Do Build Environments Give Companies an End Run Around the GPL?

Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"

Comments

It would be nice to name names

[postbigbang]

so we can vilify them, castigate them, and otherwise snark.

Re:It would be nice to name names

[QuantumG]

As if we don't know it's Cisco.

Re:It would be nice to name names

[Anonymous Coward]

Do we? I've never seen a cisco or linksys device you could't load custom firmware onto.

Re:It would be nice to name names

[Anonymous Coward]

Or Tivo, or Netgear, or Pioneer, or Samsung, or....

Re:It would be nice to name names

[Anonymous Coward]

Got stuck in exactly the same situation: Panasonic TX-P46G15E TV admits using (L)GPL code in their system menu and points to http://www.am-linux.jp/dl/EUIDTV7/ However no utility or script to install modified firmware. I asked gpl-violations.org to help but without hard proof that TV runs Linux they didn't pursue further (even though Panasonic admits using (L)GPL software in system menu and user manual as well).

Re:It would be nice to name names

[Mr. Freeman]

Without names there isn't a whole lot anyone can do. All of this "Some companies are violating the GPL/the law/doing unethical things but I'm not going to name them because for some stupid reason I feel I should respect them" isn't doing anyone any good... except for the companies causing the problems.

For the free market to work, information like this has to be made available. If people know which companies are doing bad things then people will stop buying products from those companies and the companies will be compelled, via loss in profit, to change their ways to go belly up. Keeping secrets hinders the free market and does nothing but cause problems.

NAME NAMES! Obviously, you should do so anonymously to prevent lawsuits, but they need to be named.

Re:It would be nice to name names

[A Commentor]

Netgear had the same problem. It was probably about 4-5 years ago, they had a nice router that ran Linux and had a USB port for supporting a harddrive. I saw that Netgear provide the source, I emailed their open source person, and he was providing the things I ask for. I ended up picking up the router during one of Fry's sales and thought I was all set to build my own firmware. I attempted to build the new firmware, everything completed successfully, but I couldn't find the firmware to install. I emailed netgear again, the response was along the lines of: "Oh no, you can't build the firmware image, we don't give out that tool, and also our html pages are copyrighted, so you couldn't put that in the firmware anyway." As others have stated, this is what TIVO did and why GPL v3 was created. With GPL v2, it would be a much harder fight to win, and again it would need to be the copyright holders of the software, who need to file suit, not the customer.

Re:It would be nice to name names

[tomhudson]

That's why people should consider switching their codebases to GPL v3. Nobody can "distribute" it without also distributing, on request, the custom build scripts used. Some make files can be a real bear, so you can imagine how much worse it is without them.

Re:It would be nice to name names

[kz45]

"so we can vilify them, castigate them, and otherwise snark."

Why?. They aren't doing anything wrong. After all, they aren't "stealing" anything. If they use the code, the code still remains free.

This article is equivalent to what the RIAA/MPAA say about piracy, yet for some reason most of the people here agree with it.

Hypocrisy at its best.

Re:It would be nice to name names

[postbigbang]

No.

If you think about, perhaps the reasons others are chiming in here is the banal illegality of it all. It's supposed to be free, and that means the make, too. Otherwise, it's not free; it's constrained, and it's impossible to use.

Any correlation between this and the RIAA/MPAA don't meet the test of credulity. They're really really different things.

Re:It would be nice to name names

[Cramer]

Most of what makes a Tivo a Tivo is custom software forwhich there is ZERO legal reason to publish. They make available their changes to the kernel and any other GPL software, as required by the GPL. However, that's not enough to replicate a Tivo. You are perfectly within your rights to remove all the non-GPL, unpublished software from your tivo (which, btw, includes the BIOS) and run your own creation(s) on it. I've done that myself to a old Series 1 -- who's BIOS doesn't check what it's loading. Without Tivo, Inc.'s proprietary parts, it's an expensive doorstop.

Re:It would be nice to name names

[Bing Tsher E]

Fine. Provide the custom build scripts.

They don't have to provide a mechanism to get the firmware into flash on the device. They can do all sorts of interesting things to block your modified flash from being accepted into the firmware. A small auxillary embedded controller can act as a gatekeeper. It can contain 'valid signatures' that they are under no obligation to issue. The embedded controller is part of a 'system' and separate from the GPL'd code, which runs on a separate processor. There are all sorts of tricks the vendor can use. And every one of them can be called 'security'- it prevents modified unauthorized firmware from running on the device. Which is a SELLING POINT to a lot of customers.

And of course, the chest-pounding in threads like this is a selling point for companies like Wind River. Their marketing people would hire a few psuedo-zealots to flame on, if it wasn't already being done for them for free here.

Re:It would be nice to name names

[tomhudson]

They can do all sorts of interesting things to block your modified flash from being accepted into the firmware. A small auxillary embedded controller can act as a gatekeeper. It can contain 'valid signatures' that they are under no obligation to issue.

GPL v3 prevents that scenario.

"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

They would have to supply all the design information of that embedded controller. The are also required to give you the "valid signature", just as they are required to give you the drm decryption keys, if they used gpl 3 code, because that 'gatekeeper' prevents access to the code on the target processor.

The other alternative for someone who wants to use GPLv3 code is to simply ask for a separate license from the copyright holder. Plenty of people wouldn't mind dual-licensing their code. Until mysql sold out, that was one way they paid the bills.

Find an author

[QuantumG]

For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.

http://www.gnu.org/licenses/gpl-2.0.html

It's a straight up violation. Go find the author of the software... any author of any part of the software will do.. and invite them to sue the manufacturer. Direct them to the Software Freedom Law Center.

Re:Find an author

[tuxish]

The scripts used means the scripts used. Not the compiler used. There isn't a violation there really. Just an annoyance.

Re:Find an author

[Xtifr]

Direct them to the Software Freedom Law Center.

Indeed, it's worth another reminder that the FSF is not in the job of policing GPL abuse. They publish the license for others to use, but they're only going to (only can) try to enforce it for code they actually own. Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.

Furthermore, while the GPL is intended to grant freedoms to you and other third parties, it is, by the fact that it leverages existing laws, difficult for a third party to enforce. It's easy to imagine the following dialog:

You: They won't give me all the code as required by the license.
Them: The license itself says its not mandatory and we don't have to accept it.
You: It also says that if you don't accept it, then normal copyright law applies, and they don't have permission to use the code.
Them: That's as may be, but you have no standing to sue us over the copyrights.
Judge: Agreed, case dismissed.

Of course, this means that they will have more-or-less admitted to copyright violation in open court, which is a pretty risky strategy, but suddenly, you're out a bunch of money and facing a dead end. Better, as QuantumG suggested, to get ahold of the copyright holders up front.

Re:Find an author

[BitZtream]

Might as well take this all the way to the limits.

Since hardware the code is running on is part of the build process, you'd also need to have not only entirely OSS software (ALL OF IT, firmware, bios, everything) but you'd also need entirely open source hardware.

I'll bet a months pay no one can make a valid claim of truly GPL compliant binary distributions if you follow that rule to the letter.

When you truely follow the full (and not some arbitrary version you create) dependancy tree, it would appear to me that all the major Linux distros are in violation of the GPL since I can't get source code to the transistors or the bios in their build farms.

Yes, I'm being entirely off the wall / bat shit insane / fubar / stupid. But where exactly do you draw the line on these sorts of things? You just stop when you get your way I guess?

As I said originally, push this issue legally, and you lose, regardless of the legal outcome.

Re:Find an author

[QuantumG]

That's the author of the software's decision. Great thing about copyright law, the copyright holders get to pick and choose who they sue.

Re:Find an author

[Anonymous Coward]

It would effectively cut off all GPLv2 and 3 distributions of Windows and Mac OS X binaries since regardless of how you look at it, there are portions of the build process which will never be open source.

Even under the most stringent reading requiring the compiler to be freely available, companies could still build binaries for these.

GCC is not self-hosting on Windows last I checked but GCC can be cross-compiled to windows and that can be used as the developers' build compiler. So the full recursive chain ships a working Linux live CD with GCC, source for that, source for GCC, the command to cross-compile GCC resulting in a windows build of GCC, the product source code, and the scripts required to build and package.

Re:Find an author

[rcamans]

the scripts used means the makefile they used. That is something you can read to tell what compiler they used, and even what version. But there may still be environmental variables not visible.

Re:Find an author

[RivieraKid]

Since the OP has given us no details as to the specifics of the two cases, it's impossible to offer any kind of rational comment.

Though, for your information, the GPL does not "infect" anything. It is a copyright license like any other except that it puts most of the control in the hands of the beholder. To the extent that it "infects" anything, that's all the choice of the developer. Don't want to follow the terms of the GPL? Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license. If you don't agree to the terms, don't use it. It's not rocket science, and it's not some kind of virus that needs to be stamped out.

By the way, due to the lack of information from the OP, it's not even clear if the FSF has any standing here - mentioning that they are not willing/able/prepared to fight the good fight is worthless when they may not even own the copyright allegedly being infringed.

I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.

I'm more inclined to believe this is something the FSF simply don't have the right to push for the reason mentioned above.

they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.

Are you confusing commercial with proprietary?

You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.

You see, there's the problem right there: Exactly what clause are these alleged companies accused of violating? They've provided the source code, Hell, the OP doesn't even mention what version of the GPL they think the companies are violating. I mean, really - how are we supposed to discuss the issue in such a scenario?

Re:Find an author

[BobPaul]

Doesn't the FSF own the code for the GNU userspace utilities? If someone is selling a device with the Linux Kernel, most certainly it contains utilities the FSF has ownership over.

Re:Find an author

[phantomfive]

I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.

This situation is one of the major reasons the FSF made a version 3 of the GPL. Releasing source code but using technical means to keep it from installing on a device is known as Tivoization.

Now, it is not clear from the summary if the company is actively preventing source code from being installed on the device, or if it can still be installed but you have to find your own bootloader, etc. As long as it's standard stuff, the company shouldn't have trouble. You aren't required to release the source of GCC in order to comply with the GPL.

Re:Find an author

[fuzzyfuzzyfungus]

In the case of embedded devices, BusyBox license violations are generally the order of the day...

Re:Find an author

[Hurricane78]

It would effectively cut off all GPLv2 and 3 distributions of Windows and Mac OS X binaries since regardless of how you look at it, there are portions of the build process which will never be open source.

Not true. For Windows there is Wine. And MacOS binaries can be compiled from Linux too. (Ever heard of cross-compiling.)

Of course if the binary includes non-open libraries, then that’s illegal in the first place.

And there is nothing apart from a compiler and the libraries, that you need to build that binary.

Re:Find an author

[mysidia]

Personally, I want a GPL++ license that doesn't have exemptions for the compiler and other tools in the build environment.

Nowadays it should be possible to build a stack that is free software from the ground up.

Re:Find an author

[hedwards]

In this case they might. One of the things that is sure to get them on board is if there's a good chance at setting precedence. I'm not sure what the outlook on this case would be, but it could resolve the issue once and for all. Or not.

Re:Find an author

[tepples]

Since hardware the code is running on is part of the build process, you'd also need to have not only entirely OSS software (ALL OF IT, firmware, bios, everything)

Coreboot.

but you'd also need entirely open source hardware.

The mostly-MIPS-compatible Plasma CPU exists. If the binary produced by a compiler running on an x86 CPU is byte-identical to the binary produced by the same compiler running on a Plasma CPU, is it still a case of turtles all the way down?

Re:Find an author

[yyxx]

Well, it might be good to have that as an additional option (as well as prohibitions against Apple AppStore-like usage). However, when the GPL was created, that was not an option, because most users were using it on machines where the compilers and other essential software was closed source.

Re:Find an author

[abulafia]

The problem with saying that GPL is not viral in that you just don't have to use it, is missing the point. The issue here is that it is hard to tell when one has violated the GPL.

Well, no, it isn't missing the point. It _is_ the point. If it is so difficult for you to understand if you're violating the license, simply don't go near GPL code. This makes it extremely simple to know you are not violating it.

The issue here is that it is hard to tell when one has violated the GPL. In your own discussion, you say that without specifics, you can't tell whether a violation occurred. In my opinion, the OP presented a reasonably generalized story.

The GPL is one of the easier licenses out there to understand, and there are reams of discussion about what it means. Try to understand the license that, say, Oracle grants you without a copyright lawyer at your elbow.

With other software, you can just buy the software, and know that since you paid money you have a reasonable right to use it.

Try arguing that with the BSA if they show up for an audit. Seriously.

More generally, the problem here, at least I think, is between chair and keyboard. Just because you think the license is weird does not make it so. If copyright law in general is complex and nonintuitive (and it is), that has nothing to do with the GPL.

If you're just dinking around with code and manage to make a mistake in how you release it, nobody is going to come after you with guns blazing and daggers flying - they'll point out the mistake and let you correct it. And even if they did (possible, I just don't think it would happen), you can stop distributing the code. If you're commercially distributing your code in hardware, you likely have an IP lawyer on retainer anyway who can explain it to you. The problem comes in for shops that either (a) base a business model on exploiting GPLed code with no intention of complying, or (b) are being intentionally careless, like these vendors.

and, I can't resist:

Look at the diversity of opinion on this very slashdot page as proof of my point.

Your median /. poster's grasp of IP law is similar to Sarah Palin's understanding of foreign policy. That they both can see the respective objects from home just makes them aggressively stupid in their analysis. (And at least, as a politician, Palin has an excuse.)

Re:Find an author

[GigaplexNZ]

Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.

Asking the authors of the legal documents for assistance as expert witnesses is a perfectly acceptable thing to do. Your analogy only works if the printers wrote the lease form as well as making physical copies.

Re:Find an author

[cyberthanasis12]

Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license

While I agree fully with the comment, I want to emphasize that the GPL license is a model copyright license, because it _lets_ the user really decide. If the user don't want to accept it, then they don't use the software and that's it. Nothing else to do.
On the other hand if you purchase a computer with Windows preinstalled, and _after_ that you purchased it you read the license, and don't agree, then what? Will you get your money back? We all know that this is seldom the case. It is also a lot of trouble for the obvious.

FYI, for the last 10 years or so, I have repeatedly asked my supplier, who is a friend of mine, to buy a laptop without windows. He always replied: not a chance, though he used more colorful words (on the other hand I have bought custom built desktops with SuSE).

Re:Find an author

[wvmarle]

The scripts is not necessarily the complete build environment. Apparently there is some code that is linked against or so that is missing - I am not programmer/lawyer enough to know whether those parts should be released as well. The problem is that you are hitting the "viral" part of the GPL: it is afaik not the idea that code that touches GPL code has to become GPL as well.

Here they are talking about "firmware tools" whatever that may be; it appears to me that this are pieces of proprietary software that are used one way or another in the compilation of the GPL'd software.

It is I think an interesting case, but I doubt it is as easy, clear, and black/white as you state it is. And, as other posters pointed out, probably one of the cases what GPLv3 was created for. It may very well be allowed under the GPLv2.

Re:Find an author

[QuantumG]

This is all stuff we discussed in the '90s. What it comes down to is: will the copyright holder sue? (typically the author). If he will, chances are he'll win in court, and more likely get a settlement before getting to court. That's the way copyright law works, for good or bad.

This is why back when Linus said he'd never sue anyone people were seriously shouting at him. Thankfully some kernel devs with spines came out of the woodwork. The busybox guys have shown the most spine to-date.

Re:Find an author

[jimicus]

There is one, it's called GPLv3.

Re:Find an author

[Bert64]

I would imagine that the vast majority of GPL code, even in cases like this, gets compiled using gcc so you already have the compiler.. It's just the build scripts you really need.

Re:Find an author

[Hal_Porter]

That baby is infected by a DEADLY BACILLUS! The DEADLY BACILLUS of COMMUNISM!

Duck and cover! Duck and cover!

Re:Find an author

[arth1]

The gcc you already have won't do you any good.
You need a cross-compiler version of gcc for the particular CPU used on the device, and when I say "version" I mean the whole cross compiling toolchain (gcc, kernel sources, binutils, glibc, and, if needed, libstdc++) has to match the versions used on the device, or at least be close enough to produce backwards compatible binaries and libraries.

Re:Find an author

[Sleepy]

You really should not spread misinformation about software licenses you do not understand. All of your "facts" are wrong.

Re:Find an author

[mini me]

He always replied: not a chance

These guys will happily sell you a laptop without Windows.

Re:Find an author

[Rakishi]

With other software, you can just buy the software, and know that since you paid money you have a reasonable right to use it.

Use does not mean modify. Use does not mean distribute. Go ahead, sell home made copies of windows and see how long till you get sued.

Hell, using windows isn't simple. The EULA tells you how you can sue it and it's anything but simple. Do I need a license for each uses who connects to a server? Can I run it in a vm? Can I run it in a non-microsoft vm? How many vms can I run of this software? Can I install it on multiple machines if only one is used at a time? If I have a student version when do I need to stop using it? If I have an OEM version, what hardware do I need to hold on to so I can legally use it?

Re:Find an author

[Xtifr]

Asking the authors of the legal documents for assistance as expert witnesses is a perfectly acceptable thing to do.

Ok, it's more like asking the authors of the lease form than the printers. Nevertheless, it's silly to expect them to intervene. Asking them for assistance? Well, they have FAQs. Asking them to appear as expert witnesses? There's tens of thousands of people (at least) using the license they published, so don't sound so shocked when they say no. Anyway, as I pointed out, his grounds to sue are pretty dubious in the first place.

If he'd mentioned taking any other action than "approaching the FSF", I probably wouldn't have said a word. Maybe I'm wrong, but I'll bet good money that he was expecting them to solve his little problem, and not just to appear as experts.

Re:Find an author

[Xtifr]

Actually, I believe the FSF owns some small amount of the code in the kernel as well, but I suspect they're overextended trying to enforce the license for code they more-or-less own outright, e.g. GNU utils and gcc. The kernel has dozens of copyright holders with much deeper pockets, who are in a much better position to pursue a case like this. Examples, include IBM, Sun, Oracle, Intel, Red Hat, HP--heck, even SCO has (perfectly legitimate) code in the kernel, though they're doing their best to forget it. (Ironically, SCO could be happily suing company after company to our loud applause if they'd decided to go after people who were actually violating their copyrights, instead of suing over non-violations of copyrights they didn't own.) :)

Re:Find an author

[Bing Tsher E]

There you go. If push comes to shove, the GPL people can require that GPL'd code ONLY run on the Plasma CPU.

Companies and individuals will flock to that part.

Or will they?

GPLv3

[selven]

The loophole being proposed is just a variant of Tivoization. And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

Re:GPLv3

[phantomcircuit]

Mod parent up. He is 100% correct.

Re:GPLv3

[Anonymous Coward]

You don't need the GPLv3 to fix this, though. It's addressed pretty directly in the GPLv2.

Mod parent down. He's only 50% correct.

Re:GPLv3

[Anonymous Coward]

I find this concept of moderating based on factual correctness quaint but interesting.

Re:GPLv3

[aynoknman]

Mod parent up. He is 100% correct.

Mod parent up. He is 98% correct.

Re:GPLv3

[selven]

I never said that you need the GPLv3 to fix it. I said that it does fix it, and everything similar you can think of. There's a slight but important difference there.

Re:GPLv3

[gringer]

Mod parent down, I don't like the tone of that comment.It needs to be dropped a couple of semitones.

Re:GPLv3

[Anonymous Brave Guy]

And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

Which may explain the almost complete absence of GPLv3 code in the software world.

In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero. Several of the major players in the industry design chips but outsource the manufacture, and the whole ecosystem is so locked down under NDAs that anyone trying to get detailed specs out in public would wish it was only Microsoft's entire legal team suing them. That means GPLv3 software is basically useless in most of the embedded development world.

Much the same probably applies to systems software, so many of those working on OSS operating systems, device drivers, etc. are similarly unable to work with GPLv3 code.

The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.

Re:GPLv3

[yuhong]

Luckily, I don't think that the GPLv3 actually require what you are talking about, nor do I think it was the intent of the GPLv3 to do this.

Re:GPLv3

[martin-boundary]

Mod parent 50% informative, because he's not using SI units.

Re:GPLv3

[hairyfeet]

Mod parent down because this is an AMERICAN site, and we don't cotton your sissy metric crap around here!

As for TFA that is why GPL came out with a V3, so it would be prudent to know which version of GPL the software being used is released under. V2 there isn't anything you can likely do as long as they release source, V3 they have problems.

Re:GPLv3

[Anonymous Brave Guy]

In the kinds of situations I described, it is not unusual for the build tools and libraries/APIs dealing with the proprietary hardware to be under NDA as well, either explicitly in their own right or implicitly because by revealing details of them you would be implying protected details about the underlying hardware.

In the GPLv2 days, this wasn't necessarily a problem, as long as you weren't directly linking to non-GPL'd code and you released the source code and build scripts for any parts of your system that were derived from GPL'd material. However, according to the arguments made by several posters in this discussion about GPLv3, it sounds like this is no longer sufficient for compliance (assuming those other arguments are correct and I am not misunderstanding).

Re:GPLv3

[Anonymous Coward]

Screw the parent, mod ME up.

Re:GPLv3

[Again]

Mod parent up. I have karma to burn.

Re:GPLv3

[koiransuklaa]

The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.

I think that's slightly revisionist.

RMS's ideas have pretty much always been originally minority views that people have tried to label as unpragmatic (and even laughed at). In time surprisingly many of those views have become "reasonable" and "mainstream" -- and it wasn't RMS who changed his mind.

The guy may be nuts, but he's a visionary -- his track record at defining a long term vision and seeing it come true pretty much beats anyone else in the industry. This will remain so whether in ten years GPLv3 turns out to become "reasonable" according to the rest of the industry or not.

Re:GPLv3

[wrook]

This has got to be the craziest post I've seen in a long time.

Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects. http://news.cnet.com/8301-13505_3-10294452-16.html This information took me 30 seconds to find on google. Before making wild ass comments, please do some research.

Now, you may have meant that GPLv3 code is rare on embedded devices. This may very well be true. But at least look up the numbers and tell us what they are rather than making outrageous comments backed up by nothing.

Also asserting that RMS is trying to capitalize on the popularity of the GPL to ram home his minority views is completely ridiculous. The GPL has ALWAYS been his vehicle for ramming home his minority views. Did you honestly think the GPL was popular when it was first released???? RMS and the GPL popularized these ideas in the first place. v2 isn't working exactly the way he wanted it to, so he changed it. What kind of warped view of the world do you have to have to think this is unreasonable?

Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues. It might not be for you. That's great. Choose another license. But take a look at some of the messages here. For example, vendors are allegedly shipping software for their wireless routers with vulnerabilities. Fixes exist for those vulnerabilities, but the customer can not apply the fix because they can't load a custom build. Things like this do not endear customers to their suppliers. Generally speaking, having the ability to fix your own problems is a good thing. This is one of the pragmatic issues that v3 fixes. The license is a promise by the vendor that these kinds of things won't happen. It is something that an informed consumer can base their purchase on if it is important to them.

I happen to think it is important to me. Many other people here happen to think it is important to them. Obviously you do not. I think you are letting your bias cloud your judgement, but that's up to you.

Re:GPLv3

[sco08y]

And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

Which may explain the almost complete absence of GPLv3 code in the software world.

In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero.

...

The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.

As much as RMS may be an ideologue, his view in this case seems to be pretty pragmatic.

Simply getting people using GPL'd code but being able to easily sidestep the requirement that others be able to use it completely defeats the purpose of it. Why would I ever want to make a deal that gives the other guy everything in exchange for, in reality, nothing? It's not pragmatic or moderate to accept an idea in principle but not act on it in fact, it's just pointless.

Maybe GPL 3 is slow to being adopted, maybe there are other places where it could have been better crafted, but the problem of getting people to comply *in substance* with GPL 2 already existed.

Now that people are looking at GPL 3 and saying, "we can't comply with this" doesn't mean that GPL 3 has made the problem worse, just exposed the fact that people were only complying with the letter of the GPL 2, not the substance of it.

Re:GPLv3

[WNight]

The GPLv3 doesn't require that all parts of a project be GPLed, merely that none of the other parts prevent the obligations under the GPL being met.

If you don't disable a device when booting an unsigned firmware you don't have to release the firmware signing code. If you don't require bit-for-bit identical binaries you aren't responsible for helping users generate them as part of the build environment.

Re:GPLv3

[Antique Geekmeister]

GPLv3 is an evolution of GPL, particularly GPLv2, against abuses which RMS predicted and which have now verified, most particularly patent issues. If you've not encountered patent software issues in the last 5 years, good for you, but they've been an increasing burden for people I work with.

The GPL is not merely "philosophical". While RMS may have a minority viewpoint, it's a minority viewpoint of someone with insight and a strange but effective brand of leadership, and the GPLv3 was developed openly with a _lot_ of community input and involvement. And GPLv3 was aimed squarely at a very real problem, the Novell/Microsoft patent licensing deal, which left Novell in a place to use and publish "GPL" code that was nonetheless patent encumbered by Microsoft and no one else could modify. If this seems unclear, the Wikipedia article is quite good, and the

GPLv3 was also written to be compatible with the Apache license. That is a big and heavily reviewed step, one which RMS wasn't completely thrilled about but which a lot of open source contributors were. So please don't claim that it's purely RMS's ideas.

Re:GPLv3

[multipartmixed]

> Why would I ever want to make a deal that gives the other guy everything in
> exchange for, in reality, nothing?

I have found that releasing software under FOSS licenses, even those less restrictive than the GPL, can be very useful indeed. Sometimes I get patches, sometimes I get bug reports, sometimes I get docs. Sometimes I can share implementation tips with others in the field, and send "Help Me!" messages with real working examples. It also makes it easier to find developers, because they are already 'up to speed' on my stuff when they start coding for me. FOSS is win-win in many regards, it doesn't have to do be via source contribution by any stretch.

Re:GPLv3

[Anonymous Brave Guy]

Last summer CNet reported that 50% of GPL projects hosted by google code were GPLv3. That works out to at least 56,000 projects.

And how many of those are actually stable, shipping, useful software? How many users does that represent, in total?

Finally, if industry is accepting the GPL because it is pragmatic, then that is a good thing. I'm sorry that you can't see beyond the end of your nose to see that v3 addresses pragmatic issues.

I never said it didn't. But if it really goes as far as some in this discussion are suggesting — and not being a lawyer, I'm not sure whether it really does or not, so I'm taking their word for it — then I think it has moved beyond pragmatism into the world of wishful thinking.

I don't really understand what is pragmatic about the kinds of cases I described. Code that is designed to run on specific hardware and requires specialist software or hardware to build/install is probably of most interest to others who also work on that hardware and already have access to the corresponding build/install systems. Those others are probably the most likely to contribute something of value back to the community as well. In trying to make everyone open up everything to everyone else, GPLv3 appears to get in the way of people opening up most of what they do to share with those who would most benefit from it, with the result that no-one can share anything with anyone in these fields under GPLv3.

It's like the FSF presented the industry with an all-or-nothing proposition, and since it had no choice, the industry said "Well, too bad, we'll have nothing then."

Re:GPLv3

[Sleepy]

>>And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.
>Which may explain the almost complete absence of GPLv3 code in the software world.

Interesting assumption, but you are wrong.

Large successful free software projects contain the work of HUNDREDS of developers.
Relicensing requires consent of everyone in the project.
This means there is a real-world dollar cost to to track down developers who have quit the project, moved on, or simply _died_ (in which case the copyright belongs to their estate, which may be a murky issue).

Developers who do not consent or whose copyright wishes can not be resolved would then need to be written out of the code somehow.

So your position would suggest:
a) you underestimate the logistics
b) you have already arrived at a strong anti-GPL opinion... and you are warping facts to support it.

Before you could even try this expensive non-trivial operation on any project, you would need a plan to pay for the organizational costs of this diruptive opnm, requiring majority consent to even make invesigation of this feasable, and even organizing the attempt alone requiring corporate sponsorship or

Re:GPLv3

[Anonymous Brave Guy]

Large successful free software projects contain the work of HUNDREDS of developers. Relicensing requires consent of everyone in the project. This means there is a real-world dollar cost to to track down developers who have quit the project, moved on, or simply _died_ (in which case the copyright belongs to their estate, which may be a murky issue).

Sure. But the GPLv3 has been around for nearly three years now in its final form, and the thinking behind it was clear well before that. If, as GPL evangelists frequently claim, copyright and patents are horribly broken as an incentive to develop works and we would be better off sharing everything GPLv3-style, then why isn't the world full of new and exciting creations that have been in the GPLv3 era for their entire lifetime and used that licence from the start? There is no shortage of serious work supported either by a traditional copyright model or by the GPLv2 within the same time frame, is there?

So your position would suggest: [...] b) you have already arrived at a strong anti-GPL opinion... and you are warping facts to support it.

I don't have a strong anti-GPL opinion. It's true that I don't believe we are ready to do away with copyright just yet, but I think the GPL has created an interesting culture with considerable potential, and I have no problem at all if some people choose to contribute their code to that culture on those terms whether for philosophical or practical reasons. I don't see that this has to be some sort of either-or battle where only one model can be useful.

I do have a fairly strong anti-GPLv3 opinion, because I think they threw the baby out with the bathwater. I fear that will be harmful to a valuable culture that has already built up around earlier versions of the GPL, and reduce the future benefits by dividing the community.

Re:GPLv3

[RAMMS EIN]

``I don't really understand what is pragmatic about the kinds of cases I described.''

Well, perhaps you can explain what you meant by the following, then:

The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.

``Code that is designed to run on specific hardware and requires specialist software or hardware to build/install is probably of most interest to others who also work on that hardware and already have access to the corresponding build/install systems. Those others are probably the most likely to contribute something of value back to the community as well. In trying to make everyone open up everything to everyone else, GPLv3 appears to get in the way of people opening up most of what they do to share with those who would most benefit from it, with the result that no-one can share anything with anyone in these fields under GPLv3.''''

While I agree that having source code for software that runs on specific hardware is probably of most interest to those who have that hardware and the build systems necessary for compiling the code, and while I agree that those who have the hardware and the build systems are the most likely group to contribute something of value, I don't see where your next sentence comes from.

The GPLv3 is not trying to open up everything to everyone else. Neither is it getting in the way of people opening up most of what they do to share with those who would most benefit from it. What the GPLv3 is doing is applying certain conditions to products licensed under it. Same as every other license.

In case of GPLv3, as relevant to this discussion, it aims to amend the GPLv2 so that entities can't distirbute "GPL-covered software that you can't effectively change" (Why Upgrade to GPLv3). In other words, where GPLv2 requires that source code be made available to those who receive binaries, GPLv3 takes some extra steps to make sure that people receiving that source code will actually be able to use it to make changes to the binaries that they received.

As you say, source code is most useful to those who have the required tools to build it, and the required hardware to run it. GPL, whether v2 or v3, aims to make it so: both require corresponding source to be made available to those that binaries are distributed to (in this discussion, people who purchase the hardware the code runs on), where corresponding source includes not only the source code proper, but basically anything required to build the software, with the possible exception of general-purpose tools or generally available free programs. In other words, far from getting in the way of making things available to those who would most benefit from it, GPL aims to _require_ making available everything needed to build the software to those who purchase the hardware.

``It's like the FSF presented the industry with an all-or-nothing proposition, and since it had no choice, the industry said "Well, too bad, we'll have nothing then."''

I don't understand where that is coming from, either. The FSF and others (e.g. the Linux and Busybox projects) presented the industry with software licensed under the GPL, and some players in the industry chose that software in preference to software licensed under other licenses (e.g. VxWorks). Of course, that does mean they have to abide by the terms of the license. In all cases I am aware of, they have also made an effort to do so. Some have done so up front. Others have done so after being reminded of their obligations. And yet others have only lived up to their obligations after having been threatened with lawsuits. None of that looks like "we'll have nothing then"

It's still a GPL violation

[mysidia]

GNU GENERAL PUBLIC LICENSE Version 3 Free Software Foundation, Section 1, "Source Code.": The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.

The GPL does not allow authors to hide or refrain from distributing any build scripts or information required to build/install the binaries.

They cannot have a "secret" build environment, the GPL requires that they reveal all scripts and information about the build environment.

I don't understand why the FSF would not pursue this with full vigor. Obviously you cannot exercise your freedom to modify code, if the vendor does not distribute the pieces required to build and install a binary.

Re:It's still a GPL violation

[penguinboy]

It doesn't sound like that applies. The OP mentions being unable to get the compiler and firmware loader utilities (which I expect would be "general purpose tools ... used unmodified") - not build scripts referred to in the quoted section.

Re:It's still a GPL violation

[Dumnezeu]

But the build scripts were not written by us. They are general-purpose build scripts, written by a third party for which we paid and we don't have the right to distribute them to anyone. Oh, my! Did I just say general-purpose? I'm sorry, but you can't have them and you're not allowed to know anything about them!

Re:It's still a GPL violation

[Hurricane78]

One of the companies still openly admitted that they violate the GPL:

one of them acknowledges that they are not fully GPL compliant, due to other license restrictions

I’d tell the FSF to sue them to hell and back! What is GPL? A second class license that can be just ignored due to some other stuff??

Re:It's still a GPL violation

[c1ay]

Does that effectively mean you can't legally install GPL code on ROM since it couldn't be overwritten even if you did have the build environment and installation scripts?

Re:It's still a GPL violation

[mysidia]

A 'firmware loader' is a perfect example of a special-purpose tool, that has exactly one use: to load special firmware on a certain kind of device.

By definition, a general purpose tool is one Designed for or suitable for more than one use; broadly useful (definition from: American Heritage Dictionary, 2000)

An example of a general purpose tool would be: cat, grep, tac.

These are not specially designed for use in their build environment.

Re:It's still a GPL violation

[Panaflex]

That's an awesome system you've built... thanks for sharing!

Re:It's still a GPL violation

[jellomizer]

I don't understand why the FSF would not pursue this with full vigor.

Actually it is a very simple concept... It is called pick the right battles. Right now there are lot of big violators who are breaking almost every point in the GPL. In terms of legally fighting each point they are violating is a weapon FSF can use on their end. The the company is breaking the spirit of the GPL or just a couple of points then it is much of a harder case, as there is little they can do to fight it. Especially if the opposing legal side finds loopholes for example they may argue that the firmware isn't software, it is hardware. Or the software for the firmware isn't needed for a full install of the gnu portions of the product. It is just a closed source tool to make editing the system easier so it is a lot like a Linux distribution that comes with closed source tool. In short it will be a tough battle.

If FSF goes after all violators with full vigor it could create a chilling effect that could scare a lot of companies away from GPL not because they don't want to play by the GPL code but it would be too scary if they missed or misinterpreted a point and get stuck in a legal battle, sometime if you violate the GPL you cannot just "release the source and make everyone happy" because it may mean that you are violating someone else's license, and they just make you pay more. Oddly enough I haven't seen a software development department where there is a full time lawyer reading the licenses of every 3rd party tool that you use, and make sure they are all in compliance.

Or lets think about it this way...
Do you want to get Sued for sining "Happy Birthday" at a party for copyright infringement, as Time Warner owns the Copyright to "Happy Birthday". What will happen if Time Warner does... Well people will stop using Happy Birthday, and the Good Will value of the song will lesson. However if say Disney uses it without permission, that will give Time Warner a hand were they can sue for damages, or make a deal to share some of Disney's copyrighted material.

Re:It's still a GPL violation

[xlsior]

Does that effectively mean you can't legally install GPL code on ROM since it couldn't be overwritten even if you did have the build environment and installation scripts?

I doubt it, because you can still replace the ROM chip altogether with a custom written version.

After all, you also can't directly overwrite/replace GPL code that's distributed on other read-only media, like CD or DVD... but as long as you have access to the proper equipment (CD burner + blank discs) there is nothing that stops you from creating usable 'custom' copies. I'd think the same applies to code in ROM, it's just that the necessary equipment is not typically found on your average home computer.

Re:It's still a GPL violation

[mysidia]

No. It is fine as long as you provide all source and details required to burn a new ROM with modified code.

Re:It's still a GPL violation

[mysidia]

Per the GPL, all build scripts must be distributed. It doesn't matter whether you call them "general purpose or not"; the term general purpose has a specific meaning, and build scripts have a specific purpose, not a general purpose.

If you don't want to distribute your build scripts, then you cannot further distribute the software, without committing copyright infringement.

The only legal thing you can do is not distribute the software at all, or rewrite the build scripts so you can distribute them.

Re:It's still a GPL violation

[RobertLTux]

in this case if it was possible to pop the chip out and replace it with another chip (or slot an override chip in a provided slot) then this would be following the letter of the GPL.

Re:It's still a GPL violation

[PAjamian]

Those would actually qualify as install scripts, see GPL Violations Source Code Release FAQ, specifically this section:

What are "scripts used to control installation"?

        After having translated software from its source code form into
        executable format, the program quite often needs to be installed into
        the system. The process of installation is often automatized by
        installation scripts. Exactly those scripts are referred to by the
        GPL.

        Please note that this is of special practical importance in the case of
        embedded devices, since the executable program(s) need to be somehow
        installed onto the device. If the user is not given a way to install
        his own (modified) versions of the program, he has no way of exercising
        his freedom to run modified versions of the program.

        Sometimes, the process of installation is not facilitated by scripts, but
        by some other means (such as executable programs). The GPL text only
        mentions the word "scripts". But when reading and interpreting the license,
        it is clearly understood that the license doesn't specifically only mean
        "scripts", but any kind of software programs that are required to install
        a (modified) version of the compiled program.

Re:It's still a GPL violation

[amirulbahr]

They do not have to distribute the work's System Libraries, or general-purpose tools. i.e. The compiler, system header files and libraries. For most embedded environments this means you still can't build even with the Makefiles and build scripts. They are probably using proprietary compilers and IDEs.

Re:It's still a GPL violation

[Bigjeff5]

It sounds like the problem is the device, not the released code.

Basically, he needs a compiler for the hardware, or the image file format that the device uses to store the firmware. If either of those two things are proprietary, and have nothing to do with the GPL'd code (the fact that GPL'd code is packaged thus doesn't mean the GPL "infects" the proprietary portions of their hardware), they are not in any way required by the GPL to release them.

Basically, the OP is perfectly capable of compiling and running the source on a different piece of hardware, but he cannot modify and re-install the software on this hardware because there are other components not covered by the GPL which are required to make it compatible with his hardware.

The answer to this is not easy, but it's perfectly legal: Reverse engineer the firmware format, then install your modified code.

It doesn't sound like there is any legal justification for forcing them to distribute proprietary software/hardware access. The GPL doesn't give you license to their hardware, just the software, and they already gave that away like they were supposed to.

Re:It's still a GPL violation

[Bigjeff5]

I believe the build scripts were distributed.

The issue here is a proprietary firmware image format, which the GPL would not cover. They released all GPL code. Wrapping it up in a proprietary format so that it will work on your device does not mean GPL suddenly applies to that format. It only covers GPL'd code and modifications to GPL'd code.

Once that sucker is compiled, they can do anything they want with the binary, including packaging it in a proprietary image format for flashing to a ROM. That portion of it they don't ever have to give up.

Re:It's still a GPL violation

[Bigjeff5]

That's not true at all. If what you say were true, then installing GPL software on a Windows machine means NTFS is suddenly GPL too. That's stupid, of course it isn't.

Once the GPL'd code is compiled it's a separate entity. You can wrap it up however you like, it doesn't magically GPL code that has nothing to do with the GPL'd code.

The code is available, and apparently complete. The OP is free to put it on any machine he likes. However, if he's going to put it on the vendor's hardware, he needs the image file format and any special software necessary to flash the ROM. This would be true whether he were using GPL code or just wanted to put nonsense on there. It has nothing to do with the GPL, it doesn't touch this.

If the code is not complete that's a completely separate issue, and the GPL definitely comes into play, but that's not what the OP said.

Re:It's still a GPL violation

[mysidia]

The GPL has a whole paragraph dedicated to the hardware probelm and additional restrictions in Section 6:

A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work....

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.

Re:It's still a GPL violation

[mysidia]

That's not true at all. If what you say were true, then installing GPL software on a Windows machine means NTFS is suddenly GPL too. That's stupid, of course it isn't.

False premise. A windows machine knows how to store its data using the NTFS format, and Windows is not GPL'ed. You do not need information about the proprietary NTFS file format in order to successfully load software onto a Windows machine.

The installation of software on Windows does not require NTFS code, so you do not need a NTFS implementation or NTFS internal details distributed with Windows software.

Once the GPL'd code is compiled it's a separate entity. You can wrap it up however you like, it doesn't magically GPL code that has nothing to do with the GPL'd code.

You can wrap it up however you want, provided you provide all details required to satisfy the 6. Conveying Non-Source Forms requirements under the GPL.

“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.

If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information.

"

Re:It's still a GPL violation

[10101001 10101001]

There's really two main issues.

One, GPL software can be used anywhere once you've legally obtained it (barring some sort of specific law, like for nuclear reactors or whatever). This is true with any software since copyright covers copying, not use--EULAs legality being obvious a side discussion. Presumably the issue at hand is redistribution, since it's an intellectually empty exercise on what one can legally do with one's own things in such a circumstance.

Two, GPL software can only be legally redistributed if it complies with the GPL license. This means really GPL software, not just pseudo-GPL software. Pseudo-GPL software would be if, for example, I wrote a program, compiled a binary, and then redistributed just the binary with a copy of the GPL. Since I'm the original author, I have perfect redistribution rights to the binary, but no one else can actually comply with the GPL since they lack the source code. Once you get GPL software from someone else, though, if you want to redistribute it you have to comply with the GPL to remain legal (or, obviously, negotiate a deal with the original author(s) under a different license).

You bring up the issue of "installing GPL software on a Windows machine means NTFS is suddenly GPL too" and of course the answer is no. The legally murky question is whether there is such a thing as "GPL software on a Windows machine"--or even "GPL software on a system with closed firmware". Of course, most people tend to treat it as "it's okay so long as it doesn't appear to be nefarious efforts to hinder modification" (ie, Tivoization). Making a ROM chip can be nefarious or it can simply be economical (ROM being possibly cheaper than flash). Flash being used and the flash tools not being redistributed and available, GPL licensed or not, seems more nefarious and is likely to urge rancor.

When it comes down to it, in a civil suit the copyright holder of the GPL code as well as the FSF are in the best position to argue the intent of the use of the GPL and language of the GPL. With only a majority agreement need with the jury, most cases would probably be persuaded on the seeming intent of most of the GPL language and side with the copyright holder. The simple point that the FSF and the copyright holder could invariably bring is, since the issue is legally murky the vendor should default with the safest legal option: don't redistribute the code or binaries based on it.

To that end, the safest legal defense to redistributing a ROM chip with GPL code on it would be to obtain the blessing of the GPL code's copyright holder. So, I'd say there'd be a pretty legally definitively route to releasing GPL code on a ROM chip.

Re:It's still a GPL violation

[hweimer]

I don't understand why the FSF would not pursue this with full vigor.

Typically, the FSF does not hold copyrights to the code that is distributed on embedded devices. Most devices ship with some variant of Linux+BusyBox, where the copyright rests with the individual authors. It might be helpful to contact Harald Welte's gpl-violations project, who might be able to provide contact to people with actual rights to the code in question.

Re:It's still a GPL violation

[WNight]

Pay a kernel developer to do their work for your company. You should then have standing to sue when the next generation of t1vos/etc adopt a kernel containing your software. It probably wouldn't be hard to find someone willing.

There's a lot of legal nonsense around it though. In photography (in the USA) registering a copyright (which should be unnecessary) is essential to being able to really pursue a claim and receive damage.

Re:It's still a GPL violation

[WNight]

Which is why the GPLv3 was created and you should use it anywhere you'd use the GPL.

No, they're just non compliant

[Pop69]

As far as I can read it, the corresponding source definition in clause 1, GPLv3 covers that situation

The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

My reading of "all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work" would cover the build environment. They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though.

Re:No, they're just non compliant

[Dr_Marvin_Monroe]

No, I disagree. The section "However, this does not include the work's System Libraries, or general-purpose tools..."

I read this as you must include the defines that you used to build it, but not the build script or firmware loader utilities that you used to put it on the device. To point out, the GPLv3 is the strictest, GPL1 and GPL2 are not as strict.

Not a violation here.

Re:No, they're just non compliant

[Zecheus]

And all those people who redistributed a GPL Java application before Java runtime was released with GPL; let's go after them too.

Re:No, they're just non compliant

[gmthor]

Where did the article say it was GPLv3 instead of v2?

Obvious answer, old answer.

[kurokame]

Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?

Yes - it's called "having more lawyers than you."

What are you going to do about it, sue? You can always sue...if you actually have the resources to fight it out. And even if you actually get it to stick, it could be years down the road before you actually get access.

Regarding your specific case, can you reverse-engineer a solution?

Re:Obvious answer, old answer.

[eclectro]

Regarding your specific case, can you reverse-engineer a solution?

Firmware chips can desoldered and be disassembled in most instances. Unless this is a cellphone, where the firmware is integrated with the CPU and fuse links burned to prevent access. Then, more advanced and involved efforts could get at it. But it would be time consuming and require a team resources.

Depending on the device and circumstances (and I agree the community should know what the devices are) it might would be worth it to chase after it in court. If only to get the build environment released as GPL. As another poster noted, it needs to be known that "Tivoization" can not be used to steal code.

Re:Obvious answer, old answer.

[RivieraKid]

He can't sue, because he has no standing. He's not the copyright owner.

Re:Obvious answer, old answer.

[Hurricane78]

That’s what the FSF is for.
And they already got a long track record of “suing the bastards” for cases that are exactly like this one.

Re:Obvious answer, old answer.

[fishexe]

He can't sue, because he has no standing. He's not the copyright owner.

I would think in future version of the GPL this could be fixed by adding a provision permitting users to pursue claims against violators, either on behalf on the copyright holder or on behalf of the users themselves, who are harmed by the violation. A copyright holder can't assign standing to pursue copyright violators other than by transferring copyright, but the parties to a license should be able to assign standing to pursue license violators by specifying other interested parties in the terms of the license.

Re:Obvious answer, old answer.

[influenza]

But couldn't he sue because he is a customer? The company sold him a device that includes software for which the license is GPL, but is not respecting his rights under the GPL. The rights that the GPL grants are primarily to the user, are they not?

Re:Obvious answer, old answer.

[RivieraKid]

No - I'm not a lawyer etc, but after a quick perusal, in the UK and US at least, as copyright legislation stands, only the copyright owner can sue for copyright infringement. Otherwise, you'd get a situation where I could sue you for copyright infringement for the latest hit console game, even though I have no connection to you or the game company - it'd be chaos. Of course, there wouldn't really be a problem in the proprietary world, but then you lose all of the freedoms that the GPL grants you.

Even law enforcement does not (or at least, isn't supposed to) actively enforce copyright - even if it's criminal copyright, unless the copyright holder has asked for action to be taken.

Of course, he could still sue, though if he makes copyright the sole grounds for his lawsuit, it's probably going to be a very short case, and it won't end in his favour.

If he's in Europe, he may be able to sue on the grounds of our stronger consumer protection laws, but even then - I seriously doubt he'd get past the first hour before the case is dismissed.

The company sold him a device that includes software for which the license is GPL, but is not respecting his rights under the GPL.

You're absolutely right, but one right the GPL does not transfer is the *copyright*. You get the right to do pretty much what you want with the software, so long as you play nice and transfer those same rights to anybody you distribute the software to, but you don't get the copyright on that code.

Re:Obvious answer, old answer.

[RivieraKid]

As you say, copyright holders cannot assign standing to third parties other than by transferring the copyright. The problem is, is that as copyright legislation stands, only the copyright owner can sue for copyright infringement.

Even if the next version of the GPL included such terms as you suggest, they would be unenforceable because they would be neutralised by copyright law. That's why you don't see such terms in licenses - they would be legally unenforceable, and that would hurt the GPL more than situations such as the one the OP is discussing.

Don't sue...

[SharpFang]

This only adds bad press to Linux. OTOH an offer to cooperate with freeing up the firmware?
Sign an NDA on a tool-set for the company, then release a free version. Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.

Re:Don't sue...

[TheRaven64]

He can't sue, because unless he is the author of one of the piece of software distributed on he device he doesn't have standing. I'm not sure that bad press is something to be concerned about though - does Microsoft get bad press when they go after people distributing machines pre-installed with Windows without complying with the license agreement (i.e. paying them)?

Re:Don't sue...

[qbast]

This only adds bad press to Linux.

WTF? Making a company comply with a license gives "bad press" ? I think that current way (asking, nagging, offering help, refusing to take any serious step) is worse - it promotes idea that GPL and other free licenses don't really matter - you can ignore them all you want and in worst case they can string along the community by releasing small bits and "discussing the situation" until the product becomes obsolete anyway.

OTOH an offer to cooperate with freeing up the firmware? Sign an NDA on a tool-set for the company, then release a free version.

Sure. Why not become unpaid employee. It is the company's responsibility. If they are incapable of understanding license of software they distribute, then maybe it is time to fire (and sue for damages) their lawyers.

Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.

Well, they did not comply with the license, so it has been automatically revoked, isn't that right?

Re:Don't sue...

[Arker]

Don't ever sign an NDA. That's horrible advice.

If the build-system has to be reverse-engineered for this company to avoid being held accountable for their commercial infringement of copyright, it's on them to get it done. And the person implementing the new build-system will need to be working in a clean room, without ever seeing the old build system, so there is no call for an NDA there. Get one person to analyse and document the function of the old one, and write the specification, then the person who does the new build system only sees that spec.

Re:Don't sue...

[Rockoon]

Its bad press because

if such a lawsuit lost, then vendors have a clear path to using Linux while also not allowing modification.

if such a lawsuit won, then vendors would never be able to use custom-but-for-hire solutions again which translates into never using linux again.

Re:Don't sue...

[SharpFang]

He's a customer - a licensee of GPL'd software. As such, he is entitled to sources, build environment and toolset, and he can sue to have them delivered. Just like a customer can sue a TV manufacturer that his TV was shipped without a remote control despite being advertized to come with one.

The situation is different concerning Microsoft - after all they lose money, and get them back through the lawsuit. Linux, OTOH, is gaining popularity. The lawsuit is likely only to make the manufacturer to give up using Linux permanently - a loss for all. A peaceful solution is needed if you want the manufacturer to comply with GPL instead.

Re:Don't sue...

[mysidia]

See.. the GPL needs to include a clause assigning the end user a license to pursue action on the copyright owner's behalf, regarding unlawful distribution to that user, providing they return proceeds to the copyright owner [minus attorney costs] :)

Re:Don't sue...

[SomeKDEUser]

Basically, either vendors play the game, and they get all the nice code for free, or they can build their own.

What? Corporations can't actually afford building their own OS/toolchain from scratch? Tough shit. Hey, the free market is always right, right? If a corporation can't afford making something, then they don't deserve it.

Basically, I care about free software because I don't like that any for-profit entity dictates to me what I can do or not with a piece of Si/Al/Cu/Polymer.

Now, interestingly, thanks to Turing and Von Neumann, what I can potentially do is without limit, any restriction is therefore extremely onerous. This makes the closed devices, in fact, evil: because a potentially infinitely useful device now only has limited use, even is it is more polished.

I fully recognise the right to design, build, sell, buy and use such devices. I simply don't see why any free help should be given. I cannot understand how anyone would think that it is remotely defensible to support and find excuses for stealing other people's work for profit, and in such a way that the potential utility to the public is dramatically minimised.

Re:Don't sue...

[dissy]

if such a lawsuit won, then vendors would never be able to use custom-but-for-hire solutions again which translates into never using linux again.

But that isn't a bad thing as you say. In fact that is *exactly* what every last contributor to Linux wants, as evidenced by their choice of distribution license, so in fact it is a Good thing.

These companies probably wouldn't think twice about suing any one of us for copyright violations against them. It's only fair they are held to a similar standard. Of course without knowing what companies these are, it's possible this statement might not be correct, but I'd guess that would make them the exception instead of the rule.

Re:Don't sue...

[qbast]

Its bad press because if such a lawsuit lost, then vendors have a clear path to using Linux while also not allowing modification.

If there are doubts about GPL being enforceable, then it is time to move to different license ASAP.

if such a lawsuit won, then vendors would never be able to use custom-but-for-hire solutions again which translates into never using linux again.

And this is a problem because ... ? GPL comes with set of rules. If company does not like them, then tough, find something else with more company-friendly license or spend the money to write your own software. There is no God-given right to profit on someone else work.

Re:Don't sue...

[TheRaven64]

Nope. The GPL is a distribution license, not a contract. If you do not abide by it then you are not in breach of contract, you are violating copyright. If the company does not distribute the software according to the terms of the GPL, then they are violating their agreement with the original author that allows them to distribute the software at all, not their agreement with the customer. The GPL is irrelevant as soon as it is infringed - it just means that the company now has no license to distribute the code; the fact that they used to have one according to the GPL does not matter.

Once they are distributing the software with no license, the copyright owners have the standing to sue. The person who received the software illegally does not (at least, not via the GPL; they may be able to sue for misrepresentation of goods or similar).

Re:Don't sue...

[Rockoon]

But that isn't a bad thing as you say.

I didnt say it was a bad 'thing' .. I said it was bad 'press'

Re:Don't sue...

[kangsterizer]

thats correct.. i already pointed such GPL issues to some device maker.. they just replied in all honesty "i don't care about the license, by the time we're sued - and by that i mean if we're sued - the product will be obsolete so we won't care either"

some even dare to say "free software people would do anything to steal our hard work". and forget that they're usually stealing hard work of thousands (or more) of people by not respecting the license (since they usually use a complete Linux system)

Re:Don't sue...

[Rockoon]

And this is a problem because ... ?

Here comes the linux defenders, who will defend linux even when it doesnt need defending.

The point is that its bad 'press' .. that may, or may not, be a 'problem' ... it is, however, true.

Re:Don't sue...

[qbast]

And this is a problem because ... ?

Here comes the linux defenders, who will defend linux even when it doesnt need defending.

Submitter of this story wants to change some stuff, which is his right under GPL but cannot because the company ignores it. Clearly it needs defending in this case.

You know, just grow up. 'OMG! Real company is using my stuff! Someone noticed me!' is good stance basement-dwelling nerds and BSD developers. In real world contracts and licenses matter.

The point is that its bad 'press' .. that may, or may not, be a 'problem' ... it is, however, true.

Usually offending party gets bad press.

Re:Don't sue...

[Rockoon]

Submitter of this story wants to change some stuff, which is his right under GPL but cannot because the company ignores it. Clearly it needs defending in this case.

There is a big reply button at the top for replying to the article.

You know, just grow up

You know, just wise up. When you reply to a persons comments (qhich were even quoted), it is expected that you have something relevant to what that person said, more specifically, to what was quoted.

People who take their OS way too seriously leave their logic at the door. They will reply to anything that seems even remotelty negative with whatever they have that, regardless of how topical it is.

The bad press comment was not a bash against linux. Stop treating everything linux like a religion. Its not a fucking religion.

Re:Don't sue...

[Lunix Nutcase]

What would be the point? It wouldn't be legally enforceable.

Yes, that is exactly what they are doing

[BlueBoxSW.com]

And it'll work, too.

Re:Yes, that is exactly what they are doing

[gringer]

And it'll work, too.

As long as there aren't dogs and those meddling kids involved.

No end run

[Todd Knarr]

No, the build environment doesn't provide an end-run around the GPL. Both v2 and v3 of the GPL require the distributor to provide the scripts that control the build. In GPLv2 it's in section 3, in GPLv3 it's in section 1. GPLv3 also covers this again in section 6, in a more general form when it discusses installation information.

Re:No end run

[harlows_monkeys]

The submitter didn't say that the scripts that control the build are missing. He said they don't provide a build environment. If I distribute GPL code that I build with Visual Studio, I don't have to distribute Visual Studio. I just have to distribute the project file (or whatever it is nowadays--haven't don't Windows in a long time).

It sounds like both companies are distributing embedded software for a hardware device. It's quite possible that the things they aren't distributing are part of some third-party expensive development environment, that they are using off the shelf. If that's the case, there's no GPL violation, as long as they distribute everything the submitter would need to build and install the software if he were to go obtain from that third party the development environment.

Re:No end run

[mysidia]

In fact, Redhat might be violating the GPL, then. Providing more examples of potential violations doesn't change other people's violations into non-vios.

Re:No end run

[Todd Knarr]

Actually, RedHat does. When you pull the source code for a RedHat distro, you get all the makefiles, configuration files, build scripts and everything else required to build the entire distribution from source code. You will, of course, have to first get the binary distro (or otherwise have the build tools available, but since RedHat's using the GNU toolchain that's trivial to obtain from RedHat or elsewhere), but RedHat makes their binary distribution available to you so there's no violation there.

Re:No end run

[wwahammy]

As an aside, even with Visual Studio, the compilers are available free of charge to anyone and you SHOULD be able to compile the code without paying for Visual Studio.

Hm..

[oldhack]

What if the firmware is burned into ROM and hardware only supports ROM?

Re:Hm..

[mpoulton]

What if the firmware is burned into ROM and hardware only supports ROM?

You burn a new PROM (or EPROM, or EEPROM...) to replace the existing one. If you have the wherewithal to tinker with the firmware on a device that only supports ROM, then you certainly have the wherewithal to swap an IC on the board.

Re:Hm..

[Dun Malg]

Like the GPL says, they need to supply everything necessary to compile, install, and run the software, except for perhaps the utility you'd use to burn the EPROM. The media they choose to distribute it on is irrelevant. It could be chiseled into stone tablets.

But this is largely irrelevant, as nobody with half a brain uses ROM firmware. Flash allows you to correct firmware errors later.

Re:Hm..

[TheRaven64]

This is almost entirely wrong. Version 2 of the GPL does specify that you need to specify everything required to compile the software, but not to run it on any specific machine. That's what Tivoisation is about; you can grab the Linux code for the Tivo, you can compile it, you can run it, but you can't run it on a Tivo.

Secondly, the media is not irrelevant. The GPL specifically states that it must be a medium commonly used for software interchange. Stone tablets would most definitely not fit this description.

Sometimes I wonder if there is any overlap between people who advocate the GPL and people who have actually read it...

Re:Hm..

[mysidia]

Yeah... it seems like they can make it really inconvenient though. By soldering down the EEPROM, breaking the erase pin, dipping the whole chip in EPOXY, Urethane, or applying ceramic coating the board, which are normally used to prevent tampering or modification.

Then the instructions to install your code involve remove coating, desolder EEPROM chip, program new EEPROM chip, mount in place.

Re:Hm..

[tepples]

You burn a new PROM (or EPROM, or EEPROM...) to replace the existing one.

And do what when the existing ROM chip has a custom, stream-ciphered wire protocol?

Re:Hm..

[wvmarle]

Like the GPL says, they need to supply everything necessary to compile, install, and run the software, except for perhaps the utility you'd use to burn the EPROM.

Mmm... that would include compilers? Third-party libaries that are linked against? Not all are available for free, some are mighty expensive, or have other restrictions. DRM comes to mind. Problems may arise when the target is custom hardware, that requires custom compilers. Now the manufacturer is required to release their changes to GCC as well, even though they are not redistributing GCC itself? Getting troublesome. I thought the GPL was not supposed to be a viral license.

Re:Hm..

[Bigjeff5]

The media they choose to distribute it on is irrelevant. It could be chiseled into stone tablets.

What they don't have to do, however, is give you a chisel and a fresh stone tablet so you can do it exactly like they did.

Seriously, it sounds like they distributed everything necessary to build the code on any machine you want, provided you have the proper tools to access the hardware. What they don't give are the tools to access the hardware, and neither do they need to.

The argument most people are making here is effectively that installing GPL'd software on top of non-GPL (i.e. an OS or firmware image) suddenly means the non-GPL software must be distributed freely. That's bullshit, of course it isn't true. That non-GPL software has someone else's copyright, and the GPL doesn't magically take that over. What it does is force you to distribute any changes to the GPL code as GPL also. It doesn't affect any software or hardware external to the GPL code at all. Ever. Other people have copyright on that shit, GPL doesn't get to steal it.

Seriously, people are assuming that the hardware vendor owns the firmware software, they probably don't. Even if they did, they have their own separate copyright on it, and GPL doesn't magically get to take that away.

TIme to name names.

[Vellmont]

It sounds like you don't work for either of these companies. So why are you protecting them?

If you really want them to do the right thing, start making a stink about it. There's very little chance anything is going to change because one guy asked them to. There's at least some chance that they will if the companies start getting a bloody nose from it.

Re:TIme to name names.

[Sarten-X]

The names should be protected at this stage. It's not clear whether they're doing something wrong or not (see the Visual Studio example in a nearby comment), so calling them out and setting loose the /. horde is a bit extreme at this point.

Re:TIme to name names.

[lokpest]

The names should be protected at this stage. It's not clear whether they're doing something wrong or not

Or more importantly, its not clear if they are doing it knowingly, or just doesn't know they not in compliance with the license. If its the latter, a quick telling them that they might want to correct that one little mistake is better strategy than yelling out "OMFG, you violated the holy GPL, you burn in hell forever, kthxbye!"

However, if the dont care to answer what you point out or more specifically if they violates knowingly and doesnt give a rats ass about it, its up one level on the no more mister nice guy-scale.

Re:TIme to name names.

[Vellmont]

The names should be protected at this stage. It's not clear whether they're doing something wrong or not

It's not clear if they're violating the GPL because there's not enough information given. We have no idea if this is GPL 2 or GPL 3, no idea what build tools are/are not available, no idea what the product is, etc.

(see the Visual Studio example in a nearby comment),

The relevant part of the GPL2 is:

For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

I read "normally distributed" as the build tools are readily available (it doesn't say free). It sounds at least close enough to a violation to warrant some pressure applied to these companies to give some sort of response. This isn't murder, and nobodies life is going to be ruined simply by letting it be known who and what we're actually talking about here.

Anyway, if any traction is to be gained the OP needs to provide specifics. That really means naming names, and specifics about what product is in potential violation. Maybe the companies aren't doing anything wrong, but keeping it all a big secret and releasing tidbits of generalized information helps nobody but the potential violators. It seems pretty obvious the OP doesn't know if they're in violation either, so why not turn to the crowd to figure out if they are? Without specifics, it's just a series of bad guesses.

Re:TIme to name names.

[Vellmont]

a quick telling them that they might want to correct that one little mistake is better strategy than yelling out "OMFG, you violated the holy GPL, you burn in hell forever, kthxbye!"

A false dichotomy. Why are those the only two options? Why does naming names have to be your extreme example of dickishness?

Re:TIme to name names.

[Achromatic1978]

A false dichotomy. Why are those the only two options? Why does naming names have to be your extreme example of dickishness?

Because past experience on Slashdot and elsewhere shows that when names are named, there is a small but significant vocal collection of frothing at the mouth, militant types that will think nothing of leaving hundreds of VMs for the CEO, sending hundreds of faxes, thousands of emails, sign them up for a few spam lists along the way as a way of "making a point".

Re:TIme to name names.

[Shulai]

And while it can sound unfair, if you look on it on the right light, it isn't. A GPL'd project can be built on a platform where no free toolchain is available (hey, even GCC had to be compiled on a different compiler the first time!). Of course, the concept is about non-free but publicly available tools, as seems to be in this case.

Re:TIme to name names.

[Vellmont]

Examples?

Re:TIme to name names.

[SomeKDEUser]

Interesting. But on the other hand, This is some bastard making money out of stealing somebody else's work. Now, clearly it is immoral/illegal to harass and abuse the guy. But on the other hand he deserves it to an extent.

Life's full of moral dilemmas, I guess.

I suppose having the guy not sleep well at night from the fear that his name might be released could strike the right balance. And thus the fine article reads as "I'll make you a proposition you can't refuse"...

More generally, I believe it is healthy that people feel compelled to comply fully with the GPL: it is good for them, as they benefit from the code and feedback, and good for the community as they benefit from the code and the feedback. Sadly a lot of people seem to require forcing them to do what is good for them.

Re:TIme to name names.

[Sarten-X]

Vellmont wanted an example, and here it is. It's not clear whether the "firmware utilities" would need to be released, or even what extent of the "build environment" is covered. Do they need to release the circuit diagrams for their ROM programmers? There are so many ambiguities, yet these companies are regarded as "some bastard making money out of stealing somebody else's work".

It's healthy to fight for the GPL, but don't go looking for a fight in response to a question.

Re:TIme to name names.

[Bigjeff5]

If you were to build GPL software on Windows, does that mean you now must distribute Windows with your code to be in compliance?

Of course not.

That's what's going on here, the OP wants tools completely unrelated to the GPL code (he already has what is needed to compile the code) to allow him to install it on the manufacturer's hardware. They don't have to do that. In fact, it is almost certainly a violation of someone else's copyright to do that. It's nice that Windows does it (it would be useless if it didn't), it's also nice that Linux and Mac do the same thing, but there is nothing that says a router vendor has to do it.

Re:TIme to name names.

[SomeKDEUser]

The very attitude of using GPL code and not actively trying to contribute back should be combated. Because were then do you draw the line? Obeying the letter and not the spirit of the licence is not good enough. Certainly should not be considered good enough.

For example: the whole KHTML/Webkit debacle. How can anyone be on the side of apple, who did all they were required to legally but still actively worked to wrest control of the project from the community (and sadly succeeded)? There is more at stake than just legality here.

Due to the excessive power a corporation has compared to an individual, the ability to bully, do propaganda campaigning, start frivolous lawsuits, they should be held to much higher ethical standards than individuals.

So yes, that they have there setup in such a way that the code cannot be modified by the users in a meaningful way makes them "some bastard making money out of stealing somebody else's work" because their product, and profit, and revenue would not exist but for the community. Morally, they owe something back, and probably legally too.

That they get away with it and get people to defend them because what they are doing is not sufficiently blatantly illegal boggles the mind.

Re:TIme to name names.

[Sarten-X]

So yes, that they have there setup in such a way that the code cannot be modified

That's the part we don't know. Their build environment might be some guy flipping through a book of op codes. In that case, the build script (as required by the GPL) might be that book's dog-eared corners. Is it fair or right to claim that guy should be available to compile anyone's program, just because he compiled a GPL program once? Of course not. That one guy can be replaced with any other similarly-performing guy, or even an automatic compiler. The marked pages' numbers might be useless, but they do provide some insight into what's necessary to compile the program.

Arguing for the release of the build environment is an identical situation. The build environment can be replaced by any other build system, GPL or otherwise.

As for violating the spirit of the GPL, let's consider the full implications of requiring the build environment's release. Rather than granting developers the freedom to work in an environment they like, it restricts developers to working with only GPL tools. If I (hypothetically) enjoy working in Visual Studio, I'd be unable to write any GPL programs, so I simply wouldn't. Free software would die very quickly.

Fortunately, the build environment is not included. Everything I write (and thus own the copyright to) can be released as GPL, with no additional strings attached.

In fact, it seems this company is trying to be good. They've apparently released the build scripts they use, rather than trying to hide their existence. They've responded to GPL questions. They're releasing source right up front, rather than wait for someone to notice, like so many other companies. They're also following their legally-binding license agreements, which prevent them from giving away the build environment. If you cannot legally obtain the required build environment, replace it with something else, up to and including some guy with a book.

Not really, no

[SSpade]

Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request? You cannot rebuild the application, even given the entire source code, without access to a non-GPL piece of software you don't have access to.

You might not like it. You might even think it's against the spirit of something or other. But it's not a GPL violation.

You could argue that one difference is that Visual Studio is available to anyone prepared to pay for it. I'm sure that the build environment for the device you're talking about is also available to anyone prepared to pay for it. It likely costs more than you'd want to pay, though.

Re:Not really, no

[lokpest]

exactly, wasnt just that what the "java trap" was all about?

Re:Not really, no

[mysidia]

Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request?

There is a special exemption for Standard system libraries, compilers, general-purpose third party tools, and any generally available free tools.

Re:Not really, no

[poppycock]

There's a nice handy place for all of Microsoft's express editions

  http://www.microsoft.com/express/

Re:Not really, no

[cyberthanasis12]

You could argue that one difference is that Visual Studio is available to anyone prepared to pay for it.

You may be right, as the poster does not give any details. However, if we are to believe the poster, the build scripts, which in the case of VS would be the project files, are not given, and this _is_ a violation of the GPL.

Re:Not really, no

[hweimer]

Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request?

Depends. Once you #include GPL-incompatible code or link against a GPL-incompatible library (that is not a system library), you have a problem. If you don't then you probably won't have trouble building the project with gcc, possibly after converting the project files.

Re:Not really, no

[noidentity]

Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request? You cannot rebuild the application, even given the entire source code, without access to a non-GPL piece of software you don't have access to.

You might not like it. You might even think it's against the spirit of something or other. But it's not a GPL violation.

Yes it is, if the build tools aren't normally distributed with the major components of the OS. Your example most likely falls under the exceptions, standard development tools for the OS don't need to be distributed, but non-standard ones do:

GPL version 2, term 3. [...] However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

GPL version 3

1. Source Code.

The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.

The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. [...]

6. Conveying Non-Source Forms.

You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License [...]

Re:Not really, no

[noidentity]

I did read what I posted, to the best of my ability. The GPL v3 paragraphs aren't fully clear to me (I suppose you're going to put me down for not being able to get a clear understanding of them), so I went by my best reading, and by what the GPL v2 says.

Maybe you can take a moment to actually make clear how even the GPL v3 allows one to release something with source code, but not with a compiler, even if the compiler is a custom in-house program that isn't available anywhere. I'm not saying the GPL v3 doesn't allow this, just that it's not clear to me.

Re:Not really, no

[Bigjeff5]

Actually you can build a program built in Visual Studio without buying Visual Studio, but only because Microsoft chooses to give away their compilers for free. They sell IDE's, not compilers, you could work with notepad to build VS apps if you want to.

I'm also not sure it's legal to distribute the compiler with your code, Microsoft owns it, and it's almost certainly a copyright violation.

In other words, he's got to get his tools from someone who is willing to sell them. If the manufacturer owns them, and is unwilling to sell them, too bad. His only option now is to reverse engineer it.

Re:Not really, no

[noidentity]

I'm not grasping why it treats user products differently from others. In all cases it seems you'd want to preserve end-user freedom to improve the product without needing permission from the original producer.

Their bad

[Arker]

No sympathy for them, if they cannot comply with the license they are engaged in commercial copyright infringement and should be thankful you gave them an opportunity to fix it rather than going straight for statutory damages.

However the FSF has limited funds and they do have to pick their battles wisely. If all you can do about the situation is bump your FSF contribution then do it.

As for a practical workaround for your benefit, do you have the ability to write arbitrary bytes to the firmware? If so you should be able do this in a hexeditor. It wouldnt be trivial though - quite a few hours of work, depending on the specifics of how they screwed their HTML up so badly and how it's encoded. You might be able to shortcircuit it a bit by simply determining what IE sends to the device to perform each task, and then scripting your own pages that result in the correct bits being sent to the device. Would have to look at the actual device in-depth to determine which route is most practical.

Re:Their bad

[Bigjeff5]

How are they not in compliance?

They distributed all code and build scripts, except for third party libraries which they are not permitted to distribute (GPL doesn't get to steal other people's copyright).

The image format to flash the ROM is an entirely separate entity from the GPL'd software, GPL doesn't steal their copyright on that either, none of the tools needed to install it on that specific hardware need to be distributed.

GPL doesn't get to steal other people's copyright, it only dictates the use of code that is a direct modification of the GPL code.

More than likely he went to the FSF and they said "1.) You're a dumbass, this doesn't violate shit, and 2.) We don't have standing anyway, you aren't the copyright holder and neither are we". He probably interpreted that as them being "too busy" or something.

Re:Their bad

[Arker]

I am relying on the OPs honesty there to some degree. "I have approached the companies directly and while one of them acknowledges that they are not fully GPL compliant, due to other license restrictions they cannot make their build environment public."

You are half-right, depending on the exact details of what is being referred to as "build environment" and the GPL version, they might or might not be required to release it.

The loophole is bigger...

[leuk_he]

However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

(from same link)

If the compiler is a special case then you have a problem there. If the target device is some special dedicated OS, it all comes under this exception? Notice that they do not require to release the compiler (unless is was adapted for this target).

Also remember a term called Tivoization. You are starting the same discussion all over again.

But they are missing the largeste advantage of the GPL. They can have free mod version and bug fixes if they release their complete environment.

Re:The loophole is bigger...

[QuantumG]

Yes, because compilers are usually distributed with embedded operating systems. (not)

The part in question is the installation scripts.

Re:The loophole is bigger...

[yuhong]

Also remember a term called Tivoization [wikipedia.org]. You are starting the same discussion all over again.

Yes, GPLv3 addresses that one.

Re:The loophole is bigger...

[doogledog]

Actually... I've seen a few commercial ARM compilers that are supplied with microkernels (Keil is one that springs to mind). And the Linux distribution I'm currently using from Texas Instruments for one of their ARM chips is supplied with a gcc cross-compiler compiled for Linux and Windows (and I think even OSX).

As much as not having the build environment (ie. scripts) can be an annoyance, companies seem to often use uBoot or RedBoot [yes, citation needed, I know... this is just what I've seen so I could be very wrong], meaning that if you have an upgrade image to pick apart, you can work out how you're meant to be building your own upgrade image.

Re:The loophole is bigger...

[Demanufacture]

Redboot is a boot loader, not a build environment. You're probably thinking of BitBake, which is a common build system for embedded environments.

Back on topic though, I don't believe that the manufacturer has any responsibility to provide a build environment. For all you know they may have used some kind of proprietary build system (a few years ago this was more common but these days pretty much everyone uses GCC). Just patch the binary!

Re:The loophole is bigger...

[doogledog]

Redboot is a boot loader, not a build environment

I know this. My point is that in some cases the source is enough, because you can use knowledge of other visible aspects of the system (such as the bootloader) to create your own build environment.
Somewhere else in the comments people were complaining about the fact that although you can unpack some source and build it, the method needed to create the binary image suitable for flashing on to the device is a complete unknown if you don't have build scripts. I don't think this is necessarily the case if you're prepared to put it the work and have the relevant knowledge.

Anyway, as you said, its all about patching the binary if you're gonna do it properly!

build tools? Re:No, they're just non compliant

[Anonymous Coward]

"They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though."

Would that it were that simple. There's lots of things out there where you can't just download the source and do a "make clean; make".... do you have the right libraries? (glibc version hell) The right version of the tools? (there's more than one version of gcc out there) The provider of the software might not even know... they just make it on their box, it goes ok, and they package up the source and distribute it.

Re:build tools? Re:No, they're just non compliant

[Antique Geekmeister]

Oh, dear, yes. This is why I _hate_ when developers start plugging in their own versions of system tools built in their "personal" development systems, and try to hand them off to me to install on active systems without ever cleaning them up to build in a "standard" environment. It's also why I think that gentoo will never be stable enough for industry use. Very small differences in build tools concatenate to generate tremendous incompatibilities.

Re:build tools? Re:No, they're just non compliant

[Frank T. Lofaro Jr.]

Would that it were that simple. There's lots of things out there where you can't just download the source and do a "make clean; make".... do you have the right libraries? (glibc version hell) The right version of the tools? (there's more than one version of gcc out there) The provider of the software might not even know... they just make it on their box, it goes ok, and they package up the source and distribute it.

Use Gentoo.

Most Open Source software, you simply do "emerge packagename" and all the dependencies, compilation, configuration is done for you, and It Just Works.

Re:build tools? Re:No, they're just non compliant

[Frank T. Lofaro Jr.]

When running a ~x86 (unstable) Gentoo, I unmasked (considered risky!) gcc 4.5.0 and rebuild my system.

1 package was totally broken (would die on startup) and I had to recompile with gcc 4.4.3.
1 package would not compile until I added a flag to CFLAGS.
Over 700 packages, including gcc, binutils, the KERNEL and all the critical utils, other system software, games, etc were just fine!

A less than 29% of 1% breakage rate, for a "dengerous", not recommended for the faint of heart bleeding edge upgrade on top of an "unstable" system.

Gentoo does JUST FINE, even better than fine, heck, compare it to even stable versions of other distros, or for laughs, to Microsoft Windows! OMG!

Legally, no. Practically, yes.

[fuzzyfuzzyfungus]

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites. If, as one of the unnamed companies claims, they used GPL code and proprietary build prerequisites that they cannot legally release, than their lawyer(s) fucked up big. Just because the GPL doesn't ask for money, and some of its friends have long hair, doesn't make it any less binding than whatever license governs their build environment. They've put themselves in the untenable situation of having two binding licenses that cannot both be satisfied(and losing redistribution rights for their firmware would probably hurt if they don't have the resources to re-do their build environment).

However, in practice, to uphold a right, no matter how solidly enshrined in law, generally takes time and money(particularly in civil cases, where the state won't provide you even a shitty lawyer). As long as they aren't the most blatant, the SFLC and their ilk probably won't go after them(especially if their hardware is uncommon or obscure; from a strategic standpoint, the SFLC probably cares more about improvements to OSS software flowing back to the community, and buildability on common devices than they do about buildability on obscure stuff). You might have slightly better luck if you can identify the specific authors/copyright holders of all the GPL code used in the firmware. Particularly for the company that put itself in a license bind, any of the authors could decide to sue them, possibly for real money, if they so chose.

For you personally, though, you are probably SOL. If you have to ask slashdot, you probably don't have the lawyers you need. About all you can do is make noise about the situation, naming names, ideally, and hope that somebody with firepower takes interest.

Re:Legally, no. Practically, yes.

[pclminion]

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites.

I need to ship you a fucking computer along with the source code? A computer is a prerequisite to build the software.

Re:Legally, no. Practically, yes.

[JohnFluxx]

Or you could just read the actual GPL text that many people have pasted and not be an idiot:

"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

Source code, not hardware.

Re:Legally, no. Practically, yes.

[pclminion]

So I can make my build process depend on some obscure piece of hardware and be okay? Excellent!

Re:Legally, no. Practically, yes.

[KarmaMB84]

"However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work."

If there's makefiles and scripts but not compilers or firmware tools to go with them I think you're pretty much out of luck.

Re:Legally, no. Practically, yes.

[JohnFluxx]

Well I interpret "source code" to mean that you don't have to ship a computer..

Re:Legally, no. Practically, yes.

[JohnFluxx]

Right, which is somewhat related to the "tivoization" ( http://en.wikipedia.org/wiki/Tivoization )

Re:Legally, no. Practically, yes.

[DMUTPeregrine]

And they don't have to release a general purpose compiler they didn't modify. If they built it with MS Visual Studio they can just tell you that they used Visual Studio and provide any needed build scripts, no need to give you a copy of VS.

Re:Legally, no. Practically, yes.

[martin-boundary]

Not so. He can read the scripts and makefiles, and download/install all the compilers and firmware tools that are referenced in them. If those tools are standard or general-purpose, he'll be able to do it. If those tools are non-standard or impossible for people to obtain, then the company didn't comply with the GPL terms.

Re:Legally, no. Practically, yes.

[jimicus]

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites. If, as one of the unnamed companies claims, they used GPL code and proprietary build prerequisites that they cannot legally release, than their lawyer(s) fucked up big.

Couple of issues with that statement:

1. Not every company insists on having a lawyer in every meeting and going through every aspect of preparing and launching a product. In many ways it may actually be a bad idea to do this because it'll cost a small fortune in legal fees and if your lawyer picks up on something, you either fix it or take the risk that if you wind up in court, you can no longer say in good faith "oops, sorry, our mistake".

2. The lawyer is an expert in law, not in technology. He's not about to attempt to build a new firmware image based on the gpl_compliance.zip file you've placed on your website just to make sure you really are compliant - and he's also going to give his client the benefit of the doubt if they say "that's all we need".

Re:Legally, no. Practically, yes.

[mr_mischief]

IANAL either, but... actually he is granted a license to the source when they distribute the binary to him, and so are any of us he sends the binary or the source on to later. He has as much license to it under the GPL as the hardware vendor using the GPLed code does, in fact. ITYM he's not the holder of the copyrights upon which the license is (allegedly) being broken. It's a nit, but an important nit. Law is like that.

Since he does have a license and they are allegedly not fulfilling their end of it, he could sue for specific performance. If he's right about it being a violation, he may even win given enough money to pay the lawyers. However, as in many lawsuits, winning may not bring the result he really wants. If the company just loses all rights to sell the product, then he's not going to get much use out of that.

Re:Legally, no. Practically, yes.

[mr_mischief]

Define the "standard" compiler that Company A has to use to compile the code for their Platform B, for which they only use one compiler. That compiler would be the "standard" compiler for that platform, wouldn't it? So if the "standard" compiler is closed-source and owned by someone else, just because it's the standard doesn't mean much. The work's system libraries are probably part of what's closed source here -- drivers for some chipset they bought from Conexant, Broadcom, or someone.

Re:Legally, no. Practically, yes.

[Bigjeff5]

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites for compiling the code.

There, fixed that for you. GPL doesn't take over the whole machine, it only involves the copyright on that specific piece of code. Derivatives of that code must be GPL also, but the provisions in the GPL apply only to GPL code. That means for GPL code you must supply the code. They did that. It also means for GPL code you must supply any build scripts to compile the code. They did that too. What it does not mean is that when they package the code in a proprietary format with proprietary tools to be flashed to proprietary hardware, they have to distribute that too. Not happening. It's probably even illegal - other people own the copyright on those formats/tools, to distribute them for free would be piracy.

Seriously, GPL doesn't get to take over other people's copyright just because you want it to. It dictates the use of the original code and derivatives of that code. Period. It doesn't touch anything else. If there is a situation where it looks like it does, that portion of the GPL would be ruled unenforceable in a heartbeat, because it's touching someone else's copyright.

Re:Legally, no. Practically, yes.

[Bigjeff5]

And it only covers the code for that particular install. It doesn't mean I need to ship you a compiler to go along with it, or the third party script engine I used to run the build script. It doesn't mean I need to send you the drive format so you can put it on the same drive as mine, nor does it mean I need to send you any tools to do so.

They gave the OP enough to build the code (minus some third party libraries, which cannot be distributed due to copyright) into an executable on any machine he has a compiler for. That's all the GPL requires. What he wants are tools that he does not have access to that are not covered by the GPL (they cannot be, they have their own copyright) in order to install the executable on router hardware. The GPL doesn't cover that, it cannot. If it did it would be made null (at least the offending provision would be) at the very first legal challenge.

Re:Legally, no. Practically, yes.

[Bigjeff5]

They have to give you the tools (code and build scripts) let you build the code to any hardware you have access to. They don't have to give you access to their hardware. At this point he can still reverse engineer the image format and potentially gain access to the router.

Really, the guy should probably shut the hell up. All they have to is claim their flash image format is "a technical measure designed to prevent piracy" and boom, it's illegal to even reverse engineer it. Put some shitty encryption on it, and it's done for. Once that happens, DMCA kicks in and he has no options at all, he'll never legally get his code on that router.

It's not an end run, it's just a violation

[blp]

GPLv2 says that source code includes "the scripts used to control compilation and installation of the executable". GPLv3 is even more explicit. So they are likely, depending on the details, just violating the GPL, not using any kind of loophole.

it is copyright

[bravecanadian]

I thought we hated copyright because it rewards people for too long now etc.

The company is not depriving anyone else of using the code so therefore there is no harm in it and no value lost etc etc etc

Funny how we want it both ways, huh?

Re:it is copyright

[Arker]

Copyright does last too long. Doesnt mean it should expire any quicker just because it's offered under a free license than otherwise. And chances are very good the code in question is still quite young.

A bigger problem is that it has been incorrectly interpreted to allow copyrighting of binary code. That is not consistent with the founders intentions. If you want to copyright software you should have to publish the source code. But in this case the source code that was licensed is published, obviously, so that isnt an issue here either.

Finally, copyright was not intended to, and should not, apply to non-commercial use. But this is commercial use.

So no, I dont see us 'wanting it both ways' here, at all.

Re:it is copyright

[SomeKDEUser]

You are wrong on many counts. One is that software still developed has its copyright resetted all the time, so duration of copyright is irrelevant here.

The company is depriving people from means of executing/modifying the code. Now if the unnamed device is equivalent to a Turing machine (and odds are it is) this is equivalent to depriving people of an infinity of functionality. Unlike a work of art where you could argue that modifications/derivations have value because of the original, and not only in and of themselves.

Re:it is copyright

[Arker]

Think carefully here, try and come up with an answer that doesn't allow me to make an end run around the copyright on music, movies or books by mechanically converting them into a different non-human-readable format.

Not sure what point there would be to your 'end-run' as the result would be, as you say, non-human-readable.

But regardless, the point isn't that copyright wouldnt apply to the non-readable form at all, but that it shouldnt be applicable *directly* to it. For example, with a properly registerd copyright on a piece of software, it would apply to the binary as well - but you shouldnt be able to copyright the binary directly, the proper procedure would be to copyright the actual *software* i.e. source version of the program, which requires disclosing that source. Any binary derived from that source would then be covered of course. Is that clearer?

The point to copyright was supposed to be to encourage, in the long run, more works entering the public domain. So for example you get a limited term monopoly on commercial reproduction of your novel, but in the long term it guaranteed that your novel would be around to enter the public domain. (Berne convention has royally screwed this up, but under the previous constitutional regime copyright was not automatic, it required registration including lodging a copy of the work in question with the library of congress to ensure that it would still be accessible after copyright expired.)

So when you apply that to software, you would need to lodge a copy *in human readable format* for preservation for the same purpose, obviously. A binary would hardly guarantee that the program would be usable in any way after expiration of copyright, with hardware development what it is, and at any rate even if some sort of emulator could still be found in which the program could be made to run, it would not effectively serve the purpose of allowing future generations to study the work like a source copy would. Clearer?

Re:it is copyright

[noidentity]

Isn't this more about contract law? The buyer of the hardware saw that it used GPL software, which influenced his decision. Now the seller isn't upholding their end of the contract.

Build scripts wouldn't help

[Anonymous Coward]

As others have posted, they are meant to give you a copy of the build scripts. These scripts may not work outside of their environment (due to hard coded paths, etc), but they are meant to give you those scripts.

But nothing in the GPL says that they have to give you the firmware utilities used to load a new firmware on.

No, this is missing the point

[Geoffreyerffoeg]

The GPL doesn't require that hardware that has GPL code be modifiable to include updated versions of code. Build systems are a distraction here: a more direct form of the problem is that the GPL code is burned into ROM, and even the GPLv3's Tivoization section (number 6, paragraph starting "If you convey...") explicitly permits that. It would be dumb if it didn't. While it may well be the case that for GPLv3 (and not GPLv2) failing to give you a usable build environment for compiling modifying code so you can run it on your "User Product" is a violation, this is forgetting a large part of the purpose of free software.

The point of free software is that the software, the code, is free for the community to use. Thinking about free software as simply the ability to modify code within its original context causes us to forget opportunities for reusability that benefit the entire free software community, well past the lifetime of this one device, and encourages behavior where modified code isn't usable on other devices or in entirely different contexts. I've written a bit more about this on my blog, with some examples of times when thinking about "free software"/"open source" only within the context of the original product has caused the free software ecosystem as a whole — the thing that's causing large companies to want to embed free software in their hardware devices in the first place — to be left behind.

What do you mean by "build environment"

[coolgeek]

Are you talking about makefiles and scripts, or are you talking about a proprietary compiler used to generate the code? There's a huge difference.

Re:IE only

[Anonymous Coward]

Some companies are still in the IT stone age. For example, one company - with which I just got an account - sells flatrates to video games for a monthly fee. So far so good but they actually use an IE-only plug-in that relies on ActiveX and only runs as administrator. And that's the "updated new version" of their client :D

Admittedly it's supposed to run on FF eventually ... some time in the future ... promise ;)

My Linksys experience

[Mathinker]

After getting the "our developers are working on it" runaround for months and months when Linksys didn't issue new drivers without the Broadcom vulnerability for my WPC54G v.4 adapter, rendering it totally useless, I decided to never, never, again buy Linksys equipment.

So you might be right that the firmware of the Linksys device I bought was upgradable, but that's useless if you have no way to make custom firmware and the vendor doesn't issue bug fixes for its original firmware.

Re:My Linksys experience

[Anonymous Coward]

I don't see any indication that there's any GPL code in those drivers, that's an adapter not a router. Most Cisco/Linksys routers are Linux based and are generally fully GPL compliant. Their wireless adapters on the other hand generally have 100% proprietary drivers.

Re:My Linksys experience

[natehoy]

Many Cisco/Linksys routers are, but I wouldn't call it "most" any more. They started building them using a closed-source OS about 3-4 years ago, and actually converted the WRT54G and WRT54GS to it mid-stream. Later, they re-released the Linux version of the WRT54G under the model name "WRT54GL".

Having said all that, Linksys has been pretty good about releasing the source code of those things they use GPL-licensed code for. Unfortunately, they tend to use the Broadcomm radios for which source code is not available, though they do publish their wrappers that control the Broadcomm binary driver.

Re:My Linksys experience

[billcopc]

Not true anymore. Many of them have been switched to the very restrictive vxWorks platform.

The big problem with GPL violations, and by extension poor customer service, is there is never enough backlash to deter these heinous practices. We can groan until we're blue in the face, Cisco/Linksys will continue to sell flaky hardware and buggy, unmaintained firmware/drivers and endless spin doctoring. These days their business is 90% sales & marketing, 10% development. That's why the router you buy today is no better than the one you bought a decade ago. They don't give a crap, they can just slap a new ugly plastic box around the same cheap old guts and print more money.

Even their enterprise gear has taken a nose-dive. They have about two dozen different 24-port switch SKUs, and they even have the nerve to give you detailed comparison grids, highlightly precisely how little they differ. How many ways can one shuffle managed vs unmanaged (why even bother anymore), and POE vs non-POE ? They need to fire half their marketing staff and beat the other ones until they stop telling the engineers what to build. Having a uniform product line means greater efficiencies in both production and support. Modern business 101, for crying out loud!

Re:My Linksys experience

[jythie]

Ahm, you do realize that one of the reasons companies have been moving back to vxWorks is because of these 'OMG you used GPL, give me full access to modify these devices!' rants. I used to work in embedded systems using Linux. Were I do to so again, I would not advise my employer to go GPL, and esp not GPL3.

Re:My Linksys experience

[Z00L00K]

As if other manufacturers aren't providing buggy devices? Compared to many Linksys are actually not that bad.

Re:My Linksys experience

[Enleth]

I don't get something in your reasoning - care to explain?

When Joe Shmoe downloads Corporation X's software from TPB, installs it and makes money using it, and they find out, they send a legal letter demanding that Joe removes the software and pays up $x (for very high values of x) or gets dragged through court (and ends up paying many times $x) for violation of the license. After that, Joe Shmoe is broke and Corporation X starts lobbying for new laws against software piracy.

When FooShmoo & Co. downloads Mr FLOSS Developer's GPL-licensed software from his website, puts it in their FooBox 2.0 and sells it without distributing the source code or allowing for its proper use, and he finds out, he first asks them to comply in an informal manner, then he tries to publicize the problem hoping that FooShmoo & Co. will comply to prevent bad publicity, and only when this fails, he goes to the FSF or the likes and asks for help, which usually means a legal letter demanding that they comply, or be dragged through court (and end up complying and paying the legal fees) for violation of the license. After that, FooShmoo & Co. can go on with its business and Mr FLOSS Developer is content that his rights as an author are finally respected.

And yet, you present the latter situation in a derogatory manner. Why?

Re:My Linksys experience

[jythie]

We are not talking about desktop applications that someone grabs off TBP. The two situations are you describe are completely differnt ends of the process.... end user pirating software and upstream developer exerting control over a downstream product. What we have in the original situation was a downstream hobbist wanting access to the internal development tools of an upstream developer based off someone upstream from that company being FOSS, but wanting tools that were not FOSS. Or more specificly, someone bought a device that was closed (but used some open components) and then wants to edit the device, but wants the upstream company's help doing it (i.e. releasing their development tools). That produces not only MUCH more work for the company (build enviroments are not something that can be trivially packaged up if they are not designed to be), but also produces a horrible PR situation since, no matter how much tinkerers claim otherwise, the original company still ends up getting the blame when user modifications break the product. I got really, really sick of dealing with those support issues over time.

Re:My Linksys experience

[Bert64]

If the card is based on a broadcom chipset, why not just use generic broadcom drivers instead of the specific linksys ones?

That said, i tend to avoid cards based on broadcom chipsets because they don't release any specs for them, i have atheros, ralink and realtek based wireless cards which work extremely well with open drivers here.

Re:My Linksys experience

[Bert64]

That's more to do with vxworks requiring less memory (and thus the hardware can be made cheaper), you can still try to flash linux onto those devices but they don't work very well due to the limited amount of memory/flash...
They still sell linux based devices, but these are no longer the lowest and cheapest routers they offer - the vxworks ones are the new bargain bucket.

Re:My Linksys experience

[wrook]

I think it should be pointed out that everybody is 10% development and 90% sales and marketing. Actually 10% R&D is considered to be quite a big budget in high tech companies. Hardware manufacturers may still be up against it since they have to do the retail channel thing (VERY expensive), but it is potentially an edge for free software companies. They should be able to move money from distribution into development.

Re:My Linksys experience

[tweek]

Broadcom doesn't release the non-x86 chipset drivers as opensource. It's a bit more complex than that but that's the gist of it.

Re:My Linksys experience

[Hal_Porter]

That's more to do with vxworks requiring less memory (and thus the hardware can be made cheaper), you can still try to flash linux onto those devices but they don't work very well due to the limited amount of memory/flash...
They still sell linux based devices, but these are no longer the lowest and cheapest routers they offer - the vxworks ones are the new bargain bucket.

It's not just less memory - vxWorks is very frugal with CPU usage too. I've seen 486 clone at 33Mhz maxing out the bandwidth on a network card while running an FTP demon out of flash memory.

The reason is that vxWorks is a very simple OS. It doesn't have much in the way of protection - all the code runs in Ring 0 on x86. So calls into the OS are just regular calls - you don't need to switch from Ring 3 to Ring 0. It can use the MMU but it doesn't usually have per process address spaces. So you don't need to flush the TLB on a process switch.

The kernel is very small and simple - it's vfs layer is only a line of two of code before jumping into a filesystem. And read() in a filesystem is very simple too - 99% of the time it just returns data from a cache buffer. TCP/IP implements zbuf to avoid copying. So the end result is that the 486 fetching a file over FTP from flash is only executing a few thousand instructions for each read - mostly copying from a buffer cache to a packet. Most the code/data probably fits in the on chip I/D cache. Which was good luck in this case, because this particular board had rather slow DRAM.

Now vxWorks isn't free in any sense - I believe it costs a buck or so per unit which is rather expensive. Still if you were switching to Linux in this system you'd need a faster CPU, more flash and more Ram. That would cost more than a vxWorks license.

Re:My Linksys experience

[WNight]

the original company still ends up getting the blame when user modifications break the product. I got really, really sick of dealing with those support issues over time.

Badly run companies run into this. I've worked at ISPs that have been Microsoft's unofficial support desk because they couldn't tell the customer that there's a signal at their cable, the rest is between them and their OS vendor.

Other companies in almost exactly the same demographics have happy users, without supporting their OS or playing weird games, simply by being upfront with the users about where problems lie.

The two situations are you describe are completely differnt ends of the process....

Different ends yes, of the same process though. Let me rework this a bit:

[upstream developer exerting control over] end user [distribution of] software and upstream developer exerting control over a downstream product.

You want control over those below you, but freedom from those above you.

Sure, the GPL has a cost, but then so do commercial libraries ($$$) - why do people present strange what-ifs where the GPL conflicts with some closed-source process as an excuse for non-compliance with the GPL? It'd be like writing two checks for the same money and blaming the first person to cash it for preventing the second person from getting paid.

It's not meant to be free. If you're really, really sick of dealing with it, maybe you simply didn't understand the cost, like many people didn't understand the implications of their variable-rate mortgages.

Re:My Linksys experience

[JoeMerchant]

Having a uniform product line means greater efficiencies in both production and support. Modern business 101, for crying out loud!

Yep, that's what they're doing, uniform, unimaginative, boring, proven. It's what the customers actually want. If you want "bleeding edge" develop it on your own Linux box, prove that it's worth something to somebody besides yourself, and start marketing your revolutionary new widget to the vast market for your brilliant innovations.

There may be a few ideas being stifled inside Cisco/Linksys/Netgear, but not many that have any commercial merit- there's enough competition in the market that good ideas actually do get built.

Re:My Linksys experience

[Lumpy]

Why? so you don't have to showcase how botched your code is? There is no logical reason for your statement.

I HAVE worked with a company that had a OSS linux core and I found we could get a product to market far faster, and after it was released, we actually started to get some patches upstream from savvy users. we reviewed them carefully, and even implemented a couple.

If the management is not purely built of closed minded idiots, OSS in a product with all of it freely shared to the world works GREAT. we ended up selling high end hardware and a good interface (at the time) for far less than the competition that was using Windows CE and QNX.

It's called having a dev and management team that had a solid understanding of not only the product but the OS and it's licensing behind it. Couple that with a near rabid following if you actually support your users and you suddenly become more successful

Problem was the device was "high end" Making a "audiophile" quality mp3 server/recorder/player in the late 90's mean you were selling them for $3999.00 so most people could not afford it and therefore the company and products crashed hard.

Re:My Linksys experience

[Lumpy]

Which if you really want a linux router, you go the correct route instead of buying low grade dog food stuff like linksys.

http://shop.gateworks.com/index.php?act=viewProd&productId=53 is one of several out there that run linux and a linux router distro far better than ANYTHING that cisco makes. it allows use of mid and higher end hardware instead of low end broadcom for the wireless networking

Honestly, anyone that buys a consumer router and then bitches that their non standard OS is not working on it right is a nut. If you want it to run right, get the right hardware.

Dont use a flat blade screwdriver to remove a JIS screw.

Re:My Linksys experience

[silentcoder]

Everything you describe is the right of the user. "Controlling" a product is a complete and utter ethical failure. Why should tech companies have this privilege ? No OTHER companies do. They just put on a sticker saying modifications will void the warantee (fair enough) but if I want to open my microwave oven and put in a 5-times more powerful magnetron - L.G. doesn't get to tell me it's illegal to do so, or for that matter, try to build a huge titanium box around the magnetron to prevent me.

Or to use the obligatory car analogy: if I tune up my engine for higher speed, I am probably shortening it's lifespan - but the car company doesn't get to tell me it's illegal to put in a faster exhaust system. They generally won't even try too hard to stop me replacing the software on the onboard computer to adjust the timings for maximum performance.
Short of safety features - no company gets to "control" how you use their products - it's against the principle of first sale (for starters, I can indeed sell my modified version - as long as I don't pretend it's unmodified [that would violate trademark law - and with good reason, it would be fraud and it's exactly what trademark law exists to prevent]).

Why the hell should tech companies get this privilege then ? Because they can claim software copyright ? Big whoop. Just because a part of a car is patented, BMW doesn't get to tell me I can't put in a different part there.
It shouldn't work that way - and it's wrong that it does. Furthermore - the decision of the original authors to use the GPL clearly indicate that those authors agreed with my perspective here, so violating the spirit of that agreement is against the grounds under which you got to benefit from their work. In most countries, violating the spirit of a legal agreement is exactly as wrong as violating it's letter, the US can get confusingly literal at times though so this may not hold there.

Finally - I'm quite sure that withholding the tools required to actually install modified firmware on the device counts as breaking the GPLv3's anti-tivoization clause so if any of this software is under GPL3 or GPL2-or-later clauses - a case could be made that they are giving source while preventing the installation of modifications and that this violates the license.

Re:My Linksys experience

[Apatharch]

warantee

Is that a malamanteau?

Re:My Linksys experience

[jabbathewocket]

Your still not getting the problem..

this is covered in the gpl as well as most of the other licenses

Lets describe a potential product that is most likely not real or exactly like a real product
This product is essentially an x86 PC with a custom case, some custom hardware, and output through a web interface
the product uses a variety of gpl'd projects within it.. and distributes all the code needed to build the code (which will pretty much run on any x86 pc)
the catch is that the product itself contains several embedded processors to make sure that what is running on this box is legit.. the first one is a code signing module that compares all incoming firmwares to a key that is burned into a rom when the product is shipped.. IE no proper key no install of rom, another customization is the bootloader itself which is entirely in house custom job and makes THIS PC not boot if the device is not booting off a special flash rom chip also hardware signed by a specific key. (IE even if you disable the security, remove the flash drive from the device and copy it over from your pc to the device it still will not "work"
all of this is pefectly legal under the GPL because the GPL is about sharing code, not about "hacking your device" while some people wish it was otherwise, it simply is not, there are times when the 2 cross paths and all is happy, but then again there are times when I agree with people who I would normally ignore as well.. that doesn't make us twins.
btw the bad publicity? comes when open source fanatics such as in this thread, give companies who are doing nothing illegal or wrong a hard time in the press and get a story posted on slashdot.. when in actual point of fact they are doing exactly what needs to be done based one the GPL.. which is probably why the OP doesn't want to "name names" until someone can convince him that they are actually breaking the rules of the GPL.

Re:My Linksys experience

[Svartalf]

Heh... And they'll just move back to VxWorks' braindead POSIX layer, licensing requirements that're as onerous as the GPL ones (just different), and things like 'em.

There IS a reason they left VxWorks to begin with.

Re:My Linksys experience

[metamatic]

Ahm, you do realize that one of the reasons companies have been moving back to vxWorks is because of these 'OMG you used GPL, give me full access to modify these devices!' rants.

And you do realize that the reason everybody bought WRT-54* devices is precisely that you could modify the firmware to fix bugs, make them more reliable, update them to support newer Internet standards without having to buy new hardware, and make them do all kinds of cool stuff?

A WRT-54GL goes for $60 on NewEgg, even though you can get faster b/g/n Linksys routers for $30. To me, that shows that locking down the firmware has made the product worth substantially less. Surely that's a bad thing, from a business point of view?

Re:My Linksys experience

[tater86]

If they are using a closed source OS that isn't a derivative of GPL code, wouldn't they be compliant with the GPL?

Re:My Linksys experience

[thejynxed]

Probably because in the 2nd, there is no tit-for-tat $ exchanging hands, and the company in question can freely ignore the author until they possibly receive a court summons from the FSF some year in the future, all the while making bank. Money talks, and nobody but an extremely small segment of society knows about or gives two shits about the GPL.

There are just some situations in which I shake my head at GPL stuff, even though I know it's supposed to be a "good thing". I mean seriously, what the heck is the FSF really going to do for you if enough companies ignore the GPL? (Mind you, the larger corporations will just stall-tactic the author into financial oblivion, even if they end up losing the judgement.)

Nothing but go broke themselves, that's what (providing some judge doesn't take it upon himself to find the entire notion of a "free" license to be a silly concept and throw the case right out, since "free" is what Public Domain is for.)

Re:My Linksys experience

[Cramer]

Actually, the reason they went back to vxWorks is cost. Linux is not the tiny, simple thing it was a decade ago. A vxWorks system can run in 2M RAM and 1M flash. The most minimal linux system needs twice that -- and 4x for a stable, usable system. The kernel alone won't fit in 1M. (Add IPv6 and you need even more RAM and CPU power.) vxWorks is well designed for small, efficient embeded systems; linux not so much.

(And yes, I deal with both.)

Re:My Linksys experience

[thejynxed]

Sorry to double-post, but the last post is not the entirety of my view on the GPL, or software licenses in general (there shouldn't be any licenses at all unless you want to take full financial liability for what your software does and how it performs, thanks, nor any software patents, since software is math), but I was trying to provide you with the explanation you asked for, and no, I am not the person you responded to.

Re:My Linksys experience

[Cramer]

Broadcom doesn't release their source code for these devices (wireless radios, switch chips, and SoC's (system-on-chip).) While some versions have floated out into public, they are not 100% complete and are definately NOT current.

Re:My Linksys experience

[natehoy]

Yes, they are. I'm not saying they are violating the GPL at all, only responding to the comment that "most Cisco/Linksys routers are Linux-based".

Those that are, tend to be GPL-compliant. It may take a little time for the code to be released in some rare cases, but it's usually very quick.

Those that are not based in Linux are (by definition) GPL-compliant (or GPL-irrelevant?) (*) because they don't use GPL code, so there's no GPL license to violate.

(*): unless their third party vendor stole GPL code, of course. But there's no accusation of that I've ever heard.

Re:My Linksys experience

[Mathinker]

My post was not about GPL violations, it was just to spread the word about a personal collision with bad customer service at Linksys. Which really pissed me off. Which is why I post about it every now and then when the topic of Linksys comes up.

Re:My Linksys experience

[Mathinker]

I actually "inherited" this card from a relative who had bought it and found out he didn't need it.

This really has to show you how bad Linksys's customer relations were with me: I didn't even pay for the adapter myself and Linksys still managed to piss me off with their lying stories about their developers working on new drivers.

Re:My Linksys experience

[soppsa]

Mod this up, its very true...

Re:My Linksys experience

[Bing Tsher E]

A WRT-54GL goes for $60 on NewEgg, even though you can get faster b/g/n Linksys routers for $30. To me, that shows that locking down the firmware has made the product worth substantially less. Surely that's a bad thing, from a business point of view?

All chest-thumping aside, what makes you think most end users care if their router is running the Linux version? It's doing the same work they require it to, at roughly half the price. If anything, your example shows that 'Linux makes the thing more expensive.' Which I am certain was not your point.

Threads like this one are dangerous, because companies like Wind River (the makers of VxWorks) can point to them when selling their product. Business types don't have much enthusiasm for having bands of hobbyist hackers/nerds fiddle with their product, tie up their external communications links with demands/questions, etc. Wind River can say 'pay us a buck a unit and you won't have to deal with that mess at all.'

And no matter what your creed or religion, for a business unit trying to sell product, it's just an expensive mess, and increased support overhead.

Re:My Linksys experience

[WNight]

I might still be missing it then. Are you saying that this is how the GPLv2 works? And that presumably we should use the GPLv3 instead of complaining?

If so, I'd largely agree. But I think we should complain at the same time because tivoization is a very unfriendly thing and shows the company's friendly face to be a lie. Not pointing out the lies (as forcefully as needed) is letting the company get away with false advertising.

If not, try again.

Re:My Linksys experience

[jabbathewocket]

I am saying that as much as the various forms of the GPL try to taint everything they touch, there are times when that is not the case, and yet still the zealots try to make it the case

Trying to get the OP to name names so that the local fanatics can get their panties in a wad over something that they know next to nothing about on "principle" is not gonna change anything, nor will it do anything other than cause headaches for a likely 100% compliant company.. due to the general lack of understanding of how all the various GPL licenses/versions work, and what they actually entail

The one thing that noone seems to understand is that the FSF doesn't give a flying fig whether or not you can put custom firmware on your router, or install whatever you want in your tivo.. They do not care at all that the Tivo Recordings are not able to be "pulled out" and slapped into torrents automagically.. it is not what they are about.. it is not their goal.. and it never will be..

It is about making sure that the CODE is not hidden away from prying eyes, and is there for others to use and expand on/fix/change/whatever.. sadly the bulk of Free Software Fanatics, are actually more interested in free beer, than free software.

Re:My Linksys experience

[WNight]

Trying to get the OP to name names so that the local fanatics can get their panties in a wad over something that they know next to nothing about on "principle" is not gonna change anything, nor will it do anything other than cause headaches for a likely 100% compliant company.

What's the problem with being pissed off with tivo, or anyone like them? They certainly violate the spirit of the GPL and their 100% compliance is a technical trick.

They certainly don't need the community good will you'd normally give to a company who was sharing your project and donating back to it.

the FSF doesn't give a flying fig whether or not you can put custom firmware on your router, or install whatever you want in your tivo..

Excepting how that interferes with your ability to modify the GPLed software on those platforms.

[The FSF and the GPL] is about making sure that the CODE is not hidden away from prying eyes, and is there for others to use and expand on/fix/change/whatever..

Yeah. I get that. Read the last paragraph of this post of mine.

I can assure you they care very much, despite RMS probably not caring about TV shows and thus tivos specifically.

This is why we don't use GPL stuff

[bsDaemon]

The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this. We also employ people to make contributions back to the FreeBSD project as well, so we're not mooches, but seriously... this is why so many companies don't want to get involved with Linux or GPL solutions.

Re:This is why we don't use GPL stuff

[bhtooefr]

Did you read his post?

His company decided they didn't like the GPL, so they went and used something different.

And, he claims that they contribute back to the projects that they use, anyway.

Not only that, but where did it say that GPL code has to appease everyone? Pretty sure he said that it DIDN'T, so he didn't use it.

Re:This is why we don't use GPL stuff

[Vellmont]

I guess we disagree about what's written between the lines and the attitude inherent in the post.

Re:This is why we don't use GPL stuff

[tokul]

so we can avoid crap like this.

And this thing was invented to protect users from people like you. You take lots of free stuff, contribute as little as possible and leverage with your closed source mods. You call GPL crap and GPL people will call you crappy capitalist leech. Don't call names on others, if you don't want to be insulted same way.

A loophole, you say?

[Superdarion]

You said it yourself; this is as much a loophole to GPL as a criminal getting away with it because he has good lawyers.

It's not a loophole of GPL itself, but rather of the legal system in which it must rely.

Embedded SDKs...

[Anonymous Coward]

It's an interesting problem with the GPL license text. There is a big difference between the "components released with the operating system" depending on whether you are talking about the full embedded SDK (often licensed for $$$ to product developers) or the final run-time OS (distributed in the product that goes to end-users). To which does the license text refer? Even back when GPLv2 was being authored, many Unix systems did not include compilers in the base release but they could be obtained by anybody willing to purchase licenses; developers would ship binaries of GPL source built with these commercial compilers, and nobody saw it as a problem that end-users could not rebuild it without also purchasing the compiler.

So, a reasonable interpretation says that the article's complaint is invalid, e.g. end users can obtain an SDK just like the product vendor did, and then modify their product instance as they see fit. However, a complicating factor is that these embedded SDKs are often heavily customized for a product vendor, and are not off the shelf systems another vendor (or end-user) could obtain. Where do you draw the line between generally available platforms and for-hire, integrated product build tools that can lead to lock-down?

A strict interpretation would be that one cannot use GPL source code in embedded products using traditional embedded development tools, because those tools have incompatible licensing terms which prevent end-user modification of systems. This is similar to the patent issue addressed in GPLv3.

Re:Embedded SDKs...

[mysidia]

nobody saw it as a problem that end-users could not rebuild it without also purchasing the compiler.

The fact nobody saw it as a problem did not mean it wasn't a GPL violation, and doesn't mean any rights were surrendered by allowing that situation to exist without complaint.

You see, your software is not mine... my software wasn't even written at the time someone considered that acceptable.

Also, they may have allowed technical slight GPL violations at the time, without much complaint, because they were actually beneficial, and would be addressed, once GNU had a decent compiler suite.

Re:Embedded SDKs...

[yyxx]

and nobody saw it as a problem that end-users could not rebuild it without also purchasing the compiler.

Yes, and times have changed, and now people are starting to see it as a problem. It's even more of a problem because much of the proprietary build environment probably consists itself of GPL'ed software and the only thing keeping it from being usable is some glue and loader code.

A strict interpretation would be that one cannot use GPL source code in embedded products using traditional embedded development tools, because those tools have incompatible licensing terms which prevent end-user modification of systems.

Yes. I don't know whether that is a good step to take yet, but it is certainly reasonable to consider at some point; given the prevalence of free software-based toolchains for embedded development, it may be easy to do for most companies. And it would prevent the kind of dangerous bullshit Apple is doing with AppStore and iPhone.

Re:This is not a violation of the GPL...

[JohnFluxx]

Or you could just have spent a second reading the GPL, and then not bothered with your incorrect post.

"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

GPL v3

[GNUALMAFUERTE]

Well, the GPL version 3 does address this issue, and other limitations (like hypervisors that prevent you from installing unsigned code).

But the problem is not a license issue, since we don't have the resources to legally battle all companies that violate Free Software licenses.

It's about people understanding the importance of GPLed software, and the philosophy behind it. It's about building an ethical understanding of the issue in the population.

But the reason why people violate the GPL is obvious: Copyright isn't natural. Stealing is immoral, and also breaks the law. Copyright infringement only breaks the law, but it's not immoral. It's not a crime. And it'll never be. Copyright is an invention, and unnatural limitation. Therefore, people disregard it, just like many other things that aren't immoral, but are illegal. Illegal, but very convenient, will get you a lot of infractions. That's why we have a lot more traffic violations than murders.

MSBUILD and Windows SDK

[realxmp]

Using MSBuild and the windows sdk both free (as in beer) you can pretty much build anything you can in visual studio. We use it for our test building system.

Software Freedom Conservancy

[madder]

If the firmware includes any software that is a member project of the Software Freedom Conservancy (here's a list), which it almost certainly does because 99% of these devices include BusyBox, send mail to conservancy@softwarefreedom.org and tell them about the device. They will start the process of making sure the vendor is complying with the necessary requirements of the licenses.

Why are you keeping secrets?

[upuv]

Sorry but the hypocrisy of your statement is so in my face I have to say something.

You are keeping the identity of these companies secret for what end? It's GPL there for open there for it should not be a secret.

If you say something this community might be able to help you. Maybe one of us has already discovered solutions to your technical problem. When something like this comes up slashdot usually coughs up pages of useful links. It can be rather fun and interesting at times.

Sadly you are keeping it secret. Thus the helpfulness of this community is next to zip.

Because you are keeping things secret it would not be all too far fetched to believe that you are actually trying to alter the code is such a way as to derive money from it. Say by either selling an after market mod or by selling it back to the mystery vendor(s).

Please don't cry about the big companies keeping secrets if you can't even get that out with out keeping a secret.

P.S. Most likely no violation was made. Hardware and build env's are not governed by source code GPL. Unless of course the hardware or build env is also derived from a GPL reference.

Re:Why are you keeping secrets?

[fishexe]

Sorry but the hypocrisy of your statement is so in my face I have to say something.

You are keeping the identity of these companies secret for what end? It's GPL there for open there for it should not be a secret.

I never realized the purpose of the GPL was to put an end to secrets. Gosh, what a fool I've been! Here I thought the purpose was to give users freedom to modify and redistribute!

P.S. Most likely no violation was made. Hardware and build env's are not governed by source code GPL. Unless of course the hardware or build env is also derived from a GPL reference.

I refer you to the numerous threads above which have pre-refuted this statement.

Re:Why are you keeping secrets?

[upuv]

Each of the links you list only refer to the requirement to provide a build env that produces an output that can be installed.

This is a grey area. Because it does not mean it produces an output that is easily installable. It really only means that the build output can operate on the target platform. Thus leaving room for the vendor to retain IP and an edge in this area. People would argue this but reality this is the case.

And at no point does the GPL say you have divulge things like chipset internals or mother board designs. It does mumble on about interface specification etc. But that does not mean it's giving away the hardware design. Example: You don't have to cough up a VLSI design for and x86 chipset do you? Why the interface is made public.

So I stand by my statements.

--
As for my "secret" comment. Proabably it was a little too abrupt. Ooops. My bad. I admit I can make a mistake.

Re:Why are you keeping secrets?

[fishexe]

Each of the links you list only refer to the requirement to provide a build env that produces an output that can be installed....Example: You don't have to cough up a VLSI design for and x86 chipset do you? Why the interface is made public.

So I stand by my statements.

Yeah, but you originally said build envs and hardware were exempt. Now it appears you only meant hardware. If you had only said hardware specs, I wouldn't have questioned it.

Re:Why are you keeping secrets?

[upuv]

Read it again. I said "a" build env. I didnt' say the best or perfect or most efficient build env. And it doesn't even have to build for the architecture you care about. It just has to compile into "valid" artifacts. Again this is a grey interpretation and disputable.

Again I stand by my comments.

Re:Why are you keeping secrets?

[fishexe]

Ok, but your original comment was "Hardware and build env's are not governed by source code GPL." As in no build envs. That's a very different statement from "they have to release a build env that compiles a valid artifact, but not necessarily the right build env to get it working." I stand by my statement that your original comment, as written and as interpreted by an average native-English-speaker of reasonable intelligence, is refuted by those links I posted. The other part of your statement, that "most likely no violation was made" is probably also refuted because according to what the OP said it sounds like they released zero build environments. I say probably because it's not completely clear, given the vagueness of the post.

Keep standing by your comments if you like, though.

Re:This is not a violation of the GPL...

[KarmaMB84]

"However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work."

They don't have to hand over unmodified third party compilers and firmware tools as far as I can tell. They do have to hand over scripts and make files but the submitter of the original story doesn't specify what's really missing. A build environment might just mean the actual compilers and tools rather than scripts.

I call "incompetence".

[dltaylor]

What is Linux built with? GCC.

What are the libraries and applications that run on Linux built with? GCC and the other GNU build tools.

What is U-Boot built with? GCC.

What is Busybox built with? GCC.

As long as the kernel configuration file and platform-specific drivers are included in the kernel source, everything needed to build it for the target is available, so a competent programmer cannot be precluded from changing it.

It may be a bit of a pain to configure additional apps into buildroot, emdebian, or whatever the vendor uses (and that configuration file should be in the source package, anyway), but those tools are are hosted at their respective homes. Again, you cannot keep a competent programmer from rebuilding them.

Unless the vendor specifically uses some sort of JTAG (or similar) interface to install software updates, the mechanism by which they do it will be in the run-time and source tree (perhaps obscure, but present). If they do use a JTAG (although it is VERY rare for a product to be released with no download update capability), there might be a case for listing the brand and model, and posting the config' file.

Look at how many boxes have "homebrew" communities. Those people are competent (if not outright brilliant). Just because YOU cannot figure out how to install some change(s), does not mean that there is a GPL violation.

Finally, there are often features in user space. As long as the libraries used are LGPL, there is no requirement to publish the source code of applications that link to them.

Re:I call "incompetence".

[Rob the Bold]

As long as the kernel configuration file and platform-specific drivers are included in the kernel source, everything needed to build it for the target is available, so a competent programmer cannot be precluded from changing it.

I know GCC can compile and link for many processors and controllers, but all? Perhaps the system in question uses a microcontroller that GCC cannot generate object code and binaries for.

Trendnet and Linksys

[jetole]

Trendnet seems to be GPL compliant in releasing source code to the surveillance cameras we installed however there is no build environment or firmware tools. Linksys on the other hand, while I don't know if they have involvement with GPL on the device in question, I know we have some managed switches from them that are IE only (or at least not compatible with ff, opera or chrome/chromium) and required me to install ies4linux in order to configure them. I didn't test with w3m.

The question is flawed...

[HumanEmulator]

Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?

The question is making a bad assumption (ie. Open source software can't run on closed hardware.) The hardware is closed, the software is not. The purpose of open source is still being served here. You can learn from this nameless company's modifications to the source, or use it to develop your own hardware or software, the benefits of more eyes on the code, etc.

Re:The question is flawed...

[Lally Singh]

I wholeheartedly agree. IMHO the real issue here is that the GPL was satisfied as far as any developer cares -- the source. Users trying to hack up their devices weren't satisfied. I'm fine with that arrangement. I think most dev's understand the business side of software, and the mix of closed/open to make it work out well.

I don't see any part of the GPL requiring that you open up hardware using GPL'd software, which appears to be the logical jump the poster's trying to make. Quite a terrible jump! Who'd want to use GPL software in their products? Who'd want to use products with crap closed-source hacked-together system software? IMHO most shops that ship Linux kernels on their hardware do it b/c they don't have the resources or motivation to make an equivalent-quality version themselves. If they couldn't use Linux, they'd shove complete crap in there instead.

Not really an issue...

[gillbates]

I say this as someone who has ported Linux to a new platform: building the toolchain and porting the code is part of the fun. If it's a popular processor, and all you have to do is define the specific architecture, plan on spending a few days (on the toolchain, that is). If it's something completely new, for example - a processor not yet supported by gcc... Well, you might as well make an ongoing project of it, host it on sourceforge, etc...

Granted, they *should* provide the toolchain, especially if it is OS software, but they are not strictly obligated. It is entirely possible they are using a proprietary compiler which they can't release to the public. This happens a lot in the embedded world.

In all likelihood, they are either using a proprietary toolchain which they can't release, or they are one of those companies where cost controls everything, and the effort to post the toolchain and hosting space is just a nickel too much. There's a good learning opportunity here - while you'll probably have to do a little detective work to get things working, and maybe even port it to a FOSS compiler.

Re:This is not a violation of the GPL...

[Dr_Marvin_Monroe]

First, we have not specified which GPL version is applicable, or if there are specific exemptions to it. Here is the applicable section under GPLv1:

"Source code for a work means the preferred form of the work for making
modifications to it. For an executable file, complete source code means
all the source code for all modules it contains; but, as a special
exception, it need not include source code for modules which are standard
libraries that accompany the operating system on which the executable
file runs, or for standard header files or definitions files that
accompany that operating system."

Nothing there about build scripts or tools to build.... Let's take a look at GPLv3 (section 1):

"The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work."

I see the section regarding build scripts, but embedded devices often do not include the ability to build on the device itself, presenting a big difference from the desktop world where you would typically config, build, install all from source. I still think that simply including the settings/defines/prerequisites would suffice. Note that the section above also specifically excludes general purpose tools. Since installation is often accomplished either through external flashing device or embedded flash utility (general purpose tool), these would be excluded.

Yeah, I've read the GPL. I'm not sure I like where things are going in v2 and v3. On the embedded devices that I work with (for instance FreeRTOS), the licenses are GPLv1 for the overall OS and tasking system. They also include a specific exemption for custom tasks/routines which doesn't require you to release unless you change the OS.

Ultimately, it boils out to defining which device, which specific license and which specific files are involved. None of that's been done, so to assume the most radicalized position here doesn't make sense.

That's not how I read it

[Moraelin]

That's not how I read that clause. While it does make the mention that you don't need to distribute any freely available or common tools required to build that source, it seems to me like they spell it out pretty clearly that otherwise you need to distribute everything needed to build, install and run that thing. (But I am not a laywyer.)

Otherwise it would be trivial to make the source need parsing through a script that only runs on my internal and proprietary modified Brainfuck interpreter, and then through a Lisp program that only runs on an old version of Autocad that's still installed somewhere in the company, before it compiles.

In your particular case, sure, you can develop with Visual Studio, but surely you can take the time to write a makefile that can be run at the command prompt. In fact, it's been years since I worked with Visual Studio, but I seem to remember it did that for me itself. And they wouldn't even force you to use gcc, since the command line versions of the MS compilers were free last I heard.

(And frankly if they don't have an automatic build machine, and the scripts that that needs, i.e., if they're in the kind of situation where tgey can only build on some dev's machine in their Visual Studio, with whatever sources they may or may not have checked out at the time... they're not the kind of company I'd want to buy anything from in the first place.)

Plus, if I understand the summary right, even if he managed to compile the binary code, the tools to install (and thus also to run it) are missing too. I'd say that's against the letter and spirit of that clause right there. The idea was to be able to make changes, not to just have a bit of source to open in an editor, but not be able to actually run any changes or, for that matter, even know if it's the right source. How would you know for something you can't even compile, and certainly not run?

And it's hard not to ascribe it to malice there. Whatever proprietery protocols they use to upload that firmware, surely they're encapsulated in a bunch of classes and functions that are just called from whatever environment they use. It's trivial to pack the same in a small command line utility.

(And again, if they're that joined at the hip to whatever environment is usually used to upload that firmware, that they can't separate the classes that do the uploading from the rest of the beast... it sure doesn't sound like the kind of company I'd trust to program my VCR, much less the firmware for anything.)

Re:That's not how I read it

[harlows_monkeys]

GPL doesn't require distributing things that are part of the major components of the operating system, and it includes compilers as major components of the operating system. Without details on exactly what is lacking, we can't rule out that everything that is missing falls under that.

Incompatible license problem

[davidwr]

A company which is using mutually-incompatible licenses in the same product may have no legal option but to recall the product or renegotiate one of the licenses, or close up shop entirely/file for bankruptcy.

Re:Incompatible license problem

[Sarten-X]

Try again. I'm not going to find the source, because I'm a lazy bum, but it's on the FSF site. The most they'd (usually) have to do is cease distribution of the GPL software.

Re:No such thing as "not fully GPL compliant"

[Arker]

The companies have stolen code.

Umm no. Nothing has been stolen. There appears to be an ongoing and deliberate commercial infringement of copyright.

MinGW

[tepples]

There is a substitute for the Windows SDK: the w32api component in MinGW GCC.

Divorcing commercial from proprietary

[tepples]

Are you confusing commercial with proprietary?

Commercial and proprietary are orthogonal in theory but not in practice. For some kinds of products, nobody has yet thought of a services-style business model to divorce commercial from proprietary. For example, what kind of services does a video game need if it's not MMO?

GPLv3 System Libraries, Major Component, etc.

[tepples]

There is a big difference between the "components released with the operating system" depending on whether you are talking about the full embedded SDK (often licensed for $$$ to product developers) or the final run-time OS (distributed in the product that goes to end-users).

GPLv3 defines "System Libraries" and "Major Component" in more detail.

Where do you draw the line between generally available platforms and for-hire, integrated product build tools that can lead to lock-down?

GPLv3 draws the line in part in terms of a "Standard Interface", or an interface published by a standards body or widely used among developers that has been implemented in published (not necessarily Free) source code. Libraries provided with a toolchain are more likely to qualify as System Libraries that can be left out of Corresponding Source if they implement a Standard Interface on top of a proprietary operating system.

Re:GPLv3 System Libraries, Major Component, etc.

[Kalriath]

So, to me, it sounds like it is actually impossible to create and license a product under GPL3 which is written in Visual Basic.

I'm not saying that's a bad thing, but I doubt the intent of the license was to prohibit writing applications in certain languages while still opening the code.

ROM with a custom protocol

[tepples]

as long as you have access to the proper equipment (CD burner + blank discs) there is nothing that stops you from creating usable 'custom' copies. I'd think the same applies to code in ROM, it's just that the necessary equipment is not typically found on your average home computer.

Some video game consoles use custom cartridge bus protocols, some of which are encrypted and/or patented. Before the NoPass crack led to SLOT-1 cards, there wasn't any published way to make your own Nintendo DS-compatible ROM chip that wasn't just shellcode to get the DS executing code from the GBA slot. But if the ROM is in a user-removable cartridge, as in the case of almost every game console since the Atari VCS, the licensee under the GPL would still have to provide Installation Information because the licensee "retains the ability to install modified object code on the User Product" through a cartridge.

but on which hardware?

[goertzenator]

Does the GPL require the source code to run on the same piece of hardware? The OP can't build an run new firmware on his router, but can he build and run it on his x86 linux machine with standard tools? If *that* can be done, is it really still a violation? The modified source code has been re-contributed to society. I know that's not really what the OP wants to accomplish though...

Re:but on which hardware?

[masmullin]

Im wondering the same thing.

GPL's about free software. You want open hardware.

[mr_mischief]

The two are related, and both are desirable. However, they are mostly two different issues. You have the source and can put it on to any hardware for which you have proper access. Your problem here isn't the software license. It's the hardware license. You also need to get hardware for which you are granted the proper access. The distinction is clear, and I'm not sure why there is so much confusion.

One more time: YANAL!

[fm6]

Sigh. Every time legal issues come up on Slashdot, somebody declares that the law is obvious, and thinks that there's only an issue because nobody's thought to visit the courthouse.

The reality is this: law is complicated and expensive. It's not enough for you to declare that something's "obvious", you have to demonstrate it in court. That costs money. Lots of money.

I've always thought RMSs notion of "free" software was braindead. It's just not workable. We have the illusion that it does work because a lot of projects use the licenses to create an IP commons that benefits all of them. That's the Open Source model that Free Software purists sneer at. It works because there's an economic basis for it. There's no economic basis for a system that lets everybody hack their own cell phone, and never will be.

Re:One more time: YANAL!

[QuantumG]

Dude, people go to court (or better yet, settle out of court) every year. The result is always the same: what the copyright owner says goes, even if the law isn't on their side. Why? Because it costs a fortune to *defend* against a lawsuit. Send a cease and desist is cheap. Filing papers is cheap.

Re:One more time: YANAL!

[fm6]

I think you're misunderstanding why such tactics work. It isn't because "what the copyright owner says goes". It's because the big media companies have a lot of money to spend on lawyers.

The Java trap

[tepples]

I doubt the intent of the license was to prohibit writing applications in certain languages while still opening the code.

Such languages are called Java-trapped. Java itself used to be Java-trapped until Sun released OpenJDK.

GPLv2 vs. GPLv3 in the embedded world

[Anonymous Coward]

My employer works in a market where we can trust our partners about as far as we can throw them. They would rip us off in a heartbeat given the chance, and have in the past, and we don't have the resources to deal with it in court. We're happy to contribute our modifications of GPL code back to the community, and we do, but the constraints of the embedded environment require that most of our value-add proprietary code is in scripting languages, so it would be trivial for any of them to rip us off if we handed out the build scripts. We don't go out of our way to obfuscate things, but we don't make it easy to modify our firmware either.

As a consequence of this, GPLv3 is a strict no-go for us, and the same is true for many other small companies in the cut-throat embedded world. If we could trust our partners, or we could afford to litigate when they attempt to screw us over, we'd gladly be as open as possible, but as it stands we can't afford to give away our proprietary code in the process of complying with the GPLv3, so GPLv2 is as Free as we go.

Posted anonymously for what I hope are extremely obvious reasons.

Mod parent down

[fishexe]

He's only 50% insightful.

(I refer you to the other replies to see why)

'minority views on software development'

[toby]

2 can play at that game.

Enjoy this.

& all the world's a PC-arch x86, eh

[toby]

n/t

Why stop there?

[OrangeTide]

I've worked at so many companies where our builds were barely able to work for new employees. Let alone work for the public at large. But really is it such a big deal, if it's just one program from the open source how to compile it is pretty well known. Packaging it in a convenient way is another matter, but if you're hacking up some device why should you limit yourself to their lame schemes?

And why stop at build systems, maybe these companies that ride on the backs of GPL developers should give you a laptop already configured to build the whole thing from source. And while they are at it, you should get their source control change history too, maybe we should demand every GPL using company give us a public read-only Git or Mercurial repo with each release.

Feel free to make any of those demands in your next open source license. Although I suspect a company would rather pay you a few thousand dollars than deal with weird requests.

Is the FSF the only body who can pursue this?

[hallux.sinister]

Can someone else sue for damages, since GPL'ed code not being provided would seem to be a violation of everyone's rights... or what about the original author, since it sounds as if they are in violation of the code's original authors granting of license... or did I misunderstand the GPL?

Re:Is the FSF the only body who can pursue this?

[mr_mischief]

IANAL, but when they distribute the binaries to you, you get a license to the source just like they had when they got the source or binaries. Someone who's taking a GPLed work and sending it on to someone else would seem to be obliged to both the copyright holder and the recipient of the binaries. One couldn't get monetary damages as the new licensee probably, but there's always specific performance. I'd be interested to see how that suit would play out, but not interested enough to buy an embedded product I know is in violation and sue the seller just to find out.

Recommendation, please !

[Taco Cowboy]

I read through the over 200 messages, lots and lots of complains.

So, instead of complaining brand X sux brand Y sux too, can someone please tell me which equipment that you would recommend, that uses Linux / GPL softwares that also comes with readily tweakable firmware ?

Thank you !

Cross Compiler

[krischik]

I take is you have never actually tried to create a GCC cross compiler.

general-purpose tools

[krischik]

You could argue that a gcc cross compiler and cross bintools are a "general-purpose tools". But have you ever tried to create them from source

Copyright: non-issue

[DrYak]

so you couldn't put that in the firmware anyway.

This is actually a non issue, as you already have a licensed copy in your current firmware (which you could obtain either with the "backup old firware before flashing" option, or get it straight from Netgear's firmware repository).

The problem will only arise if you decide to publish your upgraded firmware on the net: you could only distribute the GPL bits, not the proprietary ones. There are 2 legal way to do then :

- Provide a small utility to save the proprietary part out of a legal copy, and the final user will use it to add the missing propretary bit from the new firmware using his/her own legal copy.
(That's the way it's done with Google Android, for example: licensed partner like HTC not only have a full built of the opensource system, but also a couple of proprietary Google Apps. The standard procedure with 3rd party firmwares is : backup google apps, flash custom firmware, restore google apps).

- in the specific case of a router, the html interface is rather basic and is a tiny part of the firmware. One could pretty much dump it and use some 3rd party alternative. (OpenWrt's LuCi is an example, as are various embed Linux distros with names ending in "-wall". But you could also go for full geekness and do everything on CLI over SSH).

The source code is provided...

[FellowConspirator]

In my opinion, the GPL specifies that you need to make the source code provided so that an individual could compile it on his own. It doesn't really specify that you need to make it work with a particular device.

That is to say. If I compile software on my Linux system, I can run it from where I build it, or I could copy the executables into some directory where other user's system path will pick it up and effectively have it "installed" so that others can easily execute it. I could even FTP it to another similar machine so that someone could run it there. The GPL is satisfied once I get to the part of building the program so that it's executable. It doesn't require me to provide all the various means to transmit / copy that executable to different places.

In the case of something like a cell phone, building the software alone is probably enough to run it in a simulator or on a development device, if you are a developer in possession of such a thing. The fact that you, as a third-party, don't actually have the an item capable of receiving the software or the means of rendering it so seems immaterial to the word and spirit of the GPL.

In the case of makers of equipment that include software controlled radio transmitters, a vendor is legally prohibited from supplying end-users with the ability to modify code which might alter the software radio's functionality, unless the user provides proof that they've been duly licensed by the appropriate regulatory agency.

It's like saying, "Here's the source code. You can install it on your transmitter if the FCC says its OK, otherwise you're going to need to play with it in a VM or something." That seems perfectly valid to me.

post the names of the companies to fix the problem

[dredawg]

Obvious solution: Out them now.

Completely Inaccurate Information

[colinnwn]

The examples provided previously are completely congruent and relevant, contrary to your claim they aren't.

If a person uses copyrighted work without paying for it, it is theft of service, the same goes for FOSS. In lieu of monetary payment, the FOSS developer requests and legally requires you to acknowledge the provenance of the code, and provide your changes back to the community. If you can't comply, don't use the code period, develop it from scratch yourself, or legally buy the code. Some FOSS developers (if they didn't use upstream FOSS code) would probably be willing to sell you a commercial license to their code, so you don't have to provide your changes to the community. It has nothing to do with control over a downstream product, other than requiring remuneration for services provided. And claiming otherwise is disingenuous.

No GPL license requires you to provide internal closed source development tools or build environments. If you think different, please show me. http://www.gnu.org/licenses/agpl-3.0.html. Some crazy person could come to you and claim otherwise, but the FSF won't be knocking on your door. The same can be said of closed source tools when some NPE patent troll decides they own IP to a tiny part of a process with plenty of prior art. They're crazy, but they're playing chicken to see who flinches first.

no matter how much tinkerers claim otherwise, the original company still ends up getting the blame when user modifications break the product.

Absolutely not true and I dare you to try to prove otherwise. If you get sent a product without factory firmware on it, it gets disclaimed from warranty. If someone tries to publicly shame you, the sane response would be to release a statement that you usually don't discuss customer information publicly, but the product was returned to you with tinkered software, specifically not allowed for warranty claims, and you believe the customer stating otherwise in public is defamatory to your company.

Re:Completely Inaccurate Information

[Bing Tsher E]

Absolutely not true and I dare you to try to prove otherwise. If you get sent a product without factory firmware on it, it gets disclaimed from warranty. If someone tries to publicly shame you, the sane response would be to release a statement that you usually don't discuss customer information publicly, but the product was returned to you with tinkered software, specifically not allowed for warranty claims, and you believe the customer stating otherwise in public is defamatory to your company.

Interesting. So now let's look at what you're saying:

• A minor shitstorm erupts because someone obtained a company's product with ditzed firmware because some hobbyist screwed with it.
• The customer who shipped the unit in to you didn't futz with the firmware, someone else did.
• But because they're upset, they start loudly complaining.
• So now it's time for the company to sue them for defamation.

Wow. You know, vendors just LOVE it when they get the opportunity to sue one of their customers for defamation.

You should put your scenario into a Powerpoint. The proprietary tool vendors would probably pay you to use it in their sales presentations.

GPLed build infrastructure as a problem

[cpghost]

GPLed build systems can also be a problem. Suppose you want to release software under the BSD license. If you used an old version of bison(1) (instead of newer ones, or Berkeley yacc(1)), there was a nasty surprise in store for you. From "info bison", Conditions for Using Bison (emphasis mine):

The distribution terms for Bison-generated parsers permit using the parsers in nonfree programs. Before Bison version 2.2, these extra permissions applied only when Bison was generating LALR(1) parsers in C. And before Bison version 1.24, Bison-generated parsers could be used only in programs that were free software.

Another example? Okay, how about IDL4? Suppose you want to write a BSD-only OS on top of L4Ka::Pistachio (which is BSD licensed too), and you wanted to make use of IDL4 (which is GPLed) to simplify IPC. You're in again for a bad surprise, because the IDL4 generated stubs are (probably) GPLed too, nullifying your intention to create a BSD-only OS. A simple special rule w.r.t. the generated stubs could have been added by IDL4 developers just as the bison(1) developers thankfully did, but IDL4 devs didn't. So it's not only the "bad greedy companies" that play tricks on build environments, it happens in the OSS community as well (sometimes intentionally, sometimes by accident).

Re:GPL's about free software. You want open hardwa

[soppsa]

Mod this up, might be first comment to actually hit the nail on the head...

Disingenuous Response

[colinnwn]

I never said for the company to sue them. I said to publicly suggest the customer is making defaming statements.

But in your example, one wouldn't say that because it isn't true. The company should come out and say the customer obtained the product outside of normal retail channels and per your warranty agreement, isn't eligible for service.

Though for low value products like a $50 Linksys router that costs the company less than $10 to replace, it might be worth the good publicity and goodwill to replace it as a courtesy. The company probably has the ability to JTAG official firmware onto the product regardless of the level of bricking, and resell the product as recertified anyway.