Does Using GPL Software Violate Sarbanes-Oxley?

Anonymous Coward writes "eWeek is reporting that The Software Freedom Law Center has published a white paper that dismisses recent publications from embedded systems seller Wasabi Systems. Wasabi recently released statements focusing on alleged GNU General Public License violations in relation to the Sarbanes-Oxley Act of 2002. The white paper, titled "Sarbanes-Oxley and the GPL: No Special Risk," essentially counsels users of the free software license that they have no need to worry."

Comments

Worded poorly.

[Short Circuit]

The SFLC wrote the paper titled "No Special Risk" ... Wasabi Systems alleged SO violations.

And no surprise...they advertise BSD-based products on their front page. (Not dissing Any of the BSDs, they're cool, IMO.)

Re:Worded poorly.

[ShieldW0lf]

Situation One: Your company owns the copyright to the software outright, released it under the GPL, and doesn't accept contributions. No problems. Situation Two: Your company distributes GPL software that it didn't write, with or without modifications. Your company recogizes that this is not its intellectual property, and never should have been, being that it wasn't written by them, and doesn't claim it as an asset. No problems. Situation Three: Your company distributes GPL software that it didn't write, with modifications. Your company fails to recognize that part of this software was never theirs in the first place and that the rest of it is not an economic asset because they do not have the ability to control access to it in exchange for money, but you try to pull some bullshit with the numbers to make it seem like an asset. By doing this, you're misleading your investors and committing fraud. You have a problem. But the problem isn't with the law. The law is working exactly as it should. If you're an OEM using open source software that you sourced externally for free and modified, it's not your property, and you shouldn't be listing it at all. If you've built your business around this lie, you're SUPPOSED to be fucked. That's what the law is for.

Slightly off topic but ....

[un1xl0ser]

Who can recommend a good book on IT 404?

CSPAN called

[Anonymous Coward]

they want their boring back.

Re:CSPAN called

[caudron]

The 90's called. They want their joke back. ;-)

And just to head the smart replies off at the pass...

The Jerk factory called. It wants me back. I'm outtie.

Tom Caudron
http://tom.digitalelite.com

Re:CSPAN called

[Firehed]

Error 404: Funny not found.

Re:CSPAN called

[Kymermosst]

The Jerk factory called. It wants me back. I'm outtie.

No, it was the village that called...

More info on SOX

[kebes]

In case you have no clue what "Sarbanes-Oxley" is, you can check out official info and the Wikipedia article. Basically it is a set of laws that place limits on what companies (and those working for them, especially upper management) can do. This has mostly to do with declaring assets and transfers of money. It tries to prevent companies from defrauding investors and so on. These laws were enacted after the Enron scandal.

Wasabi's complaint is that under these laws, you have to declare all assets, including intellectual property. Their rationale is that using open-source software, you may be in violation of the law if you do not review and declare that usage.

As was pointed out last time this was discussed on slashdot, a company would only be in trouble if they were already doing something illegal: violating the GPL. If you violate the GPL, then you're misrepresenting your ownership of IP (claiming to have a license you don't), and thus are also violating Sarbanes-Oxley.

So what's the problem? If a company follows the GPL, then everything is fine. They have nothing to worry about. If they violate the GPL, then they're breaking multiple laws. So, as always, companies should make sure that what they are doing is legal. This in no way diminishes the extent to which GPL software can be used in commercial environments. Wasabi acts as if there is some tremendous additional legal burden to using GPL software. However it seems that Sarbanes-Oxley would equally apply if you mis-represented your ownership of non-GPL software. So there's no difference. (You can read the Software Freedom Law Center white paper for a more complete explanation.)

Re:More info on SOX

[Jeffrey Baker]

More importanly, you can substitute any other license for "GPL" in the parent post. If you misappropriate software under any license, you could have some liability. Duh.

Re:More info on SOX

[booch]

In almost EVERY argument against the GPL, you can substitute any other license for "GPL", and the argument would still hold true.

One of the biggest arguments against the GPL is that if you use it in your own code, you have to agree to its terms. In the case of the GPL, those terms mean that your code must be GPLed. Other licenses set other terms; many licenses don't even ALLOW you to use their code in your code. In any case, if you don't follow the terms, you can be sued for copyright violation. So you always have a choice, no matter what the license -- either follow the license, or get sued.

Re:More info on SOX

[Fulcrum of Evil]

One of the biggest arguments against the GPL is that if you use it in your own code, you have to agree to its terms.

How is that an argument against the GPL? In most other cases, even getting the code will violate several laws, and you have no right to use it in your product. Seems the GPL gives you more than most. If you just want a library, the choice is simple - make your stuff GPL or don't use the library (with some exceptions).

Re:More info on SOX

[zero1101]

One of the biggest arguments against the GPL is that if you use it in your own code, you have to agree to its terms. In the case of the GPL, those terms mean that your code must be GPLed.

This is an extremely misleading statement, if not outright false. Your code must only be GPLed *if you redistribute it*. There are, unfortunately, plenty of cases where PHB's decide not to use GPL software because they don't understand this. And apparently neither do many Slashdot readers.

Re:More info on SOX

[Tony Hoyle]

In practice though GPL stuff isn't enforced...

Witness the number of embedded devices (particularly routers) where you can't get the source code to the GPL parts, and where you can, they're hard linked to closed source binaries with 'no unauthorised distribution' clauses (Yes I mean you Broadcom!).

So it's perfectly legal to modify the GPL bits, but illegal to distribute the resultant code... thus the GPL is defeated by apathy because nobody cares.

Re:More info on SOX

[TubeSteak]

Give him a break

booch (4157) is new here

Re:More info on SOX

[kesuki]

but illegal to distribute the resultant code

I think you meant 'binaries' of course, obviously you can redistribute the source code, it just won't Compile or if it compiles it won't 'run' without the proprietary bits that you had to seperate out.

anyways, it's just a sign of how sad and pathetic things are nowadays. back in the old days if you invented something, but hated patents, you could just tell people how to do it, and no one else could patent it, because you'd proven how to do it first... but with software, you can't even GIVE it away without being at risk of being sued, hense the various 'open source' licences.

Re:More info on SOX

[jschrod]

Check out http://www.gpl-violations.org.

Witness the cases where GPL gets enforced legally, when embedded devices violate the copyright of the netfilter project.

Re:More info on SOX

[zippthorne]

*sigh*

There are rights you cannot sign away. For instance, there is no form, statement, or contract you can sign, notorize, witness, swear before a judge, that grants another human being the right to take your life.

In the US, the vast majority of "liability waivers" that you sign before doing something that could be remotely dangerous (i.e. scuba lessons, skydiving lessons, bungee jumping, wall climbing, surfing, marathon running, go cart driving, you know, stuff you can't do sitting in front of a computer screen) are not valid contracts (however, rights that are appropriable may still be validly signed away, so the contract may not be wholly struck out. consult a lawyer).

Many in the GPL movement claim that similar law applies to reverse engineering for interoperability purposes. IIRC, the samba team in particular has had to do some kind of reverse engineering (i'm not sure if it was actual disasembly however), so their experience, and any cases they may have had to bring, would be informative.

Belief that a license is unfair is irrelevant, except where that unfairness runs into conflict with other laws, say.. anti-trust laws for instance. The outcome of a clash of multiple laws is not necessarily clear, and this is where the lawyers make their money.

Oh, and thanks for misconstruing my categorizing of some beliefs as an exposition of my own belief, then blowing it out of proportion for the purpose of discreditation via sarcasm.

Intended Consequences of laws

[dada21]

Some think that these situations are unintended consequences of laws that have "good" effects. Sarbanes-Oxley was intended, from the start, to be the ultimate way for governmentto control any corporation at will.

The law was initially meant to "fix" problems such as the Enron fiasco, but if you rewind just a few years, you see that most of these fiascos came directly out of trying to take advantage of loopholes in previous laws. The SEC colludes with the rest of the all powerful federal government to constantly keep non-preferred companies on their toes, while giving excessive power to the cronies. Sarbanes-Oxley will have the same effect.

The one light in Congress, Dr. Ron Paul, made an excellent note regarding Sarbanes-Oxley and the cost it will pass on to consumers. The Mises Institute also has a ton of great articles and blog posts regarding the horrors of this law.

It is time to realize that government is NOT good at regulating business, except from the point of view of the cronies. Bills like this will rarely be used for their original intent, and the un?-intended consequence in the long run is to see criminals made of innocents that had nothing to do with the law's purpose.

Instead of voting, I think we need to start pitching money in a hat to buy rope for those who violate their oath to uphold the Constitution.

Re:Intended Consequences of laws

[dada21]

I have absolutely zero dollars in publicly traded companies. I have no faith in the business of others -- in my own businesses I have so much "insider information" that I can't believe everyone else is a big enough sucker to trust these massive companies to tell the truth about everything.

That being said, I hate accountants. The average CPA is part of the problem in this country (CPAs as a group lobby Congress to make the tax code worse every year). Instead of requiring companies to do anything, how about telling people that they really shouldn't put their money anywhere but where they trust? I make between 20% and 50% on my various businesses, annually. Most stocks pay no dividend, so they actually make their owners no profit (except on sale, which is ridiculous as companies should pay profits).

The whole system is a mess, and its a mess because we keep requiring business to perform counter-productive to how a free market performs.

Re:Intended Consequences of laws

[dada21]

Yes, let them go wild. It will teach the average "investor" that there is no such thing as a free lunch. You should NEVER put your money into a business that you don't have faith in or trust. If you make it government's job to make people "tell the truth" you'll get lies covered by legal loopholes.

The problem starts with the Fed (Greenspan, Bernanke and their inflationary cycle) that makes money worthless over time so we seek to invest it to at least break even. The problem is made worse by the same inflationary cycle that makes our salaries go up slower than the inflationary cost of living increases (which go up because of the money printing). It goes downhill from there -- the SEC makes investors believe they're protected, which in a free market is a fallacy. You are only protected through contracts, not through law forcing people to act a certain way. Beyond contracts you protect yourself by doing business with people with a history (see eBay's feedback system).

This is all a mess, made worse by people who have faith in others. I have no faith in others except those who have proven their trustworthiness to me. This is why I only invest in businesses I have direct contact with.

Re:Intended Consequences of laws

[NeutronCowboy]

Instead of voting, I think we need to start pitching money in a hat to buy rope for those who violate their oath to uphold the Constitution.

Nonono - you got that all wrong. It's "we need to start pitching money in a hat to buy our own senators". Don't vote with a voting box - vote with your dollar! Isn't that the american way anyway?

Re:Intended Consequences of laws

[Billly Gates]

Do you believe that?

Business can not happen without the government. Its in any economics101 course and certain services can not be done by business. Mainly things in public consumption since its not profitable to help everyone.

The free market works best when the market is stable. The government tries to setup the market as free as possible and to stabilize it so it can grow.

Without SOX you would have problems of more problems of bad accounting reporting which would hurt the general market more.

The government is not always the bad guy here and many market purist forget withotu the government regulating currency, providing roads, educating yoru workforce, and making trade negotiations with foreign nations we wouldn't have a market for you to sell products to.

It seems all these mu8lti billion dollar right wing think tanks sponsored by big businesses have quite a few followers today. I just dont understand the American obsession agaisnt government but not at all agaisnt big business?

Re:Intended Consequences of laws

[jdavidb]

Instead of requiring companies to do anything, how about telling people that they really shouldn't put their money anywhere but where they trust?

Our culture has accepted a lie about trust. We believe that it is the obligation of people to extend trust, and that it is a moral failing when they do not. In reality, the exact opposite is true. Nobody should be trusted until they have proved themselves trustworthy. If person A fails to trust person B, that is solely and completely person B's responsibility. It is not person A's fault. A has to earn B's trust.

This was clear to me during my dating days in an online singles community when I'd hear women who had just been jilted say, "How can I ever trust anyone again?" Well, the problem is that they were extending trust to people who had not yet earned it, and those people performed as could be expected. Then these women were viewing it as somehow their own moral obligation to trust people after that. In reality they were receiving an education that was pointing them to the obvious conclusion that it was not their responsibility to trust people who have not earned it.

Extending that to business is left as an exercise for the reader; I've had more success in dating than I have in business. ;)

Re:Intended Consequences of laws

[AuMatar]

You are only protected through contracts, not through law forcing people to act a certain way

Contracts are only worth the paper they're printed on because the law enforces consequences if they're broken. In the end, it still falls back on the law to enforce good behavior. The problem isn't that the laws to force the truth don't work- its that they aren't actively investigated or enforced until after a major collapse such as Enron. And that even after that, most of the people get away with it. What we need is better enforcement.

Re:Intended Consequences of laws

[rossifer]

would you mind reading just one free tiny e-book that covers mine? http://www.mises.org/money.asp This is Rothbard's basic book regarding money and what government has done to destroy the economy.

I went ahead and read it, and the author makes the same mistake that all advocates of the gold standard make: they fail to understand that currency and value are separate. Further, the author completely misunderstands the role of the central bank (The U.S. Federal Reserve Bank) in a paper money economy: which is to stabilize the relationship between currency and value. This deliberate stabilization is impossible in a gold standard economy (more precisely, there are too many players who can influence the quantity of currency in circulation in a gold standard economy to know who they are, let alone understand their motivations).

I admit, most people don't understand why certain pieces of paper are more valuable than others, but that lack of understanding does not mean that we should revert to the gold standard (which has an equally misunderstood relationship between currency and value). All the gold standard buys you is less control.

Government destroyed our currency by getting off of a 100% reserve system in 1913. It has destroyed any reason to save (the best way to create a strong economy is through savings, not public credit),

This statement presupposes that inflation alone is a disincentive to savings. Which is false.

The incentive to save is based on relative returns. If the available interest rate of savings accounts is above the inflation rate, there is an incentive to save. At the moment, this is not true. After taxes, bank interest rates on savings accounts, most CD's and most money markets are below the inflation rate. But this inversion of returns, and the problematic incentives that provides is a recent (over the last 20 years) event, not stretching back to 1913.

You'll have to come up with another theory. I agree that bank regulation is to blame, but to describe a new set of regulations that provide for banks to make a profit on savings and to offer a competitive interest rate is beyond my limited knowledge of economics and monetary theory.

Regards,
Ross

Re:Intended Consequences of laws

[AuMatar]

Contracts can be enforced in a private market without the force of law. If you sign a contract, you take out contract insurance through a private company. This company issues a "bond" against your signature, guaranteeing the other party that you'll follow through, and also offering you insurance against the other party running off. This happens all the time in the construction industry (I should know, I own a business that gets bonded on each project).

No, it can't. First off- I sure as hell shouldn't HAVE to take out insurance for every one of my contracts. Yeah, thats a great idea- lets build up yet another level of middle men into society. Second off- its rife for corruption. For example, say I have a contract with a big company- say WalMart (no reason for picking them except their size). The bond company does hundreds of contracts with WalMart a year. They do 3 or 4 with me. We have a disagreement. WalMart tells them to side with WalMart, or they'll never give them buisness again. Who do you think they're going to side with?

The free market doesn't work on situations like this. They're called externalities, and covered in econ 101. A course I become more increasingly sure no libertarian has ever taken.

Sure, someone can take their terrible negative feedback and start anew with another company, but would you trust a 30 year old with zero feedback? Neither would I.

So in a world already hampered by big corporations, you want to add another artificial stumbling block raising the barriers to entry and allowing the big corps to fuck you over even more. Another great idea.

Don't forget to factor in that over half of all buisnesses fail in under 5 years. So yes, there would at any one time be a majority of buisnesses with little to no feedback. You'd also have a whole new class of crooks- feedback scams. They happen on ebay all the time- someone creates an account, sells a few dozen items to friends to build up feedback, then scams some unlucky guy (or frequently several unlucky guys) out of thousands of dollars in a big sale.

In a free market, interest rates are free to go up and down. Banks that need money can offer better rates than those who have money. Also, in a free market with a fixed money supply (100% reserves) we'd see soft deflation, which is good for the economy -- it gives people reason to save, increasing the money supply to banks for loans to GOOD businesses, not junk ones.

Deflation is no better than inflation. Both are good for different sectors of the economy and different economic classes. Inflation is good for people in debt (they need to pay less when the debt is due), deflation is good for debt owners (the debt is worth more when it is due). There's good reasons for prefering inflation to deflation- inflation makes credit very expensive. It makes buisnesses hard to start and homes hard to buy. Historicly inflation in this country was pushed for by farmers, who were land rich and cash poor, so they could more easily utalize their land to generate debt in bad years and repay in good.

As for a fixed money supply- thats not a good thing. One of the biggest problems in the middle ages was that the fixed money supply frequently left too little cash money in an area, limiting economic growth. The basic macroeconomics equation is change in money supply+ change in velocity of money=change in GDP plus inflation. If the money supply is fixed, you either have no change in GDP or you end up having money cycle very quickly. Quickly cycling money lowers savings rates (you have to spend it more often). Its much preferred to have a slowly increasing money supply. The ideal is to increase the money supply just enough so that inflation is 0, but this is nearly impossible to do. In practice its better to overincrease it and have mild inflation than the reverse.

Re:Intended Consequences of laws

[Qzukk]

The problem is that nobody out there has the time to engender the trust they'd want from every single individual they come in contact with, and corporations certainly won't go out of their way to help. Can I really trust the "Organic" produce sellers to not take the ugliest fruit from the truck and slap the organic label on it so they can mark it up? Can I really trust my water utility to purify the water I'm drinking and not feed me any strange chemicals for research purposes? Can I really trust the power plant next door to the house I live in to follow all applicable safety regulations? Can I really trust the medicine I bought to not be placebo pills?

How would these entities go about convincing me to trust them? What do I do if nobody decides that my trust is all that important? What is my recourse for cases where entities build up trust over time specifically to pull off a couple of big scams (see: ebay)?

Re:Intended Consequences of laws

[dada21]

I'm neither a libertarian nor a Rand-droid, fwiw :)

I do travel the world, in fact I just got back from a 3 week trip to Eurasia. My visits to Poland and India were eye opening, indeed. This summer I am traveling to 2 other continents, and following up with a late winter visit to Dubai, one of the my favorite cities in the world, and also the freest market to boot. I see growth everywhere I go, except in the US. Of all my businesses, my 2 biggest failures were due to regulation by the government. My 2 biggest successes were in the free markets that were unburdened by regulations.

I believe we've put too much faith in government, which is the reason things are as bad as they are. Most people don't notice it, though, but traveling to other countries has proven to me that we have no idea what we're talking about. The Chinese "slaves" working in the corporate towns are happier than those who don't have jobs. The Indian "slaves" working for the megacorps have a much higher standard of living than their neighbors. I'm not sure where the bad things are, but I keep looking for them and I find nothing.

When Ethiopia was "starving and the people were dying," I went there. I saw prosperous cities, people with brighter futures, and an economy that would explode if it wasn't for excessive regulations and taxes. I see the same thing today in Tunisia and other parts of Northern Africa.

My words don't come out of some utopian fantasy, they come from honest experience working with many people in many countries. Humans want to make themselves better, and they find ways to do it regardless of what government promises to do. Usually those promises are the main reason we can't better ourselves.

FWIW, I believe megacorporations come directly out of government support and subsidy. I don't know if we'd see the same megacorporation control in a free market, as most megacorps get there through utilizing regulations in their favor.

Re:Intended Consequences of laws

[killjoe]

In india you can buy and sell children. In fact many children are sold to quarries where they carry stones on top of their heads until they are about 15 or 16 because by that time they are crippled by either a leg injury of a spine injury. By the time they are that old they are also deeply in debt to the company they are working for because the company has been charging them for rent and food (which by coincidence is more then they earn). Their only way out is to have children and then sell the children to the company to satisfy their debt. After being freed from their debt both boys and girls usually go into prostitution because their bodies are too broken to do any other kind of work.

That's just one industry. In india there are a huge number of people who are in similar situations.

No thanks.

Re:Intended Consequences of laws

[rossifer]

An ounce of gold today buys about the same thing that an ounce of gold did in 1800 and an ounce of gold in 0 AD.

This statement is only true for a very carefully selected group of products (and almost no services). While an ounce of gold will still buy a nice men's suit of about the same relative quality as you might buy in 1800, for pretty much everything else, an ounce of gold will not buy you the same things you could get in 1800. This is due to relative changes in value of purchasables, especially the value of human services as compared to physical goods. The comparison to 0AD prices is that much more crazy (just because you can find one product that could be traded for about the same gold does not mean that there's equal value behind an ounce of gold over time).

Even more importantly, your assertion about the consistency of value behind an ounce of gold glosses over huge currency to value changes (hyper inflation and deflation) that have disrupted local economies and created great misery until things restabilized.

If the available interest rate of savings accounts is above the inflation rate, there is an incentive to save.
Yet the available interest rate is set by the same organization that prints the new paper currency!

Actually, a particular consumer bank's savings account interest rate is not set by the federal reserve and only bears the slightest relationship to any of the interest rates they do set. The biggest problem is that banks earn a lot more money from debt than from savings and are disincented from providing savings services, except as necessary to maintain their fractional reserves. How to correct this imbalance of incentives? It's more complex than you think.

My money is stable, and I don't fear stock market fluctuations, war, imperialism or a global loss of faith in the dollar.

Gold ended up being devalued hugely in the late '70's and early '80's (from about $800/oz to $300/oz in 1976 USD) and many people who thought like you do lost substantial fractions of their savings because they had fearfully put all of their money in gold as a hedge against disaster. Which turned out to be disastrous for them once the oil crisis passed.

Is your future safe?

Actually, pretty risky. Almost all of my money is in my home and will soon be in my own entrepreneurial venture. But I'm convinced that that's the best place for it, despite the risk that the company could fail. The independence and potential upside are too compelling to ignore.

Regards,
Ross

Re:Intended Consequences of laws

[matt4077]

Your comment is somewhat true. However, trust is very important for an economy. I. e. you wouldn't buy anything without some trust, currencies are based only on trust (no more gold standard) etc.

I seem to recall that much of the economic success the jewish communities had in the early 20th century and before was based on trust, i. e. you could give someone locally some money and some business partner of them would pay the same sum (minus some fees maybe) to the final recipient. Very useful in the times before international banking systems were firmly established.

Why were they trustworthy? Because their reputation depended on it, and reputation is rather important in small communities.

Today, the communities are much larger, so you wouldn't know someone personally or be able to learn anything about his personal reputation. That's why there are companies like Western Union, Paypal and banks. These entities are under the rule of law, in which you trust. The law has therefore become a proxy for trust.

Re:Intended Consequences of laws

[killjoe]

"You're right, I witness such a "business." I also witnesses families who were able to leave the situation and better themselves just a few miles over in a tourist-friendly town."

In any country there will be the poor and the rich. The measure of a countries civility and humanity is how the poor live. The fact that there are people "getting ahead" in India is of little consequence when they are getting ahead on the backs of child labor, prison labor, and slavery.

A programmer in India is able to charge two dollars an hour because his house was built by the destiture using bricks made by five year old girls, using furniture made by slave children.

Like I said. No thanks.

"In American, we carry the burden of our parents on our heads so much that by the time we'll retire, we'll have to pass our our expenses to the next generation."

Unlike most of the world your parents will get Social security, medicare or medicaid. Imagine your burden if those weren't there?

"I see opportunities for growth in India, I see almost none hear."

In that case you are blind. If you don't see opportunity in America you are not looking.

"This country, the US, will learn a very harsh lesson, very soon. If it wasn't for the imperialist wars waged against others, I think we'd have collapsed by now."

And we will continue to wage wars to prop ourselves up. One of the reasons we invaded iraq was to prevent them from asking euros for their oil. Make no bones about it. We will kill anybody who gets in our way. This is why America is dominant. We have no morals when it comes to money. This is also why there is more opportunity here then anyplace else.

Re:Intended Consequences of laws

[killjoe]

"My 2 biggest successes were in the free markets that were unburdened by regulations."

I think that's everybodies point. Business loves to run free and do whatever it wants. It's great for you, sucks for everybody else.

As I said there are lots of places in the world where there are weak govenments and businesses run the country. I don't want to live in any of them. You want to live in Dubai? Under a king? No democracy? Go ahead. My guess is that you won't live there, you will set up a business and fuck the guest workers like all other dubai businesses do. Get them into the country and then take away their permission to leave so you can work them for cheap.

Dubai is great if you are a) connected b) rich c) royal d) visiting.

The original article says ...

[gregor_b_dramkin]

violators of GPL are violators of Sarbanes-Oxley.

solution: don't violate the GPL.

Coming soon to slashdot:

[endrue]

Does the GPL Violate Sarbanes-Oxley?
[E]ssentially counsels users of the free software license that they have no need to worry.

Coming soon:

Does peanut butter taste like fish?
No

Is water wet?
Yes

Short and informative - this is great stuff!

Re:Coming soon to slashdot:

[XMilkProject]

Is water wet?

In the vast majority of possible temperatures it is gas or solid. So I'd say, on average, no; water is not wet.

Re:Coming soon to slashdot:

[outZider]

and then it is no longer water.

Re:Coming soon to slashdot:

[MP3Chuck]

Really? Does it change from H2O when it changes phase? ;)

Re:Coming soon to slashdot:

[General Alcazar]

In English, water implies liquid state:

Solid H2O: Ice
Liquid H2O: Water
Gaseous H2O: Steam
Plasma H2O: Profit!

Re:Coming soon to slashdot:

[Door-opening Fascist]

Bzzt. The IUPAC name for H2O is water, regardless of state.

Re:Coming soon to slashdot:

[darkmeridian]

water is not ice.
water is not steam.

ice is solid water.
steam is gaseous water.

Re:Coming soon to slashdot:

[venicebeach]

I think more to the point is whether a liquid can be "wet". Usually we use the term "wet" to refer to a solid that is covered with or has absorbed a liquid.

SOX is change management over financial systems

[futuresheep]

SOX requires strict change management controls over financial systems. When we went through our audit, the auditing company was mostly concerned with how changes were made to these systems, what management controls were in place to monitor these changes, and the processes that were in place to ensure their integrity. None of the OSS software used in these processes was given a second glance beyond the aforementioned items. As an example, our use of Nessus as one the our tools for network audits and our archive of Nessus scans was applauded.

Just my Experience.

Re:SOX is change management over financial systems

[jamcmh]

I like what you said, but let's be clear... SOX says nothing about change management.

SOX can be boiled down to two things: #1) The opinion from the auditor of how effective your controls are (this includes everything from IT to Payroll, and everything in between), and #2) The opinion from the auditor expressing their evaluation of if or if not you are following the controls.

Now. Consider what you said:

"SOX requires strict change management..." -- While true, it is somewhat misleading. Your company has established a Change Management methodology as a control to cover the accountability of changes to the systems. You follow these Change Management guidelines as if it were a religion. That results in #1 - their opinion of your C/M after evaluting it, and #2 - their opinion of if you're following it religiously.

Re:SOX is change management over financial systems

[CodeArtisan]

I like what you said, but let's be clear... SOX says nothing about change management.

Not directly. PCAOB Audit Standard #2, however, does. The PCAOB Audit Standard is the SEC approved audit standard to which US Public Companies filing under Sarbanes-Oxley are held.

Paragraph 50 of the standard requiter that Change Management over financial systems should be tested by the auditor.

Since when is the GPL a EULA

[Tweekster]

What would use of software have to do with the GPL... The user does not have to accept the terms of the GPL to USE the software...

Groklaw quotes Moglen: FUD, plain and simple.

[toby]

Article here.

Quoting a response by the Software Freedom Law Center:

the latest Software Freedom Law Center white paper maintains ... these issues were reviewed and it was found that there is in fact no special risk for developing GPL'd code under SOX. "Under most circumstances, the risk posed to a company by SOX is not affected by whether they use GPL'd or any other type of software. Arguments to the contrary are pure anti-GPL FUD [fear, uncertainty and doubt]," the paper says.

Wasabi = BSD zealots

[drwho]

I contacted Wasabi hoping to buy some tools from them for BSD development on embedded platforms. When I asked about a platform they didn't support, the proceeded to criticize that CPU and Linux saying they were underpowered and immature, basically, they want you to buy their favorite CPU. Sadly, this company is made from NetBSD developers, who I had previously thought were among the less rabid BSD zealots.

I stayed with Linux for embedded systems, and probably will forever, unless embedded BSD is freed from the grips of these people.

Re:Wasabi = BSD zealots

[Billly Gates]

Management runs the company not its BSD founders. Also they sell their own embedded systems and highly discourage using your own as it would cost htem money.

Management wants to kill linux as much as possible so you can run netbsd instead.

It seems they are desperate at this point and bashing linux was not a good way to make a customer. It seems they have incompentant salesmen and upper management probably had a role in training them.

Re:Maybe I'm a bit thick but...

[ZachPruckowski]

How can GPL (or using GPL'ed software) violate the SOX, if GPL'ed software is used as the license permits? Reading the article didn't give me any insight about this issue.

You can not get in trouble for using software you have a license to use. Period. If you follow the GPL, you have a license to use OSS. Break the GPL, and well, you don't have that license anymore. Ditto with normal software. If you violate an EULA, or steal software, you don't have a license anymore. Using software you don't have a license to is a SOx violation, regardless of whether the software is free or not.

Sarbanes-Oxley is a joke

[rfolstad]

I speak from experience and people can and will use SOX as an excuse for anything and everything. The problem is auditors are now trying to understand technology and they just don't get it.

The basics of SOX is that your CEO must sign that the proper controls are in place to ensure that all changes made to production systems that affect the reporting of financial information are approved changes.

Companies can take this to mean that changes to your firewalls, mail servers and webserver need to be logged and monitored with scrutiny. And they will even send "auditors" in to take screenshots of /etc/shadow hahahahahahhaa.. It's hilarious.

Realistically it is impossible to be 100% SOX compliant and profitable. This bill will be gone within 5 years and other countries without silly laws like this will prosper in the meantime.

So yes. If there is a not an audit trail in place where someone approves of applying that patch to the linux kernel on all production machines then you are not SOX compliant. Just like if someone doesn't approve installing that critical service pack from microsoft. Without approval and test cases you will fail your SOX audit unless you pay the extortion^H^H^H^H^H^H^H^H^H fee that anderson^H^H^H^H^H^H^H accenture is charging these days.

Re:Sarbanes-Oxley is a joke

[srNeu]

SOX has become revenue stream for auditing firms. They took a very simple law (about 2 pages) that is as you stated "The basics of SOX is that your CEO must sign that the proper controls are in place to ensure that all changes made to production systems that affect the reporting of financial information are approved changes." and turned it into a complex cash cow.

My company's parent company has several internal corporate auditors on staff that are extremely computer illiterate. They basically take what the external auditors say to do make us produce documentation for it. However, the auditing firms have made the requirements overly complex and the corporate guys don't understand the technology to know what really makes sense or not.

Case in point, our corporate guy decided that only 2 of the 4 admins at our company need admin access in the mrp system. So he directed one of the dedicated mrp people to remove my access. Now I can no longer unlock user accounts, etc., so my ability to help the company has been reduced. No where in the SOX law does it say that you can only have 2 people with admin rights. So where does the corporate guy get that impression --- from the auditing firm. I have since got my rights back due to confronting him if he could point out exactly where in the SOX law it says that only 2 people can have admin rights. He couldn't, and only said that [unnamed auditing company] said that was the right way.

As long as the external auditing companies make up the rules on what is covered and what is not, we will continue feeding the auditing company's cash cow called SOX.

Re:Maybe I'm a bit thick but...

[Billly Gates]

According to SOX you need to give an account on who owns all your IP.

The counterlink given in this article is just as biased.

Here is the problem. You run linux and your software is an asset used to help run your company. Who owns it? Does Linus own the kernel? What about the distro owner? How about the 250 people who contributed to the kernel?

Wasabi is saying that you need to keep track of all the thousands of kernel and FOSS developers since they own the copyright on the code in your accounting reports. Since that is impossible you therefore break the SOX law and your business can be held liable.

The GPL is not an EULA but just a license for the code. The issue of proper credit and who owns what is what the fud is all about.

This will scare some of the suits from using linux but they would typically find a reason not to use it anyway.

Scuttlemonkey does it again!

[Fujisawa Sensei]

Does Using GPL Software Violate Sarbanes-Oxley?

Does this actually have anything to do with the article? No

The Article says that violating the GPL may be a SOX violation, but no more so than any other EULA.

I've seen a lot of complaints about Zonk; SM is worse.

you know

[Ender Ryan]

I really hate to think that the law is so fucking insane that your "regular," above average intelligence bloke can't figure it out for himself. If that truly is the case, which it most certainly seems to be, we seriously need to start all over again. Start with the Constitution, and go from there, and try a little fucking harder to prevent it all from being corrupted like it is now.

The Founders of this insane country have got to be spinning in their graves.

Wasabi Burns

[Doc Ruby]

I knew the founders of Wasabi Systems, here in NYC. The original "brains" behind the startup, which planned a "Red Hat for NetBSD", got screwed by his lawyer partner in the late 1990s, and left. No surprise to hear their business model is lying about GPL (Linux) in press releases.

Re:Maybe I'm a bit thick but...

[booch]

According to SOX you need to give an account on who owns all your IP.

OK.

Here is the problem. You run linux and your software is an asset used to help run your company. Who owns it?

I still don't see the problem. It's not my IP, so I don't have to account for it. Really, you'd have the same problem with code from Microsoft and other proprietary software vendors. Much of the code they sell is sub-licensed code owned by other companies. Heck, some of it is even BSD-licensed code.

What the FUD?

[redelm]

AFAIK, SOx is all about increasing "transparency", mostly records retention and statement quality. OSS can only help these, not hurt, unless the corp is incurring liability by violating licences.

So what if it does violate SO

[Anonymous Coward]

People who think for themselves will one day realize that in the end, it's all about FREEDOM. Corporations do not have your best interests at heart and never will. The GPL is where the future of free software is, and only the GPL. People who bitch and moan about things will one day thank the GPL for being what it is. Corporations are becoming stronger. GPL software can never be stopped by anyone, ever, anytime.

No Violation

[stonetony]

The Government in notorious for telling you that you need to comply with regulations without telling you how to comply. This sounds great at first, but this also leaves you open for penalties later if they determine that the methods you chose were insufficient. There is nothing in Sarbanes-Oxley that restricts the use of any specific sort of software to comply.... as long as if/when they investigate you they determine that you are/were in compliance.

Thats no better than what you complain about

[Wizardry Dragon]

Is this an 'innocent until proven guilty' world or a 'guilty until proven innocent' world?

I tend to take a decidedly buddhist view when it comes to that, nothing to do with the religion (before I get a religious flamewar going here), but I believe in moderation. Completely distrusting everyone is no worse than complete trusting everyone. You have to strike a balance - the way our world works depends upon it. Buisness depend upon trusting that the average consumer is not a theif (someone should tell the RIAA that, before they strangle the music industry), relationships depend upon trusting that the person you are with will be true to you, in whatever way that means to you.

~ Wizardry Dragon

SOX Violations

[Ratbert42]

From my growing experience with SOX, I probably violate it every time I take a piss without capturing it.

Re:Maybe I'm a bit thick but...

[gnasher719]

'' Here is the problem. You run linux and your software is an asset used to help run your company. Who owns it? Does Linus own the kernel? What about the distro owner? How about the 250 people who contributed to the kernel? ''

That is really very simple. Your company can just make a statement like: "In our company, we are using 500 copies of Linux and 500 copies of OpenOffice. Both Linux and OpenOffice are owned by their respective copyright holders; we are using this software under the GPL license. We are also using 500 copies of Windows XP and Microsoft Office which are both owned by Microsoft; we are allowed to do this because we paid Microsoft lots of money for the licenses. "

If in reality you only paid for 100 licenses of Windows XP and Microsoft Office and someone finds out, then you are not only in trouble with Microsoft, but also with SOX. And should you be violating the terms of the GPL license in such a way that you are not allowed to use Linux and OpenOffice (and I am not quite sure at the moment how you would do that), then you are also in trouble with SOX.

Beware Your EULA

[Stephen Samuel]

Man, if you're worried about the GPL, imagine what happens if you use Microsoft Software?

Under the MS EULA, once you upgrade your software, you have no rights to use the older version(s). This means that if the 'upgrade' breaks your mission-critical software you are so toast.
If you don't revert your software, then your mission-critical software wll remain broken until Microsoft deigns to fix the issue.
If you do revert your software then you're in violation of the EULA and subject to having Microsoft demand that you delete the entire package at any time.

With the GPL, you're only likely to run into problems if you want to distribute the software without distributing the full source. You can sometimes get away with not publishing the source to isolated parts of software written by you, but at that point you're running on the border and should talk to lawyers to make sure that you're not crossing over the line.

Re:Beware Your EULA

[julesh]

Under the MS EULA, once you upgrade your software, you have no rights to use the older version(s). This means that if the 'upgrade' breaks your mission-critical software you are so toast.

I believe you are mistaken. Not only would it violate the principle that once you have paid for a license it is yours to dispose of as you wish (doctrine of first sale), Microsoft specifically grants downgrade rights in many of their licenses anyway -- e.g., if you want a second license for Office 97 you can buy a recent version of Office and install from your old Office 97 disk if you want.

Re:Beware Your EULA

[Stephen Samuel]

Not only would it violate the principle that once you have paid for a license it is yours to dispose of as you wish (doctrine of first sale),

If you're saying that, I'd have to conclude that you've never actually read (and understood) your MS windows EULA.

Once you buy an article you can do what you want with it. Licenses are arbitrary... That's why the EULA has the claim "you agree that you have licensed this software, not purchased it (or something to that effect).

Under general copyright there is no need to obtain a license to run a piece of software. The doctrine of fair use would allow you to install and use it to your heart's content on any one machine.
In theory a license is supposed to grant you something that you would not normally have.. MS licenses seem to do nothing other than take away rights that you would normally have. I think that that's part of the reason why EULA 'agreement' pages are designed to discourage you from actually reading them.

From the current XP-Pro SP2 eula. (find it here)

3. RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in this EULA. ..... The Software is licensed, not sold. (emphasis MS's)

8.Upgrades. To use the software identified as an upgrade, you must first be licensed for the software identified by microsoft as eligible for the upgrade. After upgrading, you may no longer used the software that formed the basis for your upgrade eligibility. (emphasis mine)

14 ..... The initial user of the Software may make a one-time permanent transfer of this EULA and Software to another end user, provided the initial user retains no copies of the Software. ..... The transfer may not be an indirect transfer, such as a consignment. ....

It just kinda goes downhill from there..

Very Stupid

[glrotate]

The Wasabi Whitepaper itself says it doesn't:

"None of this applies to companies who merely use GPL software, such as those who run Linux on their servers, as long as their software was created in a compliant way. In addition, none of this applies to companies using non-GPL open source software, such as BSD; in the case of BSD, there is no requirement to make modifications open source. Rather, the requirements discussed here apply to companies who modify GPL software, such as embedded OEMs
using Linux."

This is only about companies releasing products with GPL software.

Actually it would be good for Open Source if it was a violation. It would be leverage to use against these infringing embeded companies.

Cui bono -- who benefits -- is often important.

[jbn-o]

The reason why they're making their case against the GPL is important. Proprietors are saying that the GPL makes them nervous, they don't like the commons the GPL creates and maintains. Proprietors want to discourage everyone from using and developing GPL-covered code so that they have less competition and won't have to spend their time lobbying governments around the world to help make Free Software implementations of various programs impossible. Thus this is just another legal risk FUD case against the most widely used Free Software license, the GNU GPL which fails to mention what the Software Freedom Law Center points out:

"Historically, GPL violations have not triggered massive lawsuits for damages the way that violations of proprietary license agreements have. The primary enforcer of the GPL is the Free Software Foundation (FSF), who has never used a GPL violation as the basis to go to court to seek a large damage award or enjoin software distribution. The FSF's stated policy is to ensure compliance, not to prevent software distribution or to seek damages.

What this means practically for the vast majority of companies complying with SOX is that the threat to their businesses posed by potential GPL license violations, both inadvertent and intentional, is so low as to be immaterial. In any case, the financial impact of GPL violations is likely to almost always be lower than the impact of proprietary license violations, for which parties routinely bring suit for damages."

And when it comes to GPL-covered software being so complicated to deal with, the SFLC has this to say:

"In most instances, compliance with proprietary licenses is much more complex than GPL compliance because the GPL is a general license with obligations that are fairly simple and understandable. No money changes hands, seats are not counted, and licenses are not time-limited. GPL compliance is a fairly simply matter, and if a company has concerns about how to comply, the FSF is staffed with experts who can and do help companies create efficient compliance procedures. Proprietary licenses, on the other hand, often contain both a greater number of provisions and a greater complexity than the GPL. Thus, a company trying to understand its rights and comply with its obligations under such a complex and detailed license will have a much harder time than one who must merely comply with the GPL. Accordingly, the risk of inadvertent license violation is often greater with non-GPL licenses."