Derivative Works And Open Source

marvin826 writes " Larry Rosen has a nice article in the current issue of the Linux Journal about the legal interpretation of derivative works. Seems there are two camps in the world in terms of using open-source libraries, such as GPL licensed libraries, in proprietary software. Read this article and see which camp you are in! Having people working full-time on proprietary software, using open-source libraries, can only help the open-source software get better? "

Comments

please

[tps12]

So we're supposed to pump out open source libraries so that giant companies like Micro$oft can write proprietary applications around them and profit from our labor? Would they like us to polish their boots while we're at it?

I don't trust this "article" a bit. $1000000 says it was funded by some big company looking to milk open source advocates for all they're worth.

Re:please

[gpinzone]

Yes, you are. You see, the draw of open source was supposed to be a better model for software and for business. No one should want to do business with a closed source vendor like MS since you can't look under the hood yourself.

Unless the Open Source advocates have lost faith in their "superior" software model, this really shouldn't be a problem.

Re:please

[Apreche]

What about the other side? MS wrote a lot of windows libraries. And a lot of people write open source programs that use those proprietary libraries. Ooooh.

Know what else? Commercial software companies write programs that use MS libraries too. And they profit from MS labor. And if they don't give any money to MS in the process (such as buying VS.NET or something) then MS don't get crap from it.

The problem here is determining whether using a program withing a program is derivitive. And is a library a seperate piece of software or part of the software that uses it, or part of the OS. If you were to argue technically it could go on for days. What we need is to know legally which it is. Which wont happen until we upgrade our laws to better ones that take into account modern technology.

Re:please

[robbyjo]

The problem is that Rosen propose 4 points:

1) The primary indication of whether a new program is a derivative work is whether the source code of the original program was used, modified, translated or otherwise changed in any way to create the new program. If not, then I would argue that it is not a derivative work.

This I agree.

2) The meaning of derivative work will not be broadened to include software created by linking to library programs that were designed and intended to be used as library programs. When a company releases a scientific subroutine library, or a library of objects, for example, people who merely use the library, unmodified, perhaps without even looking at the source code, are not thereby creating derivative works of the library.

If I understand correctly, this is expressly prohibited in GPL, but is allowed in LGPL. So, I disagree with his point here. If we allow this, companies will extort this and take advantages as much as possible -- which, of course we don't want.

3) Derivative works are not going to encompass plugins and device drivers that are designed to be linked from off-the-shelf, unmodified, programs. If a GPL-covered program is designed to accept separately designed plugin programs, you don't create a derivative work by merely running such a plugin under it, even if you have to look at the source code to learn how.

I think this is also expressly prohibited in GPL, but allowed in LGPL. So, I believe plugin system should also be discouraged in GPL, otherwise it will make a "major loophole" (like making a main program out of a plugin).

4) In most cases we shouldn't care how the linkage between separate programs was technically done, unless that fact helps determine whether the creators of the programs designed them with some apparent common understanding of what a derivative work would look like. We should consider subtle market-based factors as indicators of intent, such as whether the resulting program is being sold as an ``enhanced'' version of the original, or whether the original was designed and advertised to be improvable ``like a library''.

See reason #2 & #3. If we allow companies sell enhanced versions of GPL programs: We're in a *deep* trouble. Imagine MS taking Advanced Gnome for their own... Golly!

Re:please

[stratjakt]

God, why do people mod this stuff up? Just because you spell Microsoft with a dollar sign?

By your logic, virtually every peice of software written for windows belongs to microsoft, as it uses their libraries. And a book report on Cujo belongs to Stephen King because his work is quoted and listed in the bibliography.

Making calls to a library that already exists on a system does not make a derivative work. IMO static vs dynamic linking should be a non-issue as well.

This is where the GPL turns to shit.

I write and maintain one app where I work, which uses proprietary libraries to generate maps. I know going in if a specific client wants to use the mapping features, he/she must either buy the mapping component seperately, or through me.

Never is there any notion that the company creating the 3rd party libraries I use gets any rights at all to my software. Yet, if the library was GPL'ed tomorrow, all of a sudden my work should be free?

Re:please

[marvin826]

Would everyone please ask themselves this question: Where would we be today without the help and investment of time, money, and talent from a little *proprietary* company called AT&T? Without their contribution to this industry that many of us make very good living off of, we would not even have the need, medium, or occasion to have this discussion.....

Re:please

[blakestah]

From Rosen:

3) Derivative works are not going to encompass plugins and device drivers that are designed to be linked from off-the-shelf, unmodified, programs. If a GPL-covered program is designed to accept separately designed plugin programs, you don't create a derivative work by merely running such a plugin under it, even if you have to look at the source code to learn how.

I think this is also expressly prohibited in GPL, but allowed in LGPL. So, I believe plugin system should also be discouraged in GPL, otherwise it will make a "major loophole" (like making a main program out of a plugin).

No, this sort of means that when you code a GPL program and specifically define a "plug-in" interface, that any binary that "plugs" in is not a derivative. In copyright terms, the fact that a "plug-in" interface is well-defined is enough to remove derivative status. In fact, a guiding principle here is that if there is a wall separating dependences (like a defined plug-in interface), then that wall removes derivative status.

You have already argued that this creates a loophole - I think the legal view will be that you cannot take GPL'd software and make a plug-in interface out of an existing interface for the purpose of removing derivative status. However, adding a novel plug-in interface to GPL'd software would be seen in a different light.

Remember, you have to take the point of view of someone looking at copyright history and trying to apply its law to software, and not the view of someone who wants to make the GPL as powerful as possible. A well-defined dependence "wall" is adequate to remove derivative status. If that creates loopholes, there are other ways to address that. I can't help it if the law ends up looking like a mess.

Re:please

[Waffle Iron]

Yet, if the library was GPL'ed tomorrow, all of a sudden my work should be free?

Only if you wanted to redistribute the library for free. Today, you can't distribute the library for free at all: you or your customer must buy it.

If the library was GPLed, it would not change the situation one bit. You would still have to buy it from the author under a different license in order to distribute it with your binary app. Some other people could use the library for free under different circumstances, but that wouldn't affect your usage. How is this a problem?

Re:please

[civilizedINTENSITY]

If the 3rd party libraries were proprietary, they could be dual liscenced. Then I could write software that used which I GPL-ed, and I could distribute my SW and the GPL-ed versions of the library. So could you. However, if you desired to produce proprietary SW you could. You would just have to use the proprietary liscenced libraries. That way my customers can experiece the freedom of my code, and the freedom of the libraries. Your customers pay to use your code, and hence must pay to use the libraries. Very simple.

Re:please

[Kunta Kinte]

By your logic, virtually every peice of software written for windows belongs to microsoft, as it uses their libraries.

Logic does not apply here. I can write software and stipulate that users must give me their first-born as payment. You are free to choose my software, or if you think the licensing terms are unreasonable, go buy someone elses package.

Microsoft requires you give them money for their software, it is their right. BSD does not require you to distribute modifications, it is their right as well.

Your right is to pick the software package that has a license that suits your purposes most.

Never is there any notion that the company creating the 3rd party libraries I use gets any rights at all to my software. Yet, if the library was GPL'ed tomorrow, all of a sudden my work should be free?

You always have the option of not using the GPL software. Nobody's forcing you too.

What this boils down to:

[intermodal]

do we consider libraries to be part of the OS or the program?

Personally, I'd consider anything that's part of another program installed on the computer as a dependency to be fair game. If I see that Program X requires me to have GAIM installed, fine. if Program X takes GAIM source, closes, and sells it in their program that way, that's bad. So as long as it only utilizes your install of GAIM rather than including it itself, then it's all good.

Note, I also don't object to them putting it on the CD with the software, as long as it's clearly seperate from their software, even if it's a dependency, as long as they provide it within GPL terms.

My concerns about collaboration and derivations

[karmawarrior]

One of the issues that the whole derivative work sphere has is that it in many ways contradicts the normal notions of collabaration, where usually people work together in a controlled environment to create a work. In open source and free software, in general it's assumed that people will if they can, but the systems are set up to allow different forks to go ahead. This leads to interesting results: people working together usually have the same aims, for someone to split off a project and develop independently suggests a difference in goals, and this in itself suggests that the people concerned may have differences of opinion that are more than just technical.

The GPL was created for a specific aim - to ensure that there would be a base of software that is, for want of a better term, free to the end user. That means that the end user need not care about how the software is created and the aims of the person creating it, but is able to use the software for their own personal use to the best of its capabilities. If the software needs to support something new, they can change it. But in itself, this promotes a non-collaborative paradigm. And this creates - as you can see from some of the heated discussions of GPL vs BSD/X11, etc, discussions on Slashdot - an ironic dichotomy where the aims of those who use GPL'd software may be at odds with those of the original developers, almost my definition.

This quagmire of free software frustrating a small minority of those who are uninvolved in its development who in many ways wish to remove the very freedoms the GPL provides to users of their own derived software will not go away by itself. Unless people are prepared to actually act, not just talk about it on Slashdot, nothing will ever get done. Apathy is not an option.

You can help by getting off your rear and writing to your congressman or senator. Tell them you believe that collaboration and the use of derivation is something you want to encourage. Tell them that you appreciate the work being done by the free software and open source communities, but if the freedoms they introduce end up being compromised by incompatable derived software that removes those freedoms you will be forced to use less and less secure and intelligently designed alternatives. Let them know that SMP may make or break whether you can efficiently deploy OpenBSD on your workstations and servers. Explain the concerns you have about freedom, openness, and choice, and how we need to work together to create a world where collaboration and derivation is a norm that can be relied upon to exist. Let them know that this is an issue that effects YOU directly, that YOU vote, and that your vote will be influenced, indeed dependent, on your legislator's policy towards free and open software.

You CAN make a difference. Don't treat voting as a right, treat it as a duty. Keep informed, keep your political representatives informed on how you feel. And, most importantly of all, vote.

This article is not legal advice

[DeadSea]

The primary indication of whether a new program is a derivative work is whether the source code of the original program was used, modified, translated or otherwise changed in any way to create the new program. If not, then I would argue that it is not a derivative work.

This is not the definition of derivative work that is assumed by the GPL. The GPL assumes that a derivative work is any work that uses another work. (In the GPLs case, by linking to it). If this were (legaly) not the case, as the article exists, then there would be very little difference between the GPL and the LGPL (which specifically allows usage without modification).

For an interesting read of why usage constituting a derivative work would be important to free software (and is part of the GPL) read Why you shouldn't use the Library GPL for your next library from gnu.org.

I myself have written popular Java libraries that I license under the GPL (not the LGPL) because I want to encourage free software development.

If you wanted to make a movie, and in your movie you had another movie playing in the background on a tv on the set, do you think you should have the right to distribute your movie containing somebody else's movie? (Ignoring fair use such as parody) I don't think you should be able to.

The article seems to be written to allay fears of business leaders that they occur legal risk by using open source software. The article does not offer good advice. I would recommend, that if you were to use open source software in closed source, look for a license that specifically allows you to do so (such as the LGPL) rather than relying on an untested definition of derivative work.

Re:This article is not legal advice

[sudog]

Doesn't matter--redistributing the software afterwards implies acceptance of the GPL terms: why do you think no company has actually tried to challenge the GPL yet? If they did, then many of the clauses in their own licenses would also be void--and they don't want that.

So we win both ways: if the companies claim that the GPL is unenforcable for simple linking, then much of the commercial EULA and licensing that is similar is also invalid. If they claim otherwise, then the GPL is totally enforceable and we also win.

Pure genius.

However, it is meaningful, and you aren't quite informed as to what the courts will or won't allow.

Been going on for years...

[russotto]

This argument is certainly nothing new; at issue is whether merely linking to a library creates a derivative work. IME, it would be a really bad thing for open source and free software if this was the case, despite the short-term impact to proprietary software makers.

If linking DOES create a derivative work, this means that the very act of USING a library in the normal way is an act covered by the copyright code. This applies to everything -- including system libraries. Makers of computer systems could thus legally prevent anyone from writing programs for them by refusing to allow them to create derivative works. Want to write a program which links with the .NET APIs? Here, sign this contract, in blood if you please. And don't even think of GPLing your program.

scaring proprietary software users away?

[burgburgburg]

I think he meant "scaring proprietary software developers away". They are the only ones who'd be concerned about the derivative work issue.

And why shouldn't they be scared away? If they want to make proprietary software, then let them. They just can't use GPL'd software programs or libraries as a replacement for paying for development of their own. There is always BSD licensed work to explore, if they are so inclined.

I would think anything would be derivative

[pgpckt]

This opinion is probably not legally sound, but it would seem to me that anything would be derivative. Linking to a library, calling a function of a library, etc. The lawyer in the article says (paraphrasing since I can't get an exact quote since the site is /.ed) that surely calling the sqrt() function isn't derivative.

Why not? If it is a sqrt() function in a free software library, I think that does count. If the author of the package doesn't want it to count, he can write his own sqrt() function and own library. If he write it from scratch, no copyright, and no legal problem. Then he can call sqrt() all day long.

As has been said previously, if we had open software package X that "accidentally" used a library copyrighted by Microsoft, does anyone thing that Microsoft wouldn't sue us? Write your own code. If you "use" someone else's code, it only seems logical that you have to agree to their terms, no matter how small the piece of code. If it is truly that small, write it yourself, and there are no issues.

Re:Noone really understands the GPL...

[Darth Yoshi]

But, as I understand it, as long as they don't distribute it and only use it for internal use, I don't see any violation of the GPL license.

If a company is using GPL'ed software and/or libraries in a commercial product, you might want to talk to the FSF lawyer.

FUD

[Euphonious Coward]

I see this article as an attack on the GPL, trying to turn it, essentially, into the Lesser GPL. While this would be convenient for commercial exploiters of GPLed code, it would also make businesses more reluctant to release their work under the GPL, for fear of having their work stolen by rivals.

The article disingenuously ignores cases where works were held to be derived even when they did not include any part of the original work, but only (e.g.) recycled characters from the original. When the second work makes sense only in light of the original, it's derivative. A program that works only when a GPLed library is present is derivative of that library.

Claiming that dependency other than copying doesn't count is a disservice to Mr. Rosen's clients, and to readers at large. An honest article would have at least acknowledged that serious legal scholars disagree with him.

Re:Noone really understands the GPL...

[MarkCC]

The GPL doesn't say that you can't create derivative works without giving them away. It says you can't
*distribute* derivative works without giving them
away.

If you're building proprietary software for use internally by the company, then they are not, legally, distributing it! In effect, it is purely free, so long as you don't distribute your derivative works.

-Mark

Re:Quoth the attorney

[Arandir]

However I am now failing to see how a program could simply "use" a library. If someone could enlighten me I would appreciate it.

Okay, let's imagine a hypothetical GPL'd glibc. Then you write a generic "Hello World" program. Your program merely uses glibc. It does not derive from it.

When someone asks you which libraries are involved in running your "Hello World" program, they will say "what libraries do you use", and not "what libraries have you derived from."

1) The C API is essentially in the public domain. There are many implementations of it, and your program has no way of knowing which implementation it is linking to.

2) The linkage happens at run time. It is the end user who actually shoves the program and the library into the same process space. Not the developer. What you are distributing has zero glibc code in it.

3) glibc was *meant* to be used in such a manner. It has been created and distributed for wide general use by people outside of the GNU project. This is the main point of the second bulletted item in the article.

4) Dependency is not derivation. It may seem so in some software languages, but they are two distinct things when it comes to copyright.

Re:Noone really understands the GPL...

[wilhelm9]

If you're building proprietary software for use internally by the company, then they are not, legally, distributing it! In effect, it is purely free, so long as you don't distribute your derivative works.

But that is "fucking vague" too. Exactly what is "distribute"? If I am working for the government, can I distribute my derivative work to all government subsidiaries without publishing source code? In projects I have worked with, there have been people from several companies involved! Can I share my derivative work with my co-worker?