SCO Shows 80 Lines of Evidence?

cheesybagel writes "In this EETimes article SCO claims to have shown their evidence to our independent analyst friends from the Aberdeen Group. The evidence, all 80 lines of it, allegedly even has identical comments."

Comments

When...

[Anonymous Coward]

will this end?

Re:When...

[nickos]

When the Linux community finds out which lines are alleged to have been copied. Then we can use source control to find out who added them.

Look - lines 2022 to 2102 were added by... Caldera!?!

Re:When...

[koko775]

RTFA. The comments are identical. However, who's to say that the code wasn't lifted from Linux?

Has anybody considered

[gazbo]

That maybe SCO are telling the truth - that maybe there is ripped off code? Undoubtedly if the claim was that MS had included GNU code in their apps, people would automatically presume guilt; why the immediate defensiveness now?

Especially as we have 80 lines of identical code including comments which is the real kicker.

Re: Has anybody considered

[Black Parrot]

> the way that SCO has acted at every stage simply doesn't add up to a company that's playing this thing straight.

If they were in fact trying to protect their IP then the first thing that would have happened is that kernel.org would have been hit with a cease-n-desist.

This is another kind of game altogether.

Re:Has anybody considered

[bheading]

As the article points out, no-one knows that this code was SCO's to begin with. It could have found it's way from Linux to SCO's code. It could have bubbled it's way up from the earlier BSD releases. Who knows ?

If the case was really that simple it sounds like it's open-and-shut. It's hard to understand why SCO won't show it publicly, or allow anyone to see it without making them sign a huge NDA. What do they have to lose ?

And even then, the 80 lines would have to be pretty critical to form the basis for claims of $1bn in damages. How many thousands of lines of code are there in Linux (or any other OS) and how many blocks of 80 lines are singularly critical to the whole functioning of the OS ?

Re:Has anybody considered

[aborchers]

I don't think anyone has denied the possibility that their claims might be true. The criticism has been about how they have conducted themselves. If SCO wasn't run by a bunch of ligitous peckerheads, they would have announced the infringment and it would have been removed from the Linux code. However, they're more interested in flexing their FUD to either (a) extort whatever they can get from IBM et al, or (b) undermine the credibility of (non-SCO) Linux.

What this shows me is that OSS unfortunately lets jerks into the party as well as people who want to play fair and make a contribution to the community. These people better enjoy it while it lasts and hope for their big payday, cause they'll never eat lunch in this town again...

Re:Has anybody considered

[be-fan]

Saying that "it's called capitalism" isn't a good arguement, its a cop-out. Lot's of companies manage to go about their business maximizing profit without resorting to unethical practices. The ones that don't (think Enron, Tyco, etc) end up on the evening news after getting busted by the government. Our government encourages healthy competition, not unethical behavior. They have laws to that effect. If something seems to be clearly unethical, you're going to need a better reason than just saying that they're trying to maximize their profit.

Re:Has anybody considered

[surprise_audit]

But the "trade-secret" code is already published in the Linux source, if SCO is to be believed...

Either: 1) SCO's code is included in the Linux kernel, and is therefore irrevocably publically available and no longer qualifies as trade-secret;
or 2) SCO's code is not in the Linux kernel and may still be a valuable trade-secret. Or it may not, but that's not Linux's problem.

There isn't a third option, and all this dicking around with NDA's and crap like that is merely making SCO look stupid.

Re:Has anybody considered

[surprise_audit]

...the copyright holder gives the company a chance to correct his mistake (and shows proove immediatly)

It's been said here before - if SCO tell us which bits are "stolen", those bits would be replaced very fast by the kernel developers. This would not be optimum for SCO, because they could not then demand licensing from all Linux users. If they can get a judge to confirm the theft without disclosing to the public where the stolen code is, then they'll have a legal leg to stand on when holding the entire Unix world to ranso

Re:Has anybody considered

[EpsCylonB]

Wow, Goerge W Bush is posting to slashdot now.

Seriously, do you believe that all corporations act ethically all the time ?.

I could bring up M$ as an example of the USA's failure to stop companies acting unethically.

Instead I will just point out the fact that a lot of goods sold in the west are made in unethical condtions (clothes made in sweatshops, diamonds mined by children, etc.).

Re:Has anybody considered

[John Hasler]

> Especially as we have 80 lines of identical code
> including comments

No. We have somebody who _says_ that 80 lines of code including comments are identical but who has entered into a secret agreement with SCO that lets SCO control what they say.

Re:Has anybody considered

[the gnat]

I could bring up M$ as an example of the USA's failure to stop companies acting unethically.

No one is claiming that our government has ever been the ideal tool for harnessing the unethical behavior of companies - though it's done a decent job at times, this sort of economic micromanagement is very difficult to pull off and many think it's a bad idea. However, the point that you missed is that maximization of profit is not usually considered a reasonable motive for morally bankrupt behavior. Yes, Nike and Microsoft are unethical, but they've never tried to give the excuse of "maximizing value for our shareholders". It's always some bullshit about innovation or emerging markets instead.

The problem with this argument is that everyone has a different perception of what "corporate ethics" should be, and while pretty much everyone agrees that the Enron execs acted unethically, people have a much wider range of views on Microsoft.

Re:Has anybody considered

[Fished]

Ok "ClosedSource" (whaddaya work for MicroSoft?) I'm not even going to try to analyze the fallacies in this little troll, I'll just rebut them.

So first SCO is at fault for not showing any evidence. Now that they have, the claim is that they can't prove the code is theirs. If the Linux community wasn't going to accept code as evidence, why ask for it in the first place?

What code? All we've got at this point, from what I can tell, is one non-programmger "analyst" with no significant UNIX experience and a degree in communication/minor in French lit claiming that "comments are the DNA." I'll consider the code as having been given once I have:

1. The code, including line numbers, filenames, and the whole sourcefile from UNIXWARE it is based on.
2. The SCO changelog showing the code goes back a long time.
3. Linux's changelog showing the code doesn't go back a long time.

Until SCO provide specifics to the Linux development community, they've provided *nothing*.

n your post you are asking why this code, that you don't believe is valid evidence, be made public. Why should SCO bother? Besides, copied or not, you already have it. Just look in the Linux source.

Listen here, troll-boy... Do you have any IDEA how many lines of code there are in Linux? SCO hasn't said where this code is, hasn't given any description of the code, and hasn't given any evidence that they didn't copy it from Linux or introduce it into Linux themselves. They've provided no evidence, just FUD.

I've never said that it was enough for SCO to reveal some code to somebody. I'm saying that SCO needs to reveal enough code to figure out what actually happened to the general public. So far, they've made *nothing* public.

Re:Has anybody considered

[gmack]

The really strange thing is that any sysV code would have far predated IBM's involvement with kernel development.

As we know from previous inverviews IBM hsa a _very_ strict disclosure policy where every bit of code relsed has to be checked first. It's also been noted that the Linux labs are *not* allowed to view source code from AIX.

I imagine the reason they don't want to publically give out this information because that would allow the OSS community to find out where the code actually came from. I'm guessing it's third party and neither SCO or Linux has IP rights over the code in question.

Re:Has anybody considered

[magic]

Copyright allows for fair use of small amounts of material-- a paragraph from a book, few notes from a song, even the entirety of a short poem.

80 lines of a million line program is a very small fraction, so this would have to stand on trade secrets, not copyright. Unless you sign a deal not to expose them, I don't think trade secrets are protected. Copyrights and patents are to encourage people to release work into the public domain after a short (150 year copyrights? WTF) period of time. So trade secrets, which keep work private, aren't protected in the same way. Presumably, the argument is that they gave IBM Unix source under a license agreement and IBM put that code into Linux.

Finally, the origin of the code has to be established. I can't show up with ten pages of text from William Gibson's newest novel embedded in my own book and claim that he stole it from me. SCO must demonstrate that Unix was the origin of the code to have any kind of suit. This requires finding the programmer who committed it (hey, for $1B at stake, maybe SCO added their own code to Linux) and when it was committed. Again, with $1B at stake, I'm not sure a 10 year old CVS log is sufficient evidence. I think testimony is necessary.

Then again, OJ wasn't guilty.

-m

Re:Has anybody considered

[RenQuanta]

So first SCO is at fault for not showing any evidence. Now that they have, the claim is that they can't prove the code is theirs.

The code has yet to be given out to the community for consideration, it was shown to two heavily biased analysts under a strict NDA.

The DiDio character is a Windows consultant, and the Aberdeen group released a report last November that Linux was "the most vulnerable operating system". Yeah, that's the same as giving it to the community for them to verify SCO's outlandish claims.

Besides, copied or not, you already have it. Just look in the Linux source.

> pwd
/usr/src/linux-2.4.20
> ls -F
COPYING Makefile arch/ include/ lib/
CREDITS README count.txt init/ mm/
Documentation/ REPORTING-BUGS drivers/ ipc/ net/
MAINTAINERS Rules.make fs/ kernel/ scripts/

wc `find drivers` | grep total>>count.txt
wc `find fs` | grep total>>count.txt
wc `find include` | grep total>>count.txt
wc `find init` | grep total>>count.txt
wc `find ipc` | grep total>>count.txt
wc `find kernel` | grep total>>count.txt
wc `find lib` | grep total>>count.txt
wc `find mm` | grep total>>count.txt
wc `find net` | grep total>>count.txt
wc `find scripts` | grep total>>count.txt
> cat count.txt
2536224 8901774 75504253 total
318544 1344003 10463709 total
539341 2073426 17956222 total
1643 5032 38571 total
3289 9680 74527 total
14262 44543 349883 total
8456 36302 259818 total
15428 51466 387165 total
233962 700480 5920826 total
12201 45061 320402 total

Yeah, sure. We'll get right on that. (In case you missed the sarcasm, eighty lines of code is a friggin' needle in the haystack! I'll leave it as an exercise to the reader to figure out all they implications that fact has...)

Why should SCO bother?

You're right about that. It's not in SCO's best interests now to give everyone the information required to determine what the facts are. It's in their best interest to drag this out as long as possible, to spread as much Fear, Uncertainty, and Doubt as possible, and to control public opinion by controlling the flow of information.

My guess? There may well be some code, but I'm betting that SCO didn't do their homework (corporate managers rarely do). It could be from the BSDs, from public-domain literature, or from SCalderO's own UNIX-Linux integration project which I've read referenced in other posts here.

In any case, I have no doubt that SCO has no case here. For further proof, go read the OSI position paper on the matter. A lengthy read, but very enlightening, and basically shows the SCO claims to be rather without merit. Or is your mind as closed as your source?

Re:Has anybody considered

[Anonymous Coward]

One thing you have forgotten:

SCO released their code in their own linux distribution under the GPL.

Re:Has anybody considered

[pVoid]

You're being defensive.

Their contradicting themselves is just sloppy work on the behalf of their legal/PR team.

As for the "how can Linux users be guilty if IBM" comment, two things: a) they aren't suing users, they are suing companies (for now), b) isn't OSS the crowd of people who pride themselves of having 'all the people' supporting their code?

You cannot enjoy the priviledges of a group without taking on it's responsabilities. If someone screwed up in your system, you must all bear that burden... in whatever shape or form. I'm thinking, all linux will suffer from this is a temporary rollback of the source tree... or just emergency hacks to remove the code from current distributions. The shit flying through the fan really is for IBM at this point.

On a side note, if this code has been in the tree for a long time, there's a good chance that big companies like Redhat might migrate to the new clean version of the tree and be forced to discontinue support for the older versions... which would be a nightmare for some.

Re:Has anybody considered

[schon]

It's been said here before - if SCO tell us which bits are "stolen", those bits would be replaced very fast by the kernel developers.

Yes, and it's true - however your conclusion has no merit.

This would not be optimum for SCO

Wrong. This would indeed be optimum for SCO.

If the alleged material has any value at all to SCO, SCO would want to stop people from distributing it as soon as possible, so that they can claim damages.

By failing to disclose the alleged code, all they're doing is proving to any judge involved that the code is worthless, and therefore should not be considered when assessing damages to SCO.

If they can get a judge to confirm the theft without disclosing to the public where the stolen code is, then they'll have a legal leg to stand on when holding the entire Unix world to ranso

Bullshit. All a judge would do is order people to stop distributing the "stolen code" - and a judge can't do that without telling people what the hell it is that they should stop doing.

Anything else would be extortion.

Re:Has anybody considered

[squiggleslash]

This is a civil suit, so SCO merely needs to have the balance of evidence on its side. This isn't an "innocent until proven guilty" thing (which would be hard in copyright cases - how do you prove a pirate didn't come up with something independently?)

Still, Linux has been published the world over, at almost every stage, on CDs, in various archives. It shouldn't be difficult to show, for example, that a particular technology dates back to 1995, etc. The law tends to be more logical and less prone to absurd loopholes than people think. Assuming IBM is innocent, they have every reason to believe they'll win the case.

And assuming they're guilty, SCO's refusal to even allow IBM to correct the damage coupled with their own licencing of the same technologies under the GPL (while they were a Linux vendor) suggests to me that their opportunity to get damages within a few orders of magnitude of a billion dollars is slight. I wouldn't even be surprised to see a token "$1" amount awarded, the usual sign a jury or judge sees a lawsuit as technically legal but clearly unwarranted.

Re:Has anybody considered

[DickBreath]

If the Linux community wasn't going to accept code as evidence, why ask for it in the first place?

Maybe the community would like to see some evidence of massive copyright infringement. Or any misappropriation of trade secrets.

Let's get this straight. SCO is suing for $1 billion based on claims of misappropriation of trade secrets. They have not complained to the court of copyright infringement. So I really don't know what the big public distraction over copied code is. (Just that, a distraction.)

If IBM contributed some kind of secret know how that was available nowhere else than SCO, this should be apparent to the Kernel developers. The source is, after all, in a source control system. It should be a simple matter, for SCO, to show which specific IBM developers contributed what secret know how, and when.

If the secret know how is in the form of copied & pasted code, then 80 lines would seem hardly sufficient. After all, the kernel's are quite different. Could there really be 80 lines that are responsible for causing Linux to be accepted in the market at SCO's expense?

Re:Has anybody considered

[tkg]

One possible, and admittedly tinfoil hat, reason for not revealing the infringing code is that SCO doesn't want it removed. If they don't reveal it, it remains a trade secret and if it's not removed they can force linux distributors to pay licensing fees effectively hijacking linux (2.4 and later) as their property. In this case the only alternative for the Linux/OSS community would be to roll back the kernel to 2.2 (SCO claims this kernel is clean) and completely rewrite all the additions to bring it back to current functionality. A big time set back by any standards. Again this is a tinfoil hat scenario, but given SCO's behavior I wouldn't put it past them.

Re:Has anybody considered

[Rabid Penguin]

IANAL, but from my understanding, the only major issues here are copyright on specific sections of code and the possible breach of contract by IBM. Copyright does apply to your first case of essentially copying code using different variable/function names, but not the design of the system.

The design of UNIX is not a trade secret, it is broadly published in Operating Systems books, the BSD kernels, and the API component is controlled by standards groups. To win a claim based on design using copyright law, the code would not only have to be similar in function, but nearly identical in form (excluding changed variable names, or other trivial changes), and from what I've seen of Linux and BSD internals, this is not the case.

Besides, broad protection of a design is generally a patent issue, of which SCO has very few, and the original UNIX patents have expired.

Re:Has anybody considered

[Fished]

What's wrong with everything? They are making some fairly outrageous claims against the Linux kernel, and have provided nothing to substantiate them. They are sueing one company (IBM) to the tune of $1 Billion, and have threatened a thousand other companies with unspecified legal action without any substantiating evidence.

Like it or not, it's not enough to say "we think you might be infringing, please stop." If they want us to take them seriously, they have got to provide enough evidence to allow us to evaluate their claims. And that much evidence is, as you put it, "everything."

Further, this is not unreasonable. If SCO's account of events is correct, any trade-secret value of the code in question is irrevocably compromised already. Why should they not make the code available? Why should they not make it possible for us to cure the alleged infraction? Why should they be able to make broad accusations against us without providing us any evidence whatsoever?

(Hint: License fees in excess of $10 million from Microsoft.)

Re:Has anybody considered

[stwrtpj]

It's been said here before - if SCO tell us which bits are "stolen", those bits would be replaced very fast by the kernel developers. This would not be optimum for SCO, because they could not then demand licensing from all Linux users.

Except they can't, and any judge worth his salt would see through this for two reasons:

• Once a trade secret is out, it is no longer secret and can never be made secret again. Any damages collected are purely punitive in nature, and would be against the infinger and not the end users. End users are NOT LIABLE, period.
• When a violation such as this occurs, it is the legal responsibility of the infinged party to mitigate damages. In this case, the ONLY way damages can be mitigated is by revealing the duplicated code so that it can be excised from the kernel. The idea that revealing the code would only allow the Linux developers to "launder" the code as SCO has stated is ludicrous, because there would be ample evidence remaining in the older versions of the kernel.

What SCO is doing is FUD, plain and simple. They're just drumming up publicity for themselves and trying to scare people into compliance with their ridiculous demands. If IBM's lawyers have any balls whatsoever, they will countersue for anticompetitive practices.

Re:Has anybody considered

[hammock]

Where did the code come from?

Find out which IBM engineers commited patches to the kernel.
Find out which SCO engineers commited patches to the kernel.

You just narrowed it down. It's probably pretty easy to find out what code it is.

It's also just as likely that SCO copied the code from Linux, since we can trust Linus' logs, but SCO could fabricate thier own logs at a moments notice.

Re:Has anybody considered

[Citizen of Earth]

I imagine the reason they don't want to publically give out this information because that would allow the OSS community to find out where the code actually came from.

The code would also be changed overnight, weakening their case to a point that the judge would throw it out immediately. Do you think their stock would pancake to below 25Â?

Re:Has anybody considered

[anthony_dipierro]

Well, $1 probably isn't possible legally, but $200 is...

In a case where the infringer sustains the burden of proving, and the court finds, that such infringer was not aware and had no reason to believe that his or her acts constituted an infringement of copyright, the court in its discretion may reduce the award of statutory damages to a sum of not less than $200.

Now if it was an IBM employee who stole the code, that's not going to be applicable. But if it wasn't, and IBM can prove that it wasn't, then we might very well see a $200 fine imposed.

The big question is if a judge or jury will find any actual damages. If the code really is critical to the OS that's certainly possible. But it's hard for me to imagine such critical code coming from some unknown source and no one bothering to verify the integrity of that contributor. I don't know, we'll see, maybe.

FUD!

[j0nkatz]

Linux supporters, however, were quick to question the meaning of the evidence. âoeCan SCO prove that this code came from SCO to Linux, and not from Linux to SCO?â asked Jon âoeMaddogâ Hall, executive director of Linux International (Nashua, N.H.), a Linux advocacy organization. âoeOr did the code that's in SCO Unix come from a third source? Show me the facts,â he said.

Not only have they NOT proved to the Linux community that the egg came before the chicken, but they have not even proved what "egg" this is. Is it IBM specific code? Is it the actual kernel??

FUD FUD FUD

Re:FUD!

[sebi]

From the article:
"One could argue that developers could write exact or very similar code, but the developers' comments in the code are basically your DNA, or fingerprints, for a particular piece of source code"

Find out who wrote it, ask who it was written for, and that should be the end of any doubt. But these are things that will happen in an eventual court case. SCO has definitely strengthened it's standing in the public eye. If their claims are any more valid, or actually simple deception remains to be seen.

Re:FUD!

[Timesprout]

They dont actually have to prove anything to the Linux community. They just have to convince a judge that the similarities in question do indeed represent a breach of contract for which IBM are liable.

Re:FUD!

[SkArcher]

The burden of proof lies on the plaintiff - SCO has to show exactly hwere this code came from, who wrote it, when, why, and who for. Only if they can prove that lot AND can prove that there was no way it could of got into the Linux code except by the agency of IBM can IBM be found guilty.

Of course, all this requires an unbiased court with no FUD pushing from M$^H^H outside parties.

I'm still of the opinion that the most likely breach for this code to have come from would be SCO's own Linux/UNIX integration projects from a few years back.

Re:FUD!

[surprise_audit]

Find out who wrote it, ask who it was written for

Now there's a good point - maybe those blocks were written by the same people...

If one (or more) of the early Unix developers later went on to contribute to the Linux kernel, any code they wrote may well have similar comments, due to being for similar functions.

There's one hell of a lot of stuff in the kernel, developed by numerous people - is it beyond the bounds of possibility that some early Unix developer took an interest in Linux and maybe contributed code within his special area of interest?

Sarcasm mode on

[RighteousFunby]

My god! What an awful lot of code that is!!!! That 80 lines took five minutes of developers precious time! It's theft! Treason, even! Hang them! Hang them all!

Seriously, if it's 80 lines out of many thousands that they're worried about, they must be either crazy, or have a major inferiority complex...

Oh wait! They're BOTH!

Why should I be worried?

[gilesjuk]

Unless SCO are coming to my house to format my hard disk and install SCO Unix.

Seriously though, I doubt I'm even using their stupid code, plus my distro of choice isn't commercial.

Mac OSX based on Linux?

[Anonymous Coward]

"The article also claims that Mac OSX is just as vulnerable to attacks as any other Linux based system."

Get your facts straight first, Mac OSX is based on BSD - not Linux!

80 contiguous lines?

[jagilbertvt]

The question I have is whether this is 80 lines of contiguous code, or if it's a line here and there. If it's just here and there, then it's quite easy for them to find matches, heck I bet it'd be pretty easy to find some comments that match too.

80 Lines of code = less revenue?

[edgrale]

So let me get this... 80 lines of code is what made Linux so popular? And the same 80 lines of code caused SCO profits to drop from about $200M/year to about $60M/year??

Gimme a break, no one is going to believe that. As soon as they know what code is "dirty", if it even is, it is going to be removed.

Where's the truth?

[Scalli0n]

If SCO was really out to be honest, they'd show us the code. I, myself, want to see these 80 lines of code, because it could be anything! I also want to see where it came from; I want to be able to go to my /src/ directory and see the same 80 lines of code as they tell me were plaigarised

Re:Sheesh.

[Grax]

Any decent developer maybe. The great ones take the same amount of time to write 3 lines of code that does the same thing.

Re: An Entire Unix Kernel...

[xScruffx]

Then they might have a strong case . . . 80 lines of identical random ASCII would be a real bitch to counterprove.

xScruffx

Re:Use SCO's Bandwidth

[Anonymous Coward]

Isn't this called a DoS attack? ...Ok, I'm new here.

Wasn't a good test

[confused one]

I read the articles (there was more than one written). I read the comments by Aberdeen's rep. She said: Yep, that's the same code alright...

Where's the analysis in this? 80 lines of code isn't damning. Where did it come from? Did she go back into the distro archives and find where and when it was put into the code? No. Did she check against the BSD codebase? NO. Did she even know what she was looking at? Probably not.

Two previous post provide sufficient defense...

[Anonymous Coward]

The following two posts, taken from previous stories concenrning SCO, quite beautifully sum up IBM's best potential defense.

The first post, taken from a June 3rd story, points out the relative significance of a situation in which everything that SCO has said is true, and it even is a bit optimistic in favor of SCO's claims (but it still puts things in perspective):

Ok so we have this quote:

"The month of June is show-and-tell time," McBride said. "Everybody's been clamoring for the code...and we're going to show hundreds of lines of code."

So lets assume "hundreds of lines of code" is our N value. Now let N equal... oh... we'll be lenient on our definition of "hundreds" and make N = 5000.

Ok so we've got our hypothetical 5000 lines of offending code. Now lets count the number of lines in every .c file in linux-2.4.20.tar.bz2 ...

TMPFILE=`mktemp /tmp/$0.XXXXXXX` for i in $(for i in $(for i in $(find ./|grep "\.c"|grep -v Documentation);do cat $i|wc -l;done);do echo $i;done);do echo -n $i+>>${TMPFILE};done;echo "0">>${TMPFILE};echo quit>>${TMPFILE};bc -q ${TMPFILE};rm ${TMPFILE}

Which gives us 3332935 (including comments but hey we're lazy).

And this seems reasonable give that according to this link [geocrawler.com] which shows ~1.8 million for a 2.2 kernel so yeah hey what's another 1.5 million between friends? (think of all the new hardware support)

Ok so we've got our probably bogus number of ~3.3 million lines of code. Remember N? Come on you can do the next step its fun!

5000 / 3332935 == 0.0015% and lets be super generous and assume comments make up 40% of our line count...

5000 / 1999761 == 0.0025%

I wonder what the statistical liklihood of having similiar blocks of code of some signifigant size that happen to be the same (excluding format and variable differences). I mean there's only so many ways one can _intelligently_ code a given function

Given those kind of percentages I doubt a judge or jury could be convinced of any copyright infringement of any signifigance. It'd be kind like trying to sue a competing encyclopedia company for swiping that one entry in the "P" volume on "Petards" ("hoisting", "petard", look it up) from you and demanding millions of dollars in compensation for this plagerism (ok so this analogy sucks but I had petards on my mind so...)

The second post, taken from a June 6th story, highlights the fact that something fishy would have had to have been going on within SCO's ranks for a block of code with full comments to be submitted for inclusion into the Linux kernel:

Not having the benefit of seeing the code I'll have to assumme these comments are fairly overwhelming evidence wise.

If you knowingly copy code, into a product that can be viewed by potentially millions, wouldn't you at least try to make it not resemble the original work.

Yes, it is easy to catch the lazy cheaters, but if put some effort in it then it should be a little more difficult then running grep.

I'm sure there are bound to be similarities here and there, coders no doubt ran into the same problems working on the same platform, but apparently these grievances were enough to goto court over.

Obviously, we can surmise they understand their work enough to copy kernel code, so we know the individuals were at least someone intelligent.

So, having in mind how code theft works, it doesn't make sense for something as obvious

Re:Two previous post provide sufficient defense...

[sbaker]

Yes - indeed. It would certainly have to be something pretty self-contained.

It's rare to find any 80 line stretch of code that could be incorporated without at least some significant changes.

Re:An Entire Unix Kernel...

[$0.02]

It's even more efficient than you think, since those 80 lines include comments.

Things are getting worse for Linux.

[aussersterne]

This is a lengthy prediction, and I'll probably get modded down for it, but hey, Slashdot is all about having fun by voicing one's opinion, so here I go.

You know and I know that SCO's case is meaningless and that even if some hapless SCO, Caldera or IBM idiot inserted code into Linux, that code can be quickly removed and replaced and a new kernel distributed to people using Linux.

You and I also know that it is much more likely that code made its way from Linux into SCO, or from BSD into both, and that SCO's "side-by-side code" demonstration technique doesn't hold up to solid reasoning.

However, very few people in business are going to understand this. Management are scared idiots, American management doubly so. They're going to stay away from Linux in droves and are already feeling personally betrayed by the people who make Linux, just on the strength of the FUD and accusations. They're already at home telling the wife how big a mistake Linux was and how they should have listened to the doubters.

It's natural for them to take this view so easily because they've been conditioned all their lives to believe that "there's no such thing as a free lunch" and "if it sounds too good to be true, it probably is" and after years of business training they're suspect of anything (even family matters) that don't emphasize the "bottom line" above all else. They were very reluctant to consider Linux in the first instance for these reasons and it took years of badgering on technical grounds and tempting on cost grounds from technical underlings to stop them from seeing Linux as some kind of a scam in the first place.

The courts in the US, unfortunately, have the same view. If it's corporation versus non-corporation, the corporation will always get the benefit of the doubt. The burden of proof will always be on the non-corporation, regardless of what the "law" may say, and in many cases, it's impossible for the non-coproration to win a case; the court will simply rule for the corporation even if it's patently obvious that the law doesn't support such a ruling. They'll do it with a backhanded wink and a nod and the belief that to hurt business and "the economy" is far worse that to hurt any non-business entity or group of individuals.

For these reasons, Linux in the US will likely suffer horribly over the next few months or perhaps even several years. In fact, it's doubtful that Linux will ever recover the "inevitable force" swagger that it has had over the last few months in that country. Instead, Linux will continue to grow across the rest of the world and the US will lose yet another technical and cultural advantage in the interests of supporting business above all else.

Hmm, maybe it's not so much a prediction as a fear. But I can't help but think that SCO has turned a corner on this one, not in terms of their case from an honest perspective, but in terms of the effect they're having.

Re:Things are getting worse for Linux.

[jeffy124]

However, very few people in business are going to understand this. Management are scared idiots, American management doubly so.

You seem to have duped into a stereotypical line of thinking. Most people in business are very intelligent, yet your opinion is based on the anecdotes of a select few. Likewise for lawyers. Your opinion is based on anecdotes of a few. Most managers listen to their IT people and their lawyers do research when they dont understand something. This includes finding out things like the significance of 80 lines of code in relation to the rest of the product as a whole.

Additionally, any lawyer for a company receiving one of SCO's letters saying that through their use of [some-non-SCO] Linux distro, they're violating some law and should cease usage. Any lawyer will interpret that as the equivalent of Ford telling GM car owners their cars are illegal, and they should buy Ford cars. (If you wanna know how hard it is to be a lawyer, try some sample LSAT questions.)

If it's corporation versus non-corporation, the corporation will always get the benefit of the doubt.

Not so. I dont where you got this opinion from. US Courts require evidence from the plaintiffs of a case, just as the defense has oppurtunity to refute and present counter evidence. I think you're basing your opinion on cases that get settled outside the courtroom, where the definition of the "law" can be easily ignored.

Recall the case of Victorias Secret vs. the mom-and-pop Victors Little Secret. The case was trademark related, Victorias Secret claimed VLS was hurting their profits and sales by having a similar name. I dont know what the intermediate rulings in the case were, but each hearing VLS asked evidence be presented of actual harm. The case eventually got before the Supreme Court, who ruled that in trademark cases, the victim (ie, plaintiff) must show evidence of actual harm being done.

The real problem goes beyond SCO

[NotoriousGIB]

The real problem here is that corporations will begin to understand that the open nature of the Linux (and other OS projects) leaves them subject to legal action.

If Microsoft were to steal code no one would ever know it since their codebase is proprietary. With open source projects not only is this not the case but it is entirely conceivable that dishonest individuals (lots of them these days it seems) would deliberately insert offending code and later claim intellectual property theft.

With billions of dollars at stake do you honestly think this won't happen? The better question to start asking is how can open source survive this kind of attack? Is it possible that some IP vetting process can be establish that will eliminate this possibility to the satisfaction of companies already stung by a major Linux scandal?

The whole situation sickens me and I despair for the race of man when I witness the greed of a few bringing so many good people trying to help one another and their community to their knees. There is no future for our society when injustice and corruption are protected by laws bought and paid for by the rich. Why isn't Ken Leigh in jail? If I were to break a window with my elbow and steal a TV I'd suffer more than the man responsible for billions of dollar of economic harm. :-(

It's a sad day. If you're religious it might be time to say a prayer for this country.

Re: Consider this

[Black Parrot]

> > Mensa member, beware of the high IQ

> Mensa member, beware of the large swollen head and general "I am better than you" attitude.

Mensa membership apparently doesn't require you to be smart enough to know that you shouldn't brag about your IQ in a forum with ~ half a million readers.

Re:Does Linus et al keep track of code submitters

[mce]

Second, Linus most of the time ignores code which does not come from his trusted lieutnants. They, too, do proper attribution.

Unfortunately not always. I once (years ago) submitted a (tiny) patch to Alan Cox. He achnowledged it and merged it into his AC kernels, but when it got into Linus' kernel, the attribution read: Alan. Personally, I don't care at all about that, but it does show that the logs are not 100% reliable.

If you read the article carefully...

[leonbrooks]

...all they are claiming is that they have 80 lines that contain code and identical comments. They have not stated that the code itself is identical.

This brings us back to a common coding practice: dumping the code and rewriting your own code underneath the comments. Still no data.

IMESHO the NDA is safe to sign because The SCO Group are about to become a memory, a bad dream.

Re: More like does IBM keep track of submitters...

[Black Parrot]

> SCO seems to think they'll either be able to make Linux go away or force everyone using Linux to buy an SCO license.

Or the third option - the most probable one IMO - they think they can arrange a buyout or make their stock bolt, providing the funds for a nice set of golden parachutes.

There is absolutely no way they can take IBM to court without revealing the relevant lines of code to IBM's lawyers, and at that point all the secrecy will become moot. Ergo, they are up to something that they expect to pay off before the case gets to court. Ergo, it's a golden parachute acquisition plan.

I suspect the SEC will need to look into this before its over with.

Damages vs. Claims

[Cylix]

So far they are claiming that Linux sales are hurting SCO sales. That is where the inflated 1 Billion dollar suite originates from. Loss of sales, not just royalties.

It would seem to me, they would have to demonstrate A LOT of code was stolen in critical areas to show the Linux kernel really couldn't do well without their code.

Of course, that is of course determining this is their code to begin with. Then determining where the actual code came from.

It isn't just about proving code was indeed stolen, its about proving enough code was stolen to really shake up SCO sales. Then how much sales is really attributed to performance. Microsoft has proven that making the sale isn't just about code worthiness. (Probably a bad example using a monopoly, but other companies make the sale without perfect software)

Re:That's exactly why SCO won't talk.

[dmaxwell]

Thereby depriving SCO of their revenue stream. They are trying to cast a cloud of FUD over the entire Linux and GNU codebase, to establish de facto ownership of the whole enchilada.

The instant they try it, they'll get shotgun blasted by the copyright holders of the portions of Linux they don't "own". They distributed Linux kernels for years under the GPL. Furthermore, they don't own what they didn't develop. Many of those owners will want legal relief for what SCO would steal from them. SCO is trying to commit a far larger theft than what they claim was done to them.

They can't keep what "infringes" a secret forever. Nor can they use that secret to take ownership of the kernel. Sooner or later, that secret will get out. They'll likely be forced to reveal it. At that point, the provenance of those lines will be established. What actually "infringes" at that point, you could probably count on your fingers. It won't take long to fix.

Re:Does Linus et al keep track of code submitters

[swb]

This is the kind of thing I was thinking of, where a random contributer gives something to an Alan Cox or other lieutentant of Linus and the patch gets rolled together whith a bunch of other patches into an "AC" patch and then the attribution gets muddled by Linus since he accepts the patch as a single block from Alan, with the assumption that he has written or at least vetted all the bits in it.

If what you say is true, then there is imperfect record keeping and its certainly is possible to substitute "Alan Cox" in the above paragraph for "IBM" or some other entity liable to submit a largish patch or patches where the submitter isn't necessarily the atomic entity that wrote the code.

It would also stand to reason that some plebian coder with access to the SCO source could use it as a basis for 'fixes' to the kernel and submit them through some 2nd or 3rd tier person who might submit a patch rollup to Linus who just merges it in under their name.

It would also stand to reason that the above plebian coder, anonymously submitting code, could actually be acting on a malicious basis, trying to poison the code by submitting non-original work.

What I don't get is what could have SCO have coded that Linux either did poorly or not at all, and was drop-in compatible with Linux? I would have presumed that the SCO code was architected entirely different and that perhaps there were some *algorithms* superior that those in Linux, actual code that could be copied line-by-line would have been next to impossible.

Yeah, there is:

[mindstrm]

When you are charging someone with breach of contract and possibly leaking trade secrets, you don't publish the information widely, you have it in sealed court documents.

Forget that it's SCO for a minute, and pretend it's someone with an honest theft of trade secret case...

Let's say someone stole the forumla to Coca Cola.. it was available to them under some NDA, but they breached their contract. In this case, you don't ask Coke to make it public so the world can decide if it's the same formula or not.. you seal the documents, have experts look at it, experts BOTH the prosecution and defendant accept as experts, and the case continues.

What SCO is claiming is not unlike this. Although SCO has threatened the linux world, currently it is IBM who sco has in court, and it's between IBM and SCO to decide what's fair.

What LinuxTAG did in Germany is a more appropriate response: Have sco stop sending out threatening letters and harming business unless they are going to show us some evidence.

Re:What evidence of origin,ownership,copyright + G

[mce]

Jim Stallings, the general manager of IBM Corp.'s Linux business recently stated: "I believe I am correct in saying there are no violations on any intellectual property issues [with Unix and SCO Group] and we will continue to support our Linux customers. It will be business as usual." Frankly IMO, given the quality of IBM's legal team, SCO don't stand a chance.

What I'm missing most in this entire mess, is IBM making a series of strong high profile statements that make very clear that (according to them) SCO doesn't stand a chance in court and why this is so. So far, SCO is getting all the publicity (with the one exception of Novell's claim), which is BAD. Repeat after me: "If I repeat my claim/lie often enough, it will become true/truth." SCO is, day after day, hitting the press with claims that are really damaging Linux business and its reputation in decision making circles, irrespective of whether they are true. The /. crowd is no counterweigth to that! And neither is a "business as usual" attitude by IBM.

That's it?

[GreatDave]

So we know that the 2.4 kernel has over 3.3 million lines of code. SCO says the copied code consists of 80 lines, comments included.

In CS class, my first few assignments were about 80 lines of code. And this is stuff like reading a flat file, spitting it out on the screen, writing it to another file...

Algorithms are just solutions to a problem. Remember your first IQ test? How many solutions were there to the problems there? One or two, maybe a couple more? How many ways can you solve a New York Times crossword puzzle anyway?

SCO is preying off media dullards who think 80 lines of, say, text in a book is significant. In computer science, 80 lines of code may well consist of two algorithms to solve two problems. And as for the comments being identical, how do we know the comments aren't something like:

int x; // Counter for allocating files

Maybe someone who worked on Unixware/AT&T Unix/whatever went to the same CS department at the same university as a Linux hacker and they learned to comment their variables the same way?

80 lines? Ridiculous. SCO has no case. IBM needs to get some CS professors or other experts on the stand to explain this to the court.

The issue here is contractual - not ethical

[Paul_murphy]

As I point out in my Linuxworld.com article (the one the editors here have not slashdotted - I wonder if they don't like pro sco opinions?) the issue is whether or not IBM breached the terms of the contract under which they had access to the AT&T code. I believe they did and that SCO will have an easy time proving it - and in that context lets remember that 80 lines will more than suffice for this if, in fact, their provenance can be proven in court.

On the other hand my belief is that this issue has little or nothing to do with Linux on any platform other than the IBM P, I, and Z series machines using the PowerPC architecture and thus the SMP and memory management code constributed to the AT&T code base by engineers from companies like Sun, NCR, and Motorola. Today's SuSe or Red Hat CVS may include these materials, but since they're only called with respect to compilation for IBM's non intel hardware, I predict a zero real impact on Linux.

FUD, of course, is another matter and the more people focus on the negative consequences for Linux which would arise if a fundamentally mistaken interpretation of the whole mess were correct, the worse things will get for the Linux community. So lets not help that along by spreading mis-information and conjecture. The facts will sort themselves out reasonably soon - and if I'm right Linux will come out unscathed while, if I'm wrong, delaying the rush to judgement may still help clarify the real issues.

Plebian?

[leonbrooks]

It would also stand to reason that some plebian coder with access to the SCO source could use it as a basis for 'fixes' to the kernel and submit them through some 2nd or 3rd tier person who might submit a patch rollup to Linus who just merges it in under their name.

They'd have to be an absolute bloody genius to find code that was portable UnixWare-to-Linux and pleased Linus and all of the lieutenants standing before him.

Ghandi marched to Dhandi

[Anonymous Coward]

People used to think it was right and proper to own other people. They even used the bible to justify this behaviour such was their perfidy. Now, instead of thinking they own people, they think they own ideas, just as wrong in a sense. Ghandi demonstrated how wrong this philosophy is in a spectacular way. He marched 240 miles to Dhandi, amazing rhyme that Ghandi marched to Dhandi. Well anyway, the Brits had a tax on salt, and Ghandi wanted to demonstrate how wrong that was by marching to Dhandi and distilling some salt out of the ocean.

The biggest reason windoze is a pile of crap, is because the way it works is a secret. It would not surprise me to discover, it was designed to be a pile of crap on purpose. Give people a pile of crap and pretend the next pile of crap will be less of a pile of crap. It seems to work as well.

When I think of the hours of frustration, lost work, I wasted on windoze. Then I think of the friends put off using computers by blue screen desease. Usually they think they have broken it somehow, which results in a fall in confidense. When I think of the hours wasted on the phone, trying to sort somebody out. The whole thing is just a vast and insidious con.

The idea that you can own an idea, is not that different to the idea that you can own another human being. Ideas are free really, you just have to get used to the idea. Ideas are the ocean we all drink from when we open our minds. The only difference between an alchemist and a chemist is chemists publish their results which benefits everybody.

Intellectual property is philosophical slavery, a shackle on the collective mind. There are similarities between a holy book and an operating system. Both establish protocols. The slave owners want to keep these protocols a secret knowledge.

Re:This is rediculous

[janda]

To quote...

In what world does 80 lines become a trade secret [...]

If those 80 lines of code allow you to sort information faster then your competetors, immediately.

Re:Which is why they wont release the code

[mark-t]

SCO still wants the infringing code to be in the linux kernel when they do copyright it, then infringments will occur after copyright.

Except that NOBODY has any rights to say which code cannot be removed from Linux. It's clearly evident that SCO wants terms on their code that are incompatible with the terms of the GPL (SCO cannot expect to collect license or royalty fees for GPL'd code), so their code must be removed. End of story. If SCO doesn't *want* their code to be removed, then they are choosing to comply with the terms of the GPL.

Comment removed

[account_deleted]

Comment removed based on user account deletion

this one is kinda hard to prove on either case....

[scoobywan]

I don't think this is something that can be
proven very easily. At best... you'd have to
check SCOs backups of thier source from a while ago.
I mean.... how hard is it to do a:

date --set="-3 years"
vi whatever.cc
date --set="+3 years"

This whole thing just doesn't make any sence.

It's simple...

[Angry Pixie]

SCO secretly submits its own code to the Linux kernel maintainers under the disguise of individual independant programmers, hoping that some of the code gets accepted into the kernel, and that a future lawsuit over the issue will pay off ;)

The question that comes to mind...

[Gerad]

Are these 80 continuious lines of code? Or are they 80 lines of code scattered about the thousands (millions?) of lines of code in the Linux kernel? If it's the first, I would say that SCO might actually have something resembling a case. If it's the second... *laugh*

Re:Are things really that bad?

[mark-t]

You can bet that within an hour of SCO revealing the location of this code, there will be a replacement for it out there.

The terms SCO want imposed on their code are wholeheartedly incompatible with the terms of the GPL, so their code *HAS* to be removed.

It's hard to see how SCO could claim to have been materially damaged by this.

They weren't. They're a dying company targetting a big one in the hopes of being bailed out before they go completely bankrupt.

What I don't get is that they say they're not out to destroy Linux, yet prolonging the mystery of where the code is does nothing but further damage to the reputation of Linux and its developers. SCO must have a different definition of "destroy" than most of us.

How SCO could resolve this, once and for all

[jd]

This is an Open Letter to SCO.

Dear SCO,

The current debacle over who owns what in the SCO and Linux kernels is unacceptable to the Information Technology industry as a whole. The industry fares badly in times of uncertainty, and at present, the economy is offering more uncertainty than the industry can healthily support.

I understand fully the rationale of not openly publishing the lines of code that are in question. However, given the claim that they are identical, the following method will allow SCO to demonstrate the legitamacy of its claims, without compromising on the security and integrity of its code base and Intellectual Property rights.

I urge SCO to adopt either the four steps below, OR something that is similar, so that we can move beyond the fear, uncertainty and doubt, and into the realms of peacably resolving these issues in a way that benefits all parties concerned.

As Professor Nash pointed out in his Nobel-prize winning paper on economics, competition functions best with cooperation. SCO and Linux are very different OS', with very different "ideal" markets. The overlap is small. Compete over the overlap, by all means. That is the idea of a free market. However, where no overlap exists, you risk expending resources on a sector you cannot gain.

I therefore urge you to fight as hard as you can, where such a fight means something, but you know computer history well enough to know the fate of many companies who steered the course of pyrric victories. IBM and Apple both got burned badly from such policies, to the point where nobody could be sure of the future of either. Understand the economic and political implications of Professor Nash's work, before pursuing a policy that, historically, has proved treacherous to all sides concerned.

As mentioned earlier, there are four simple steps SCO can do, which protect its Intellectual Property, yet prove its case beyond any reasonable doubt. These steps are as follows:

• 1) Compile the Linux kernel and the SCO kernel under the same compiler, with the same options (in this case, you'd want maximum debug).
  
• 2) Put these two binaries on a website, such that you can extract a given string of N bytes, starting at position P into the binaries.
  
• 3) To avoid revealing this mysterious trade secret stuff, show the MD-5 and SHA-1 hashes of those strings. If they are, indeed, identical, then SCO may have a case.
  
• 4) If SCO has found such alleged chunks, they can supply the relevent N and P values for the binaries, to prove their case. If they CANNOT publicly supply such N and P values, even with all of the protections I've outlined to secure the code from being examined, then their case is more likely based on examining common abstract data types, common implementation techniques, or the implementation of a unique solution to a given specific problem.
  

The point of the above "proof" is that SCO -could- win in the public opinion arena, by using a method of this kind, IF it has a case.

If there are lots of (N, P) clusters, close together (ie: evidence of a similar function, using identical operations in an identical way, with identical symbol names, etc), then the Linux and IBM crowds would probably respect that and work to resolve this issue peacably, recognising that code from SCO does indeed appear to be in there.

If, however, you have very scattered (N, P) blocks, with a very random distribution, you're much more likely to be looking at simple reuse of a common ADT, or the solving of specific problems with a unique implementable solution. When something is absolutely unique - there is only one algorithm, or block of code which can perform the task - then it is restraint of trade to attempt to own that unique method. Patents, etc, rely on the premise that alternatives, and thus competition, exist, and that you are merely protecting YOUR alternative, not denying others the right to compete.

(This is one reason I think the patent system is seriously messed up. The case for a patent should be proven prior to patenting, as not all competitors are in a position to launch a serious challange to the lawfulness - either in letter or in spirit - of the patent.)

The code

[dtfinch]

I have a feeling that SCO will never state to the public which of their code made it into Linux. Instead, they'll just try to prove it in court so that they can demand that all the linux distributors pay license fees. Since they won't know what code is SCO's, they won't be able to remove it to avoid the fees. If anyone does say which code is SCO's, they'll face charges of copyright violation.

Even if they don't get their billion they'll still try to get those license fees. But I'm certain that they'll be counter sued for multiple GPL violations. They can't force their code to remain in Linux yet disagree to the GPL, which is what they appear to want to do.

So What?

[Tuckdogg]

Let's assume that SCO is right. Assume that the 80 lines of code from the kernal are from Unix, copied line by line. That doesn't prove their case. In order to win, they have to prove copying and that IBM did it. If they can't show that IBM is the company that copied the code, they aren't entitled to jack at trial. And I seem to remember a certain company called Caldera (you may know them better as SCO now) bragging to no end about how they were going to merge Unix and Linux into a single product. If you don't think IBM is going to harp on that like crazy at trial, then you obviously aren't paying attention.

The Final Straw to me

[LuiWoh]

Over the years I have gone back and forth. Running Linux (RedHat, Slackware, Debian) and Windows (95,98 XP Pro) Sometimes a dual boot system, other times just Windows, other times just Linux. I, like the rest of you, have read and followed the SCO situation and today... Yes today... decided I will never use a proprietary OS again. This case is so stupid to me it is amazing. How about as a society we move forward instead of backwards? It is just about money, isn't it? Free as in Beer or Free as in cash? I, today am choosing Free. You decide what one.

Re:Are things really that bad?

[isorox]

1) Did the code indeed come from UNIX to Linux and not from some other common source such as BSD - or from Linux to UNIX. Given the lack of version control in early versions of UNIX, it's going to be hard to show *where* it came from.

What if it went from UNIX to BSD to Linux. Obviously the first jump is copyright infringment, but if it goes BSD -> Linux, thats fine according to the BSD license. Would it be the same as buying stolen property? Would you just have to give it back (remove the offending lines)?

A single point in time proves nothing.

[fireman sam]

I can take 80 lines of code from the Linux Kernel and dump it into my Good Thing(TM) Kernel. The start jumping up and down saying "Linus stole my code". Show the two pieces and have the experts saying "the evidence looks damning".

What we need is the codes history. From both sides we need:

1. who created the code (ie checked in)
2. When was the code created.

The winner will simply be the codebase who had it first.

Re:Use SCO's Bandwidth

[stor]

OK I think you're just joking and sorry to be a party pooper but resorting to dirty stuff like that doesn't seem like such a great idea.

We'll be best off coming out of this ordeal with the perception of being law-abiding adults rather than petty, angry rebels.

Cheers
Stor