Slashdot Mirror


Open Source Licensing and the App Store Model

snydeq writes "Savio Rodrigues sheds light on the limitations open source software faces in app stores, a problem that will only increase as the app store model proliferates. 'In effect, in the context of a GPLv2 license, an Apple App Store item that abides by Apple's terms of service is deemed to be restricting usage and imposing further limitation on usage rights than were envisioned by the original licensor of the open source code,' Rodrigues writes. 'Far from being an abstract example, this situation is precisely why the popular VLC media player was removed from the App Store.' Microsoft, for its part, disallows the use of GPLv2 altogether. 'With the vast amount of GPLv2 code available for use, the incompatibility between the App Store's (and Windows Marketplace's) terms of service on one hand and GPLv2 on the other is a problem in need of a fix.'"

39 of 251 comments (clear)

  1. What about Xcode? by df5ea · · Score: 2

    Apple's Xcode is included in the Mac App Store. It includes GPLed stuff like GCC. Can this be a problem like VLC?

    Or are the rules for the Mac App Store different from those of the iOS App Store?

    --
    echo -n blabla | md5sum | cut -b 1-5
    1. Re:What about Xcode? by larry+bagina · · Score: 5, Insightful
      VLC wasn't a problem until a single contributor (and nokia employee) complained to Apple to have it removed.

      Apple makes their gcc/etc source code available and the app store version of the gcc binary doesn't have any DRM and can be copied/modified so the FSF shouldn't have any reason to complain.

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    2. Re:What about Xcode? by shutdown+-p+now · · Score: 2

      Xcode is distributed by Apple itself, so they place no additional burden (with respect to providing source code on request etc) by putting it in the app store.

    3. Re:What about Xcode? by Trolan · · Score: 4, Interesting

      The problem that had been noted with VLC was that you had to go to a 'third party' site for the source, and you couldn't build the actual app and install it without additional hurdles. In this case the Xcode application itself isn't GPLd, LLVM (the default C/C++/Obj-C compiler) is similar to the BSD license, and any GPL source elements are available from Apple (http://opensource.apple.com/).

      Xcode4 is kind of an odd duck in that it doesn't conform specifically to OSX AppStore guidelines (installs outside of /Applications, isn't a single .app file, etc)

    4. Re:What about Xcode? by harlows_monkeys · · Score: 2

      VLC wasn't a problem until a single contributor (and nokia employee) complained to Apple to have it removed.

      Apple makes their gcc/etc source code available and the app store version of the gcc binary doesn't have any DRM and can be copied/modified so the FSF shouldn't have any reason to complain.

      No need to mention DRM, since DRM does not inherently conflict with GPLv2. The problem with GPLv2 and app stores is with the terms of services of the app stores.

    5. Re:What about Xcode? by harlows_monkeys · · Score: 2

      The problem that had been noted with VLC was that you had to go to a 'third party' site for the source, and you couldn't build the actual app and install it without additional hurdles.

      No, none of those were the problem with VLC. The problem with VLC was that the terms of service of the App Store, which users must agree to in order to be allowed to download and install the app, conflict with GPLv2.

    6. Re:What about Xcode? by thetoadwarrior · · Score: 2

      The Mac store I suspect has different rules than the iOS store. After all the Mac store has loads of IDEs but there are none on the iOS.

      Lugaru HD is on the Mac App store which is a game whose source is released under the GPL.

    7. Re:What about Xcode? by jeaton · · Score: 3, Informative

      No, they don't have to offer it "via exactly the same means as the binaries".

      3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

              a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
              b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
              c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

      Nothing in there says that the source must be provided in the same form as the binary. You could have binaries released via the App store, but mail out source code on CD, for instance.

    8. Re:What about Xcode? by Lord+Bitman · · Score: 2

      I create a video player that reads a video file and a decryption key, Neither of these things are part of the video player's code base.
      I sell you a piece of hardware which includes: 1) The video player software burned into some write-once chip 2) The complete source code for that software.

      You have the source-code, and you can compile it yourself in such a way that you can view any keys involved. But you can't* modify the device I sold you (the device itself isn't covered by any license or law requiring it to be easy to modify, just like your cell phone).

      And you can't just "remove the DRM" and expect it to work. That would only work in a case where the only "DRM" involved was a "can I play this?" flag, which is so trivial it hardly qualifies (and is specifically not covered by the DMCA, for that matter)

      *this ignores the fact that the entire "Is DRM compatible with GPL?" question is moot, since DRM is not compatible with reality

      --
      -- 'The' Lord and Master Bitman On High, Master Of All
    9. Re:What about Xcode? by jo_ham · · Score: 2

      Well, not really, since there are other GPLv2 apps on the store - the developer, who was part of the team that put VLC together objected after the fact, so Apple said "ok, we'll comply and take it down".

      I think the FSF were expecting Apple to do something different (ie, do what the FSF "suggested" they do), rather than simply comply with the removal request. But hey, double win, since this means they can call it "being hostile to open source" and "removing open source apps from the store!"

  2. Limited problem. by Microlith · · Score: 3, Interesting

    First, this article is a pitch for OpenLogic's software.

    The problem has a limited number of causes:

    • Apple's App Store forces users to agree to a ToS that applies extra restrictions on the software delivered that is explicitly prohibited by the GPL.
    • The devices provide no means whatsoever for a user to load software on the device without going through the App Store.

    Were the second case not true, this wouldn't be an issue. If the first case were not true, this would probably not be an issue either. Both cases being true make Open Source (or rather, Free Software) unwelcome on both Microsoft and Apple's mobile platforms, which is exactly how they want it.

    1. Re:Limited problem. by Microlith · · Score: 4, Insightful

      he question really is why does Apple force a ToS that prohibit the use of GPL code.

      It's a side effect of their desire to lay terms and conditions on the users of the App Store. The Apple philosophy seems to be control, regardless of what side-effects it has.

      This feeds into the desire for a solid experience, but I think it's become a ridiculous and punitive obsession.

      The second question is if the benefit of GPL and other free code is strong enough to make these closed platforms uncompetative.

      People are trying, of course. But no vendor seems to have the wherewithal to create a truly good experience, or try and generate the hype necessary to counter Apple. And Apple could undermine that by allowing end-users to load software freely without the App Store.

      And I don't at all count Google as the savior here, since going with them basically means you're throwing the existing world of open source and Free Software on a bonfire (which is expected, when you're conforming to design decisions made for what was supposed to be closed source software.)

    2. Re:Limited problem. by Anthony+Mouse · · Score: 2

      Since there is no way in hell ... and nor should there be, anyone who is sane enough to recognize security concerns attendant on any responsible smartphone provider will accept ... that Apple will ever allow unsigned binaries access to their devices, this issue is effectively unresolvable until the FSF pulls its head out and accepts that the general public really, truly, should have code signing protection, remote malware killswitch, etc. for their smartphone devices; there's just too much personal and financial information available there for any responsible company to not do their best to lock down the platform.

      There is nothing preventing the GPL from being compatible with those things if implemented properly. The key is that you have to make installing unsigned software obnoxious but not impossible, so that anybody who wants to can do it but at the same time nobody will do it lightly or by accident. The developer option would probably be fine if you didn't have to pay anything or buy a Mac to exercise it.

      'Tis strange indeed that whilst the TOS of Android Market are similarly infringing in all the ways that are alleged to matter wrt remote kill and so forth, the Apple-bad crowd never seem to notice...

      Because you can install Android apps that aren't from the Android Market?

    3. Re:Limited problem. by Tjp($)pjT · · Score: 2
      The second case is not true. There are two methods to load software outside the App store. Note GPL does not require tools or equipment used to be free.
      • First - jailbreak the phone. Then your world is opened. And it is legal to do. There are risks the user assumes for this, but that is normal.
      • Second - Get a developer license. Pay Apple $99 a year to develop software for the iPhone. Build the App from scratch, or well lets just say if you're a legit developer and your device is flaged for developer use, certain other venues are open. Which you can discover elsewhere

      And open source licensed under BSD/MIT/many more ... That is available as a resource to use for App Store Apps. No software that I have used (but experiences vary) has refused to give me access to a copy of the open source items they used even as they modified them.

      Lastly, I am actually looking to modify the GPL v2 text (as allowed by FSF) to accommodate the App Store (tm)Apple, Google and Microsoft market place (Google is sort of easier, but maybe not for long after the virus-ware there). Interested in helping me and a lawyer willing to donate some time? write me at the very disposable email address slashlegalhelp @ chammy.info . After a few weeks this will not be monitored.

      --
      - Tjp

      I am in wallow with my inner money grubbing capitalistic pig. ... Oink!

    4. Re:Limited problem. by Anthony+Mouse · · Score: 2

      OK, but so what? Android is just the UI and some libraries, it's still Linux underneath and it's all open source. You don't really have to re-implement anything -- if you need some library from desktop Linux that isn't in Android, you don't have to rewrite it, you just have to statically link it. There is obviously some work to be done to e.g. get gtk and qt working with the Android UI, but they already work with OS X and win32 and I'll eat my hat if they can't reuse a large majority of the OS-dependent code from desktop Linux. To say nothing of the possibility of just running x.org alongside Android as a stopgap measure in much the same way x.org runs on OS X.

    5. Re:Limited problem. by CheerfulMacFanboy · · Score: 2

      The App Store could be compatible with the GPL, if Steve Jobs didn't have the "my way or the highway" stick up his ass. The App Store is either poorly designed, or well designed if violating the GPL is you main goal.

      The GPL could be compatible with the App Store if RMS didn't have the "my way or the highway" stick up his ass. The GPL is either poorly designed, or well designed if violating Apple and its customers is you main goal.

      --
      Fandroids hate facts.
  3. Don't buy anything that uses such an App store by LodCrappo · · Score: 4, Insightful

    Problem fixed.

    --
    -Lod
    1. Re:Don't buy anything that uses such an App store by turbidostato · · Score: 2

      "Yeah, that'll solve the problem. Cause FOSS has such an easy time with distribution now, it don't need no steenking app store."

      Maybe it doesn't need no stinking *Apple* app store if other contenders (I'm looking at you, Android) are clever enough to offer better conditions to open source developers.

    2. Re:Don't buy anything that uses such an App store by Anonymous Coward · · Score: 2, Insightful

      Dude, apt-get get is like the mother of all app stores.

    3. Re:Don't buy anything that uses such an App store by LodCrappo · · Score: 2

      http://techaryan.com/eric-schmidt-350000-android-activations-every

      350,000 Android activations *every day*. Do you really want to do the math?

      --
      -Lod
  4. Re:Clarification Needed by Microlith · · Score: 3, Insightful

    It'll never happen. Apple would have to give up some control over the platform and they'll NEVER let that happen.

  5. Re:What does GPLv2 code have to gain here? by Microlith · · Score: 2

    Why would FOSS developers care whether users who buy into company A's platform can use the software?

    Because Company A is making the arbitrary decision that users should not be allowed to use FOSS, and banking on them not caring because they don't know.

  6. Not incompatible by mysidia · · Score: 4, Insightful

    the incompatibility between the App Store's (and Windows Marketplace's) terms of service on one hand and GPLv2 on the other is a problem in need of a fix.'"

    No, the app store model does not need a fix, because it's not inherently incompatible. Source code can still be provided, with download instructions.

    What's in need of a fix are the fact that phones are locked down to prevent the user from modifying and installing any application they want, without crypto signing and the manufacturer's approval.

    App store providers can fix it if they insert a clause in their license terms requiring the user be allowed to modify, compile, and install any application they want on their own, without requiring any crypto signatures.

    Without the "cannot install your own app restrictions"; the app store is just a convenient installation program. Many GPL software applications use proprietary installers, such as InstallShield or MSI based installers, without source code provided to the installer; without GPL-violating DRM on the phone, the app store is just a fancy installer program that can install files directly from an URL or remote location.

    1. Re:Not incompatible by Wrath0fb0b · · Score: 3, Insightful

      What's in need of a fix are the fact that phones are locked down to prevent the user from modifying and installing any application they want, without crypto signing and the manufacturer's approval.

      The GPLv2 does not require that devices honor modifications, only that the user is free to download the source and the binary and modify and redistribute them. That was the entire lesson of TiVo and the motivation for GPLv3.

      I would have thought that a reasonable way to solve this would be for a GPLv2 application distributed in the App Store to have a link to a web page where you can download the source and the binary. There would be a sort of philosophical question, given that you can't access the copy that's on your phone but I don't think the GPLv2 requires such pedantic exactitude. So long as you can get a copy of the source used to build that binary, I think the license is met.

      And, of course, if you don't want software that you write to be used in such a fashion, use the GPLv3. I don't find anything wrong with that at all -- the author ought to decide based on what he or she feels is right.

      http://en.wikipedia.org/wiki/Tivoization

    2. Re:Not incompatible by Kenja · · Score: 2

      Lets see. Check the check box allowing third party app sources. There! I cracked the complex lock down system!

      Course thats for Android phones...

      --

      "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
    3. Re:Not incompatible by mysidia · · Score: 2

      The GPLv3 states that. GPLv2 only states that you make the source code available.

      FALSE

      The GPLv2 states very clearly:

      6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

      The GPL v2 already prohibits adding restrictions. The GPL v3 merely elaborates and explicitly identifies DRM and crypto techniques as introducing restrictions that are prohibited by the GPL, for purposes of clarification; they are not mentioned specifically by the GPL v2, but that does not mean it is allowed to impose additional restrictions when distributing GPL v2 licensed software.

      It's called TiVoization after TiVo, Inc., did that by releasing full source code to the LInux they run, but you cannot run anything you built from that code on an unmodified TiVo.

      What TiVo did would be a GPL violation in regards to the Linux kernel, had they not been very clever and implemented all their software and custom filesystem in user space.

      Even if the Linux kernel had been released under the GPLv3, they could still accomplish TiVoization without a GPL violation. Modified GPL kernels don't get you very far, when all the system drivers, filesystems, hardware I/O devices are controlled in user space.

  7. Re:Clarification Needed by hedwards · · Score: 2

    I'm just surprised that Steve allows Apple users to keep their keyboards, mouses and touchscreen. I'm thinking their getting dangerously inventing something like this: Apple's goal invention.

  8. Where do you get that out of GPL v3? by SuperKendall · · Score: 2

    No, the alleged issue -- the biggest, anyways, there's a few more -- is that you can't redistribute the binary (well, you can to jailbroken devices or developers who can run codesign themselves, but in the general case you can't). Source doesn't come into it at all; anyone who claims source distribution is an issue should be gently corrected

    To me this seems exactly backwards. The whole section six of the GPLv3 is all about various forms of binary distribution can provide a way to get to the source. The GPL doesn't really care about the binary, the whole point of the thing is to get people source so that they can modify and make new versions.

    There's nothing at all about the App Store that prevents this, as long as your provide all of the code for your project somewhere everyone can get to.

    Since there is no way in hell ... and nor should there be, anyone who is sane enough to recognize security concerns attendant on any responsible smartphone provider will accept ... that Apple will ever allow unsigned binaries access to their devices

    You don't need unsigned binaries since any developer could build and run the source. Just as the GPL does not require that you buy a computer for someone wanting to compile your source, it does not mandate that the person acquiring the source does not have to buy whatever is required to compile it.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  9. Re:Then buy what instead? by Anthony+Mouse · · Score: 2

    A) You can still buy an Android phone even if you buy a Wii.
    B) They have a device called a "PC" which is mostly open and runs a lot of video games.

  10. Re:Maybe the market will fix the problem? by Anthony+Mouse · · Score: 2

    With the recent story about infected apps on the Android Market, I am having second thoughts about switching at all.

    I guess FUD works.

    You know you could get an Android phone and just not install shady apps.

    Incidentally, has someone ported Synaptic or the like to Android yet? It would be incredibly convenient to have an "app store" app which is full of free software. Especially because then you could have repositories run by people you trust who make sure nothing in them is malicious. And get all the advantages of the walled garden, but without the walls -- because hey, if I want to install the app my college buddy wrote, I still can.

  11. Try paying attention to the LEGALITY by SuperKendall · · Score: 3, Interesting

    You appear to utterly misunderstand the FSF's position. From the PC Magazine article on the VLC flap:

    Well excuse me for studying the legal language of the GPL instead of the "position" of the FSF.

    I mean, I've only been carefully reading through variants of the GPL and thinking about the wording for 20 years but whatever.

    You see "source" mentioned anywhere there? Nope. That's because it's not about the source.

    It might not be in the "position" but far more relevant is what an application must do to abide by the GPL.

    I know what the FSF is saying, I just don't see it in the license which in fact talks at great length about SOURCE. And the point of the GPL is that you have access to the SOURCE. Free as in speech, remember? And I did in fact mention section six, which you didn't bother to read whatsoever I gather? Because that's where it goes on and on about SOURCE in relation to the binary, which it treats as an afterthought.

    Can you (or since you are unwilling, anyone else) point to where in the license the FSF position is codified in legal language instead of baboon like posturing (and know here that I am a card-carrying member of the FSF, can you say the same?)

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Try paying attention to the LEGALITY by larry+bagina · · Score: 3, Informative

      1. Free Software Foundation
      2. Brett Smith is not a lawyer.
      3. The reason VLC isn't on the app store is because Rémi Denis-Courmont filed a copyright infringement notice.

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    2. Re:Try paying attention to the LEGALITY by julesh · · Score: 2

      Can you (or since you are unwilling, anyone else) point to where in the license the FSF position is codified in legal language

      AIUI, the issue is with these sections of GPLv2:

      3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above
      [...]
      6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

      As I understand the FSF's position, the App Store terms prevent somebody who has received an executable under section 3 from redistributing it further under section 3, and thus is a violation of section 6. Source doesn't enter into the situation, because it's all about section 3 distribution.

  12. Re:What does GPLv2 code have to gain here? by aristotle-dude · · Score: 4, Interesting

    It's not arbitrary. Apple have locked down their devices, and for (IMO) good reasons. The GPL forbids distribution of locked down derivatives, so it isn't Apple's doing, it's the GPL's. Same for Microsoft.

    Citation needed. Give us the specific clause int he GPL Version 2 that states exactly that. Put up or shut up. The GPL Version 2 is a "source" license. Version 3 tries to go beyond that and specify what you can and cannot do with the binary. I'm not sure if those are enforceable but the author can always resort to copyright to block distribution.

    --
    Jesus was a compassionate social conservative who called individuals to sin no more.
  13. Re:App Store Model? by Elbereth · · Score: 2

    I agree, but we're apparently in the extreme minority. Sometimes I wonder if I'm missing out by not having a Facebook page, an iPhone/Android, meaningless sex with chicks from bars, and a big screen television that gets 2000 channels. Then I usually come to my senses and start to hate that shit again.

  14. Re:Single-player devices by Anthony+Mouse · · Score: 2

    Even if a game supports WLAN play, is the host expected to buy phones and copies of each game for players 2, 3, and 4 to use?

    Of course not. Each player can supply their own device and copy of the game like any other LAN party.

    That's actually a pretty good idea: Using a touchscreen phone as a game controller and then hooking one of the phones up to a TV, with multiplayer over 802.11. I hope that catches on.

    But most developers of PC games appear to be under the impression that the PC is single-player, ignoring the possibility of four gamepads and an HDTV monitor.

    That's because it mostly is, or at least the usual model is that each player has their own PC. But what's wrong with that? It's easier than ever because modern laptops are fast enough to play almost all PC games, so you don't even have to lug a bunch of desktops and CRTs into the same room if everybody has their own laptop.

  15. Re:Why does that make a difference? by Anthony+Mouse · · Score: 2

    I'm not seeing why that is the sticking point, when you have to buy a computer at all to compile anything.

    It's a sticking point because it adds a major unnecessary restriction. 90% computers aren't Macs, and you're excluding all those people even though they meet all of the inherent requirements for compiling the code.

    And jailbreaking doesn't count because it's not formally permitted so you can't get it past the lawyers. It would be a different story if Apple officially accepted it as a method for installing software.

  16. Re:Wrong, two other ways by Microlith · · Score: 3, Insightful

    The first way is jailbreaking; but lets ignore that for the moment.

    Yes, lets. Because it forces you to violate an EULA you agree to when you start using the device. You shouldn't be forced to violate a contract (of any kind) to be free to do as you wish.

    The second way is compiling and installing yourself. Which is something you would be able to do with the developer tools, which you would need anyway once you get access to the source.

    The developer tools themselves do not allow you to load them. You must pay the yearly $99 fee to load them on your phone, and even then it is a limited "beta" signature that will eventually expire (90 days, I believe.) So even then Apple is placing restrictions on your use of the software.

    Anyone who can make use of the source can also get a build onto the device, in two different but equally effective ways.

    I hardly call forcing people to violate an EULA, and forcing them to pay $99 to load software they compile themselves on a device they own "effective" or even remotely reasonable.

  17. Re:App Store Model? by Americano · · Score: 3, Insightful

    No, real geeks value their time enough to know that reinventing the wheel is usually an immensely stupid idea. App stores are for those who value their time more than they value the $1.99 they'll spend on an app that's available now, and addresses their needs.