Slashdot Mirror
Linksys and the GPL, Again
Rob Flickenger writes "While poking around on the Linksys WRT54G (one of the new Linux 2.4.5 based APs) at a SeattleWireless Hack Night session, we noticed a number of binaries in their firmware (including Zebra, PPP 2.4.1, and iptables to name three) that are released under the GPL, some of which are obviously modified. The question is, where is the source code to Linksys' modifications? Their "GPL Code Center" has the packages, but they are the pristine distributions, without any changes whatsoever. I've asked Linksys for clarification, but given Linksys' customer service reputation, I highly encourage other interested parties to ask them as well. More details are up on my weblog on oreillynet.com."
Absolutly not, but you do have to make it available upon request.
Finkployd
...not the 2.4 series. They are using an *older* kernel, not a newer one.
The GPL doesn't say how the source must be distributed if you distribute a program. It must simply be available.
Charging fees for it is possible and within the GPL restrictions, too, so even if source is made available, it may not be free as in beer.
For those who have not read the linked weblog entry, here are the reasons he believes it to be a GPL violation:
1) "One perfect example of this is Zebra, the advanced dynamic routing software package. By opening the firmware file directly, as well as by making queries through the makeshift ping interface mentioned earlier, we noticed that the zebra running on the WRT54G doesn't use the standard configuration file locations. This means that it must certainly be a modified binary." He also mentions that Linksys seems to have used a modified GCC to compile their software, "with a signature string of "GCC: (GNU) 3.0 20010422 (prerelease) with bcm4710a0 modifications"). That bcm4710 refers to the Broadcom chipset that this AP is actually made from."
2) Yes, the author DID email Linksys asking for the source code. You can read that message here. According to the update at the bottom of the weblog entry, he got a response shortly before midnight on 29 July, but it just said that the issue was being directed to second level support.
Please understand that zebra uses autoconf, the released source has a configure script which allows --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc]. This does not change the source.
i really dont think they do; read your GPL, if you release binary code, you have to supply a means of getting the source code. but to hit your argument at the base... the fact is, they don't even need to provide binaries for the modified gcc. it is being used "in house" and there is therefore no need to redistribute the changes. (remember, gcc is not provided to the end user in the router firmware)
Look it up. You have to distribute machine-readable source for free (less duplication and media costs, if any) to anybody who asks for it.
The GPL is very specific.
Did they release the modified GCC? Somehow I doubt they put gcc on the access point. Since they did not release the binary, they don't need to release the source.
If it was LinkSys who modified GCC and used it as their own compiler (and did not distribute it), then now, they do not need to release the source.
However, the authors speculation was that it was Broadcom who modified GCC to produce code for their own chip, the BCM4710. If Broadcom was distributing the modified compiler as part of an SDK to third-party developers using the chip, then Broadcom would have to release their changes.
-- Fighting mediocrity one bad post at a time.
Well, from the horse's mouth:
from http://www.gnu.org/licenses/gpl-faq.html
------
Does the GPL require that source code of modified versions be posted to the public?
The GPL does not require you to release your modified version. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.
But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.
Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.
--------
So, if Linksys did modify the software, they (for the most part) must release the source. If they didn't modify it, and only messed w/ configuration files, then they should be good.
DRINK DUFF (responsibly) DRINK DUFF (responsibly) DRINK DUFF
Nonsense. Copyright law is making it illegal for me to modify and distribute software without releasing the source. In other words, copyright law is forcing me to release the source.
Not true. Copyright law prohibits you from distributing the software at all (binary or source), even if you don't modify the source.
The GPL allows you to copy things you would not normally be allowed to copy under copyright law.
So?
So it speaks to your misconception about copyright law. It's only the GPL in this case that's letting you distribute at all, with the proviso that you also make the source available.
You are mistaken about this.
You can charge what you will for verbatim (un-modified) copies of the source. but if you sell someone the binary, the source must either accompany the binary, or be offered "for a charge no more than your cost of physically performing source distribution".
What this means is that if I haven't purchased the binary (inside the router) I can't demand they give me the source. I have to negotiate for it; they can demand any price they want. But once I've bought the router, I can demand the source for the binaries. This effectively limits the amount they can charge for the source to the amount they can charge for the binary.
See Section 3 of the GPL (http://www.gnu.org/licenses/gpl.txt) Version 2, June 1991:
The thing about things we don't know is we often don't know we don't know them.
Their modified GCC is not 'normally distributed with the major components of the operating system'. So according to this clause it needs to be distributed (in source or binary form). But, since GCC is under the GPL the source of the modified GCC must be released.
QED.
Download the firmware updated, dd the right section, mount it cramfs.
Look at the busybox binary.
run strings on it.
There is at least 1 error message that isn't in standard busybox. That is a surefire sign that they made a modification to it.
As for zebra, I heavily suspect it's the same deal.
Did you not read the submitter's comments? The code there is the original source of those packages, not the modified code Linksys uses.
>are you talking about the bsd license? do you see this happening with bsd?
If you don't see it, it is probably because the commercial forks aren't called BSD anymore.
Windows notoriously used BSD networking code. Do you suppose the Microsofties contributed their changes back to the code base? So far as we know, no one has forked and closed an entire *BSD distribution, but I would imagine that most of the basics of them have been forked and closed multiple times.
I suppose that you could say that shows that the protections of the GPL are overkill; after all, the *BSD's are surviving quite nicely. You could also say that the GPL gives us tools to prevent anti-social behaviour, and that those tools are being applied to Linksys.
See what I've been reading.
This is a violation of the GPL, see my post.
Under GPL, you basically have your hands tied. You can't legally modify and use the code withouth submitting them back, and you can't really submit back the changes because they are usually hacks to get it to work how you want (not "improvements" on the code).
What the hell are you talking about? The original maintainers don't have to accept your patches in order for you to be able to distribute binaries. Just make whatever changes you want, no matter how trivial, and then make sure to distribute the source right alongside the binaries (have a link to the source on the same page that links to the binaries, or put the source and binaries on the same CD, etc). You don't have to care what the original author thinks about the changes you've made. You just have to distribute the source.
Better yet, if the changes you're making are for "internal use only", then you don't even have to distribute the source, simply because you're not distributing binaries (you don't see Google/Amazon/whatever falling over itself to give you it's source code, do you?).
The GPL has no effect if you do not distribute the software. The GPL does not cover the output of the program. Therefore a modified but undistributed GCC does not require them to give you the source.
The source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.
The only way I could see that falling under the GPL is if their source is essentially useless because only their unreleased compiler can compile it, to the extent that you couldn't change the code to work with an available compiler. Sounds pretty weak to me.
You may realize this, but I'll cover it before someone gets confused - the source does not have to be made available to "anybody who asks." It must be made available to those who receive a binary distribution of the software. Quite a bit of difference there.
OK first off remember Linksys realy dosent make very much of anything it got these AP's internals from Broadcom. Had a bunch of SDK warriors put there logo on everything and called it there so did a few other companies. They were told it had GPLed software so they released the GPLed software not nessicarily knowing if broadcom changed it or not realy it's broadcom that people should be putting preasure on about complying with the GPL section 3.
No sir I dont like it.
License is automatically revoked due to non-compliance. Therefore copyrighted works are being distributed without a license.
ergo - this is a copyright violation.
*Assuming of course that the GPL version of Zebra has indeed been used, and not the commmercial licensed version.
Basically you are saying this:
If I modify a GPL project so that it contains my none-standard code that can only be compiled by a modified version of gcc I am not distributing, am I in compliance with the GPL as long as I distribute my none-standard modified code?
The GPL states that:
The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
This limits the obfuscation tactics drastically since you must be distributing code you work on itself. Ultimately, you might be able to produce a system whereby the code you write is only understandable by your special compiler, but it will still be code that will be human-readable and follow a flow of programming logic.
This tactic will annoy people at large, but won't prevent the smart people from reproducing exactly what your code is doing... which will make the effort described rather pointless. Because, after all, if you are trying to do something worthwhile enough to expend the effort to do that code trickery, there will be smart people interested in seeing what you are doing. Also, since gcc itself is GPLed, you'll have to be making an error-free compiler all-by-yourself.
And, in the end, all of that so you can circumvent the intents of the author who was gracious enough to let you use their software for free.
Do not spread "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0" over the internet, thank you.
The only people they would have to release the source to is LinkSys, unless they distribute this modified version of GCC to others.
Here is a copy of their license from one of the source files:
Then, I respectfully stand corrected.
I've heard many people say this, and it always throws me. The GPL is not law; I don't understand how it would need to be "tested in court". As I understood it, the GPL is a private agreement which all parties agree to for mutual benefit. If a court were to find it unenforcable, it would not mean that (in this example) LinkSys would be free to use the code without distributing the source, but rather that LinkSys would no longer have a license to use the code. Short of finding copyright law itself (which HAS been tested in court) unenforcable, I can't imagine how court could find the GPL eggregious enough to warrant an illegal infringment of anyone's inalienable rights.
The thing about things we don't know is we often don't know we don't know them.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
See up there where it says "3rd party" Thats us dumbass, If so much as one person outside of the "Broadcom entity" has the program...