Slashdot Mirror
Castle Denies GPL Breach
Anonymous Coward writes "Castle Technology, who were accused of breaching the GPL in RISC OS 5, have made a press release denying the allegations. This story has been covered on The Iconbar RISC OS news and resource site." We've given Castle some loving here on slashdot recently. Looks like this one isn't going away quietly.
At least not until they change their name to GNU/Castle
sulli
RTFJ.
From what I understand, the GPL (and most software licenses it seems) has never been tested in court. Perhaps this will be that test. I only hope that the GPL holds up in court.
So it's, one, test the GPL in court, two, pray it holds up???, three, GPL software profits!
Imagine how happy Microsoft would be if the GPL is ruled invalid...
Karma: Bad (mostly affected by being such an asshole)
They need a new lawyer.
The cake is a pie
Its been a few days since I read the original article, but I don't seem to remember where the original allegation that they'd ripped off the Linux kernel came from, other than "the guy". Who is "the guy"? Is he an employee for Castle, possibly disgruntled, or is he just "the guy" sleeping on the couch? If there is a legitimate breach, than whoever holds the license should by all means fight. But I've always been under the impression that borrowing code from a GPL based package was acceptable, as long as credit is given where credit is due. If that's the case, and there was indeed a breach of the GPL, couldn't Castle just put the creators names in the credits, no harm, no foul? Any takes on this?
Unless there is skullduggery afoot... hmmmm.
/rubs chin, cues "Scooby Doo" intro music
They say its not used GPL code in some old editions, and they wont be doing so in future. Its not clear if there is some release they did. They don't say they havem't done it with current code. Since they are making a floppy of the relevant code available that is a good step and means someone can check nicely and settle the question for good.
At one point they say:
"The RISC OS 5.00 kernel did not contain work taken from or derived from the ARM-Linux or Linux kernel
then they say:
has it's PCI allocation and bridge setup based in part on the following functions from the Linux kernel sources:
So they say "based in part on the following functions", so are they saying that they have literally taken no CODE but were BASING their code on some Linux kernel code? So are they then saying that perhaps they just took the api from the LK but the code itself is new? If this is the case, then I could see how there would be a lot of confusion and that they have done nothing wrong. If not, then I'm not sure what they're trying to say?
GPL defines the source code as "the preferred form for making modifications to the work". So unless their engineers are way way way way better at doing hex arithmetic and mental cryptography than most of us are, yes the GPL does have a provision against it.
Some day when opensource is big enough, we'll be able to take down companies just by accusing them that they stole open source code. "We won't shut ya down if you tell us where the other Cappie bastards are! Admit it, they're all stealing source!"
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
later issues of the supporting software have had to have function names removed (along with a strategy of tokenising textual messages and compressing binaries)
In other words, that's the last time we're stupid enough to ship unstripped binaries!
The PR also explicitly denies using Linux source, rather than GPL'ed source. Reading between the lines, these guys know full well that they're in breach and they're trying to finesse the situation.
So long, and thanks for all the Phish
is at http://216.239.53.100/search?q=cache:mf1nlduliL4C
So, if they had clean conscious, why would they remove that page?
I don't buy into this.
Clearly this is just the endgame of a clever get rich scheme. They anticipate that a butt load of /.ers will contact them looking for the source code. In a few weeks they'll stop answering their phones, their website will go defunct, and Castle will for all purposes seem to have disappeared. Coincidentally, in a few days after that the number of ebay auctions for blank floppies will go through the roof.
For the avoidance of doubt, the hardware abstraction layer (roughly analogous to a PC's BIOS) has it's PCI allocation and bridge setup based in part on the following functions from the Linux kernel sources
I admit that it could probably be worded better, but it sounds like they could have took the function names/possibly signatures and wrote their own code. Get the source and find out. However, if the experts in this matter can still show that the object form is too close to the GPL output, then there may be something to worry about.
No sig, sorry.
I know this is a complete what if, but here it goes.
What if i was the owner of a company like Castle. A small shop of 30 or so people writing a commercial OS. Now say it was the task of three of the programmers to write some part of some IOKit. Now say they were under deadline and feared being fired, and couldn't keep up and stole a couple of pages of source from a GPL OS of your choice. Now say no one realizes this for 18 months and then the door is suddenly blow open and the execs of the small company are totally against this violation, and fire the employees in question and remove the code in question from the OS. Should the rest of the OS have to be GPLed? I would hope not!
Jon Hess
Look at what little happened over the Virgin Webplayer.
It used a Linux kernel, some libc parts and shipped with this clause in the EULA
Section 2.2 of the member agreements reads as follows:
2.2 Webplayer Software License. Subject to the
provisions of this Agreement, we grant to you a
limited, non-exclusive, personal, non-transferable license to use and display the Webplayer Software in object code form only, solely as part of and as necessary to use the Webplayer and the Virginconnect Services. Except for the license granted to you above, we (or our licensors) retain all right, title and
interest, including all intellectual property rights, in and to the Webplayer Software. You may not attempt (or authorize any attempt) to defeat, obstruct or
block any or all of the Webplayer Software functionality, or to decompile, reverse engineer or disassemble the Webplayer or the Webplayer Software.
Nothing happened to them, and unless the people who actually OWN the copyright grow a backbone and take it to court, nothing else will happen.
Short response: D.U.M.B. A.S.S.
Long response: You're still dumb, but here's why. First, making the source available for download does NOT cover the source redistribution part of the GPL, so the whole "not having an FTP server" doesn't matter. You have no responsibility to make copies of GPL software available to others for free or for cost. See the first question on the GPL quiz for more details on this.
Second, he can charge whatever he wants for sending you a copy of the program. $0, $1, $100, or $1,000. As long as he makes the source available with it, or at the cost of redistribution, everything is fine.
I really really REALLY wish people wouldn't randomly throw RMS bashes into other good articles. "Oooh, it's a GPL-related article, let's bash RMS." I'm not a huge fan of RMS, and I still call it "Linux", but I hate it when people just go off on the guy. I hate it even more that I have to go and write a response to something this stupid and waste my time. How this got modded up to 4 (oh.. it's 5 now), I don't know..
Bah!
This may not be a breach of the GPL. What Castle has said is that the hardware abstraction layer was based on the Linux kernel sources. They have made that code available.
What will determine if the remaining code is also under the GPL is how closely it integrates with the abstraction layer. Castle maintains that this abstraction layer is "roughly" analogous to a PC's BIOS.
For those of you who don't know what the BIOS is, it is the initial code which resides on a microchip that runs when you first boot your computer. It has, among other things, the very low level I/O routines that allow your computer to read enough of your hard drive to allow your operating system to boot.
It would be possible to write a BIOS and then put the code under the GPL. Would that mean that any OS that gets booted by these BIOS would suddenly be in violation of GPL? I don't think so.
The two questions that need to be answered are:
1. How analogous to a PC's BIOS is this abstraction layer? (This may be a subjective assessment and therefore open to litigation.)
2. Is there any more GPL'd code contained in the Castle product?
The race isn't always to the swift... but that's the way to bet!
It seems that people have already judged them guilty of violating the GPL. I think people need to take a deep breath and answer: What exactly is the evidence that they have incorporated GPL code into their product?
A few functions named the same as their linux counter-parts seems like rather weak evidence of a breach. Copyright does not protect ideas, so if they examined the GPL code, understood how it worked, and then re-implemented it with their own code, then this is a garden variety reverse engineering.
On the other hand, if they actually did lift code, then it should be pretty easy to verify with or without their source code. So before anybody continues on with blabbering about how terrible Castle is, can somebody just say what the evidence is?
The point is that the page has not been removed/altered/etc. and that before modding accusatory messages up, people should take 5 seconds and check the link.
No sig, sorry.
Do you remember the bnetd / vivendi complaint? I'll recap here briefly:
Vivendi: You stole our code. There was a bug in one of our subroutines, and your implementation included the bug. Also, some of our subroutines look identical.
Bnetd: Of course! Since the bnetd project was basing its code on the unprotected network traffic between client and server, the code would contain the bug because it was observed in said traffic.
Furthermore, If the two programs do the same thing, it makes sense that some of the code will be the same, simply because its the easiest / best way to implement it.
Is it possible that something similar is occuring here?
Here's what they say
The press release goes on to state that "For the avoidance of doubt, the hardware abstraction layer (roughly analogous to a PC's BIOS) has it's PCI allocation and bridge setup based in part on the following functions from the Linux kernel sources:"[snip functions]
Castle state that "any company or individual wishing to recieve a copy of the source code to this component should apply in writing to:" [snip address]You will also need to enclose a formatted 3.5" floppy diskette and return postage stamps (or international reply coupons if you are outside the UK)
So, the title "Castle deny GPL breach" is wrong. Castle have (somewhat grudginly) admitted using GPLed source and announced their intention to comply with the terms of the GPL. They emphasised that the Linux code they used is in their HAL and not the RISC OS kernel to explain why they will not provide the source to RISC OS.
So, IconBar titled their article "Castle Technology deny GPL breach" because they had not fully understood the press release they were quoting. The submitter submitted it with a similar title because he hadn't understood it either or because he hadn't read as far as the third paragraph. Chris DiBona posts it and says "Looks like this one isn't going away quietly" presumably because he hadn't read the third paragraph. There are as I write this 207 posts on this topic, most of them overexcited and almost all of them from people who didn't read as far as the third paragraph. I find this all hilarious.
The GPL is not a contract: "You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it."
It is simply a grant of rights conditional on a particular set of actions being taken.
But if you want to think of it in the consideration framework, the licensee receives the right to distribute GPL'd code in ways not normally permitted by copyright law, and the licensor receives the fulfillment of his or her desire that the software be redistributed according to the terms of the GPL.
The people trying to enforce the GPL are in fact very kind. They usually leave you two choices
1) Release it under GPL
2) Admit to breaching it (by accident or intentional), settle for a full press release and removal of the infringing source code
If they really wanted to be assholes, they could simply file charges for copyright infringement, Usually, if they not only copied the code, but presented it as their own work they could be sued with fraud too. And (if found guilty) the company would have to pay damages. Complying with the licence after the crime would not free them from any liability.
So you see, releasing it under GPL is a settlement offer from the copyright holders. They don't have to make the offer, and the company doesn't have to accept.
Kjella
Live today, because you never know what tomorrow brings
yeah I know it's cruel, but some things just _have_ to be done. If they still persist, we just _might_ think about making them use VB for kernel development.
*evil grin*
From term #2 of the GPL (emphasis added):
I've asked it before and here I go again: "What the hell is a volume of a storage or distribution medium and what's aggregation?"
When the (first) GPL was written a "volume of distribution medium" was a tape snail-mailed from the FSF in Boston, or for work-derivers, a tape or maybe as Castle is doing, a floppy.
I understand that this exception is how binary kernel modules (NVidia) can be distributed in a CD-ROM with the GPL'd Linux kernel, gcc, emacs, etc.
However, Castle is putting the HAL and kernel into a Flash ROM. Even if they aren't statically linked together (not hard to imagine: HAL boots & uncompresses kernel image into RAM, then jumps), is this mere aggregation? One can extract a single file from a tape or CD-ROM, but can you un-aggregate a ROM?
Consider TiVo: is the closed-source application "merely aggregated" with the GPL'd kernel? You can put the hard drive in a PC & un-aggregate, but this violates your warranty and is not as trivial as grabbing a file from a CD-ROM.
When does "aggregation" end as "volume of storage medium" becomes more deeply embedded? If the ROM is soldered down instead of socketed? If it's inside a microcontroller with the security fuse thrown so it can't be read out?
Link-based licensing (compile-time or runtime) tends to get compilicated (or complicate things) in the embedded world, where many devices use single statically-linked system images. The conventional linking-based interpretation of the GPL's standalone-works stipulation (GPL section 2) is a bit awkward in that context. If you take a loose view of the link restrictions (e.g. accepting compile-time linkage), then the GPL contaminates the least part of the incorporating work that could "be reasonably considered independent and separate works" -- possibly a driver, a HAL, or the whole kernel.
Assuming that Castle aren't lying then this goes straight to the hard question of the GPL (and of Copyright law enforcement in general) -- what is a derived work?
They admit that they have a GPL component and offer source. Fine. Then the question: is the product as a whole, a derived work of this component, or are they separate works, distributed together? If the former then Castle are in breach and would need to offer their entire OS under the GPL, the latter they are fine.
This question comes up in other places. For instance is Linux kernel + binary only module a derived work, or are they separate works? This ha snever been tested, but Linus has expressed some opinions.
It seems agreed that Linux kernel + proprietary user mode software (eg a Linux PDA with some proprietary app on it) are separate works, but in the embedded software world, even this becomes murky.
There is a real question here which can only ever be finally resolved by precedent.
I have, as part of my work, been required to disassemble binaries and re-implement in C. It always used to make me smile when a chunk of asm revealed itself as a simple plane intersection routine, linked list management, matrix transform, hardware init sequence, or whatever. Recompiling the C implementation often produced *exactly* the same asm.
My point echos the parent post: if you are writing code with the same functionality, it shouldn't come as a shock when the binaries match, especially - as was mentioned - if some massaging is done to one version to make them match.
Of course, no one can say one way or the other until they've seen the source code that Castle has agreed to show. I suspect they merely used the GPL'd code as reference, and wrote a similar version that matched their hardware, which isn't your bog-standard PC. How stupid would they look if they say it isn't the GPL'd code when it is, then show it to people? I mean, really..?
I'm biased, I'll admit that. I've been an Acorn/RISC OS user for many, many years. But I'm disgusted at the pitchfork and torch reaction this issue has received here. Linux/OSS users should be all-to-familiar with a platform struggling against a much larger organisation. Never before have I seen such two-faced, knee-jerk ranting on this site, and that's saying something.