Embedded Device Manufacturers Ignoring GPL

swillden writes "Iain Barker and some other Linux Kernel Mailing List readers have discovered that several manufacturers of DVD players based on the Sigma Designs EM8500 chipset are distributing Linux, both in the devices and as binary-only firmware upgrades, but not providing source. Apparently, Sigma Designs provides its customers with a copy of the kernel as part of a chipset SDK, and those customers are making and selling devices without complying with the terms of the GPL. It's not clear if this is because Sigma didn't tell its customers about the GPL and their obligations, or if they're all ignoring it on their own. Maybe they've all bought licenses from SCO and therefore don't have to comply with the GPL? The LKML post contains a list of some of the infringers."

Comments

Keep this within reason, please.

[Masque]

If I have to pay an extra USD$25 in shipping when I replace my DVD player because it comes with the kernel source printed out, I'm going to be seriously pissed.

Re:Keep this within reason, please.

[justsomebody]

I guess you don't understand or you're joking.

I don't know now, but there were the times when I wanted to use my Sigma DVD card under Linux. And they provide shit. The least to comply with GPL would be releasing the drivers for their cards for Linux.

Re:Keep this within reason, please.

[Pius II.]

Nope, the GPL says "offer [...] to give any third party [...] a complete machine-readable copy of the corresponding source code". That could for example be a little slip of paper, saying "You can download the Linux kernel source at $company_url".
There's normally already lots of little slips inside a generic DVD player package, saying things like "If you can read this, your warranty is void" and other stuff, so one more shouldn't bring the cost up by too much.

Re:Keep this within reason, please.

[shepd]

>... Then wouldn't a scanner with OCR software be considered a machine??

0n, ye5 l an 5une 1L w0u1d oe c0n51dened o na(n1me!

Re:Have they hacked the kernel?

[EvanED]

*Takes bait*

It doesn't matter if you don't modify the kernel; if you distribute it, you must provide source.

Re:How do they know the GPL is being violated?

[Bruce Perens]

You have to distribute source whether or not it's a derivative work.

Bruce

Re:Have they hacked the kernel?

[Bruce Perens]

This has nothing to do with zeal. Just following the rules of the license. If the source is not distributed with the product, or made available from the entity distributing the binary for a period of three years after the binary is distributed, you're not complying with the license and have no right to distribute the software.

Lots of people ask for tons of money for a privilege we let people have without charge. The least they can do is comply with the terms of the license.Bruce

Re:time to prove GPL's right in court

[3Suns]

No reason to wait... This kind of thing has happened many times before. You send 'em a "comply or desist" letter, which should weed out all those infringing due to ignorance. So far, all GPL infringment cases have been settled out of court, which is why everybody's saying it's "untested in court". In reality, no lawyer in their right mind would actually try to fight the GPL. It's not like this issue's never come up before.

No doubt the OEMs have not been told

[Bruce Perens]

There have been a lot of cases of far-east engineering firms including GPL code in products, and selling those products to other companies that are not made aware of the licenses they have to comply with.

Cisco got trapped this way, too. And they can turn around and sue those far-east folks, if it's worth their time.

I am an expert witness in one such case.

Bruce

Re:No doubt the OEMs have not been told

[Bruce Perens]

I think it would be much more dangerous if the product you purchased contained an unlicensed copy of Windows CE. MS sues for real money.

Bruce

Re:No doubt the OEMs have not been told

[Bruce Perens]

Actually, my personal agenda comes into these cases less than you might think. Before I get to talk, the witnesses are all deposed. Then I read the depositions. Then I get to sum up to the judge what went wrong, who was responsible, and what it should cost. The other expert does the same, and the judge decides who is more convincing.

I can't lie under oath. And I have to deal with discovery - the fact that the court can force me to give my opinion whether it is to the customer's advantage or not.

So, when I think my testimony would damage them, I have once or twice told a customer - you don't want me to work on this any longer, and you don't want to know why. And they know not to probe farther.

Thanks

Bruce

Re:time to prove GPL's right in court

[Bruce Perens]

The big difference is that the people who are violating the GPL are distributing the GPL code in a product. When you redistribute or sell the code, you have a different set of obligations than a user. The GPL allows the end-user to do almost anything.

Bruce

Define distribution

[fireteller2]

[snip from GPL]

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.

b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)

[end snip]

So does this then mean that if I install Linux on my computer, and then sell or give my computer away I must provide extensive notification of the Linux installation? Including documentation at each place I may have edited the code, and some form of the Linux kernel source in cases were I do not have the kernel source installed?

I can see how distributing firmware upgrades constitutes distributing software, and is thus firmly within the preview of the GPL. However, I'm having a harder time understanding how imbedded hardware applications constitutes a software distribution. If the hardware running the GPLd software can not under normal operation be accessed by an end user does it still constitute software distribution? The manufacturer does seem to be getting some benefit from the use of the GPLd software. However, if I use an online service that uses a modified Linux on internal hardware are they required also to provide me with their source? Where is the line? That the hardware is physically in my possession? What if I rent or lease equipment? This seems like a very slippery slope for the proliferation of GPLd software.

I'm not proposing an opinion I'm just curious what the /. opinion is on this.

Re:Define distribution

[Bruce Perens]

Well, what happens when you sell or give away a computer with Windows? At the very least, you should give the person those pages with the holograms and activation passwords, and the licenses. Oh, but some of those licenses don't permit resale! So you have to remove the software before you sell the computer.

In the case of a computer with Linux, if you give it away you fall under 3(c) of the GPL, and only have to pass on the source-code offers that were given you. If you sell it, you fall under 3(a) and 3(b), so you either distribute the source code with the computer or make an offer to do so valid for 3 years.

Me, I'd wipe the disk, put on a fresh install, and give the buyer the CD set.

Bruce

Re:Define distribution

[seanadams.com]

P.S. - I'm not a big GPL supporter, The BSD License is more commercially acceptable.

You can be a fan of whatever you want, of course, but that's not a reasonable justification.

What's commercially acceptable about software that doesn't exist? The reason so much GPL software exists is because developers like the license. Not being a fan of the GPL because it doesn't allow businesses to get free code without so much as having to share their changes is pretty weak stance IMHO.

Re:How do they know the GPL is being violated?

[Anonymous Coward]

exactly.

the more maddening part is that Sigma is so violently anti-open source that they flat our refuse to release code to use their em8500 chipset. we had to reverse engineer the em8300 and 8400 chipset but so fgar we have discovered that they intentionally changed things to be radically different from the 8400 to thwart open source driver efforts. and all communication with the company about information has resulted in hostility towards a open linux driver.

Yes they have a binary driver available. it is completely a useless piece of junk.

Sigma designs is a hostile company. their attitude towards open source and linux in general is appaling enough, this is another stab in the back of every OSS developer.

Re:How do they know the GPL is being violated?

[Weaselmancer]

I think his terminology was incorrect. I think what he was saying is that it's a stock linux kernel with non-GPL'd kernel drivers.

Yes, that's exactly what I had in mind - thanks. Take a stock kernel, write your own drivers specific to your widget, and release a binary.

In this case the kernel would be GPL, but stock. You can get it anywhere. Your drivers would be non-GPL. They're your own business. Aren't they?

I'm asking because I work in the embedded field, and recently talked my engineering team into Linux for our next target. And this is the development path we intend to follow. We aren't modifying anything, we're using stock kernels and adding our drivers in.

I hope Bruce keeps reading this thread. I'm not trolling - honest! I'd really like to not wind up on "the list".

Weaselmancer

Re:time to prove GPL's right in court

[zulux]

why can't you just ignore the GPL?

As a user... you can ignore the GPL. You can use the software as you see fit.

As a distributer of GPL'ed software - you have to get permission from the copyright holder to copy the software, or, if you'd like, follow the terms of the GPL.

With an EULA, you have to get permission from the copyright holder to copy the software. (Fat chance). Or.... nothing. EULA's don't give you permission to copy software at all.

At Lest Kiss Technology...

[cacepi]

Is in compliance, or at least appear to be.

Re:At Lest Kiss Technology...

[swillden]

Is in compliance, or at least appear to be.

Maybe. That zip file contains a kernel and busybox, but it doesn't look like it contains any drivers for the EM8500 DVD Decoder, which means that if you built the source and loaded it into your KISS player, it would no longer play DVDs. It also includes a binary, "linux.bin", which appears to be the actual kernel binary, but it's not clear if that contains the EM8500 driver binaries.

Whether or not they can exclude that driver (and potentially other parts of the software as well) without violating the GPL is hard to say. If it's a purely userspace driver, they're fine. If it's a kernel module... thing get much stickier. Linux has a history of tolerating binary-only kernel modules, but that only holds under certain assumptions, which may not be met here.

Re:How do they know the GPL is being violated?

[Bruce Perens]

And by the way, if you don't distribute the source with the product, you must include a written offer with the product, valid for 3 years, to distribute the source to anyone who asks. If that product doesn't come with source and doesn't come with that offer, they are in violation right now.

Bruce

Re:How do they know the GPL is being violated?

[whoever57]

The GPL doesn't state that distributors have to supply source with all products, only that it is supplied on request.

To comply fully with the GPL you have to offer the source code. The GPL is quite explicit about this: when you distribute a binary, you have to tell people how they can get the source code and the offer has to accompany the binary distribution.

Hold the phone.

[FreeLinux]

While I am sure that there are numerous manufacturers out there that are blatantly violating the GPL in their use and distribution of Linux, that may not be the case with these manufacturers.

The GPL states that those that distribute GPLed software must provide the source to the recipients of the distributions upon request. That does NOT mean that they have to make the source available on their website. It means that people you receive the ditribution, in the form of the DVD player, must receive the source upon request. No one else is entitled to the source, only those that have received the distribution. It is even legal for them to refuse requests for the source from those who have not been distributed to, as in people who do not own the DVD players. This strict interpretation breaks down when these manufacturers make the software freely downloadable from their website in the form of firmware upgrades but, even in this case, the GPL does not require the distributor to make the source available on the website. They can still require formal requests before providiing the source.

Now, what the LKML does not say is, if the people concerned have made a formal request or not. It states that they examined the web site but there is no requirement for the DVD manucaturer to post the source on their website.

Like I said in the begining, they may be in violation of the GPL but there is insufficient evidence in the LKML posting to prove that. Remember that it is only a courtesy when distibutors make the sources available to all on their website. The GPL does not require them to do so at any time.

Free DVD players?

[pair-a-noyd]

If SCO is selling embedded licenses for $29 per device and the DVD manufacturers are RETAILING them for $29 at Wally World then they must be giving them away for free.

When you consider all the middle men and middle-middle men that handle the unit from assembly line in China to the isle pallet at wally world, each handler marking up the unit 100%, or at the very least, 50%, (and figure in shipping costs too!) the cost to produce a DVD player is most likely in the less than $1 per unit range. And if they paid the SCO scam of $29 per unit, they would be losing a LOT of money real fast.

It's in their best profit-interest to ignore the GPL and do what ever the hell they want. If they get sued they can fold shop, change name/address and be back to cranking out new players the next day.

Welcome to the wonderful game of "global greed"

Re:Sigma is not to blame here.

[Bruce Perens]

In my experience, the most likely reason for this happening is the engineering firms desire to do everythig cheaply, and they have their managers interpret the license rather than hiring an attorney to do it. The manager says something like "this is an embedded device, so this source-code requirement must not apply". Obviously, the pay lawyers and expert witnesses much more later in exchange for what they saved by not hiring a lawyer to advise them about the license.

Bruce

LiteOn Phomaster LVD2001 DVD Player

[acousticiris]

I purchased this DVD player late last summer and discovered the Linux kernel present on the upgrade BIOS disc.

This is the response I got from them:
----
From: DCTW_Service@liteonit.com
Subject: Re: Request for GPL Code
Dear Sir,

Sorry at the present, we don't provide the source code.
Thanks for your understanding.

Best Regards!
----
Of course, my understanding isn't important. The copyright owner's understanding is what matters.
I decided to e-mail the folks at the FSF for a follow up. I assumed that was the place to go, though I admit even today, that I'm not exactly sure sometimes.
Here was the response from them:
----
From: license-violation@fsf.org Subject: [gnu.org #114549] Linux GPL Code Violation - LiteOn Phomaster LVD-2001
For some reason, your mail never reached my inbox (indeed, the web interface to our RequestTracker seems to be having a bit of a hard time with it too). So, sorry for the late response.

We've already seen a few violations which look to be the same product as this under different packaging. We will add LiteOn to the list of people to write to about this. Thanks for the report.

--
-Dave "Novalis" Turner
GPL Compliance Engineer
Free Software Foundation
----
The whole process was really quite daunting from my perspective. It is my understanding that the Linux Kernel is not a GNU product (though much of the software in a typical linux distrubtion is). Being a linux/GPL/FSF/GNU newbie, it took me quite a bit of time to hunt down a place to submit my complaint. Does anybody know of a database of copyright owners who use the GPL, and more importantly a convenient location for notifying said individuals when a breach is found or suspected? Even the FSF site didn't have a spot that was blaringly obvious to someone who had never visited the site before for reporting GPL violations of their software.
I will say, its nice to see some attention being payed to this with regard to my DVD player. Not to advertise for the theifs, but its a great player...the new BIOS even allows one to play ogg encoded files written to a DVD or CF card. I'm interested, obviously, in getting my hands on the code and potentially flashing the BIOS with my own handy-work...maybe see if I can get the thing to take a hard drive or wireless network adapter in its PC card slot.

Re:time to prove GPL's right in court

[swillden]

The GPL is anti-business because it seeks to undermine traditional business models (by reducing the cost of software to $0) while thwarting alternative business cases

Sure, the GPL is antithetical to traditional software businesses, but GPL software is also tremendously useful to lots of other businesses. Lots *more* businesses, in fact.

Sure there are plenty of /. pontificators who sit around on their couch proposing alternative business models, but 90% of those wouldn't pass the laugh test at a corporate board meeting.

Here's one, see if it passes the "laugh test": A company is in the business of producing computer-animated films. It can buy high-end hardware that runs expensive software which may not always do exactly what it needs, or it can grab GPL'd software, modify it as needed and run it on commodity hardware.

Now, which type of software better serves this business?

Or, how about this one: A company is in the business of selling powerful computers, high-end proprietary software products and professional services to integrate the software and hardware and make it meet business needs. This company can develop its own proprietary operating system(s), incurring huge costs that really only serve to support the hardware and services businesses, or the company can grab GPL'd software, port it to the company's hardware, port the software to it and train the company's services professional on it. The services professionals can then score additional points with their clients by pointing out that the clients are not locked into said company.

I'm sure you recognize this company.

The GPL is about making software available to users and keeping the software from being locked up and controlled. Many users, in business and not, appreciate this.

You can try to argue that this destroys software companies which will ultimately destroy software development, etc., etc., but that's crap. As long as there are people willing to give their work away for free, there's no market for competition to that work. In markets where the free stuff doesn't exist there are opportunities to sell proprietary software.

At the end of the day, this may very well slow the development of commercial software because it increases the risk that the investment will not show a return. I'm convinced that this slowdown will be more than offset by the fact that so much code is available for experimentation and enhancement by anyone, not just by the developers at one company.