Slashdot Mirror
GPL Causing Problems for Derivative Linux Distros
NewsForge (Also owned by VA) is reporting on a recent discovery by Warren Woodford about how the GPL could affect derivative Linux distributions. This could make life difficult for those small distros that are being maintained by one or two people in their spare time due to the high amount of work it creates. From the article: "Woodford does supply the source code for MEPIS' reconfigured kernel in a Debian source-package. His mistake seems to have been the assumption that, so long as the source code was available somewhere, he did not have to provide it himself if he hadn't modified it. While he has not contacted any other distributions, he suspects that he is far from the only one to make this assumption. 'We, like 10,000 other people, probably, believed we were covered by the safe harbor of having an upstream distribution available online,' Woodford says. 'I think, of the 500 distributions tracked by DistroWatch, probably 450 of them are in trouble right now per this position.'"
Remember, this applies equally to kernel hackers as well as people creating derivatives from other GPL software.
From: mrAngry@snootygits.com
Subject: I want the source code to your system!
Polite Reply:
If you would like the source code you are welcome to have it.
Please note however that I have only made changes to a few of the thousands of x system source files.
There are 2 ways that you can have it, the simplest being go to my upstream system writer and download the base code which I used and see the src folder on my FTP/CVS/web server for my own modifications.
Otherwise I am willing to post you a CD/DVD containing the entire source code (original and my modifications). I cannot unfortunately upload the entire x GB folder since I do not have the bandwidth to spare.
Please note however, there will be an administration and postage charge of £10 if you require a DVD image.
have a nice day.
Anyone making source modifications to a system must have at least one source copy of the original so be respectful but don't waste your time worrying about it.
liqbase
His mistake seems to have been the assumption that, so long as the source code was available somewhere, he did not have to provide it himself if he hadn't modified it.
It's called passing on an offer to supply source code.. it's a part of the GPL. What a load of shit.
How we know is more important than what we know.
Why should the "upstream" or "bigger" distro supplier be obligated to distribute source code for YOUR particular distribution? Of course _somebody_ needs to be responsible for making the source available, otherwise the entire spirit of the GPL is unenforceable...
It makes sense to me that the person distributing the binaries should be responsible for making source code available for said binaries. That is how the license is written, and it is very straight forward. No surprise here - so what is the complaint?
Do we really want everyone and their brother shipping their own MyFirstDistro as binary only, just because the sources are individually (hopefully, for the time being) available elsewhere? Is it fair to put that burden on someone else?
Wouldn't any license be a headache for a small distro provider? How many packages in an average distro, for a team of 2-3 people to validate compliance on?
Sheesh, evil *and* a jerk. -- Jade
I seem to recall various incidents in the past few years (a DVR maker comes to mind, though I can't remember which) where commercial products used GPL software unchanged, failed to distribute source (pointing people to the maintainer of the software), and the FSF and community raised a fuss. So I don't understand why this is suddenly such a light-bulb moment.
-- Old Man Kensey
...surprised when their guess as to what is required is not correct. Film at 11.
Wikipedia has a pretty good plain English translation of the requirements to distribute GPL software.
Think of the Children; Sleep with your Sister
Requirements for being in this police force include an aversion to shaving, showering and doing laundry. Punishment will involve rubbing the face of violators with the dirtiest beard in the police force.
2 years and no mod points. Join reddit. Because openness is good.
The GPL only requires that one provide the source code if asked, and it is perfectly legal to send it via postal mail for a nominal fee.
I can't imagine that anyone is actually asking these small Linux distributions to provide the source code for the Linux kernel when it is available for a free download.
OK, these "distro makers" are downloading vast amounts of material covered by the GPL for free and then redistributing it for money or advertising. (MEPIS sticks in an Earthlink signup icon, for example.) And then they whine that they have to provide the source for the free stuff they're reselling.
Even worse, some of these distro makers want you to sign up for a "support contract". If they don't have a repository of the source, their support probably isn't worth much.
And who would be affected if these distros stopped being maintained? Nobody in their right mind is going to rely on a software project that is somebody's hobby.
This doesn't really kill one-man distros, it just means that the one man can't go through the pointless ritual of creating an ISO that nobody actually uses. So big deal. If you want to have fun by creating your very own Linux distro, nobody's stopping you. But if you want to create a distro (or any other open source project) that people will actually use, you have to learn to work with others.
What about public FTP mirrors (such as run by many universities) that distribute binary packages/CD images/...? Do they have special agreements with the projects they mirror? Otherwise I guess they have to provide the source for any version they ever distributed for a period of three years too.
I'm not an expert on this ... but
... but enforcing this is actually counter to the intent of the GPL as far as I can see.
I thought the point of the GPL was to encourage people to share and reuse code. Enforcing that EACH person who reuses code also shares it themselves is counter to this intention. The effect will be less reuse and less sharing overall. Obviously someone has to make it available, and when and upstream provider stops doing so, everyone else would have to pick up the slack.
Why don't we completely rewrite the kernel from scratch and license it under something else?
Wait, I've heard that idea before somewhere...
I make websites and stuff. Buy one.
At a reasonable price. My billable rate is CAD$78/hr. Minimum 3 hour callout, plus materials, and shipping.
HTH, HAND
If someone comes up to you and demands the source code rudely, you can politely tell them to fetch the code from the same place you got it from. You can send source files for anything you have changed or added.
The angry user cannot legally sue you since they do not own the rights to the source code. The chances are the original programmer won't try to sue you either. They would have nothing to gain by doing so, unless you are making tons of money from your distribution (and if so, you can afford to mirror the entire source code). As long as you are reasonable you should be fine.
Just relax, and get on with making the next version.
I'll probably be modded down for this...
Warren has made his own problems. I tried Mepis in 2004 and quite liked it. I used it for more than a year and installed it on several people's machines. However, I will not use it any more.
My reasons are several, but one of the top ones is murky licensing.
No doubt somebody from the MEPIS community will loudly declare that licensing is not a problem. If this is the case, exactly how can I get the source to build myself a MEPIS distro?
There has been considerable bad blood in the MEPIS community and former community. I am not a member of any faction. I have done my share to contribute. I simply tried to get my questions answered and MEPIS and Warren came up short. His many rants -- the one cited in the story is one of many over the last three years -- further convince me that I was right to walk away.
MEPIS is because is non-standard. Warren repeatedly warns against upgrading packages from the standard Debian repositories. There is no upgrade path from one version of MEPIS to the next. There appears to be a very weak mechanism for collecting community know-how as to how to configure the system to "just work" on a particular platform.
There is no safe harbour....
If you are re-distributiong non-commercially, without modification, upstream source is fine (which makes sense)
If you are modifying anything, including doing your own custom kernel, then you must provide source. Providing the source alongside the downloads, granting equivalent access to it, satisifes your obligation under the GPL to provide source. The day you stop offering downloads, you can stop offering the source as well.
That's a very good thing - there needs to be a lot less "small distros maintained by one or two people in their spare time". These SDMBORTPITSTs aren't helping anyone: if you want to roll your own linux for some itch you want to scratch - more power to you; but there's no need to call it a distro and pretend that you are going to maintain it for more than 2 months.
sic transit gloria mundi
In ubuntu, as in debian, there is complete source package for every binary package. Should you read the appropriate documentation, or even google, you could easily download the source package corresponding to the kernel package. Perhaps you were told to "fuck off" because you were too lazy to google before being rude?
Not a troll, nor flamebait - just "hacking" the 'reasonable' clause and cost in the GPL.
Hypothetical:
Say I make (ast an hourly rate of my annual salary) $50 an hour. Not unresaonable for a consultant.
I am distributing a baby distro and I do the source via DVD and postal request since I cannot afford a lot of bandwidth.
Figure it takes me 20 minutes to process the request, type up the label, grab the latest from my repository and DL the rest fromthe upstream, burn a DVD, and put it in a protective mailer package. And other 20 to go to the post office and 20 to come back (assume I'm in a rural area outside the suburbs). So thats and our of my time. Add in that this is essentially overtime in addition to my real job, so I bill it at time and a half. Thats $75 baseline in cost.
Add in the postage ($8 or whatever the USPS "Priority Mail" rate is), the mileage and gas on the car to go to the post office, the CD cost (including mileage on the car and gas and time to go buy them, plus wear and tear amortization on my CD burner), cost of the bandwidth, etc.
So all in all:
"Yes, you can have the whole source tree from my upstream and the 2K of diffs I have added - the reasonable cost for this source is $94.37 per CD"
Is that the right answer?
Every penny of it is documented and accounted for. Every bit of it is involved with the cost in materiels and time that it takes to prepare and ship the source. My software is free, my time is not. If you think otherwise, go ahead and put yourself down as a slave who will work for free at the demands of people that use the software you donated - is that the intend of the GPL, to enslave authors to the whims of the recipients of their gifts?
Again: Not a troll, nor flamebait - just "hacking" the 'reasonable cost' clause in the GPL.
Who decides what is reasonable?
Does the GPL give someone the right to dictate to the person releasing the software what they can and cannot do with their time? Think about it.
If not, then how do you overcome the situation above, where the GPL seems to imply that you have to release the whole of the code, including upstreams, not just your diffs, especially where releasing the whole of the upstream is cumbersome or onerous - and the response ($94.37 per DVD) is likewise.
Personally, I never looked at it this way before - the only thing I've released as open source (long ago) has been under the BSD license just to avoid the entanglements the GPL requires. And that only to be able to avoid warranty that Public Domain doenst expressly mention.
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo! http://goo.gl/J9bkO
People working on the FreeBSD Ports Collection have had this discussion too with regarding to re-distributed RPMs for for example the linux Userland emulators.
At the end they decided just to download the original SRPMS and make them available at the FreeBSD ftp sites too, just to get out of the hassle of it.
bash$
I know this is a little late in the discussion, but I did a quick search on the page and couldn't find anything about patch files.
Would this affect any small source-based distro's that use patches on top of the original source files? [sort of like Gentoo, 'cept they aren't small]
Lately I've been thinking about building a small distro based on Gentoo or even just "roll your own" for my self. If I intend on releasing it to the public [I am still uncertain] would patch sets be the easiest route if I were to need to actually modify any code[it will be a source-based distro]?
Google returns about 24.8 billion results for the word "the". Keep in mind, that's four times the total number of people on the planet. It's 32 times the number of people online. So assuming all things were equal, that would mean that even if we wired up every person on the planet, they would each have four webpages, at least.
Sorry, but we're not there yet. You'd think it'd be time for some natural selection of the Internet. Who the fuck wants to read anything Jack Thompson has to say? Surely we could do without Heroic domain and typo squatters, couldn't we?
The problem is, even if no one clicks on typosquatter ads for quite awhile, these Heroic pages probably won't go away without a fight. They'll find other ways to make money, other places to hide, all without cancelling the ones that aren't working.
So what happens to all the old Linux distros? Oh, they might even still be available, but the unpopular ones won't be maintained. Remember tomsrtbt? That was my best recovery tool, before I had a cd burner, cheap CDs, and noticed how everyone had ubiquitous CD drives. Now I use RIP. Let's compare those -- tomsrtbt still works on the same computers it did before, but doesn't support the filesystems I need, and my main computer no longer has a floppy drive -- not to mention, it was last released in 2002. RIP probably takes less time to load, even though it pulls some 75 megs into RAM before you use it, versus tomsrtbt's 2 megs, because tomsrtbt is on a floppy (a slower floppy than usual), and RIP is on a CD. And let's not forget, RIP was last released four days ago.
So, why is tomsrtbt still online? It's still on DistroWatch, even.
The problem is, when a project is truly forgotten, you also forget to remove it, even if there's a natural replacement.
Don't thank God, thank a doctor!
Don't people read and make sure they understand a license before they start distributing software under it? Just copy the source file from the original distro and post them on your FTP site. You could set up a script to do this while you sleep at night. The distro I use, BLAG, which is only a couple people seems to have no problem with being a derivative of fedora and offering the source in both individual SRPMs and ISOs.
Does the FSF have the power to insist on this for software they don't have copyright on (like, IIRC, the vast majority or even all of the Linux Kernel?)
If they request the source code to a GPL package, and the author ignores them, what option do they have? I imagine the original copyright holder(s) would have an action as the original author(s) but I fail to see what standing the FSF has unless they are a copyright holder.
This is an honest question - I don't know how this aspect of law (copyright law, maybe some other laws sneak in?) would actually work. What are the limits?
Of course, the linux distro that isn't chock full of GNU tools is a rare bird indeed...
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
From my experience, they would only have to make available the source code to the objects that were GPL in the first place.
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
There is no upgrade path from one version of MEPIS to the next.
Well, that's what happens when you mix in non free stuff like Macromedia flash, Real Player, Nvidia drivers, NDis wrappers, Vonage clients, etc. Non free is brittle. It might be less brittle than the Windoze world, but it will never be as easy as the free world.
Free packages in Mepis upgrade with about as much grace as you can expect. Just last week, I upgraded Kontact from a 2003 edition to Etch. This worked out OK through apt-get outside of X. It got all the KDE goodies, xorg and other dependencies and just worked when it was done. There was one hang up, but the system itself told me what magic phrase to type.
There appears to be a very weak mechanism for collecting community know-how as to how to configure the system to "just work" on a particular platform.
Nuts. Mepis is one of the easiest distributions to install. If it works off the CD, it will work off your hard drive and Mepis works with more hardware than anything else I've ever tried.
Mepis is still a great distribution to install for someone when you don't want to spend a lot of time. It demonstrates what free software can do. The problems it has are the problems of non free software in general and those rear their head far less often on a Mepis system than they do on less free platforms. In short, don't give up a useful tool just because one person says some stupid things.
Warren can and will fix this little source code problem and this little non issue will fade away without trace. The chances are that some co operative solution will be easiest. Distributions which use the same package unmodified can get together to share the cost and expense of keeping the source code available.
Friends don't help friends install M$ junk.
No, Gentoo has an advantage because they don't have to deal with the kludge of binary packages.
Please, for the good of Humanity, vote Obama.
I happen to be a distro maintainer myself – yes, I know, I say that every single post, but at least now it actually is relevant – and I'll admit, up until recently I didn't distribute any of the source code either. But starting with the latest release, I've done no less than three whole discs of nothing but source – it's really not that hard to do, honestly.
(If you're wondering, it had nothing to do with the FSF or GPL zealots; I've been working on doing an AMD64 port of my system, and that meant I had to move away from simply pulling pre-existing x86 binaries and actually start building the source myself. Honestly, it actually seems to be working a lot better this way.)
Just in case any other would-be distribution maintainers are reading this, I may as well offer some advice – I've just put together a set of three ISO images containing the complete source code, as well as build scripts, etc. to automate the compile process. You really just have to know how to distribute it. As far as my distro's concerned, I don't actually distribute the ISO images or CD's myself – all the downloads, etc. go through MadTux.org, who not only host everything at no cost to me, but they also donate some of the money from monthly CD sales to me to continue development, pay for Web hosting, etc. So get someone like them to help with the hard part (actually distributing everything) and once that's out of the way, you should be fine.
Creative misinterpretation is your friend.
Releasing the game content under GPL isn't my concern. I'm giving that away nearly public domain anyway.
My problem is with having to host the source code for a project that I'm only really a user of. I make content for use in this program, content without which the program is useless (and a program without which my content is useless), and which, if everything were unencumbered by licences, would rightly be bundled together with a copy of the program. How many commercial or even freeware games do you find that require you to first get a separate game engine from somewhere else? Not many; since game and content are useless without each other, they're pretty much always bundled. But the GPL puts an annoying burden on people who aren't developing software at all but want to include the needed software with their projects.
For a hobbyist like me, that could be quite annoying. I suppose I could host a copy of the source on my site, but then, I want to put the file up on the common Marathon-mod sites or other such sites too. Do I have to put copies of the application source on those sites as well? What if they don't have a category for "game engine source"? Then it's back to bundling the source files with the game, which is (as per my analogy) like handing instructions on the chemical composition of the plastic bottles I'm using to everyone I serve my fruit punch too. It's a hassle to me and the people I want to give things to. I'm not making any modifications to the code at all, I haven't even downloaded it, I just downloaded binaries so I could run the content I made. The original project is still there, with the code and the binaries where I got them from. It seems like in a case like this there should be some leeway for these such uses, and it's a problem with the GPL that there isn't.
And further, even if I were just to include a note with the project saying "I will post you a copy of the source on CD if you want it", how stringent must I be over here about making absolutely sure that I've got the source still backed up somewhere? If my HD dies and I don't have backups (which it almost did just recently... starting to keep some backups now), must I then stop all distribution of the project everywhere that it's online? Or since I've already put it up on a bunch of other people's websites (with this note), is that then in their hands? What if I could access the site through some web interface and remove the files, must I then do that? And if not, must I contact the site owners and tell THEM to stop distribution? Could they even have distributed it in the first place without first taking me up on my offer to send them a copy of the source? So I couldn't even upload it to such sites unless it was included in the same package, or the site agreed to host a copy of it themselves?
Wasn't the whole point of the GPL supposed to be freedom? This seems awfully restrictive to me.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
Seems reasonable to me. RMS sold emacs tapes for $150 and that was in the early '80s so I can't see a problem with someone charging $94.37 for a DVD.