Slashdot Mirror
Do Build Environments Give Companies an End Run Around the GPL?
Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"
so we can vilify them, castigate them, and otherwise snark.
---- Teach Peace. It's Cheaper Than War.
Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?
Yes - it's called "having more lawyers than you."
What are you going to do about it, sue? You can always sue...if you actually have the resources to fight it out. And even if you actually get it to stick, it could be years down the road before you actually get access.
Regarding your specific case, can you reverse-engineer a solution?
It sounds like you don't work for either of these companies. So why are you protecting them?
If you really want them to do the right thing, start making a stink about it. There's very little chance anything is going to change because one guy asked them to. There's at least some chance that they will if the companies start getting a bloody nose from it.
AccountKiller
This only adds bad press to Linux.
WTF? Making a company comply with a license gives "bad press" ? I think that current way (asking, nagging, offering help, refusing to take any serious step) is worse - it promotes idea that GPL and other free licenses don't really matter - you can ignore them all you want and in worst case they can string along the community by releasing small bits and "discussing the situation" until the product becomes obsolete anyway.
OTOH an offer to cooperate with freeing up the firmware? Sign an NDA on a tool-set for the company, then release a free version.
Sure. Why not become unpaid employee. It is the company's responsibility. If they are incapable of understanding license of software they distribute, then maybe it is time to fire (and sue for damages) their lawyers.
Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.
Well, they did not comply with the license, so it has been automatically revoked, isn't that right?
Direct them to the Software Freedom Law Center.
Indeed, it's worth another reminder that the FSF is not in the job of policing GPL abuse. They publish the license for others to use, but they're only going to (only can) try to enforce it for code they actually own. Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.
Furthermore, while the GPL is intended to grant freedoms to you and other third parties, it is, by the fact that it leverages existing laws, difficult for a third party to enforce. It's easy to imagine the following dialog:
You: They won't give me all the code as required by the license.
Them: The license itself says its not mandatory and we don't have to accept it.
You: It also says that if you don't accept it, then normal copyright law applies, and they don't have permission to use the code.
Them: That's as may be, but you have no standing to sue us over the copyrights.
Judge: Agreed, case dismissed.
Of course, this means that they will have more-or-less admitted to copyright violation in open court, which is a pretty risky strategy, but suddenly, you're out a bunch of money and facing a dead end. Better, as QuantumG suggested, to get ahold of the copyright holders up front.
The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this. We also employ people to make contributions back to the FreeBSD project as well, so we're not mooches, but seriously... this is why so many companies don't want to get involved with Linux or GPL solutions.
And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
Which may explain the almost complete absence of GPLv3 code in the software world.
In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero. Several of the major players in the industry design chips but outsource the manufacture, and the whole ecosystem is so locked down under NDAs that anyone trying to get detailed specs out in public would wish it was only Microsoft's entire legal team suing them. That means GPLv3 software is basically useless in most of the embedded development world.
Much the same probably applies to systems software, so many of those working on OSS operating systems, device drivers, etc. are similarly unable to work with GPLv3 code.
The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Since the OP has given us no details as to the specifics of the two cases, it's impossible to offer any kind of rational comment.
Though, for your information, the GPL does not "infect" anything. It is a copyright license like any other except that it puts most of the control in the hands of the beholder. To the extent that it "infects" anything, that's all the choice of the developer. Don't want to follow the terms of the GPL? Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license. If you don't agree to the terms, don't use it. It's not rocket science, and it's not some kind of virus that needs to be stamped out.
By the way, due to the lack of information from the OP, it's not even clear if the FSF has any standing here - mentioning that they are not willing/able/prepared to fight the good fight is worthless when they may not even own the copyright allegedly being infringed.
I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.
I'm more inclined to believe this is something the FSF simply don't have the right to push for the reason mentioned above.
they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.
Are you confusing commercial with proprietary?
You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.
You see, there's the problem right there: Exactly what clause are these alleged companies accused of violating? They've provided the source code, Hell, the OP doesn't even mention what version of the GPL they think the companies are violating. I mean, really - how are we supposed to discuss the issue in such a scenario?
"Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves
Sorry but the hypocrisy of your statement is so in my face I have to say something.
You are keeping the identity of these companies secret for what end? It's GPL there for open there for it should not be a secret.
If you say something this community might be able to help you. Maybe one of us has already discovered solutions to your technical problem. When something like this comes up slashdot usually coughs up pages of useful links. It can be rather fun and interesting at times.
Sadly you are keeping it secret. Thus the helpfulness of this community is next to zip.
Because you are keeping things secret it would not be all too far fetched to believe that you are actually trying to alter the code is such a way as to derive money from it. Say by either selling an after market mod or by selling it back to the mystery vendor(s).
Please don't cry about the big companies keeping secrets if you can't even get that out with out keeping a secret.
P.S. Most likely no violation was made. Hardware and build env's are not governed by source code GPL. Unless of course the hardware or build env is also derived from a GPL reference.
Not true anymore. Many of them have been switched to the very restrictive vxWorks platform.
The big problem with GPL violations, and by extension poor customer service, is there is never enough backlash to deter these heinous practices. We can groan until we're blue in the face, Cisco/Linksys will continue to sell flaky hardware and buggy, unmaintained firmware/drivers and endless spin doctoring. These days their business is 90% sales & marketing, 10% development. That's why the router you buy today is no better than the one you bought a decade ago. They don't give a crap, they can just slap a new ugly plastic box around the same cheap old guts and print more money.
Even their enterprise gear has taken a nose-dive. They have about two dozen different 24-port switch SKUs, and they even have the nerve to give you detailed comparison grids, highlightly precisely how little they differ. How many ways can one shuffle managed vs unmanaged (why even bother anymore), and POE vs non-POE ? They need to fire half their marketing staff and beat the other ones until they stop telling the engineers what to build. Having a uniform product line means greater efficiencies in both production and support. Modern business 101, for crying out loud!
-Billco, Fnarg.com
The problem with saying that GPL is not viral in that you just don't have to use it, is missing the point. The issue here is that it is hard to tell when one has violated the GPL.
Well, no, it isn't missing the point. It _is_ the point. If it is so difficult for you to understand if you're violating the license, simply don't go near GPL code. This makes it extremely simple to know you are not violating it.
The issue here is that it is hard to tell when one has violated the GPL. In your own discussion, you say that without specifics, you can't tell whether a violation occurred. In my opinion, the OP presented a reasonably generalized story.
The GPL is one of the easier licenses out there to understand, and there are reams of discussion about what it means. Try to understand the license that, say, Oracle grants you without a copyright lawyer at your elbow.
With other software, you can just buy the software, and know that since you paid money you have a reasonable right to use it.
Try arguing that with the BSA if they show up for an audit. Seriously.
More generally, the problem here, at least I think, is between chair and keyboard. Just because you think the license is weird does not make it so. If copyright law in general is complex and nonintuitive (and it is), that has nothing to do with the GPL.
If you're just dinking around with code and manage to make a mistake in how you release it, nobody is going to come after you with guns blazing and daggers flying - they'll point out the mistake and let you correct it. And even if they did (possible, I just don't think it would happen), you can stop distributing the code. If you're commercially distributing your code in hardware, you likely have an IP lawyer on retainer anyway who can explain it to you. The problem comes in for shops that either (a) base a business model on exploiting GPLed code with no intention of complying, or (b) are being intentionally careless, like these vendors.
and, I can't resist:
Look at the diversity of opinion on this very slashdot page as proof of my point.
Your median /. poster's grasp of IP law is similar to Sarah Palin's understanding of foreign policy. That they both can see the respective objects from home just makes them aggressively stupid in their analysis. (And at least, as a politician, Palin has an excuse.)
I forget what 8 was for.
This has got to be the craziest post I've seen in a long time.
Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects. http://news.cnet.com/8301-13505_3-10294452-16.html This information took me 30 seconds to find on google. Before making wild ass comments, please do some research.
Now, you may have meant that GPLv3 code is rare on embedded devices. This may very well be true. But at least look up the numbers and tell us what they are rather than making outrageous comments backed up by nothing.
Also asserting that RMS is trying to capitalize on the popularity of the GPL to ram home his minority views is completely ridiculous. The GPL has ALWAYS been his vehicle for ramming home his minority views. Did you honestly think the GPL was popular when it was first released???? RMS and the GPL popularized these ideas in the first place. v2 isn't working exactly the way he wanted it to, so he changed it. What kind of warped view of the world do you have to have to think this is unreasonable?
Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues. It might not be for you. That's great. Choose another license. But take a look at some of the messages here. For example, vendors are allegedly shipping software for their wireless routers with vulnerabilities. Fixes exist for those vulnerabilities, but the customer can not apply the fix because they can't load a custom build. Things like this do not endear customers to their suppliers. Generally speaking, having the ability to fix your own problems is a good thing. This is one of the pragmatic issues that v3 fixes. The license is a promise by the vendor that these kinds of things won't happen. It is something that an informed consumer can base their purchase on if it is important to them.
I happen to think it is important to me. Many other people here happen to think it is important to them. Obviously you do not. I think you are letting your bias cloud your judgement, but that's up to you.