Slashdot Mirror
Linksys and the GPL, Again
Rob Flickenger writes "While poking around on the Linksys WRT54G (one of the new Linux 2.4.5 based APs) at a SeattleWireless Hack Night session, we noticed a number of binaries in their firmware (including Zebra, PPP 2.4.1, and iptables to name three) that are released under the GPL, some of which are obviously modified. The question is, where is the source code to Linksys' modifications? Their "GPL Code Center" has the packages, but they are the pristine distributions, without any changes whatsoever. I've asked Linksys for clarification, but given Linksys' customer service reputation, I highly encourage other interested parties to ask them as well. More details are up on my weblog on oreillynet.com."
For those who have not read the linked weblog entry, here are the reasons he believes it to be a GPL violation:
1) "One perfect example of this is Zebra, the advanced dynamic routing software package. By opening the firmware file directly, as well as by making queries through the makeshift ping interface mentioned earlier, we noticed that the zebra running on the WRT54G doesn't use the standard configuration file locations. This means that it must certainly be a modified binary." He also mentions that Linksys seems to have used a modified GCC to compile their software, "with a signature string of "GCC: (GNU) 3.0 20010422 (prerelease) with bcm4710a0 modifications"). That bcm4710 refers to the Broadcom chipset that this AP is actually made from."
2) Yes, the author DID email Linksys asking for the source code. You can read that message here. According to the update at the bottom of the weblog entry, he got a response shortly before midnight on 29 July, but it just said that the issue was being directed to second level support.
Please understand that zebra uses autoconf, the released source has a configure script which allows --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc]. This does not change the source.
i really dont think they do; read your GPL, if you release binary code, you have to supply a means of getting the source code. but to hit your argument at the base... the fact is, they don't even need to provide binaries for the modified gcc. it is being used "in house" and there is therefore no need to redistribute the changes. (remember, gcc is not provided to the end user in the router firmware)
Did they release the modified GCC? Somehow I doubt they put gcc on the access point. Since they did not release the binary, they don't need to release the source.
If it was LinkSys who modified GCC and used it as their own compiler (and did not distribute it), then now, they do not need to release the source.
However, the authors speculation was that it was Broadcom who modified GCC to produce code for their own chip, the BCM4710. If Broadcom was distributing the modified compiler as part of an SDK to third-party developers using the chip, then Broadcom would have to release their changes.
-- Fighting mediocrity one bad post at a time.
You are mistaken about this.
You can charge what you will for verbatim (un-modified) copies of the source. but if you sell someone the binary, the source must either accompany the binary, or be offered "for a charge no more than your cost of physically performing source distribution".
What this means is that if I haven't purchased the binary (inside the router) I can't demand they give me the source. I have to negotiate for it; they can demand any price they want. But once I've bought the router, I can demand the source for the binaries. This effectively limits the amount they can charge for the source to the amount they can charge for the binary.
See Section 3 of the GPL (http://www.gnu.org/licenses/gpl.txt) Version 2, June 1991:
The thing about things we don't know is we often don't know we don't know them.
Their modified GCC is not 'normally distributed with the major components of the operating system'. So according to this clause it needs to be distributed (in source or binary form). But, since GCC is under the GPL the source of the modified GCC must be released.
QED.
Download the firmware updated, dd the right section, mount it cramfs.
Look at the busybox binary.
run strings on it.
There is at least 1 error message that isn't in standard busybox. That is a surefire sign that they made a modification to it.
As for zebra, I heavily suspect it's the same deal.
Did you not read the submitter's comments? The code there is the original source of those packages, not the modified code Linksys uses.
>are you talking about the bsd license? do you see this happening with bsd?
If you don't see it, it is probably because the commercial forks aren't called BSD anymore.
Windows notoriously used BSD networking code. Do you suppose the Microsofties contributed their changes back to the code base? So far as we know, no one has forked and closed an entire *BSD distribution, but I would imagine that most of the basics of them have been forked and closed multiple times.
I suppose that you could say that shows that the protections of the GPL are overkill; after all, the *BSD's are surviving quite nicely. You could also say that the GPL gives us tools to prevent anti-social behaviour, and that those tools are being applied to Linksys.
See what I've been reading.
This is a violation of the GPL, see my post.
Under GPL, you basically have your hands tied. You can't legally modify and use the code withouth submitting them back, and you can't really submit back the changes because they are usually hacks to get it to work how you want (not "improvements" on the code).
What the hell are you talking about? The original maintainers don't have to accept your patches in order for you to be able to distribute binaries. Just make whatever changes you want, no matter how trivial, and then make sure to distribute the source right alongside the binaries (have a link to the source on the same page that links to the binaries, or put the source and binaries on the same CD, etc). You don't have to care what the original author thinks about the changes you've made. You just have to distribute the source.
Better yet, if the changes you're making are for "internal use only", then you don't even have to distribute the source, simply because you're not distributing binaries (you don't see Google/Amazon/whatever falling over itself to give you it's source code, do you?).
You may realize this, but I'll cover it before someone gets confused - the source does not have to be made available to "anybody who asks." It must be made available to those who receive a binary distribution of the software. Quite a bit of difference there.
OK first off remember Linksys realy dosent make very much of anything it got these AP's internals from Broadcom. Had a bunch of SDK warriors put there logo on everything and called it there so did a few other companies. They were told it had GPLed software so they released the GPLed software not nessicarily knowing if broadcom changed it or not realy it's broadcom that people should be putting preasure on about complying with the GPL section 3.
No sir I dont like it.
The only people they would have to release the source to is LinkSys, unless they distribute this modified version of GCC to others.