Using OSS for In-House Tools, Only?

Robert Hart writes "With people such as Microsoft and ADTI suggesting incorrectly that if you use GPL software in house (without distributing it to third parties) you must make your code publicly available, actual examples of people using GPL software internally would seem to be the best response (pragmatic examples to back up the 'theory'). I am interested in hearing about examples of corporations and government agencies, from around the world, using GPL software as part of an inhouse development effort. As there is also a potential for time/money saving by doing this, there is a possibility that this may lead to some research to put numbers behind this."

Comments

You're fighting a losing battle

[ObviousGuy]

Microsoft will come out of this smelling like roses and the OSS camp will look like a bunch of Communists. The fact of the matter is that the GPL is too complicated for the layman to understand in toto.

Recently there was a /. story about an FSF quiz that was designed to gauge your GPL knowledge. Just about everyone here on /. scored 70% or so. That's 30% misunderstanding. And this is among people who argue for the GPL all the time. How much less do you think the average person is going to understand the license?

With regards to OSS tools, there are two choices. Use them or not. Using them entails following the GPL which adds all sorts of weird, non-obvious restrictions. Not using them means they can get on with their normal routine.

Microsoft is pushing this aspect to its limit. To understand Microsoft licenses, it's pretty straightforward. You can't copy the product to another machine. They play this up to its fullest as well.

No matter what you think of the GPL or OSS, it's underlying value system is so contrary to the American psyche that you'd need a true revolution to make any significant inroads. Such a revolution won't happen in the near future because the anger and bile that OSS zealots have for closed source products doesn't resonate with Capitalist Joe.

Re:You're fighting a losing battle

[FattMattP]

With regards to OSS tools, there are two choices. Use them or not. Using them entails following the GPL which adds all sorts of weird, non-obvious restrictions. Not using them means they can get on with their normal routine.

The GPL adds exactly zero restrictions to using a piece of software. The GPL is a distribution license. It affects what you have to do to redistribute GPL'd software. If you aren't distributing software, then you can throw the GPL out the window and get on with using the software.

Re:You're fighting a losing battle

[FattMattP]

This is not the impression anyone gets from reading the GPL license. It is not the impression anyone gets when they get the source code laid on them. It is not the impression they get when they are confronted with the alphabet soup of OSS licenses.

So what? They're legal documents. Sometimes it takes a lawyer to interpret them. I have far more licenses that I've agreed to use on all the software on my Windows systems than any open source system. Each Windows program comes with a different license. Even programs from Microsoft all have different licenses save for Office which has one. The number of licenses that the various open source software packages use is far less.

This is not about formalities and legalities.

Of course it is. We're talking about a legal document and what it means.

It is purely about impressions and OSS zealots like yourself who continue to spout off about distribution and granting of rights and adding zero restrictions are not helping. The GPL quiz is evidence that the GPL cannot be easily understood by the "experts", much less the layman.

What experts? Lawyers? Or a bunch of programmers? When you get out of high school and into the real world, you're going to encounter a lot of legal documents that you probably won't understand. More than likely you'll have to consult with a lawyer to help you understand the legal language in these documents. And these documents are going to be everywhere. You'll have to deal with them when you rent an apartment, buy a house, get a job, open a bank account, get a credit card, buy a car, get insurance, etc. So are you going to rant about zealotry when you reach a point in your life where you have to deal with such documents?

Re:You're fighting a losing battle

[John Hasler]

"Using [OSS tools] entails following the GPL which adds all sorts of weird, non-obvious restrictions."

a) All OSS tools are not licensed under the GPL and b) The GPL places absolutely no restrictions whatsoever on use. You can use GPL software without agreeing to the license at all.

If anything, it is closed-source that is socialist, with its government-enforced monopolies.

gcc...

[josepha48]

At just about every company that I have worked at they used gcc as the compiler at one point or another and did not open source their software. On one project it was a cost savings to use gcc. It was flat out cheaper. At my current job we use gcc on Sun and Linux for out ports. As the economy started to fall we needed a cheap compiler for Sun and I suggeseted gcc. They bought it so to speak as the Sun compiler was much more expensive (about $3000 a seat or maybe it was $300 I can't remember). There have been issues with gcc, but nothing that was major. Basically it required a few programs to be properly coded. Like using memset instead of memcpy which HP did not complain about. Also things like removing the multiple function declarations (different ones at that) which gcc does not like but HP seemed okay with.

Oh and if you know anyone that is looking for a large scale leasing app that runs on Linux please reply to this post with more info. We are getting ready to release an alpha and I just got eop working today ;-).

Re:gcc...

[Lumpish Scholar]

What he said.

On my previous assignment, a large embedded project (millions of lines of code, hundreds of developers at its peak) was done with gcc/g++. On my current assignment, I'm developing software for Solaris 8, using Purify to help test it, keeping it under source control with ClearCase (so no fear of commercial software development tools) ... but compiling with gcc.

Question?

[cybermage]

With people such as Microsoft and ADTI suggesting incorrectly that if you use GPL software in house (without distributing it to third parties) you must make your code publicly available

Can some GPL guru do us all a favor and provide an argument for why Microsoft and ADTI are incorrect here? It is my understanding that they're wrong, but I cannot back it up with a reasoned argument. I would think a reasoned argument would as important as examples: Otherwise, the examples would be of people violating the license, right?

Re:Question?

[Anonymous Coward]

"You may modify your copy or copies of the Program or any portion of it, [...] provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License."

Re:Question?

[Misch]

whole or in part contains or is derived from the Program,

In this case, "derived from" is not referring to the output of the program, but the actual codebase of the program having been modified in some way.

from the GPL FAQ

Q: Is there some way that I can GPL the output people get from use of my program? For example, if my program is used to develop hardware designs, can I require that these designs must be free?

A: In general this is legally impossible; copyright law does not give you any say in the use of the output people make from their data using your program. If the user uses your program to enter or convert his own data, the copyright on the output belongs to him, not you. More generally, when a program translates its input into some other form, the copyright status of the output inherits that of the input it was generated from.

So the only way you have a say in the use of the output is if substantial parts of the output are copied (more or less) from text in your program. For instance, part of the output of Bison (see above) would be covered by the GNU GPL, if we had not made an exception in this specific case.

You could artificially make a program copy certain text into its output even if there is no technical reason to do so. But if that copied text serves no practical purpose, the user could simply delete that text from the output and use only the rest. Then he would not have to obey the conditions on redistribution of the copied text.

Re:Question?

[devphil]

It's not that hard, really:

Say there's a GPL'd package called Foo. You take it, modify it in-house, and compile it to form a modified binary that we'll call Foo2.

If you only use Foo2 in-house, then you need not release the changes. No problem.

Now, let's say you provide the Foo2 binary to someone else outside your organization. (Free of charge, for money, for chocolate, whatever.) Now you must also provide your modifications. It doesn't need to be public, but whoever gets the Foo2 binary must also be able to get the changes to turn Foo into Foo2.

Re:Question?

[Matts]

This of course ignores the fact that the code for Foo2 that you gave to the person outside your organisation is now GPL'd, and they can release it for free to the whole world.

Re:Question?

[4of12]

This of course ignores the fact that the code for Foo2 that you gave to the person outside your organisation is now GPL'd, and they can release it for free to the whole world.

Which ignores the fact that you got foo with source absolutely free and were able to use for any purpose of your own apart from certain forms of redistribution.

I like to think of the GPL as the share and share alike license.

Dual-licensing

[gehrehmee]

If the opinion of GPL code is really that bad, why not use dual-licensing to get around it?

If you released your OSS project with a license that allowed the licensee to apply their choice of the GPL or a standard "You have no rights to redistribute" license, they might actually be more reassured. (as strange/silly as that is)

Re:Dual-licensing

[joib]

Like, say, Qt and MySQL... And a lot of other programs using similar schemes.

Re:what percentage understand the MS license?

[Splork]

"Recently there was a /. story about an FSF quiz that was designed to gauge your GPL knowledge. Just about everyone here on /. scored 70% or so. That's 30% misunderstanding."

What percentage of the microsoft license do people understand?

Re:Question? (and the answer questioned)

[Lumpish Scholar]

You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License

Right; but if you distribute it to anyone, including co-workers, you must respect:

we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights ... Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

So if you want to restrict the recipients' right to redistribute, even if they're covered by employment or non-disclosure agreements, you are not allowed to distribute GPL or GPL-based software to them.

If my employer makes a change to gcc, and lets me use the binary, then my employer cannot restrict me from grabbing the source and posting it on the Internet. Was my employer to do that, they'd immediately lose the rights (to modify and redistribute the software) they were granted under the GPL.

(The usual way of saying this is, "They'd have to GPL their software"; which is not true, though it's the only way they could keep their redistribution rights.)

Giving away GPL code?

[dirk]

This is a tad off-topic, but somewhat related. I know according to the GPL you only need to provide source to the people you provide the binaries to. If you don't provide binaries to anyone outside the company, you do not need to provide source to anyone outside the company. But isn't one of the other stipulations of the GPL that anyone can redistribute the source/binaries as long as the follow the GPL? What is to stop someone within your organization from taking the source from your internal app and distributing it outside the company? OR is there some part of the GPL that I'm missing that would prevent this?

Re:Giving away GPL code?

[ObviousGuy]

What is to stop someone within your organization from taking the source from your internal app and distributing it outside the company?

Threat of termination. Lumpish Scholar posted his interpretation of just such a scenario above.

Anyone who is willing to divulge company secrets is not someone who should remain in your employ. Kaner, et al discuss interviewees divulging private company information, but the same reasoning can be applied to currently employed engineers as well.

Re:Giving away GPL code?

[Tony-A]

What is to stop someone within your organization from taking the source from your internal app and distributing it outside the company?
The computers, software, office furniture, etc. belong to the organization not to the someones who are using them. You don't get to sell off "your" office desk.
What will happen is that for any bug-fixes and generally-usable improvements to the GPL software, it is to the organization's benefit that those changes are either fed back or generally available. Much easier if you don't have to keep redoing the changes if you pick up something newer. This behavior is somewhat expected, but nothing in the GPL requires it.
Your internal app is some mixture of original GPL, desirable bug-fixes and modifications, and some changes that are unique to your own organization. The thing is that even though maybe interesting to some other parties, nobody else wants the stuff that's unique to your organization. Somewhere along the line the stuff that's unique to your organization will be dropped, either by the maintainer of the GPL stuff, or by the organization itself.

Re:Giving away GPL code?

[dirk]

But the the question is, what happens when they have the right to give out the code. You can terminate someone who gives out company secrets because they have no rights to give out those secrets (and any company worth it's weight in piss has made it's employees sign an NDA). But with the GPL, you have a right to redistribute that program, and that right may override an NDA (not sure, hasn't been tested). And could you terminate someone for distributing software which you gave them explicit permission to distribute (through using the GPL).

Re:Giving away GPL code?

[Rogerborg]

• isn't one of the other stipulations of the GPL that anyone can redistribute the source/binaries as long as the follow the GPL? What is to stop someone within your organization from taking the source from your internal app and distributing it outside the company?

Hmm, very good point indeed, and 100% on topic, I think.

I was going to say that the company (and not the individual developer) owns the copyright on any new code, and that the extra rights of the GPL flow from the protection of copyright, so that the company could prohibit even its own employees from distributing this code.

But then I realised that you're absolutely right, that this is precisely the situation that the GPL is intended to avoid. If you add new source to a GPL utility, it becomes GPL licensed, and that means that anybody who gets their hands on it, however they get their hands on it, has an explicit license to copy and distribute it (if they follow the license terms).

Of course, in practical terms you can get sacked for it, but there's nothing in the GPL that prevents it. You can see why paranoid companies like Microsoft hate and fear the GPL so much.

Re:Question? (and the answer questioned)

[jamus]

See the GNU GPL FAQ, they have an answer for this type of situation.

However, the Licence is legal binding, and the FAQ isn't.

Re:what percentage understand the MS license?

[jcast]

The important part (i.e., all your computers are beong to us). Of course, that's also the part they're used to disregarding...

Re:Question? (and the answer questioned)

[cybermage]

we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights

I think that is the crux of the issue. Modifying the code doesn't modify the license; and, according to section 2, all you really need to do is copy the modified code to trigger it:

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

Who doesn't make copies of their code?

So, actually, it looks like Microsoft and ADTI have it right in a sense:

Premise: Original work licensed under the GPL.
Premise: Company obtains a copy through GPL and makes modifications.
Premise: Company makes copies of modified code for internal use.
Premise: GPL, under section 7, doesn't allow additional restrictions on distribution. So, company cannot restrict distribution.
Conclusion: Anyone with access to modified source can distribute under the GPL or company cannot use GPL'd work.

Hmmmm.... Not exactly the mindset I've been working under. How did we start this conversation? Oh yeah, we we're looking for proof Microsoft and ADTI were wrong. Oops.

Re:Question? (and the answer questioned)

[zangdesign]

In the FAQ, it states that an organization as a whole can make a modified copy and not distribute it. So the organization is the responsible body, not the individual employee.

That would imply that an employee could NOT distribute it without the permission of the organization, if the modified product was intended for in-house use only.

why bother with the GPL

[Naikrovek]

its possible to "open source" your software without following the GPL, a licence which I myself do not choose when i write software.

off-on-a-tangent-time: to me, truly "free" software means adding no stipulations of any kind, unlike the GPL. therefore, short of paying a lawyer lots of $ to write the Naikrovek(tm) license, i use the BSD license for all the software i write. Fortunately for me, my entire company licenses the software they work on under the BSD license, unless its trade-secret.

there's nothing saying that you have to use the GPL for your in-house tools.

Re:why bother with the GPL

[foobar104]

off-on-a-tangent-time: to me, truly "free" software means adding no stipulations of any kind, unlike the GPL.

I'd just like to chime in with a "hear, hear." I agree completely, and in the face of the vocal proponents of the GPL, it's nice to see that people other than myself hold this opinion.

Thanks.

Re:why bother with the GPL

[Rogerborg]

• to me, truly "free" software means adding no stipulations of any kind [...] i use the BSD license for all the software i write

Why not just state that it's public domain? Isn't that "truly free"?

Or instead of the slightly wordy BSD say "© Naikrovek. You may freely use, copy, modify or distribute this text, as long as this copyright notice is preserved", which is functionally identical, a lot shorter, and shows respect for the intelligence and good faith of the recipient. Bearing in mind that anyone acting in bad faith isn't going to read the BSD anyway, you might as well not piss them off with a long preamble in each source file. ;-)

Re:Question? (and the answer questioned)

[rubinson]

Unfortunately, I don't have mod points today. Somebody please moderate the parent up because it gets to the entire crux of the issue.

An organization is considered a single body; therefore, one can "redistribute" a GPL'd work internally ad infinitum without invoking the GPL. ("Redistribute" is in quotes because one can't technically redistribute a program to themselves; that's just copying.)

Posts to this thread are confused. An organization doesn't "give" software to its employees. Rather, the organization acquires software which is then used by employees. There's no redistribution and, therefore, the GPL isn't invoked. As such, the employee has no right to redistribute the software whatsoever. And to do so would, at a minimum, be a violation of company policy. Most likely, it would also (legally) be considered theft.

Re:Question? (and the answer questioned)

[Tony-A]

If my employer makes a change to gcc, and lets me use the binary
1. as an employee using the employer's computers.
2. as an outside individual doing something other than company business.
Seems you would have a right to the source in case 2 but not in case 1.

Re:Question? (and the answer questioned)

[Twylite]

This is premised on the legal relationship between an organisation and its members (whether employees, members, volunteers, etc). This legal relationship varies from country to country - in some places it is not valid to assume a contract/license which is binding on the organisation is binding on individuals, unless they explicitly agree to the contract as well.

Misuse of terms

[Fweeky]

There is a lot of misuse of terms on SlashDot I think; "Open Source vs Microsoft" == "GNU/Linux vs Microsoft", "OSS" == "GPL Software", etc.

These things are very different; there's a tonne of open source software out there that lots of people use that isn't GPL:

• Perl - Artistic License and GPL
  
• PHP - PHP License
  
• Apache - Apache Software License
  
• Free/Open/NetBSD - BSD License, and some bits of Beerware
  
• Mozilla - Mozilla Public License
  
• Python - Python Software Foundation License
  
• Zope - Zope Public License
  
• zlib/libpng - The zlib/libpng License
  

To constantly suggest that the GPL is the One True License is not only wrong, but very damaging, since it undermines perceived choice over licensing.

This is supposed to be a site for vaguely intelligent people; can't we at least make some effort to be more precise in our terminology?

Re:what percentage understand the MS license?

[Zocalo]

What does it really matter? The crux of the Microsoft EULA for most of their products is that "you can install this product on one PC only. It is not transferable." Period. Just about everyone that uses a PC understands this, whether they choose to obey it or not. All the other stuff about becoming Bill's bitch is really just icing on the cake from a Microsoft revenue point of view.

I took the GPL quiz (I got all but one right, but that was more down to logical deduction than knowledge), and use GPL'd software in a corporate environment daily, so I feel that I should understand the license, but from the quiz I feel that I don't. In comparison with the Microsoft EULA the GPL really is inpenetrable to the layperson, with numerous "ifs" and "ors" , which is maybe not a good thing. The wording of the GPL leaves the door wide open for this kind of FUD which will no doubt be accepted as truth by many who should know better.

Perhaps what the GPL needs is an companion document that answers the FUD in plain language - the explanatory answers from the quiz would be a good place to start. The fact that the proponents of the GPL can dispel the FUD is not the point - the point is that they are being required to do so in the first place.

Re:what percentage understand the MS license?

[Zocalo]

I had something a bit simpler than the full FAQ in mind, ie. that could be included with the source and/or binary and answer maybe the top 10 PHB questions. After all, a 22 page FAQ for a 7 page license doesn't exactly make it sound simple does it? I have quite often left Microsoft vs Open Source discussions with the feeling that people are going with Microsoft purely because of the KISS principle. They understand MS style EULAs, because they usually boil down to "I've bought x seat licenses, so I can install on x PCs". They likewise understand their support options, upgrade options, likely costs in the near future, and so on. It might well be costing their employer more, but they don't have to understand this "GPL" thing or (heaven forbid) have to explain it to some senior manager who barely knows how to turn a computer on.

To give a real life example, I did some work at one site recently who wanted some very basic network usage monitoring - the kind of stuff that would be a no brainer for MRTG. Because of the KISS argument above they were about to spend the best part of £1000 on an overkill commerical product, with additional outlay as they added additional devices because it was licensed per node. They were happy with this because they understood the license and costs, even when I said I could set up an a Linux box with an MRTG config for then in a morning and have a web configuration front-end tailored for them by the end of the same day.

(For those who want to know - they agreed to give it a shot, and I was in the local pub with it all done by 14:00 the following day. They were so happy and their license concerns sufficiently assuaged that I'm replacing their NT based mail gateway with a Linux box next month...)

Oh, I know

[Rogerborg]

• I am interested in hearing about examples of corporations and government agencies, from around the world, using GPL software as part of an inhouse development effort.

Well, the NSA seems to be pretty keen on Linux. I know they're not that big or important, and they don't know much about technology or the law or anything... ;-)