Slashdot Mirror
GPL 3 May Require Websites to Relinquish Code
Vicissidude writes "At present, companies that distribute GPL-licensed software must make the source code publicly available, including any modifications they've made. Though the rule covers many businesses that use GPL-licensed software for commercial ends, it doesn't cover Web companies that use such software to offer their services through the Web, as they're not actually distributing the software.
GPL 3, the next version of the free software license, a draft of which is expected to be released in early 2006, may close this loophole, GPL author and Free Software Foundation head Richard Stallman said in an interview."
Sounds like a sane byproduct of a sanely limited feature of the license to me.
Someone set us up the bomb, so shine we are!
If they want to stick with their own GPL2 fork, they can still keep it locked up.
And we've known this for how long? Granted, the story itself isn't a dupe (afaik), but every article on the GPL3 in the past few months has mentioned the idea of websites running GPL software being required to release their source code by some means. It's hardly news.
That might make life interesting for Google (and probably Yahoo) as I'd bet a large chunk of googles operations are based on FOSS code including their clustering software, mail etc.
While I can see the point of making distributors in the conventional sense having to release the source I've a nasty feeling making web service companies reveal their source might only harm the OSS movement in the longer term... Google might be Okay as they've got the bandwidth to be able to release the source code for all OSS code used internally but not sure about the smaller providers...
--- Users are like bacteria -> Each one causing a thousand tiny crises until the host finally gives up and dies.
I'm no expert but wouldn't it be more likely that they would stick with their previous code that only has the V2 license attached? Whats forcing them to upgrade?
If you are embedding, say, GPL md5 checksum calculator in otherwise proprietary software, will you need to publish the whole source code? If so, I'm willing to bet most companies would rather re-invent the wheel and rewrite it. I wouldn't want to publish the source code to a production web site for obvious security reasons.
while true;do echo -e -n "\033[s\n\033[u\134_\033[B";done
This doesn't exactly seem much like a loophole, more a feature (It's not a bug - it's a feature!)
By closing it off, does this mean that any CMS that's using the GPL will need a link hard-coded and un-removable back to the source for it to be valid?
Anonymous Coward
There is a very strong "gimme gimme" theme that runs deep within the GPL community. It says, give me the source code you have because I want it. The GPL, in fact, guarantees that if GPL'd software is used in another product, both products then become infected by the GPL and the resulting work is then covered by the GPL. In a very logical sense, this makes a lot of sense. We want people who use our work (GPL'd) to also be compelled to give back their work. The payment we demand is not monetary, it is to be paid in sourcecode.
So the loophole exists that someone may be able to make available a software package through an interface like the web which does not export the actual software to the client. The application, though, is absolutely in use by the client, he just can't see the source code. The user can't even request the source code (which the GPL forces the distributor to release to the asker). This is way outside the theme of the GPL, and it is not what the GPL writers had in mind when they originally (and revisedly) wrote it. The user should have the freedom to read, learn from, and change the code to the products he uses, that is the spirit of the GPL. By hiding the code and program behind the safety of a webserver, the companies exporting the application via the web interface are restricting the users' ability to do those things.
I don't support Stallman in this. I think it is absolutely the right of these companies to do this sort of thing. And I think that changing the GPL to include such egregious usurpation of rights is a blow to Free Software, both spiritually and tangibly as we will see more people decide to either stick with GPL2.0 or go with a more lenient license.
Jesus saved me from my past. He can save you as well.
...to the following questions:
What can we do to make sure that for profit enterprises won't ever consider using GPL3 code in any projects?
How can we best add legitimacy to Microsoft's FUD about the GPL?
I have a feeling this will do more harm than good to F/OSS usage out there.
I can't really codify my feelings into words since my examples are all licensed under something OTHER than the GPL (apache,php) but I think everyone sees where this would stiffle GPL-based software growth.
It's like saying that anyone who uses foo shopping cart (licensed under the GPL) to sell t-shirts online must now release any code changes they make to foo shopping cart just because the business uses it to sell t-shirts.
This has been the biggest FUD from Microsoft for the longest time. You shouldn't write an application to run on Linux because you'll be forced to give your code away! With this type of change, that might become fact rather than fud.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
The zdnet article is just a rehash of the onlamp interview with Stallman that has recently been on /.:3 .html0 9/24/1325214&tid=117&tid=156
/. blurb to this story or the zdnet article want to make you believe.
/.
http://www.onlamp.com/pub/a/onlamp/2005/09/22/gpl
http://developers.slashdot.org/article.pl?sid=05/
Needless to say that you should read the actual interview, as things are a bit more complex than what the
Well done
I like how Stallman and Theo De Raadt both have incrmental approaches. Continually chipping away.
E.g. here's some of the latest on OpenBSD and RAID:
"Take Adaptec for instance. Before the 3.7 release we disabled support for the aac(4) Adaptec RAID driver because negotiations with the Adaptec had failed. They refused to give us documentation."
and
"But having been ignored for so long by these vendors, it is not clear when (if ever) we will get around to writing that support for Adaptec RAID controllers now. And Adaptec has gone and bought ICP Vortex, which may mean we can never get documentation for the gdt(4) controllers. The "Open Source Friendly liar" IBM owns Mylex, and Mylex has told us we would not get documentation, either. 3Ware has lied to us and our users so many times they make politicians look saintly.
"Until other vendors give us documentation, if you want reliable RAID in OpenBSD, please buy LSI/AMI RAID cards. And everything will just work."
http://www.thebricktestament.com/the_law/when_to_
This is what RMS actually said:
This inteview is also discussed on OSNews.
Windows users:
Internet Explorer is obsolete. Please upgrade to Google Chrome or Mozilla Firefox.
Your example is exactly where I was trying to go in my own post.
If I build a business around hosted virus scanning and the backend runs postfix,clam-av and mysql (which I've written all the gluecode myself), why the hell should I be forced to give up that glue code? I'm not selling the software, I'm selling a service, which is what they've been telling us should be the business model all along.
Someone may argue that, since I'm selling a service, I should have no problem with giving up the code but I say to those people "Why? I took and glued together three disparate products to build my solution. I'm not selling the software package to anyone, I'm keeping it internal. My development of the glue is my edge."
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
I think that's only partially true. As I understand it, the derivative software will only have to allow the source code to be accessed if the original did as well. In other words, if google creates UltraSearch.com and licenses it as GPL3 AND includes a mechansism to download the source, then anyone who creates a derivative work would have to retain that mechanism or a comparable one. But if google had kept their sources private, then anyone who created a derivative work would presumably be allowed to keep their source private too. Of course, this is all confined to web-apps. Any software that is actually distributed will still have all the normal GPL conditions applying to it.
If I have an (otherwise proprietary) web application that makes a call to a GPL3'd grep command then I'd have to distribute grep to people if they asked. That sounds silly and unnecessarily burdensome and would create the sort of administrative overhead that would push people to a non-free solution.
However the mechanism Richard Mentions: seems vastly more sane. GPL3'd applications that aren't web-apps won't suddenly require distribution if they are used in a web-app, only applications coded with such use and distribution in mind will.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
Here's what RMS said:
"Running a program in a public server is not distribution; it is public use. We're looking at an approach where programs used in this way will have to include a command for the user to download the source for the version that is running."
I don't think it's possible. As even RMS notes, running a program constitutes use, not distribution, and no "copyright license" can tell you how to use your software. Additionally, it's against the spirit of free software.
He who lights his taper at mine, receives light without darkening me.
Mod parent informative... I now have Quake 3 running on Linux :-)
Sounds like lots of people would simply quit using GPLed stuff then and move to one of the BSD systems. For web frameworks and platforms the vendors would have to choose. Most Java frameworks are Apache-licensed anyway, and for other GPLed project the group would have to choose either to turn into hobby-only projects or to keep the old GPL.
The hard part about this is that probably every single copyright holder under the GPL has the right to choose to upgrade to GPL3, so that only singly-owned project could choose to really stay GPL2. But IANAL.
*** Dangerous Virus ***
So I have this apple in my proprietary tree, which I decide to release under GPL3... Now if I eat the apple and next mornign go to the toilet, is my poop licensed under GPL3 also?
You don't know what you don't know.
If I use modified GPL'd software to help me design furniture and I sell the furniture, I don't have to release my changes under version 2 or 3.
If I let people use the modified software for a fee, over the net to help them design their own furniture then under version 2 I still don't have to release my changes since I'm not actually selling or distributing the software. Under this proposed version of 3 I would have to release the changes.
Web sites aren't being singled out, it's just that websites are a very common example of "public performance" of software without distribution.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
So it's not a feature that applies to apache, the kernel or anything other than the web application itself. It's not retro-active; the developer has to add it to a newly released version and if you don't like it then continue developing the existing version without it.
This is a really interesting move by the GPL board. Its clear that the target is Google. Under GPL3 they would have a tough time not releasing GoogleOS and GoogleFS and all the other enhancements that they are working on that are still in beta.
;))- but then IANAL.
The problem is that the only reason we know about either GoogleOS or GoogleFS is because it didn't cost them anything. If they knew they would have to release their IP if they decalred it as an enhancement, wouldn't they just claim that they were using Slackware through out, and no you can't see our server logs. Whats stopping them from turning round and saying, in light of the GPL3 we will now be moving to OpenBSD - ne nah ne ne nah.
How do you define a modification? If you create your own start up script for Apache, or create a custom configuration... is that a modification? Will it be defined as any modification that requires a recompilation of code? (Kernal configuration is going to be fun). How will already understaffed GPL projects be able to 1: enforce a code submission 2: handle the increased noise, as every man and a dog submits their patches?
How is this ever going to be enforcable? Thou shalt not covet thy neighbours wife - great idea, totally unenforcable in a court of law, in a libre society (it sure as hell is free as in beer - have you seen gas prices?
There is a big difference between writing a sensible, modular enhancement that you think will benefit all, and hacking together a patch that makes a project work better in your situation.
This is not a licence enhancement so much as a declaration of faith. How serious are you about FOSS?
Scared of flying, pointy things snce 1979!
This will be great for things with an MIT/Berkeley license (e.g. *BSD). The license allows you to do with the code as you please (as long as you preserve the Copyright notice) and hold the author harmless.
That's really simple.
There seems to be a lot of confusion about the GPL, even among people who like it a lot. The simplicity of the MIT license makes it a no-brainer.
Also, there is some question as to whether or not the GPL is a contract or not. There is the possibility that someone could "take back' the license. As there is no apparent consideration (e.g. you didn't pay for the license, did you?), a court might say, OK, he took it back. There was no contract.
That sort of ambiguity, until put to rest, causes trouble for some.
So the MIT (modified Berkeley) license will look better than ever.
http://www.thebricktestament.com/the_law/when_to_
Yech!
I can see why such a feature might be desirable for some kinds of software. For example, you might want to ensure interoperability among different web services based on free software. And, after all, commercial software vendors apply even more onerous restrictions to web-based software, such as "per user" licensing costs.
However, I think it would be a good idea to have two versions of the license, one with this provision and one without, and give them different names, say WGPL (Web GPL) and GPL. If the FSF only releases a revision of the GPL that includes this provision, I suspect many software authors will stick with the GPL2, and they'll be missing other clarifications and improvements in the GPL license.
Scenario 1: My company has a website, built in-house with GPLv3 tools and components. It is serving data to customers with web browsers. Is it required to make the code for its website software public?
Scenario 2: My company has an internal software application built in-house with GPLv3 tools and components. This software generates research data. A summary of this data is made available to its customers as, say, PDF files. How is this different from scenario 1?
Scenario 3: My company makes a business out of supplying critical stock trading services to its customers. The backend messaging servers are built on Linux, or use other GPLv3 tools. The application opens interfaces, be they proprietary, to paying customers, so that they can interact with this messaging server.
How is this different from scenario 1?
cat
Though the rule covers many businesses that use GPL-licensed software for commercial ends
Well no, it absolutely does not. The GPL covers distribution not use, if it covered use, no one would be able to use GPLed software in a commercial setting.
Closing this "loophole" would amount to drastically changing the philosophy behind the GPL.
Though I do vaguely remember reading something about the new rule being an edge case that covers rather rare circumstances, and not a reinvention of the GPL.
Seirously, taken literally this says that if I run a webapp on a GPLed server or even a GPLed OS, I have to release the source code. Yeah, that would fly.
sic transit gloria mundi
The existing GPLv2 contains a different loophole. In reading about GPLv3 planes, I haven't yet seen any effort by the FSF to close it, but I wonder if anyone else has more info.
The exploit is this:
When you modify and distribute a GPL program, you must provide the recipient the source code, in one of three ways. Either you give an "offer" to supply the code anytime in the next 3 years, or you let her download it from the same system as the binary, or you ship the source along with the binary.
That 3rd choice provides the loophole, although it requires two cooperating people to abuse it. PersonA hires PersonB to modify the program, and give him 100s or 1000s of matched discs of binaries and source. PersonA then takes out all the source discs and grinds them into powder, and then sells the binary-only discs to customers.
He's allowed to do this because of "first sale" rights, which state that someone who legally recieved a copyrighted work can redistribute it, even in damaged or partial form. The customers are buying a modified GPL program, but they didn't get the source included, nor did they get an offer to request the source later.
Note 1: To keep the loophole working, PersonA can never duplicate binary discs himself to sell. That would be copyright infringment. He must always buy new pairs of discs from PersonB, and keep on trashing the source code- although rewritable media will make it more affordable)
Note 2: PersonA must trust PersonB, because PersonB is allowed to give out GPL copies to 3rd parties if he chooses. There is no way PersonA can prevent this, except by enticement of future profitable sales.
You couldn't be more wrong:
There are two grants in this clause:
1. [marked with first] the unconditional grant to make derivative works;
2. [marked with second] the conditional grant to distribute derivative works.
This means you may modify a GPL'd program and keep your changes to you. If the licensee is a 3000-employee enterprise, the IT team is not obligated to distribute the changes to each employee as long as each employee is not permitted to take the software home (ie, if the firm is not distributing/licensing its changes to the employees).
Got it? IANAL & TINLA, but I am a paralegal.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
That tries this stunt (if the code is in a website, publically accessed and has the option to download the source, then your derivative must have equal option). And you know what? It hurts (meaning it's not Free). Because if I want to take the code and make a derivative that is *not* a website, I can't make the option available.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
1. tell what you think "distribution" means[...] Distribution (aka publishing) WRT copyright law is the act of making a copy and selling/donating/renting it to another (legal) person.
1a. a corporation is one type of person. In some acts, a corp is represented by some employee that has permission to execute that act. For instance, my enterprise's IT manager (who has proper permission from the rules of the corporation) goes to the MS dealer and negotiates a site license for XP Pro. Who will pay the bill, the IT manager? The IT department? No, the corporation. Who is the licensee? The corporation.
2. note that if Wal-Mart[...] You have noticed you were talking about a tangible good (aprons) instead of copiable, intellectual content? (which we are discussing here) If you were talking about software, for instance, the answer would be: No, they have not distributed it (see #1 above). technically? We are talking about copyright law here, so technically, ie, legally, this does not count as distribution... because no other person is receiving the copies, just the same (legal) person.
3. What is your standard for decide this isn't "distribution"? The copyright law. The person that bought/got/modified the software is the enterprise (acting according to its own internal regulations [*]), the thing starts to be distribution when an authorized person inside the enterprise says "hey, guys, you can take our rebranded OpenOffice.org home and install in your computer"... because then the "Enterprise" person is distributing to the "Employee" person a copy of the software. As opposed to an authorized person inside the Enterprise installing the software in a computer that belongs to the enterprise (no distribution there).
3a. [*] even when acting against corp regulations, the corporation is still liable for the actions of its employees, if others (mainly execs) take notice of said actions and do nothing about it. But this is another can of worms.
4. what stops me from modifying a GPL program like Mozilla and selling binary-only copies to random strangers? The fact that you would then be distributing it?
5. Which is never the case. Sure it is. When your enterprise buys a site license for XP Pro (3000 seats), the enterprise is the licensee. When your IT manager downloads Apache and installs it in an enterprise's server, with permission from the enterprise's execs, the enterprise is the licensee, because the IT manager is doing that on behalf of the enterprise.
6. If a 3000-person enterprise walks into Fry's[...] Enterprises do not have "personal" usage of nothing, only commercial, because they are commercial by nature. Anyway, even for personal use (which an enterprise can buy for an exec, for instance) XP Pro's license only permits installing in one machine.
better now?
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
This is why I will either continue to use GPL v2 or add an permission to run a website without giving away the code to the GPL v3.
while (!asleep()) sheep++
The point of the GPL is to protect the users (NOT the software itself!), by giving them the freedom to modify the software they use as they see fit. A remote user is still a user!
I agree with the first part of this, however as someone who develops code for use on the web I'd say that I was the user and the people looking at my website are seeing documents that is produced by what I set up. I'm the user. The people who are looking at the web pages are consumers of my product. (the pages).
The "remote user" is not a user of the software, they are a user of the result of my use of the software. If I hadn't set it up, they wouldn't be able to see the results.
It's like requiring the plans to a printing company, and a paper factory whenever you buy a book. The manufacting info of the book is not what you are buying, just the contents.
Let's take GMail as an example. I'm an end user. I don't develop GMail; heck, I don't even work for Google at all. Nevertheless, I would prefer it if GMail were GPL v3, because then I could verify that it wasn't copying every email I send directly to the FBI, or deleting every other message someone sends me, or misbehaving in some other way -- in other words, the same thing the GPL allows me to do with a local email client like mutt or Mozilla Thunderbird.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
The GPL, in fact, guarantees that if GPL'd software is used in another product, both products then become infected by the GPL and the resulting work is then covered by the GPL.
Keep in mind that it's copyright law that is viral, not the GPL. Any time you copy a chunk of one copyrighted work into another copyrighted work, you have created a derived work whose copyright is jointly held by both of the original copyright holders. It is illegal to distribute this work unless you have the permission of both. That's the law. In this case, the GPL'd code has been released under a set of terms which provide the needed permission in many cases but not all.
The GPL does not "infect" your code. You *choose* to place code that has some strings attached into your code. If you don't like the strings, don't take the code, but don't blame the GPL for "infecting" your code.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Just as code generated by a GPL'd compiler should not be inherently under the GPL, nor should a document created with a GPL'd word processor be automatically GPL'd, the web sites served by a GPL'd web server need not be automatically GPL'd.
- Michael T. Babcock (Yes, I blog)