AOL Pulls Nullsoft's WASTE

dmehus writes "America Online, parent company of Nullsoft, has pulled what it views as a controversial project called WASTE from Nullsoft's servers. This is not the only time it has stepped in to Nullsoft's doings. It had quickly taken down Gnutella, developed by Nullsoft co-founder Justin Frankel, and shut down an MP3 search engine. CNET's News.com has more details." For those not keeping track, WASTE was only recently released.

Comments

GPL

[Molt]

Hold on, Waste was released under the GPL.. exactly how can AOL plan to pull that?

Re:GPL

[lpontiac]

Can't speak for elsewhere, but it turns out under Australian law that even if I release something under the GPL, I might be able to "take it back." It has something to do with the fact that the law makes it extremely difficult to give something away - that's the reason that if, for instance, I want to give someone a house, I can't "give" it to them, I have to "sell" it to them for $1.

A lawyer called Jeremy Malcolm gave a rather good talk on this at Linux.conf.au 2003 (there should be links to his slides and audio of the talk itself on the site, if anyone's interested).

Duh.

[afidel]

Who didn't see this coming. Justin comes up with cool tech because he can't be touched by AOL and even if they fired him he's stinking rich from the takeover so he doesn't have to work for anyone. AOL still owns the servers and can dictate what gets released by one of their holding but once the code is out there it's there for good (assuming Justin didn't violate any sections of the GPL, specifically re patents).

Re:Duh.

[afidel]

Ownership of the equipment doesn't give them ownership to the IP. They would have to have a contract with Justin that says all thoughts are AOL's regardless of whether he does them for work or not. That is a possibility, but with Justin's rebellious streak I doubt it.

Mirrored

[Anonymous Coward]

As linked from heise.de, the release is mirrored on the web.

The whole "unauthorized" release thing is interesting, though. I'd say that they have to prove that it wasn't an official release as it certainly looked like one. But what if somebody infiltrates Microsoft and puts sections of the Windows source on the web site under the GPL?

Re:Mirrored

[moonbender]

I'd think the situation you describe is pretty straightforward (IANAL though). The person who hacked MS never owned the copyright to any of Microsofts software, and thus does not have the right to release the source code under any license. Any licenses he gave would be null and void.
If someone would actually download the sources and take the license seriously, he'd definitely have to stop working with them as soon as he is told.I'm not sure whether there would be any further ramifications - I'd assume no, at least not as long as the person who downloads the source is doing so in good faith, that is he really is dumb enough to believe Microsoft released the Windows source under the terms of the GPL.

As for this situation, it's similar, but not the same: AOL, and not Nullsoft, probably owns the rights to WASTE, and so only AOL can release the software under the GPL. However, as a part of AOL, maybe Nullsoft also has the privilege to do so, especially in this case of software they programmed themselves. That'd mean they abused that privilege, and might lead to some kind of trouble for Nullsoft, but in that case the GPL would still hold. On the other hand, maybe the situation is effectively the same as the one with MS, described above, which would mean that Nullsoft had no right to grant any licenses, and as such whoever downloaded WASTE would in fact be required to delete the software.

Wait a minute...they can't do that!

[ScottGant]

"If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated."

It was released under the GPL, it's out there...the GPL is out there...they can't all of a sudden say "Sorry, we changed our minds".

Will this be a landmark case that tests the GPL now? I wonder...

Re:Wait a minute...they can't do that!

[JoeCotellese]

It seems to be that as in the case of Gnutella, they had to know that their parent company wouldn't like this very much.

I don't think the provisions of the GPL say that you have to continue distributing the code, only that the code once freed remains free. There are already other WASTE mirrors so I think they achieved their objective.

You would think the NULLSoft crew would just leave AOL. I imagine that they are sticking around because of retainer contracts tied to $$ and when the time comes they all jump ship en masse.

Re:Wait a minute...they can't do that!

[ssimpson]

Erm, the link provided in the story e.g. here

To everyone posting the source code

[joshki]

You may not be on solid legal ground here. I didn't see the original release, but the page they have up now says:

An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.

(emphasis mine)

If the files were posted by someone who did not have the authorization to post them, then you have no legal right to distribute them, because that person had no right to place the files under the GPL. Of course, we have no way of knowing if that's what really happened, but I'd still be very hesitant to publish the files until someone with the standing to do so weighs in on the issue (Any FSF lawyers reading this?).

Re:To everyone posting the source code

[mako]

Interesting. What would happen if say a car salesmen sold a customer a car for 1/2 price while the office manager is on vacation. The customer assumes the sale is legitimate, the sale is finalized and the customer drives home. When the office manager returns would he have recourse against the customer, as well as, the employee?

Or to use your example if the thief exchanges the stolen money for goods and services must the second innocent party incur the damages and repay the original injured party? Or is the thief solely responsible for remuneration?

Re:To everyone posting the source code

[Chilles]

And to further stretch the analogy (thought experiment time)

Suppose the car was probably bought under certain terms, maybe a free service checkup every 3 months. Would the customer still have the right to the full terms of the contract he signed with the garage? I'm inclined to think so...
But if that is the case than people that downloaded waste from the original Nullsoft website still have the right to the contract they "signed" (i.e. they read and undertood the accompanying licence). So those people have certain rights with respect to the waste source code they downloaded. More specifically, they downloaded it under the GPL. So those people still have both the rights and duties that come with the GPL with respect to waste.

No one knew or had any reason to suspect that the person distributing waste was not authorized to do so. So everybody that downloaded waste from the nullsoft website has legally obtained Waste under the GPL. And may legally redistribute the waste program or any derived works as long as they include the source code in their distribution.

This is just a thought experiment though, I have no idea how this works in real life. I know I just thought that giving us Waste was a cool action by Nullsoft and I never suspected otherwise. (this was released the same day RTCW Enemy Territory was given away for free so perhaps I wasjust getting used to companies giving cool stuff away for free)

Re:Does GPL apply?

[Albanach]

It was released by nullsoft under the GPL - the subsidiary had a choice over the licensing conditions the wanted to use and settled upon the GPL.

Just because their parent company doesn't like that choice, it can't be undone. If AOL have a problem with nullsoft's choice of license, that's an internal matter for the two compaines to resolve.

The only way I can see things being different would be if under contract terms between the two companies AOL had to aprove each piece of software produced by their subsidiary. Then they might argue that the code wasn't nullsoft's to release or give any license to. In much the same way as if someone here found the code to Microsoft Office, they can't just slap the GPL at the top and release it to the world.

AOL may very well pull the source..

[GauteL]

.. and Waste may very well be illegal, no matter if it was released under the GPL.

What matters is WHO released it under the GPL. If the ones that released it had no legal rights to do what they did, then Waste is illegal, and redistributing it is illegal.

Why? Because only the copyright holder can release software like this. Otherwise the license is void, and you are all doing something illegal by distributing the source.

The above is pretty much clear, but lawyers might want to answer the question of wether the people that released the software did in fact have the rights to do something like this. If a lowly employee releases software, my guess is that he does not have the rights to do so. Otherwise any employee of Microsoft would have the right to release Windows under the GPL..

Before distributing Waste, you should be pretty sure that it was in fact a release warranted by Nullsoft executives, otherwise it may be illegal.

It may be that the release was warranted by someone with the proper authority, but if AOL/Nullsoft states otherwise, this might be decided by trial.

Re:AOL may very well pull the source..

[randombit]

Why? Because only the copyright holder can release software like this. Otherwise the license is void, and you are all doing something illegal by distributing the source.

Absolutely true. But, from my brief glance at the source, it looks like all of the files have GPL notices at the top. Either the unauthorized person was very thorough, or this really was supposed to be GPLed - maybe not released right now, but at some point. But that is hardly proof, and while they cannot revoke the GPL, it's hard to prove either way, unless they name the person who supposedly uploaded it without authorization, and file a $$$ lawsuit against him for IP loss.

Either way, WASTE is at this point not really safe for use. For examples, it uses PCBC encryption (broken), MD5 for authentication (!!!), RSAref (slow + unmaintained + bad RNG), and on Windows it doesn't seem to be seeding the RNG with much of anything (on Unix it reads /dev/urandom, which is fine). The NullSoft guys may have interesting ideas, but it seems like they probably should have asked somebody before implementing the crypto in WASTE.

Another possible scenario:

[Karl Cocknozzle]

1. AOL are the copyright holders and as such the code was never released by them under the GPL so it's not under the GPL now and never has been.

2. AOL don't own the copyright and as such the code is, and always will be , subject to the GPL.

I humbly suggest possibility #3...

3. AOL owns the copyright, and is trying to test whether they can "retract" a decision to release code under the GPL.

This is actually a critical point... If AOL can "retract" this decision, what stops them from "taking back" Mozilla? What keeps SAP from "taking back" SAPdb? Many open-source projects get code from, or are even started thanks to the largesse of, large corporate interests.

If they can establish in court that it is okay for AOL to "retract" an officially GPL'ed release, how long before a major player starts buying companies that have "right of retraction" on their open source competitors and exercising those rights?

Re:only 2 possibilities

[Fnkmaster]

This post shouldn't be modded offtopic. Legally, I believe it's a key issue (of course, this is just my opinion and IANAL). Ownership of the copyright of this code is a complex issue, undoubtedly, determined by a series of contracts between employees and their employers, and the companies involved. Just because we might say in the common parlance that "AOL owns Nullsoft" doesn't necessarily mean much. AOL might own every share of Nullsoft stock, but if they delegate management of Nullsoft to Nullsoft executives, those managers have the right and obligation to manage the company as they see fit (within the bounds of standard fiduciary obligations - which are complex). The managers do have the obligation to represent shareholder interests with respect to company assets - but that is a contractual and fiduciary responsibility issue, and does not retroactively impact who had the right to license that code.

As far as I know, in the absence of overriding contracts regarding copyright holdings of Nullsoft, Inc. that automatically assign such copyrights to AOLTW and prohibit sale or trade of rights in those copyrighted materials without explicit authorization of AOLTW, I believe Nullsoft management would have acted as legal agents of Nullsoft Inc. with respect to copyrighted materials when they posted them on the Nullsoft web site with license and copyright notices attached. If AOL failed to put greater contractual and procedural controls in place, that's their problem, and they could take it up in court with the individual managers or corporate personage of Nullsoft, Inc.

Then again, after the Gnutella fiasco, if AOLTW _didn't_ have explicit contracts in place giving them assignment and control of all copyrighted Nullsoft works, they are idiots.

Can AOL un-ring the bell?

[LostCluster]

The site that's there now claims that WASTE is owned by Nullsoft, and whomever posted WASTE on the server with a GPL license lacked the authority to do. As a result, AOL's view is that the GPL doesn't stick to the software because only Nullsoft held the copyright and Nullsoft didn't attach the GPL.

What a mess here... something that's really lacking from the new page is anything that says just how "unauthorized software" appeared on the nullsoft.com site.

- If they're claiming that they were hacked, this would have to go down as the hack of the century... I doubt that happened.
- If they're claiming an employee acted outside of their authority, aren't they responsible for restraining that employee's actions so they don't become visible to the public?
- If AOL's trying to overrule a decsion made by their Nullsoft division after learning about it, isn't that too little too late?

This has got to be one of the most interesting test cases of how the GPL works ever.

Re:The Crying of Lot 49

[dark-br]

Yes, I believe the name "Waste" is indeed a references to Thomas Pynchon's novel "The Crying of Lot 49." In the novel, W.A.S.T.E is either a hoax or a secret system for communication, and (might) stand for "We Await Silent Tristero's Empire." Here's a little quote:

"Last night, she might have wondered what undergrounds apart from the couple she knew of communicated by WASTE system. By sunrise she could legitimately ask what undergrounds didn't....[H]ere were God knew how many citizens, deliberately choosing not to communicate by U.S. Mail. It was not an act of treason, nor possibly even of defiance. But it was a calculated withdrawal, from the life of the Republic, from its machinery. Whatever else was being denied them out of hate, indifference to the power of their vote, loopholes, simple ignorance, this withdrawal was their own, unpublicized, private. Since they could not have withdrawn into a vacuum (could they?), there had to exist the separate, silent, unsuspected world."

Re:GPL - Source Posted

[SubtleNuance]

Except that the person, was an agent of Nullsoft - agents of commercial entities *are* legally capable of entering into an license agreement. This protects the 2nd party (in this case the public) from Businesses backing out of a 'deal' saying "this person didnt have the right to obligate us" - in fact, (s)he does.

imagine if some 3rd party came down on a seperate department (and previously unaware of this project) AOL for WASTE, maybe AOL's employees HAD discussed the matter with the people in their immediate sphere of relevance... all was well. teh decision to publish (and enter into the GPL license with the public) -- they cannot simply say "oh, we were just kidding". becasuse we, the public, had every reason to believe that the Nullsoft fellows had the authority (as they must have, in order to publish).

remember, IMNALBPOO/.

except that they did have the rights

[Trepidity]

The code is (c) Nullsoft, and even AOL is not disputing this. The code is not (c) AOL Time Warner, which is an important distinction (Nullsoft is a subsidiary, and so a separate legal entity). Justin Frankel essentially is Nullsoft; he's a co-founder and principal developer. The code was released on the official Nullsoft website by him, the same way most other Nullsoft software is released. In short, the release followed the standard practice used by most other Nullsoft releases (most of which, like NetMon, are uncontroversial). This is Nullsoft release policy, and Justin is basically their release manager (for at least some of their stuff -- Winamp is handled separately). Simply because AOL disliked this particular release doesn't give them a legal leg to stand on in pulling it.