing your code in hardware, you likely have an IP lawyer on retainer anyway who can explain it to you. The problem comes in for shops that either (a) base a business model on exploiting GPLed code with no intention of complying, or (b) are being intentionally careless, like these vendors.
and, I can't resist:
Look at the diversity of opinion on this very slashdot page as proof of my point.
Your median /. poster's grasp of IP law is similar to Sarah Palin's understanding of foreign policy. That they both can see the respective objects from home just makes them aggressively stupid in their analysis. (And at least, as a politician, Palin has an excuse.)
Re: (Score:2)
I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.
This situation is one of the major reasons the FSF made a version 3 of the GPL. Releasing source code but using technical means to keep it from installing on a device is known as Tivoization [wikipedia.org].
Now, it is not clear from the summary if the company is actively preventing source code from being installed on the device, or if it can still be installed but you have to find your own bootloader, etc. As long as it's standard stuff, the company shouldn't have trouble. You aren't required to release the source of
Re: (Score:2)
the scripts used means the makefile they used. That is something you can read to tell what compiler they used, and even what version. But there may still be environmental variables not visible.
GPLv3 (Score:5, Informative)
The loophole being proposed is just a variant of Tivoization. And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Re: (Score:2, Redundant)
Mod parent up. He is 100% correct.
Re: (Score:2, Informative)
You don't need the GPLv3 to fix this, though. It's addressed pretty directly in the GPLv2.
Mod parent down. He's only 50% correct.
Re:GPLv3 (Score:5, Funny)
I find this concept of moderating based on factual correctness quaint but interesting.
Re:GPLv3 (Score:5, Funny)
Mod parent down, I don't like the tone of that comment.It needs to be dropped a couple of semitones.
Re: (Score:2)
Comment removed (Score:4, Funny)
Re: (Score:2)
I never said that you need the GPLv3 to fix it. I said that it does fix it, and everything similar you can think of. There's a slight but important difference there.
Re: (Score:2)
Mod parent up. He is 100% correct.
Mod parent up. He is 98% correct.
Re:GPLv3 (Score:4, Insightful)
And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Which may explain the almost complete absence of GPLv3 code in the software world.
In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero. Several of the major players in the industry design chips but outsource the manufacture, and the whole ecosystem is so locked down under NDAs that anyone trying to get detailed specs out in public would wish it was only Microsoft's entire legal team suing them. That means GPLv3 software is basically useless in most of the embedded development world.
Much the same probably applies to systems software, so many of those working on OSS operating systems, device drivers, etc. are similarly unable to work with GPLv3 code.
The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.
Re: (Score:3, Informative)
'minority views on software development' (Score:3, Funny)
2 can play at that game.
Enjoy this. [xkcd.com]
Re:GPLv3 (Score:4, Insightful)
I think that's slightly revisionist.
RMS's ideas have pretty much always been originally minority views that people have tried to label as unpragmatic (and even laughed at). In time surprisingly many of those views have become "reasonable" and "mainstream" -- and it wasn't RMS who changed his mind.
The guy may be nuts, but he's a visionary -- his track record at defining a long term vision and seeing it come true pretty much beats anyone else in the industry. This will remain so whether in ten years GPLv3 turns out to become "reasonable" according to the rest of the industry or not.
Re:GPLv3 (Score:5, Insightful)
This has got to be the craziest post I've seen in a long time.
Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects. http://news.cnet.com/8301-13505_3-10294452-16.html [cnet.com] This information took me 30 seconds to find on google. Before making wild ass comments, please do some research.
Now, you may have meant that GPLv3 code is rare on embedded devices. This may very well be true. But at least look up the numbers and tell us what they are rather than making outrageous comments backed up by nothing.
Also asserting that RMS is trying to capitalize on the popularity of the GPL to ram home his minority views is completely ridiculous. The GPL has ALWAYS been his vehicle for ramming home his minority views. Did you honestly think the GPL was popular when it was first released???? RMS and the GPL popularized these ideas in the first place. v2 isn't working exactly the way he wanted it to, so he changed it. What kind of warped view of the world do you have to have to think this is unreasonable?
Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues. It might not be for you. That's great. Choose another license. But take a look at some of the messages here. For example, vendors are allegedly shipping software for their wireless routers with vulnerabilities. Fixes exist for those vulnerabilities, but the customer can not apply the fix because they can't load a custom build. Things like this do not endear customers to their suppliers. Generally speaking, having the ability to fix your own problems is a good thing. This is one of the pragmatic issues that v3 fixes. The license is a promise by the vendor that these kinds of things won't happen. It is something that an informed consumer can base their purchase on if it is important to them.
I happen to think it is important to me. Many other people here happen to think it is important to them. Obviously you do not. I think you are letting your bias cloud your judgement, but that's up to you.
Re: (Score:3, Interesting)
Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects.
And how many of those are actually stable, shipping, useful software? How many users does that represent, in total?
Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues.
I never said it didn't. But if it really goes as far as some in this discussion are suggesting — and not being a lawyer, I'm not sure whether it really does or not, so I'm taking their word for it — then I think it has moved beyond pragmatism into the world of wishful thinking.
I don't really understand what is pragmatic about the kinds of cases I described. Code that is designed to
Re: (Score:3, Insightful)
And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Which may explain the almost complete absence of GPLv3 code in the software world.
In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero.
...
The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.
As much as RMS may be an ideologue, his view in this case seems to be pretty pragmatic.
Simply getting people using GPL'd code but being able to easily sidestep the requirement that others be able to use it completely defeats the purpose of it. Why would I ever want to make a deal that gives the other guy everything in exchange for, in reality, nothing? It's not pragmatic or moderate to accept an idea in principle but not act on it in fact, it's just pointless.
Maybe GPL 3 is slow to being adopted, maybe ther
Re: (Score:3, Interesting)
GPLv3 is an evolution of GPL, particularly GPLv2, against abuses which RMS predicted and which have now verified, most particularly patent issues. If you've not encountered patent software issues in the last 5 years, good for you, but they've been an increasing burden for people I work with.
The GPL is not merely "philosophical". While RMS may have a minority viewpoint, it's a minority viewpoint of someone with insight and a strange but effective brand of leadership, and the GPLv3 was developed openly with a
It's still a GPL violation (Score:5, Informative)
GNU GENERAL PUBLIC LICENSE Version 3 Free Software Foundation, Section 1, "Source Code.": The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.
The GPL does not allow authors to hide or refrain from distributing any build scripts or information required to build/install the binaries.
They cannot have a "secret" build environment, the GPL requires that they reveal all scripts and information about the build environment.
I don't understand why the FSF would not pursue this with full vigor. Obviously you cannot exercise your freedom to modify code, if the vendor does not distribute the pieces required to build and install a binary.
Re: (Score:2)
Embedded SDKs... (Score:3, Interesting)
It's an interesting problem with the GPL license text. There is a big difference between the "components released with the operating system" depending on whether you are talking about the full embedded SDK (often licensed for $$$ to product developers) or the final run-time OS (distributed in the product that goes to end-users). To which does the license text refer? Even back when GPLv2 was being authored, many Unix systems did not include compilers in the base release but they could be obtained by anybod
The Java trap (Score:3, Informative)
I doubt the intent of the license was to prohibit writing applications in certain languages while still opening the code.
Such languages are called Java-trapped [gnu.org]. Java itself used to be Java-trapped until Sun released OpenJDK.
Re: (Score:3, Insightful)
One of the companies still openly admitted that they violate the GPL:
one of them acknowledges that they are not fully GPL compliant, due to other license restrictions
I’d tell the FSF to sue them to hell and back! What is GPL? A second class license that can be just ignored due to some other stuff??
Re: (Score:3, Informative)
Those would actually qualify as install scripts, see GPL Violations Source Code Release FAQ [gpl-violations.org], specifically this section:
What are "scripts used to control installation"?
After having translated software from its source code form into
executable format, the program quite often needs to be installed into
the system. The process of installation is often automatized by
installation scripts. Exactly those scripts are referred to by the
GPL.
Please note that this is of special practical importance in the case of
embedded devices, since the executable program(s) need to be somehow
installed onto the device. If the user is not given a way to install
his own (modified) versions of the program, he has no way of exercising
his freedom to run modified versions of the program.
Sometimes, the process of installation is not facilitated by scripts, but
by some other means (such as executable programs). The GPL text only
mentions the word "scripts". But when reading and interpreting the license,
it is clearly understood that the license doesn't specifically only mean
"scripts", but any kind of software programs that are required to install
a (modified) version of the compiled program.
Re: (Score:3, Insightful)
ROM with a custom protocol (Score:3, Interesting)
as long as you have access to the proper equipment (CD burner + blank discs) there is nothing that stops you from creating usable 'custom' copies. I'd think the same applies to code in ROM, it's just that the necessary equipment is not typically found on your average home computer.
Some video game consoles use custom cartridge bus protocols, some of which are encrypted and/or patented. Before the NoPass crack [pineight.com] led to SLOT-1 cards, there wasn't any published way to make your own Nintendo DS-compatible ROM chip that wasn't just shellcode to get the DS executing code from the GBA slot. But if the ROM is in a user-removable cartridge, as in the case of almost every game console since the Atari VCS, the licensee under the GPL would still have to provide Installation Information because the
Re: (Score:3, Insightful)
I believe the build scripts were distributed.
The issue here is a proprietary firmware image format, which the GPL would not cover. They released all GPL code. Wrapping it up in a proprietary format so that it will work on your device does not mean GPL suddenly applies to that format. It only covers GPL'd code and modifications to GPL'd code.
Once that sucker is compiled, they can do anything they want with the binary, including packaging it in a proprietary image format for flashing to a ROM. That portio
No, they're just non compliant (Score:4, Informative)
The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
My reading of "all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work" would cover the build environment. They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though.
build tools? Re:No, they're just non compliant (Score:4, Interesting)
"They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though."
Would that it were that simple. There's lots of things out there where you can't just download the source and do a "make clean; make".... do you have the right libraries? (glibc version hell) The right version of the tools? (there's more than one version of gcc out there) The provider of the software might not even know... they just make it on their box, it goes ok, and they package up the source and distribute it.
Re: (Score:2)
No, I disagree. The section "However, this does not include the work's System Libraries, or general-purpose tools..."
I read this as you must include the defines that you used to build it, but not the build script or firmware loader utilities that you used to put it on the device. To point out, the GPLv3 is the strictest, GPL1 and GPL2 are not as strict.
Not a violation here.
Obvious answer, old answer. (Score:5, Insightful)
Yes - it's called "having more lawyers than you."
What are you going to do about it, sue? You can always sue...if you actually have the resources to fight it out. And even if you actually get it to stick, it could be years down the road before you actually get access.
Regarding your specific case, can you reverse-engineer a solution?
Re:Obvious answer, old answer. (Score:5, Informative)
He can't sue, because he has no standing. He's not the copyright owner.
Don't sue... (Score:2)
This only adds bad press to Linux. OTOH an offer to cooperate with freeing up the firmware?
Sign an NDA on a tool-set for the company, then release a free version. Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.
Re:Don't sue... (Score:4, Insightful)
Re:Don't sue... (Score:5, Insightful)
This only adds bad press to Linux.
WTF? Making a company comply with a license gives "bad press" ? I think that current way (asking, nagging, offering help, refusing to take any serious step) is worse - it promotes idea that GPL and other free licenses don't really matter - you can ignore them all you want and in worst case they can string along the community by releasing small bits and "discussing the situation" until the product becomes obsolete anyway.
OTOH an offer to cooperate with freeing up the firmware? Sign an NDA on a tool-set for the company, then release a free version.
Sure. Why not become unpaid employee. It is the company's responsibility. If they are incapable of understanding license of software they distribute, then maybe it is time to fire (and sue for damages) their lawyers.
Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.
Well, they did not comply with the license, so it has been automatically revoked, isn't that right?
Re:Don't sue... (Score:4, Informative)
Don't ever sign an NDA. That's horrible advice.
If the build-system has to be reverse-engineered for this company to avoid being held accountable for their commercial infringement of copyright, it's on them to get it done. And the person implementing the new build-system will need to be working in a clean room, without ever seeing the old build system, so there is no call for an NDA there. Get one person to analyse and document the function of the old one, and write the specification, then the person who does the new build system only sees that spec.
Yes, that is exactly what they are doing (Score:2)
And it'll work, too.
Re: (Score:2)
And it'll work, too.
As long as there aren't dogs and those meddling kids involved.
No end run (Score:5, Informative)
No, the build environment doesn't provide an end-run around the GPL. Both v2 and v3 of the GPL require the distributor to provide the scripts that control the build. In GPLv2 it's in section 3, in GPLv3 it's in section 1. GPLv3 also covers this again in section 6, in a more general form when it discusses installation information.
Re:No end run (Score:5, Informative)
The submitter didn't say that the scripts that control the build are missing. He said they don't provide a build environment. If I distribute GPL code that I build with Visual Studio, I don't have to distribute Visual Studio. I just have to distribute the project file (or whatever it is nowadays--haven't don't Windows in a long time).
It sounds like both companies are distributing embedded software for a hardware device. It's quite possible that the things they aren't distributing are part of some third-party expensive development environment, that they are using off the shelf. If that's the case, there's no GPL violation, as long as they distribute everything the submitter would need to build and install the software if he were to go obtain from that third party the development environment.
That's not how I read it (Score:4, Insightful)
That's not how I read that clause. While it does make the mention that you don't need to distribute any freely available or common tools required to build that source, it seems to me like they spell it out pretty clearly that otherwise you need to distribute everything needed to build, install and run that thing. (But I am not a laywyer.)
Otherwise it would be trivial to make the source need parsing through a script that only runs on my internal and proprietary modified Brainfuck interpreter, and then through a Lisp program that only runs on an old version of Autocad that's still installed somewhere in the company, before it compiles.
In your particular case, sure, you can develop with Visual Studio, but surely you can take the time to write a makefile that can be run at the command prompt. In fact, it's been years since I worked with Visual Studio, but I seem to remember it did that for me itself. And they wouldn't even force you to use gcc, since the command line versions of the MS compilers were free last I heard.
(And frankly if they don't have an automatic build machine, and the scripts that that needs, i.e., if they're in the kind of situation where tgey can only build on some dev's machine in their Visual Studio, with whatever sources they may or may not have checked out at the time... they're not the kind of company I'd want to buy anything from in the first place.)
Plus, if I understand the summary right, even if he managed to compile the binary code, the tools to install (and thus also to run it) are missing too. I'd say that's against the letter and spirit of that clause right there. The idea was to be able to make changes, not to just have a bit of source to open in an editor, but not be able to actually run any changes or, for that matter, even know if it's the right source. How would you know for something you can't even compile, and certainly not run?
And it's hard not to ascribe it to malice there. Whatever proprietery protocols they use to upload that firmware, surely they're encapsulated in a bunch of classes and functions that are just called from whatever environment they use. It's trivial to pack the same in a small command line utility.
(And again, if they're that joined at the hip to whatever environment is usually used to upload that firmware, that they can't separate the classes that do the uploading from the rest of the beast... it sure doesn't sound like the kind of company I'd trust to program my VCR, much less the firmware for anything.)
TIme to name names. (Score:5, Insightful)
It sounds like you don't work for either of these companies. So why are you protecting them?
If you really want them to do the right thing, start making a stink about it. There's very little chance anything is going to change because one guy asked them to. There's at least some chance that they will if the companies start getting a bloody nose from it.
Re: (Score:2)
Re: (Score:2)
The names should be protected at this stage. It's not clear whether they're doing something wrong or not
It's not clear if they're violating the GPL because there's not enough information given. We have no idea if this is GPL 2 or GPL 3, no idea what build tools are/are not available, no idea what the product is, etc.
(see the Visual Studio example in a nearby comment),
The relevant part of the GPL2 is:
Re: (Score:2)
a quick telling them that they might want to correct that one little mistake is better strategy than yelling out "OMFG, you violated the holy GPL, you burn in hell forever, kthxbye!"
A false dichotomy. Why are those the only two options? Why does naming names have to be your extreme example of dickishness?
Re: (Score:2)
Because past experience on Slashdot and elsewhere shows that when names are named, there is a small but significant vocal collection of frothing at the mouth, militant types that will think nothing of leaving hundreds of VMs for the CEO, sending hundreds of faxes, thousands of emails, sign them up for a few spam lists along the way as a way of "making a point".
Not really, no (Score:4, Interesting)
Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request? You cannot rebuild the application, even given the entire source code, without access to a non-GPL piece of software you don't have access to.
You might not like it. You might even think it's against the spirit of something or other. But it's not a GPL violation.
You could argue that one difference is that Visual Studio is available to anyone prepared to pay for it. I'm sure that the build environment for the device you're talking about is also available to anyone prepared to pay for it. It likely costs more than you'd want to pay, though.
Their bad (Score:4, Insightful)
No sympathy for them, if they cannot comply with the license they are engaged in commercial copyright infringement and should be thankful you gave them an opportunity to fix it rather than going straight for statutory damages.
However the FSF has limited funds and they do have to pick their battles wisely. If all you can do about the situation is bump your FSF contribution then do it.
As for a practical workaround for your benefit, do you have the ability to write arbitrary bytes to the firmware? If so you should be able do this in a hexeditor. It wouldnt be trivial though - quite a few hours of work, depending on the specifics of how they screwed their HTML up so badly and how it's encoded. You might be able to shortcircuit it a bit by simply determining what IE sends to the device to perform each task, and then scripting your own pages that result in the correct bits being sent to the device. Would have to look at the actual device in-depth to determine which route is most practical.
Legally, no. Practically, yes. (Score:5, Interesting)
However, in practice, to uphold a right, no matter how solidly enshrined in law, generally takes time and money(particularly in civil cases, where the state won't provide you even a shitty lawyer). As long as they aren't the most blatant, the SFLC and their ilk probably won't go after them(especially if their hardware is uncommon or obscure; from a strategic standpoint, the SFLC probably cares more about improvements to OSS software flowing back to the community, and buildability on common devices than they do about buildability on obscure stuff). You might have slightly better luck if you can identify the specific authors/copyright holders of all the GPL code used in the firmware. Particularly for the company that put itself in a license bind, any of the authors could decide to sue them, possibly for real money, if they so chose.
For you personally, though, you are probably SOL. If you have to ask slashdot, you probably don't have the lawyers you need. About all you can do is make noise about the situation, naming names, ideally, and hope that somebody with firepower takes interest.
Re: (Score:2)
As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites.
I need to ship you a fucking computer along with the source code? A computer is a prerequisite to build the software.
Re: (Score:2)
Or you could just read the actual GPL text that many people have pasted and not be an idiot:
"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."
Source code, not hardware.
it is copyright (Score:2, Insightful)
I thought we hated copyright because it rewards people for too long now etc.
The company is not depriving anyone else of using the code so therefore there is no harm in it and no value lost etc etc etc
Funny how we want it both ways, huh?
Re: (Score:3, Insightful)
Copyright does last too long. Doesnt mean it should expire any quicker just because it's offered under a free license than otherwise. And chances are very good the code in question is still quite young.
A bigger problem is that it has been incorrectly interpreted to allow copyrighting of binary code. That is not consistent with the founders intentions. If you want to copyright software you should have to publish the source code. But in this case the source code that was licensed is published, obviously, so t
Build scripts wouldn't help (Score:2, Interesting)
As others have posted, they are meant to give you a copy of the build scripts. These scripts may not work outside of their environment (due to hard coded paths, etc), but they are meant to give you those scripts.
But nothing in the GPL says that they have to give you the firmware utilities used to load a new firmware on.
No, this is missing the point (Score:4, Informative)
The GPL doesn't require that hardware that has GPL code be modifiable to include updated versions of code. Build systems are a distraction here: a more direct form of the problem is that the GPL code is burned into ROM, and even the GPLv3's Tivoization section (number 6, paragraph starting "If you convey...") explicitly permits that. It would be dumb if it didn't. While it may well be the case that for GPLv3 (and not GPLv2) failing to give you a usable build environment for compiling modifying code so you can run it on your "User Product" is a violation, this is forgetting a large part of the purpose of free software.
The point of free software is that the software, the code, is free for the community to use. Thinking about free software as simply the ability to modify code within its original context causes us to forget opportunities for reusability that benefit the entire free software community, well past the lifetime of this one device, and encourages behavior where modified code isn't usable on other devices or in entirely different contexts. I've written a bit more about this on my blog [mit.edu], with some examples of times when thinking about "free software"/"open source" only within the context of the original product has caused the free software ecosystem as a whole — the thing that's causing large companies to want to embed free software in their hardware devices in the first place — to be left behind.
What do you mean by "build environment" (Score:3, Insightful)
Are you talking about makefiles and scripts, or are you talking about a proprietary compiler used to generate the code? There's a huge difference.
This is why we don't use GPL stuff (Score:4, Insightful)
The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this. We also employ people to make contributions back to the FreeBSD project as well, so we're not mooches, but seriously... this is why so many companies don't want to get involved with Linux or GPL solutions.
A loophole, you say? (Score:2)
You said it yourself; this is as much a loophole to GPL as a criminal getting away with it because he has good lawyers.
It's not a loophole of GPL itself, but rather of the legal system in which it must rely.
Why are you keeping secrets? (Score:5, Insightful)
Sorry but the hypocrisy of your statement is so in my face I have to say something.
You are keeping the identity of these companies secret for what end? It's GPL there for open there for it should not be a secret.
If you say something this community might be able to help you. Maybe one of us has already discovered solutions to your technical problem. When something like this comes up slashdot usually coughs up pages of useful links. It can be rather fun and interesting at times.
Sadly you are keeping it secret. Thus the helpfulness of this community is next to zip.
Because you are keeping things secret it would not be all too far fetched to believe that you are actually trying to alter the code is such a way as to derive money from it. Say by either selling an after market mod or by selling it back to the mystery vendor(s).
Please don't cry about the big companies keeping secrets if you can't even get that out with out keeping a secret.
P.S. Most likely no violation was made. Hardware and build env's are not governed by source code GPL. Unless of course the hardware or build env is also derived from a GPL reference.
GPL's about free software. You want open hardware. (Score:4, Interesting)
The two are related, and both are desirable. However, they are mostly two different issues. You have the source and can put it on to any hardware for which you have proper access. Your problem here isn't the software license. It's the hardware license. You also need to get hardware for which you are granted the proper access. The distinction is clear, and I'm not sure why there is so much confusion.
GPLv2 vs. GPLv3 in the embedded world (Score:4, Interesting)
My employer works in a market where we can trust our partners about as far as we can throw them. They would rip us off in a heartbeat given the chance, and have in the past, and we don't have the resources to deal with it in court. We're happy to contribute our modifications of GPL code back to the community, and we do, but the constraints of the embedded environment require that most of our value-add proprietary code is in scripting languages, so it would be trivial for any of them to rip us off if we handed out the build scripts. We don't go out of our way to obfuscate things, but we don't make it easy to modify our firmware either.
As a consequence of this, GPLv3 is a strict no-go for us, and the same is true for many other small companies in the cut-throat embedded world. If we could trust our partners, or we could afford to litigate when they attempt to screw us over, we'd gladly be as open as possible, but as it stands we can't afford to give away our proprietary code in the process of complying with the GPLv3, so GPLv2 is as Free as we go.
Posted anonymously for what I hope are extremely obvious reasons.
Re: (Score:2)
What if the firmware is burned into ROM and hardware only supports ROM?
You burn a new PROM (or EPROM, or EEPROM...) to replace the existing one. If you have the wherewithal to tinker with the firmware on a device that only supports ROM, then you certainly have the wherewithal to swap an IC on the board.
Re: (Score:3, Interesting)
But this is largely irrelevant, as nobody with half a brain uses ROM firmware. Flash allows you to correct firmware errors later.
Re: (Score:2)
This is almost entirely wrong. Version 2 of the GPL does specify that you need to specify everything required to compile the software, but not to run it on any specific machine. That's what Tivoisation is about; you can grab the Linux code for the Tivo, you can compile it, you can run it, but you can't run it on a Tivo.
Secondly, the media is not irrelevant. The GPL specifically states that it must be a medium commonly used for software interchange. Stone tablets would most definitely not fit this descr
Re: (Score:2, Funny)
Some companies are still in the IT stone age. For example, one company - with which I just got an account - sells flatrates to video games for a monthly fee. So far so good but they actually use an IE-only plug-in that relies on ActiveX and only runs as administrator. And that's the "updated new version" of their client :D
Admittedly it's supposed to run on FF eventually ... some time in the future ... promise ;)
Re: (Score:2)
Or you could just have spent a second reading the GPL, and then not bothered with your incorrect post.
"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."
Re: (Score:3, Interesting)
First, we have not specified which GPL version is applicable, or if there are specific exemptions to it. Here is the applicable section under GPLv1:
"Source code for a work means the preferred form of the work for making
modifications to it. For an executable file, complete source code means
all the source code for all modules it contains; but, as a special
exception, it need not include source code for modules which are standard
libraries that accompany the operating system on which the executable
file runs, o
Re:No such thing as "not fully GPL compliant" (Score:4, Insightful)
Umm no. Nothing has been stolen. There appears to be an ongoing and deliberate commercial infringement of copyright.