Slashdot Mirror


GPL 3 May Require Websites to Relinquish Code

Vicissidude writes "At present, companies that distribute GPL-licensed software must make the source code publicly available, including any modifications they've made. Though the rule covers many businesses that use GPL-licensed software for commercial ends, it doesn't cover Web companies that use such software to offer their services through the Web, as they're not actually distributing the software. GPL 3, the next version of the free software license, a draft of which is expected to be released in early 2006, may close this loophole, GPL author and Free Software Foundation head Richard Stallman said in an interview."

27 of 574 comments (clear)

  1. Not really by dtfinch · · Score: 4, Informative

    If they want to stick with their own GPL2 fork, they can still keep it locked up.

    1. Re:Not really by Richard_at_work · · Score: 3, Informative

      I think that this is only the case if you are the developer of the original open source application.

      No, so long as you take the fork from the codebase before the license change, you get the origional license. This is exactly what recently happened with Xfree and Xorg - the license changed to one that people didnt like, so a fork was made of the last known codebase with the acceptable license and further developments have been done on that, becoming the dominent fork.

      What worries me personally about this amendment to the GPL is that it ceases to be a distribution license only and adds in limitations as to what you can change in the source code. The Gnu Documentation License tried doing this with invariant sections and this was declared to be nonfree by many linux distributions who then refused to carry those documents.

  2. Re:Huge Security Issue! by Ziviyr · · Score: 2, Informative

    Should be able to safely call md5sum and pipe in the results.

    --

    Someone set us up the bomb, so shine we are!
  3. FUD + Dupe = Congrats by Knome_fan · · Score: 4, Informative

    The zdnet article is just a rehash of the onlamp interview with Stallman that has recently been on /.:
    http://www.onlamp.com/pub/a/onlamp/2005/09/22/gpl3 .html
    http://developers.slashdot.org/article.pl?sid=05/0 9/24/1325214&tid=117&tid=156

    Needless to say that you should read the actual interview, as things are a bit more complex than what the /. blurb to this story or the zdnet article want to make you believe.

    Well done /.

    1. Re:FUD + Dupe = Congrats by aussie_a · · Score: 4, Informative
      For the exact quote:
      Some companies, such as Google, use code covered by GPL to offer their services through the Web. Do you plan to extend GPL 3 copyleft to request code publication in this case too, considering this behavior like a product distribution? Running a program in a public server is not distribution; it is public use. We're looking at an approach where programs used in this way will have to include a command for the user to download the source for the version that is running. But this will not apply to all GPL-covered programs, only to programs that already contain such a command. Thus, this change would have no effect on existing software, but developers could activate it in the future. This is only a tentative plan, because we have not finished studying the matter to be sure it will work.
      Thanks a lot /. for the FUD. You sure fooled me. However I do have one question: If I edit the code that has such a "command", do I have to edit the command so it displays my derivative version of the code? Or is it fine for the command to merely publish the older version?
  4. Stallman's approach by putko · · Score: 2, Informative

    I like how Stallman and Theo De Raadt both have incrmental approaches. Continually chipping away.

    E.g. here's some of the latest on OpenBSD and RAID:

    "Take Adaptec for instance. Before the 3.7 release we disabled support for the aac(4) Adaptec RAID driver because negotiations with the Adaptec had failed. They refused to give us documentation."

    and

    "But having been ignored for so long by these vendors, it is not clear when (if ever) we will get around to writing that support for Adaptec RAID controllers now. And Adaptec has gone and bought ICP Vortex, which may mean we can never get documentation for the gdt(4) controllers. The "Open Source Friendly liar" IBM owns Mylex, and Mylex has told us we would not get documentation, either. 3Ware has lied to us and our users so many times they make politicians look saintly.

    "Until other vendors give us documentation, if you want reliable RAID in OpenBSD, please buy LSI/AMI RAID cards. And everything will just work."

    --
    http://www.thebricktestament.com/the_law/when_to_s tone_your_children/dt21_18a.html
  5. That article is just disinformative by Cronopios · · Score: 5, Informative
    The information comes from this excellent interview to RMS conducted by Federico Biancuzzi, and published on OnLamp.

    This is what RMS actually said:
    Some companies, such as Google, use code covered by GPL to offer their services through the Web. Do you plan to extend GPL 3 copyleft to request code publication in this case too, considering this behavior like a product distribution?

    Running a program in a public server is not distribution; it is public use. We're looking at an approach where programs used in this way will have to include a command for the user to download the source for the version that is running.

    But this will not apply to all GPL-covered programs, only to programs that already contain such a command. Thus, this change would have no effect on existing software, but developers could activate it in the future.

    This is only a tentative plan, because we have not finished studying the matter to be sure it will work.

    How would it work?

    If you release a program that implements such a command, GPL 3 will require others to keep the command working in their modified versions of the program.
    This inteview is also discussed on OSNews.
    --
    Windows users:
    Internet Explorer is obsolete. Please upgrade to Google Chrome or Mozilla Firefox.
  6. Partially by Mark_MF-WN · · Score: 4, Informative

    I think that's only partially true. As I understand it, the derivative software will only have to allow the source code to be accessed if the original did as well. In other words, if google creates UltraSearch.com and licenses it as GPL3 AND includes a mechansism to download the source, then anyone who creates a derivative work would have to retain that mechanism or a comparable one. But if google had kept their sources private, then anyone who created a derivative work would presumably be allowed to keep their source private too. Of course, this is all confined to web-apps. Any software that is actually distributed will still have all the normal GPL conditions applying to it.

  7. Devil is in the details by Chuck+Chunder · · Score: 5, Informative
    A simple "websites running GPL software being required to release their source code by some means" is quite scary and if it's that simple it could be quite burdensome as "running GPL software" is a very wide target.

    If I have an (otherwise proprietary) web application that makes a call to a GPL3'd grep command then I'd have to distribute grep to people if they asked. That sounds silly and unnecessarily burdensome and would create the sort of administrative overhead that would push people to a non-free solution.

    However the mechanism Richard Mentions:
    We're looking at an approach where programs used (on a public server) will have to include a command for the user to download the source for the version that is running," Stallman said. "If you release a program that implements such a command, GPL 3 will require others to keep the command working in their modified versions of the program.
    seems vastly more sane. GPL3'd applications that aren't web-apps won't suddenly require distribution if they are used in a web-app, only applications coded with such use and distribution in mind will.
    --
    Boffoonery - downloadable Comedy Benefit for Bletchley Park
  8. Re:Loophole? by KiloByte · · Score: 2, Informative
    If you use GPL code within your company to, say, sell pants in a retail store, you're fine? But if you use GPL to, say, sell other products online, you're not? What is the difference?
    None, at least to me. Both are using, not distributing.

    Note that GPLv2 specifically includes limits only to distribution, not to use. In fact, you are not even required to accept it at all:

        5. You are not required to accept this License, since you have not
    signed it. However, nothing else grants you permission to modify or
    distribute the Program or its derivative works. These actions are
    prohibited by law if you do not accept this License. Therefore, by
    modifying or distributing the Program (or any work based on the
    Program), you indicate your acceptance of this License to do so, and
    all its terms and conditions for copying, distributing or modifying
    the Program or works based on it.

    Note that there is no way to restrict usage in a license -- you need a signed contract for that. Once you have the software in question, nothing save a separate agreement can stop your rights. GPLv2 is a pure license -- it only grants rights you wouldn't otherwise have (the right to distribute at certain conditions).

    I am also concerned that RMS may have problems with reality checks these days. Come on, first the GFDL and now then -- can we have the old RMS who wrote gcc and GPL back, please?
    --
    The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
  9. Re:Google time.... by chrisd · · Score: 4, Informative
    We are releasing some code, but remember that the redistribution requirement noted in the story applies to GPL v3 code, which doesn't exist yet. A lot of code won't be going to v3 (The linux kernel, for one).

    Also, I think that the open source community has to handle this very carefully, and clearly, otherwise there will be a lot of confusion around who has to post code and when. That said, we're just seeing drafts now for a license that won't officially exist until January 2007, so making any kind of substantive commentary on it is difficult.

    One last thing, the web server (apache) that most people use isn't released under the GPL, so this has nothing to do with that.

    --
    Co-Editor, Open Sources
    Open Source Program Manager, Google, Inc.
  10. Re:Loophole? by ArsenneLupin · · Score: 1, Informative
    Sounds like a sane byproduct of a sanely limited feature of the license to me.

    Not really. Under the old regulations, web sites could use open source software to write code that excludes open source browsers.

    Granted, the new regulation doesn't really fix this (it is enough to publish source code... much of which is public anyways if it is client-side javascript), but it's a step into the right direction.

  11. Re:Going too far? by i_should_be_working · · Score: 2, Informative

    If I use modified GPL'd software to help me design furniture and I sell the furniture, I don't have to release my changes under version 2 or 3.

    If I let people use the modified software for a fee, over the net to help them design their own furniture then under version 2 I still don't have to release my changes since I'm not actually selling or distributing the software. Under this proposed version of 3 I would have to release the changes.

  12. Re:Google time.... by DrSkwid · · Score: 2, Informative

    no it doesn't

    try reading it

    it says you can't remove a source code downloading function if you make a derivative work, thats it

    and, besides, there isn't a gpl3 yet, only some ideas

    --
    There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
  13. Re:Loophole? by node+3 · · Score: 4, Informative

    Websites that do this don't clearly run counter to the intention of the GPL as I support it.

    That's your opinion. However it's the opinions of the authors of the GPL (RMS and Moglen) who get to define the intention of the GPL. As they have found a flaw in the GPL which allows GPL licensed code to be used in a way counter to their intentions, they are taking responsibility and working to bring the GPL more in line with their intentions.

    Expanding the GPL to force source disclosure to anyone who recieves the output of GPL code is absolutely unreasonable.

    Believe me, they understand that and understood it long before you ever even considered that possibility, and that's why they don't intend to create that requirement.

  14. Re:Wait a minute by Nasarius · · Score: 2, Informative

    A great deal of GPL'd software uses the recommended "v2 or later" line. It certainly doesn't force anyone to upgrade, but it has the potential for creating a great deal of confusion. I just hope that they're compatible with each other.

    --
    LOAD "SIG",8,1
  15. give it a different name by idlake · · Score: 2, Informative

    I can see why such a feature might be desirable for some kinds of software. For example, you might want to ensure interoperability among different web services based on free software. And, after all, commercial software vendors apply even more onerous restrictions to web-based software, such as "per user" licensing costs.

    However, I think it would be a good idea to have two versions of the license, one with this provision and one without, and give them different names, say WGPL (Web GPL) and GPL. If the FSF only releases a revision of the GPL that includes this provision, I suspect many software authors will stick with the GPL2, and they'll be missing other clarifications and improvements in the GPL license.

  16. Re:How serious are you? by naich · · Score: 4, Informative
    This is a really interesting move by the GPL board. Its clear that the target is Google. Under GPL3 they would have a tough time not releasing GoogleOS and GoogleFS and all the other enhancements that they are working on that are still in beta.
    Wrong. This part of GPL3 will only apply to web apps and only to web apps that have been marked as having to have this requirement by the developers of said web app. Google wrote the code so Google have control of the code and can decide whether to add this requirement or not.

    Expect lots of deliberate misunderstandings of this concept for FUD porpoises.

  17. Re:Google time.... by Matrix9180 · · Score: 3, Informative
    Oh really?
    This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
    From http://www.gnu.org/copyleft/gpl.html
    --
    120chars for a sig is teh suck
  18. Close another loophole? by Minna+Kirai · · Score: 2, Informative

    The existing GPLv2 contains a different loophole. In reading about GPLv3 planes, I haven't yet seen any effort by the FSF to close it, but I wonder if anyone else has more info.

    The exploit is this:
    When you modify and distribute a GPL program, you must provide the recipient the source code, in one of three ways. Either you give an "offer" to supply the code anytime in the next 3 years, or you let her download it from the same system as the binary, or you ship the source along with the binary.

    That 3rd choice provides the loophole, although it requires two cooperating people to abuse it. PersonA hires PersonB to modify the program, and give him 100s or 1000s of matched discs of binaries and source. PersonA then takes out all the source discs and grinds them into powder, and then sells the binary-only discs to customers.

    He's allowed to do this because of "first sale" rights, which state that someone who legally recieved a copyrighted work can redistribute it, even in damaged or partial form. The customers are buying a modified GPL program, but they didn't get the source included, nor did they get an offer to request the source later.

    Note 1: To keep the loophole working, PersonA can never duplicate binary discs himself to sell. That would be copyright infringment. He must always buy new pairs of discs from PersonB, and keep on trashing the source code- although rewritable media will make it more affordable)

    Note 2: PersonA must trust PersonB, because PersonB is allowed to give out GPL copies to 3rd parties if he chooses. There is no way PersonA can prevent this, except by enticement of future profitable sales.

  19. Private modifications... by hummassa · · Score: 4, Informative
    No, the GPL never said that [the existing GPL said that if the derivative code stayed in-house, then you didn't have to release your changes]. Many, many people have said so, including some FSF personnel, but the GPL text itself says nothing of the kind. (in fact, it implies the opposite for most circumstances). If you think otherwise, go ahead and paste where the GPL says this.
    You couldn't be more wrong:
    (GPLv2 clause 2) [first]You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program[/first], [second]and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
    a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.
    b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.
    c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)[/second]

    There are two grants in this clause:

    1. [marked with first] the unconditional grant to make derivative works;

    2. [marked with second] the conditional grant to distribute derivative works.

    This means you may modify a GPL'd program and keep your changes to you. If the licensee is a 3000-employee enterprise, the IT team is not obligated to distribute the changes to each employee as long as each employee is not permitted to take the software home (ie, if the firm is not distributing/licensing its changes to the employees).

    Got it? IANAL & TINLA, but I am a paralegal.

    --
    It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
    1. Re:Private modifications... by Anonymous Coward · · Score: 1, Informative
      Please try again- and especially, tell what you think "distribution" means, and why use by one corporation doesn't count. From page 195 of the copyright law:
      (6) "Distribute" means to sell, lease, or assign a product to consumers in the United States, or to sell, lease, or assign a product in the United States for ul- timate transfer to consumers in the United States.
      Please note that if Wal-Mart buys 500,000 blue aprons and sends a carton to each store, they have technically "distributed" that material even if they haven't transferred ownership. In the English language, "distribution" applies as long as you are moving things around, even within a single organization.

      That sort of distributing is outside the scope of copyright law and licenses because it does not meet the legal requirements for distribution. Giving 500,000 legally produced copyies of a piece of software to 500,000 employees is legal and requires no license.

      What is your standard for decide this isn't "distribution"? Merely the fact that the recipients of the modified binaries haven't been given permission to take them elsewhere? That interpretation would render GPL-compliance wholely voluntary.

      They aren't consumers because they haven't been given ownership of the copy.

      If that's the case, then exactly what stops me from modifying a GPL program like Mozilla and selling binary-only copies to random strangers? They are consumers therefore that act would qualify as distribution and be regulated by the gpl. If the licensee is a 3000-employee enterprise Which is never the case. If a 3000-person enterprise walks into Fry's an buys a single copy of Microsoft Windows XP Professional, is "he" is really allowed to install it on 3000 PCs for "personal" use?

      Even if the license is only for one seat, the licensee is still the corporation, not the employee that uses that particular computer. In the case of GPLed software, the corporation is allowed to make a copy for use on any computer they own. This is similar to a site license of Windows XP.

  20. Re:Google time.... by xtracto · · Score: 4, Informative

    either version 2 of the License, or (at your option) any later version. any later version.

    Read your post again for me.

    Now, that means you can chose to use the GPL 2.0 terms on the software that was distributed by that license (like lets say The GIMP 2.0) or, if you like you could chose any later version of it.

    Do you understand now?

    --
    Ubuntu is an African word meaning 'I can't configure Debian'
  21. Re:Loophole? by Anonymous Coward · · Score: 1, Informative
    It's your fault for leaving that phrase in your source files.
    The simple solution is to leave the phrase out.
    All of my (GPLed) source code has the following:
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; version 2 of the License.
    Notice how that differs from the original, which states:
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
    Note that there is nothing in the GPL (v2) that prevents one from modifying the paragraph in the source code that refers to it.
  22. Re:Loophole? by node+3 · · Score: 2, Informative

    That's very different to a "loophole" where the intention of the licence is extremely clear but people are using clever tricks to avoid it.

    The intention of the license is very clear--it's to promote four very specific freedoms. In the opinions of RMS and Moglen, the current version of the GPL fails to ensure those freedoms in a specific set of circumstances. This is due to a loophole--a loophole not between the wording of the GPL and this specific set of circumstances, but a loophole between the intention of the GPL and that set of circumstances.

    To my knowledge, the current GPL talks about copying and distributing, not using.

    Copying is where the GPL applies, because it's based on copyright law. Distribution is where they chose to focus because:

    1. This keeps the GPL simple (too complex and unintended consequences are more likely)
    2. Distribution was the most prevalent way users became users.

    Now, it's increasingly common for a person to become a user (as per the opinions of RMS and Moglen, and their opinion is what applies regarding the intent of the GPL, as it is their document) without having the software they use having been distributed to them. Therefore, in order for the GPL to more accurately address the intentions of its authors, it will need to be updated, which is exactly what they are in the process of doing now.

    Indeed it would - so if I used my program to write static HTML which I then published, would this program require me to publish the source?

    I'm fairly certain they do not intend this, and that the new GPL will not require this. If you read the pages on the FSF site, it will become clear that they believe users should have the right to use modified GPL'd software without distributing their changes if they so desire. Your static HTML example would fall into this category.

    It's only because web surfers are, in effect, using the software that this question has come up.

    If you use a program to create a static html page, you are the user. If I click a button on a web page, the program that is run by my click is now being used by me, and thus I am the user.

    At least, as far as RMS is concerned, as I understand it.

  23. Re:Loophole? by Phisbut · · Score: 1, Informative
    Standard disclaimer... IANAL.

    What happens if I've published my code under v2 and the users everywhere decide to apply v3 to it? What if I don't find v3 particularly appealing?

    I don't think it's the user who chooses which version you apply. If you develop something under version 2 with the "or later versions" clause, and I take your code and modify it, I can redistribute it under GPLv3. However, I cannot force you to make *your* version GPLv3, since yours is "version 2 or later at your option".

    The way I see it, leaving the "at your option" clause simply permits other people to relicence it under a more recent version of the GPL, but it does not force you to dump the earlier version if you don't like the later one.

    --
    After 3 days without programming, life becomes meaningless
    - The Tao of Programming
  24. GPL does not "infect" by swillden · · Score: 2, Informative

    The GPL, in fact, guarantees that if GPL'd software is used in another product, both products then become infected by the GPL and the resulting work is then covered by the GPL.

    Keep in mind that it's copyright law that is viral, not the GPL. Any time you copy a chunk of one copyrighted work into another copyrighted work, you have created a derived work whose copyright is jointly held by both of the original copyright holders. It is illegal to distribute this work unless you have the permission of both. That's the law. In this case, the GPL'd code has been released under a set of terms which provide the needed permission in many cases but not all.

    The GPL does not "infect" your code. You *choose* to place code that has some strings attached into your code. If you don't like the strings, don't take the code, but don't blame the GPL for "infecting" your code.

    --
    Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.