GPL Violation, Microtest's DiskZerver

Early this week, brtb submitted an eye-opening write up which may end up as the classic example of a large-scale GPL violation. Microtest's DiskZerver, a NAS device designed to handle CDs, would seem to be a sharp product, except it's based on software licenced under the GPL and potentially other free-software licenses as well. Of course, you would never know this, because Microtest never mentioned it, however that didn't stop Microtest from manufacturing and then marketing the device before it sold it off to another company. DiskZerver's new company xStore, which was unaware of the licensing issues, was notified about them, and this impending article. They have yet to comment. In situations like this, what should a company do to bring such a glaring GPL violation back into compliance?

Slashdot reader brtb reports:

About a year ago my employer, a local high school, purchased a couple MicroTest "DiskZervers," network-attached-storage boxes designed to cache CD images for LAN usage. We were mainly Netware-and-Win95 at that time, and the Zervers performed flawlessly in that configuration. But problems began when the district IT department made the decision to switch us over to an NT-domain setup. The Zervers, even with their advertised "Domain Integration" support, didn't seem to like this too well, so I dug a little deeper... imagine my surprise when I found out the boxes are actually embedded 486's with Linux and a whole slew of other GPL'ed software, mentioned nowhere in the manuals or on the accompanying software CD.

Apparently, Microtest (NAS division since sold to XStore) put together a mess of GPL software - a modified Linux kernel 2.0.27, Samba 1.9.x-ALPHA (!!!), the MARS_NWE netware emulator, and GNU C libraries (libc5), among others, stuffed them on a flash chip in a drive-bay-size embedded 486-based computer, and sold it as their "DiscZerver" product line. They also used some non-GPL packages, including Apache and Netatalk (macintosh server). Nothing wrong with their methods, but there's plenty wrong in their implementation.

The web interface and proprietary Windows front-end, the only given methods of configuring the device, refer to the various services generically, like "Web server," "SMB server," "NCP server," etc. - there's no mention anywhere, even in the manual, of the actual programs being used. Of course along with this is no accompanying source code or even the offer to provide any, as the GPL requires.

I can't even get any useful tech support from this company, much less someone to ask about getting the source code for the software and whatever modifications they made, which includes a flash file-system driver ("yaffs" - I think MicroTest wrote it, as I can't find any info on it) for the kernel. I did manage to hack out the hidden-from-customers root password; with that I found a shell prompt (Stand-alone Shell v1.0 - GPL? dunno) which only increased my determination as I could see exactly what programs they managed to steal, strip out identifying info, and use without credit.

I did contact the FSF with the limited information I had before I got shell access, and they did confirm the existence of a GPL violation, but were unable to do anything specific as they do not hold copyright on any of the programs I knew of at the time (and actually suggested I post to Slashdot to get some answers). xStore itself has not returned my emails or phone call. I have another e-mail in to the FSF, now that I know the machine includes glibc1.

So, right now I have a nice little piece of hardware, some mis-compiled (I think) software, and no idea what to do next. At the very least, I learned that my usual policy of disassembling and analyzing any new hardware we get is the right one; of course that doesn't help all the LAN users that need access to these CDs. I'd be happy if I could just get the code so I can fix SMBd/NMBd to work properly. I've thought about trying to make my own really-small distro to load on, but it's not really worth my time - I could just load the cached CD images (thankfully just standard .ISO's) off the Zerver's CD-storage hard drive into my other Linux server, compile and install Samba correctly (works great if you do it right) , and get on with life... but I really shouldn't have to do either. Any ideas?

Comments

This is a violation? Bull!

[Anonymous Coward]

GPL is moot when it comes to Embedded Systems!
You're not supposed to access the software on
these directly! Even Stallman admits as much
(check out the FSF philosophy pages)

If someone puts Linux on a toaster, he doesn't
have to supply you with source!

Two things

[halftrack]

First:
MicroTest could have done things simple just by printing a Readme-first documet stating that their system is built upon GPL'd software and printing the links to ftp-sites where it could be downloaded. Should sombody ask for the sourcecode it wouldn't be very hard having an ISO-image laying around with all the source on it. (One could say MicroTest acted a bit stupid.)

Second:
... but [FSF] were unable to do anything specific as they do not hold copyright on any of the programs I knew of at the time ...

I would like to see the next version of the GPL including a clause granting FSF the right to sue on behalf of the copyrightholder(s.)

Download their manual and read their license

[joshv]

Their license states explicitly that THEY own all of the software on the device and that you may not attempt to reverse engineer the product.

So I guess they are saying that they wrote their own OS with utilities supporting all of the same file sharing mechanisms that Linux is known to support and that they own the whole ball of wax. That's a good one.

Sorry, I'd have cut and pasted the license in here but it was in PDF format.

-josh

Re:Put up and FTP site

[gorgon]

They also must provide the code on a physical medium on request for no more than the cost of media and shipping; simply putting it up on ftp is not sufficient. In practice making it available by ftp may be acceptible if it means that nobody particularly wants to get the software on a physical medium, but the offer to provide the physical medium must be made.

I think you're incorrect about this. An ftp site should be fine, physical media is not required. If it were, Debian, for example, would be in violation, since Debian allows ftp access to all of the source in its distro, but does not sell CDs, floppies, etc. See section 3 of the GPL.

Re:Nothing!

[jgerman]

That's a terrible analogy, and does not fit the situation at all. I can read GPL code learn how to do something and then write my own versions that do not use GPL code at all and it's free of the license. USING the code in my product is a completely different situation.

Re:Nothing!

[LordNimon]

Just because you don't like the GPL doesn't mean that it's not a good license, or that no one should use it. In the world of free software, the GPL is just as necessary as the BSD license. Many people would not be writing free software if they knew that their efforts could be used to support a closed, proprietary product. There's nothing wrong with that at all. If I am going to spend hours, days, weeks, or months writing free software, why should I not be given the right to ensure that my efforts are only used to promote free software?

Is the GPL parasitic and restrictive? Yes! So what?!?!?! If you don't like GPL software, don't use it!

Have you written any free software? If not, then you really don't have any right to criticise the GPL. The GPL is designed to protect both the creators and the users of free software evenly.

Re:Nothing!

[jmv]

If you write a book on fishing, and after reading it I invent a new maneuver that allows the catching of a larger type of bass, I shouldn't be forced to tell you how I did it.

With the GPL, you could invent a new way of fishing without telling anybody (remember, only redistribution is restricted). Your example should read:

"I write a book on fishing and give it to you for free, and after reading it you invent a new maneuver that allows the catching of a larger type of bass. You are *not* allowed to create a new book by copy-pasting my text, add your technique and sell it without giving me the same rights I gave you."

I think that's reasonable. You are also (under the GPL) allowed to write a new book which is equivalent to mine (but without copying mine verbatim).