Do Build Environments Give Companies an End Run Around the GPL? 374
Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"
It would be nice to name names (Score:5, Insightful)
so we can vilify them, castigate them, and otherwise snark.
Obvious answer, old answer. (Score:5, Insightful)
Yes - it's called "having more lawyers than you."
What are you going to do about it, sue? You can always sue...if you actually have the resources to fight it out. And even if you actually get it to stick, it could be years down the road before you actually get access.
Regarding your specific case, can you reverse-engineer a solution?
TIme to name names. (Score:5, Insightful)
It sounds like you don't work for either of these companies. So why are you protecting them?
If you really want them to do the right thing, start making a stink about it. There's very little chance anything is going to change because one guy asked them to. There's at least some chance that they will if the companies start getting a bloody nose from it.
Re:Don't sue... (Score:4, Insightful)
Their bad (Score:4, Insightful)
No sympathy for them, if they cannot comply with the license they are engaged in commercial copyright infringement and should be thankful you gave them an opportunity to fix it rather than going straight for statutory damages.
However the FSF has limited funds and they do have to pick their battles wisely. If all you can do about the situation is bump your FSF contribution then do it.
As for a practical workaround for your benefit, do you have the ability to write arbitrary bytes to the firmware? If so you should be able do this in a hexeditor. It wouldnt be trivial though - quite a few hours of work, depending on the specifics of how they screwed their HTML up so badly and how it's encoded. You might be able to shortcircuit it a bit by simply determining what IE sends to the device to perform each task, and then scripting your own pages that result in the correct bits being sent to the device. Would have to look at the actual device in-depth to determine which route is most practical.
Re:Don't sue... (Score:5, Insightful)
This only adds bad press to Linux.
WTF? Making a company comply with a license gives "bad press" ? I think that current way (asking, nagging, offering help, refusing to take any serious step) is worse - it promotes idea that GPL and other free licenses don't really matter - you can ignore them all you want and in worst case they can string along the community by releasing small bits and "discussing the situation" until the product becomes obsolete anyway.
OTOH an offer to cooperate with freeing up the firmware? Sign an NDA on a tool-set for the company, then release a free version.
Sure. Why not become unpaid employee. It is the company's responsibility. If they are incapable of understanding license of software they distribute, then maybe it is time to fire (and sue for damages) their lawyers.
Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.
Well, they did not comply with the license, so it has been automatically revoked, isn't that right?
Re:The loophole is bigger... (Score:4, Insightful)
Yes, because compilers are usually distributed with embedded operating systems. (not)
The part in question is the installation scripts.
Re:Find an author (Score:5, Insightful)
Direct them to the Software Freedom Law Center.
Indeed, it's worth another reminder that the FSF is not in the job of policing GPL abuse. They publish the license for others to use, but they're only going to (only can) try to enforce it for code they actually own. Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.
Furthermore, while the GPL is intended to grant freedoms to you and other third parties, it is, by the fact that it leverages existing laws, difficult for a third party to enforce. It's easy to imagine the following dialog:
You: They won't give me all the code as required by the license.
Them: The license itself says its not mandatory and we don't have to accept it.
You: It also says that if you don't accept it, then normal copyright law applies, and they don't have permission to use the code.
Them: That's as may be, but you have no standing to sue us over the copyrights.
Judge: Agreed, case dismissed.
Of course, this means that they will have more-or-less admitted to copyright violation in open court, which is a pretty risky strategy, but suddenly, you're out a bunch of money and facing a dead end. Better, as QuantumG suggested, to get ahold of the copyright holders up front.
it is copyright (Score:2, Insightful)
I thought we hated copyright because it rewards people for too long now etc.
The company is not depriving anyone else of using the code so therefore there is no harm in it and no value lost etc etc etc
Funny how we want it both ways, huh?
What do you mean by "build environment" (Score:3, Insightful)
Are you talking about makefiles and scripts, or are you talking about a proprietary compiler used to generate the code? There's a huge difference.
This is why we don't use GPL stuff (Score:4, Insightful)
The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this. We also employ people to make contributions back to the FreeBSD project as well, so we're not mooches, but seriously... this is why so many companies don't want to get involved with Linux or GPL solutions.
Re:GPLv3 (Score:4, Insightful)
And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Which may explain the almost complete absence of GPLv3 code in the software world.
In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero. Several of the major players in the industry design chips but outsource the manufacture, and the whole ecosystem is so locked down under NDAs that anyone trying to get detailed specs out in public would wish it was only Microsoft's entire legal team suing them. That means GPLv3 software is basically useless in most of the embedded development world.
Much the same probably applies to systems software, so many of those working on OSS operating systems, device drivers, etc. are similarly unable to work with GPLv3 code.
The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.
Re:Find an author (Score:5, Insightful)
Since the OP has given us no details as to the specifics of the two cases, it's impossible to offer any kind of rational comment.
Though, for your information, the GPL does not "infect" anything. It is a copyright license like any other except that it puts most of the control in the hands of the beholder. To the extent that it "infects" anything, that's all the choice of the developer. Don't want to follow the terms of the GPL? Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license. If you don't agree to the terms, don't use it. It's not rocket science, and it's not some kind of virus that needs to be stamped out.
By the way, due to the lack of information from the OP, it's not even clear if the FSF has any standing here - mentioning that they are not willing/able/prepared to fight the good fight is worthless when they may not even own the copyright allegedly being infringed.
I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.
I'm more inclined to believe this is something the FSF simply don't have the right to push for the reason mentioned above.
they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.
Are you confusing commercial with proprietary?
You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.
You see, there's the problem right there: Exactly what clause are these alleged companies accused of violating? They've provided the source code, Hell, the OP doesn't even mention what version of the GPL they think the companies are violating. I mean, really - how are we supposed to discuss the issue in such a scenario?
Re:it is copyright (Score:3, Insightful)
Copyright does last too long. Doesnt mean it should expire any quicker just because it's offered under a free license than otherwise. And chances are very good the code in question is still quite young.
A bigger problem is that it has been incorrectly interpreted to allow copyrighting of binary code. That is not consistent with the founders intentions. If you want to copyright software you should have to publish the source code. But in this case the source code that was licensed is published, obviously, so that isnt an issue here either.
Finally, copyright was not intended to, and should not, apply to non-commercial use. But this is commercial use.
So no, I dont see us 'wanting it both ways' here, at all.
Re:It's still a GPL violation (Score:3, Insightful)
One of the companies still openly admitted that they violate the GPL:
one of them acknowledges that they are not fully GPL compliant, due to other license restrictions
I’d tell the FSF to sue them to hell and back! What is GPL? A second class license that can be just ignored due to some other stuff??
Re:It's still a GPL violation (Score:3, Insightful)
Why are you keeping secrets? (Score:5, Insightful)
Sorry but the hypocrisy of your statement is so in my face I have to say something.
You are keeping the identity of these companies secret for what end? It's GPL there for open there for it should not be a secret.
If you say something this community might be able to help you. Maybe one of us has already discovered solutions to your technical problem. When something like this comes up slashdot usually coughs up pages of useful links. It can be rather fun and interesting at times.
Sadly you are keeping it secret. Thus the helpfulness of this community is next to zip.
Because you are keeping things secret it would not be all too far fetched to believe that you are actually trying to alter the code is such a way as to derive money from it. Say by either selling an after market mod or by selling it back to the mystery vendor(s).
Please don't cry about the big companies keeping secrets if you can't even get that out with out keeping a secret.
P.S. Most likely no violation was made. Hardware and build env's are not governed by source code GPL. Unless of course the hardware or build env is also derived from a GPL reference.
Re:My Linksys experience (Score:5, Insightful)
Not true anymore. Many of them have been switched to the very restrictive vxWorks platform.
The big problem with GPL violations, and by extension poor customer service, is there is never enough backlash to deter these heinous practices. We can groan until we're blue in the face, Cisco/Linksys will continue to sell flaky hardware and buggy, unmaintained firmware/drivers and endless spin doctoring. These days their business is 90% sales & marketing, 10% development. That's why the router you buy today is no better than the one you bought a decade ago. They don't give a crap, they can just slap a new ugly plastic box around the same cheap old guts and print more money.
Even their enterprise gear has taken a nose-dive. They have about two dozen different 24-port switch SKUs, and they even have the nerve to give you detailed comparison grids, highlightly precisely how little they differ. How many ways can one shuffle managed vs unmanaged (why even bother anymore), and POE vs non-POE ? They need to fire half their marketing staff and beat the other ones until they stop telling the engineers what to build. Having a uniform product line means greater efficiencies in both production and support. Modern business 101, for crying out loud!
That's not how I read it (Score:4, Insightful)
That's not how I read that clause. While it does make the mention that you don't need to distribute any freely available or common tools required to build that source, it seems to me like they spell it out pretty clearly that otherwise you need to distribute everything needed to build, install and run that thing. (But I am not a laywyer.)
Otherwise it would be trivial to make the source need parsing through a script that only runs on my internal and proprietary modified Brainfuck interpreter, and then through a Lisp program that only runs on an old version of Autocad that's still installed somewhere in the company, before it compiles.
In your particular case, sure, you can develop with Visual Studio, but surely you can take the time to write a makefile that can be run at the command prompt. In fact, it's been years since I worked with Visual Studio, but I seem to remember it did that for me itself. And they wouldn't even force you to use gcc, since the command line versions of the MS compilers were free last I heard.
(And frankly if they don't have an automatic build machine, and the scripts that that needs, i.e., if they're in the kind of situation where tgey can only build on some dev's machine in their Visual Studio, with whatever sources they may or may not have checked out at the time... they're not the kind of company I'd want to buy anything from in the first place.)
Plus, if I understand the summary right, even if he managed to compile the binary code, the tools to install (and thus also to run it) are missing too. I'd say that's against the letter and spirit of that clause right there. The idea was to be able to make changes, not to just have a bit of source to open in an editor, but not be able to actually run any changes or, for that matter, even know if it's the right source. How would you know for something you can't even compile, and certainly not run?
And it's hard not to ascribe it to malice there. Whatever proprietery protocols they use to upload that firmware, surely they're encapsulated in a bunch of classes and functions that are just called from whatever environment they use. It's trivial to pack the same in a small command line utility.
(And again, if they're that joined at the hip to whatever environment is usually used to upload that firmware, that they can't separate the classes that do the uploading from the rest of the beast... it sure doesn't sound like the kind of company I'd trust to program my VCR, much less the firmware for anything.)
Re:No such thing as "not fully GPL compliant" (Score:4, Insightful)
Umm no. Nothing has been stolen. There appears to be an ongoing and deliberate commercial infringement of copyright.
Re:Find an author (Score:5, Insightful)
The problem with saying that GPL is not viral in that you just don't have to use it, is missing the point. The issue here is that it is hard to tell when one has violated the GPL.
Well, no, it isn't missing the point. It _is_ the point. If it is so difficult for you to understand if you're violating the license, simply don't go near GPL code. This makes it extremely simple to know you are not violating it.
The issue here is that it is hard to tell when one has violated the GPL. In your own discussion, you say that without specifics, you can't tell whether a violation occurred. In my opinion, the OP presented a reasonably generalized story.
The GPL is one of the easier licenses out there to understand, and there are reams of discussion about what it means. Try to understand the license that, say, Oracle grants you without a copyright lawyer at your elbow.
With other software, you can just buy the software, and know that since you paid money you have a reasonable right to use it.
Try arguing that with the BSA if they show up for an audit. Seriously.
More generally, the problem here, at least I think, is between chair and keyboard. Just because you think the license is weird does not make it so. If copyright law in general is complex and nonintuitive (and it is), that has nothing to do with the GPL.
If you're just dinking around with code and manage to make a mistake in how you release it, nobody is going to come after you with guns blazing and daggers flying - they'll point out the mistake and let you correct it. And even if they did (possible, I just don't think it would happen), you can stop distributing the code. If you're commercially distributing your code in hardware, you likely have an IP lawyer on retainer anyway who can explain it to you. The problem comes in for shops that either (a) base a business model on exploiting GPLed code with no intention of complying, or (b) are being intentionally careless, like these vendors.
and, I can't resist:
Look at the diversity of opinion on this very slashdot page as proof of my point.
Your median /. poster's grasp of IP law is similar to Sarah Palin's understanding of foreign policy. That they both can see the respective objects from home just makes them aggressively stupid in their analysis. (And at least, as a politician, Palin has an excuse.)
Re:My Linksys experience (Score:4, Insightful)
Re:It's still a GPL violation (Score:3, Insightful)
I believe the build scripts were distributed.
The issue here is a proprietary firmware image format, which the GPL would not cover. They released all GPL code. Wrapping it up in a proprietary format so that it will work on your device does not mean GPL suddenly applies to that format. It only covers GPL'd code and modifications to GPL'd code.
Once that sucker is compiled, they can do anything they want with the binary, including packaging it in a proprietary image format for flashing to a ROM. That portion of it they don't ever have to give up.
Re:My Linksys experience (Score:4, Insightful)
I don't get something in your reasoning - care to explain?
When Joe Shmoe downloads Corporation X's software from TPB, installs it and makes money using it, and they find out, they send a legal letter demanding that Joe removes the software and pays up $x (for very high values of x) or gets dragged through court (and ends up paying many times $x) for violation of the license. After that, Joe Shmoe is broke and Corporation X starts lobbying for new laws against software piracy.
When FooShmoo & Co. downloads Mr FLOSS Developer's GPL-licensed software from his website, puts it in their FooBox 2.0 and sells it without distributing the source code or allowing for its proper use, and he finds out, he first asks them to comply in an informal manner, then he tries to publicize the problem hoping that FooShmoo & Co. will comply to prevent bad publicity, and only when this fails, he goes to the FSF or the likes and asks for help, which usually means a legal letter demanding that they comply, or be dragged through court (and end up complying and paying the legal fees) for violation of the license. After that, FooShmoo & Co. can go on with its business and Mr FLOSS Developer is content that his rights as an author are finally respected.
And yet, you present the latter situation in a derogatory manner. Why?
Re:GPLv3 (Score:4, Insightful)
I think that's slightly revisionist.
RMS's ideas have pretty much always been originally minority views that people have tried to label as unpragmatic (and even laughed at). In time surprisingly many of those views have become "reasonable" and "mainstream" -- and it wasn't RMS who changed his mind.
The guy may be nuts, but he's a visionary -- his track record at defining a long term vision and seeing it come true pretty much beats anyone else in the industry. This will remain so whether in ten years GPLv3 turns out to become "reasonable" according to the rest of the industry or not.
Re:GPLv3 (Score:5, Insightful)
This has got to be the craziest post I've seen in a long time.
Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects. http://news.cnet.com/8301-13505_3-10294452-16.html [cnet.com] This information took me 30 seconds to find on google. Before making wild ass comments, please do some research.
Now, you may have meant that GPLv3 code is rare on embedded devices. This may very well be true. But at least look up the numbers and tell us what they are rather than making outrageous comments backed up by nothing.
Also asserting that RMS is trying to capitalize on the popularity of the GPL to ram home his minority views is completely ridiculous. The GPL has ALWAYS been his vehicle for ramming home his minority views. Did you honestly think the GPL was popular when it was first released???? RMS and the GPL popularized these ideas in the first place. v2 isn't working exactly the way he wanted it to, so he changed it. What kind of warped view of the world do you have to have to think this is unreasonable?
Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues. It might not be for you. That's great. Choose another license. But take a look at some of the messages here. For example, vendors are allegedly shipping software for their wireless routers with vulnerabilities. Fixes exist for those vulnerabilities, but the customer can not apply the fix because they can't load a custom build. Things like this do not endear customers to their suppliers. Generally speaking, having the ability to fix your own problems is a good thing. This is one of the pragmatic issues that v3 fixes. The license is a promise by the vendor that these kinds of things won't happen. It is something that an informed consumer can base their purchase on if it is important to them.
I happen to think it is important to me. Many other people here happen to think it is important to them. Obviously you do not. I think you are letting your bias cloud your judgement, but that's up to you.
Re:GPLv3 (Score:3, Insightful)
And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Which may explain the almost complete absence of GPLv3 code in the software world.
In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero.
...
The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.
As much as RMS may be an ideologue, his view in this case seems to be pretty pragmatic.
Simply getting people using GPL'd code but being able to easily sidestep the requirement that others be able to use it completely defeats the purpose of it. Why would I ever want to make a deal that gives the other guy everything in exchange for, in reality, nothing? It's not pragmatic or moderate to accept an idea in principle but not act on it in fact, it's just pointless.
Maybe GPL 3 is slow to being adopted, maybe there are other places where it could have been better crafted, but the problem of getting people to comply *in substance* with GPL 2 already existed.
Now that people are looking at GPL 3 and saying, "we can't comply with this" doesn't mean that GPL 3 has made the problem worse, just exposed the fact that people were only complying with the letter of the GPL 2, not the substance of it.
Re:My Linksys experience (Score:3, Insightful)
the original company still ends up getting the blame when user modifications break the product. I got really, really sick of dealing with those support issues over time.
Badly run companies run into this. I've worked at ISPs that have been Microsoft's unofficial support desk because they couldn't tell the customer that there's a signal at their cable, the rest is between them and their OS vendor.
Other companies in almost exactly the same demographics have happy users, without supporting their OS or playing weird games, simply by being upfront with the users about where problems lie.
The two situations are you describe are completely differnt ends of the process....
Different ends yes, of the same process though. Let me rework this a bit:
[upstream developer exerting control over] end user [distribution of] software and upstream developer exerting control over a downstream product.
You want control over those below you, but freedom from those above you.
Sure, the GPL has a cost, but then so do commercial libraries ($$$) - why do people present strange what-ifs where the GPL conflicts with some closed-source process as an excuse for non-compliance with the GPL? It'd be like writing two checks for the same money and blaming the first person to cash it for preventing the second person from getting paid.
It's not meant to be free. If you're really, really sick of dealing with it, maybe you simply didn't understand the cost, like many people didn't understand the implications of their variable-rate mortgages.
Re:My Linksys experience (Score:4, Insightful)
Everything you describe is the right of the user. "Controlling" a product is a complete and utter ethical failure. Why should tech companies have this privilege ? No OTHER companies do. They just put on a sticker saying modifications will void the warantee (fair enough) but if I want to open my microwave oven and put in a 5-times more powerful magnetron - L.G. doesn't get to tell me it's illegal to do so, or for that matter, try to build a huge titanium box around the magnetron to prevent me.
Or to use the obligatory car analogy: if I tune up my engine for higher speed, I am probably shortening it's lifespan - but the car company doesn't get to tell me it's illegal to put in a faster exhaust system. They generally won't even try too hard to stop me replacing the software on the onboard computer to adjust the timings for maximum performance.
Short of safety features - no company gets to "control" how you use their products - it's against the principle of first sale (for starters, I can indeed sell my modified version - as long as I don't pretend it's unmodified [that would violate trademark law - and with good reason, it would be fraud and it's exactly what trademark law exists to prevent]).
Why the hell should tech companies get this privilege then ? Because they can claim software copyright ? Big whoop. Just because a part of a car is patented, BMW doesn't get to tell me I can't put in a different part there.
It shouldn't work that way - and it's wrong that it does. Furthermore - the decision of the original authors to use the GPL clearly indicate that those authors agreed with my perspective here, so violating the spirit of that agreement is against the grounds under which you got to benefit from their work. In most countries, violating the spirit of a legal agreement is exactly as wrong as violating it's letter, the US can get confusingly literal at times though so this may not hold there.
Finally - I'm quite sure that withholding the tools required to actually install modified firmware on the device counts as breaking the GPLv3's anti-tivoization clause so if any of this software is under GPL3 or GPL2-or-later clauses - a case could be made that they are giving source while preventing the installation of modifications and that this violates the license.