Slashdot Mirror
GPL Violations By D-Link and Boxee
An anonymous reader submitted a link to a bit of a rant on GPL issues connected to D-Link and Boxee. They spend quite a bit of time explaining "Tivoization is a dangerous attempt to curtail users' freedom: the right to modify your software will become meaningless if none of your computers let you do it. GPLv3 stops tivoization by requiring the distributor to provide you with whatever information or data is necessary to install modified software on the device."
Is it that time of the day already? Time for a free software vs. open source vs. "I just want something I can use damn it!" flamewar...
Palm trees and 8
GPL is based on copyright, dictating the rules by which the work can be transferred (or sold, or given). It's the same as breaking the Microsoft EULA when you pirate your Windows copy.
Surely, there may be not enough GPL authors going after people breaking their licenses, but it falls on the same category [I *think* the FSF sometimes offers legal help for those trying to sue companies to enforce their GPL-licensed products.]
some of the complaints are that promised features were never implemented. learned this a long time ago. buy on the feature set at the time of sale, don't ever trust a company to implement new promised features. after the sale they are thinking about selling the next version, not paying developers to code software you already paid for
No, they get sued if they don't bring the offending products into compliance with the GPL.
RTFA:
The Truth
Your Boxee Box was shipped containing GPLv3 software. You should be able to install modified versions of software to your Boxee Box.
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
First: there is no issue with GPL and tivoization. GPLv2 allows it and GPLv3 forbids it, full stop. It is as clear as day and every developer can make an informed choice as to what he/she wants to allow with the code.
Now it seems that these things include GPG that is under GPLv3. So it looks an awful lot as a violation, if confirmed. At the same time it seems that the program was removed by online firmware updates, so everything would be kosher for the GPLv3 (that gives the option to stop distributing the offending code and be legally safe)
Did someone at Boxee actually edit a forum post to change the author's intent?
Forum Post Screenshots
Is Boxee's operation really this shady?
By whom? Maybe the EFF.
I think part of the problem is that, to the best of my knowledge, the GPL hasn't been fully tested in court, and there is no single body (and certainly not with a lot of resources) who can police this. I'm not even sure the EFF has standing to sue everybody who might do this ... unless the GPL says they're the effective copyright holders for everything GPL'd, short of an amicus curiae the EFF doesn't own the code which is alleged to have been violated.
A lot of companies seem to more or less say "too bad" when it comes to the provisions and providing this stuff ... they're just not willing to provide you with the details you'd need, admit that they're using the GPL'd software, or provide you with the sources even if they are. So, effectively they rip it off with impunity and laugh at you.
If there's no actual consequence for these companies, what is going to change? This is far from the first time we've heard about companies flipping the bird at the terms of the GPL.
And, really, based on my experience with my latest D-Link router ... it might be time to consider a change anyway. My latest router has a tendency to lose connection on one of its ports, and has some issues which may or may not be the fault of Vista.
Lost at C:>. Found at C.
Yet he doesn't even name a single piece of this GPLv3 software that Boxee uses. The entirety of his proof is:
Once you have a command prompt on your Boxee Box, type “gpgv2 --help” et voila, you are greeted with the GPLv3 header.
Wow, soooo convincing.
You don't capitalize by or other short prepositions in titles. How long have you been doing this? Maybe set this as your homepage for a few days.
VLC rules by the way.
Calling out bogus battery capacity claims.
It's the same as breaking the Microsoft EULA when you pirate your Windows copy.
No. An EULA takes away rights on something you bought, the GPL gives you rights on something you've copied for free (or bought for money, but GPL gives you the right to copy it for free after that).
Yea, notice step 1: Reset your box to factory default. The only GPLv3 piece of software on the box is GPG, and it was removed in a firmware update, so the case here is extremely weak.
GPLv2 didn't "Allow" what Tivo did, it overlooked it. Once Tivo Inc. showed GNU just how evil a corporation can be, they had to spend time and money creating GPLv3, time and money that could have been spent actually doing something, instead had to be spent on lawyering.
As a side note, Tivo Inc. is losing customers, and every useless Tivo sitting unsold at a yard sale is a message to consumers that a Tivo box is worthless. If Tivo Inc. were to provide some small amount of functionality for these machine, they would at least be able to upsell some customers.
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
This is why the FSF asks for copyright assignment in GNU projects. They become party to the license, and can act on its infringement.
Doing the Right Thing should not be preempted by making a buck.
"tivoization"-- Nice word.
http://www.geoffreylandis.com
Quick Google Search:
http://en.wikipedia.org/wiki/GNU_General_Public_License#The_GPL_in_court
http://techrights.org/2007/11/23/gpl-court-test/
"Science can amuse and fascinate us all, but it is engineering that changes the world. " - Asimov.
Almost no software, and certainly no major projects. Except, of the top of my head: GCC, GPG and Samba
...If it was "hackable". But it seems that hardware makers today want more than selling you their product. They want to make sure you don't use it unless it's in a way they approve of.
For now, I have alternatives (buy something else), but I am afraid my daughter will not have that option.
moi
Well, yes, that was my thinking as well. But then I thought, "Hey, what if I wanted to reset to the factory default (which is arguably better) and just use that and never connect to the internet and receive the latest firmware update. Then, what if I wanted to make a change to gpgv2 and run the changed binary on my Boxee. In terms of the GPLv3, I *should* be able to, but I can't because I don't have the encryption keys required for the modified image to work".
It is all well and good if they have removed the offending software in recent updates (no way to check though, since you can't get any sort of shell access on the box anymore), but at one point they did violate the GPLv3. And for it, they should make ammends by providing the required keys ... even if it is only for that 1 single version that they released a long time ago that I still have the ability to run. However, the key for that build, and for any other build would be the same ... which I suppose is a win for people wanting to hack their Boxee Box.
I wonder if any virus scanners can be set to detect GPL code to keep your product/project from being infected.
Well, if there was no GPLv3 code on the device, then in precisely what way would it have the header for GPLv3 in the device?
That would imply two broad conclusions:
1) Boxee is including license headers for software they don't ship, just in case you would like to be able to read it, but that in no way implies they have any GPLv3 code.
2) They have GPLv3 code as evidenced by the fact that that it was there in the first place.
I don't know about you, but I have never included license information for software I'm not including in any product I've ever been party to creating or maintaining.
You're right that it's not possible to know what all is included, but I'm hard pressed to believe that if you have the headers you don't also have at least something using that license.
Lost at C:>. Found at C.
Not as weak as it may seem.
Being as they distributed gpgv2, which is licensed under the GPLv3, means that somebody can make a claim for the cryptographic keys required to make gpgv2 run on the target hardware. The fact they removed it in a software upgrade doesn't change the fact that a GPLv3-licensed binary was distributed: the fact that the binary is still on the machine (and able to be restored by a factory reset) actually proves that GPLv3 code is likely STILL being distributed.
It's a lot more than a technicality. A common-sense interpretation of both the GPLv3 and case law says that there is an actionable claim here for a license violation.
Since this is one violation on one utility, can't they just cut the author a check for a different license and be done with it? Seems like $10k would be way cheaper than any lawyer involvement. Unless the author wants to use his util as a foot in the door to force Boxee open then I don't see why this won't be resolved in a matter of days. Obviously if this is a much bigger project with lots of authors that complicates matters a little bit, but it seems like just paying the guy off after the fact is the easiest way to clear yourself of GPLv3 violations. Or is that somehow not allowed?
That was my tought too ... GCC and Samba.
Interestingly enough, notice the major players in this industry which are pretty good at supporting OSS are also moving away from ... GCC and Samba ... to things that don't have such restrictions.
The major products are free to use GPLv3, but the writing is on the wall, they're going to lose support from the big guns and be replaced by alternatives without those restrictions. Basically cutting of their nose to spite their on face.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
My consulting firm helps law firms and their customers come into compliance with the GPL and other Free Software licenses - both before and after they distribute the product. I can tell you they do take it seriously when they run into trouble, because there is not just the threat of a lawsuit, but the threat of having infringing products prohibited from being imported into the nations where they wish to sell them.
What a lot of companies are having problems with is establishing a compliance program before they get that letter from the Software Freedom Conservancy (which has sued about 40 companies, no kidding). Too many of them fix the problem after it's happened.
Tivo-ization is not one of the things the companies are in trouble for, because the software in question is under GPL2, not GPL3. The problems are from simple non-compliance with the license terms.
Bruce Perens.
Well if it's only in the default firmware, it's like they didn't distribute at all! Right? Right?
Analogies don't equal equalities, they are merely somewhat analogous.
Also because it gives them more power. It's been years now since Stallman worked on any real code, so for his arguments to have any traction he needs to scuttle about like a hermit crab in someone elses shell.
By 'major players' you mean Apple. One company does not a trend start.
Yeah, can't see Apple capable of starting a trend really.
That touchscreen pinch-zoom phone thingy never took off, and those big tablet things are just dead in the water - no one's copying them.
an EULA spells out the terms under which your bought something.
It does not 'take away rights' it identifies purchase terms you agree to (even if you don't agree with them)
every day http://en.wikipedia.org/wiki/Special:Random
I just sold mine because I couldn't install XBMC on it. They (Boxee) made it seem like the new D-Link Box was going to be hacker friendly and it's far from it.
http://www.youtube.com/watch?v=lwhypK3egeQ
ayottesoftware.com
> there is an actionable claim here for a license violation.
Sounds like the license violation has already been cured - if they have stopped distributing the software and removed from existing installations best they can with updates.
If they haven't acutally stopped distributing, then the copyright holder could sue them to get them to either a) come into compliance or b) stop distributing. Looks like we know what they will do, since they've already gone down that route.
Question is, is it worth suing them to get them to really remove the software (if is still really there) that they already removed from users (unless you jump through some hoops) ?
DLink has a history of GPL violation in the past. I am frankly not one bit surprised...
ELOI, ELOI, LAMA SABACHTHANI!?
An EULA defines the terms under which the copyright holder allows you to use their work, for which you may or may not have paid money for.
Just like the GPL.
Again... it is not clear that the copy of gpgv2 is in violation of the GPLv3.
Unless the code used to build it is different than that on some major repository or distro... they can simply point to that for the code in question.
If they modified it and are not making available their changes... then yes, they are in violation of any version of the GPL.
If you cannot use your own custom version of gpgv2 in place of what they are without their magic keys... then they would be in violation of the GPLv3.
Nothing said in the post indicates any of the three... and until it does, this is an accusation which needs to be proven by the accuser, not the accused.
Help Brendan pay off his student loans
That is incorrect. The GPL puts no restrictions on use, ONLY on copying. Thus, it relies on copyright and not the (legally dubious IMO) EULA.
God is imaginary
SOmething they have no right to do, unless it is proffered up before a plain old sale is made.
Additionally: you appear to be clueless about what hte GPL actually does. THe GPL gives you rights to copy something you have acquired. EULAs attempt to restrict your rights to use the product you legally bought over the counter by pretending it is a "licence", and attempting to hold you to the terms of a contract you never saw.
than bill of rights.
The FSF isn't at all democratic, what goes into the GPL is entirely up to Stallman.
TiVo would be obsolete if it publicly allowed modification of its software, because Cable Labs would withdraw TiVo's permission to transfer recordings in any capacity. And this capability is one of the reasons I will never use a cable company or IPTV's inferior DVR solution. The TiVo software is outdated (granted, I do not own a TiVo premiere, because without the OLED front display, I view it as a downgrade), but it still does what it does better than anything else on the market. I do not get why people rag on TiVo for this - all of my TVs all the way back to my 30" SONY Trinitron FD (circa 2004) run a Linux kernel, and none of them are modifiable either, yet nobody ever complains about that. I am sure SONY has sold more TVs running Linux than TiVo has subscribers, and SONY is not the only manufacturer to run Linux, so.... what gives?
Because the proprietor doesn't have the "right" to distribute GPLv3 code without following the terms of the license.
Analogies don't equal equalities, they are merely somewhat analogous.
Bruce, I don't know much about this, and others have stated above that it is GPLv2 software. Do you think it is possible that it is GPLv3 software if there is a GPLv3 header? Does it even matter? I don't know what significance the header makes...
Either they are in violation, and need to come into compliance, or this smells of trolling to cause turmoil in FOSS-land. No better way to troll than to turn people against each other, for no good reason.
Like a city whose walls are broken down is a man who lacks self-control.
Rather than trolling, consider that it's from someone who doesn't like tivo-ization, and doesn't understand that much as some of us might like if it did, GPL2 doesn't give anyone the legal ammunition to go after tivo-ization. Next question: are sources provided correctly? That is something that can be enforced under GPL2.
Unless it contains a recent version of Samba, it is unlikely that there is GPL3 stuff in there. I didn't check, I'm working on other stuff today.
If the company or its attorneys need help with a compliance issue, I'm happy to look deeper. But I charge as much as their attorneys do for my expertise. If they don't need my help, I generally leave this stuff to Bradley Kuhn to handle.
Bruce Perens.
Yes, because they totally came up with the idea of a touch screen interface and nobody had ever used a pinch to zoom gesture before. Troll some more?
Your post is nonsensical. There is no significant connection between interface design and choice of backend software licenses. In your world, I guess that everybody quit using Linux after Apple used BSD as the basis for OS X.
Spooooon!!!!!
Jealous much?
It's pretty easy to figure out that the third is the problem: yes, you can't install any custom software on your boxee. End of story, gplv3 violation.
A successful API design takes a mixture of software design and pedagogy.
If you cannot use your own custom version of gpgv2 in place of what they are without their magic keys... then they would be in violation of the GPLv3.
I just read the GPLV3 and don't find a clear statement that you must be able to run the modified source code on the same system upon which the modified object code has been received. You must get source, yes. Must execute, I don't see.
I see a specific exclusion for user devices where "you" (the provider") also cannot modify and run the recompiled code. The specific example deals with code installed in ROM. Is this not a similar case, where even the modified code provider cannot modify the program and run it on that hardware (without having to make chages elsewhere, in non-GPL code?). They can modify the source, compile it, install it, but even for them it will not run unless other changes to the system are made.
Second, doesn't the GPL specifically deny any warrantee of any kind, even for "usability and fitness of purpose" or whatever, to anyone who modifies the code? If you modify the code and try to install it and it does not run, doesn't the GPL specifically release the provider from ANY requirement to support the modified code? Doesn't that mean "if you change it and it doesn't run, tough luck?"
I would be very scared of any code that says anything other than that last bit. I write code and send it off to other people, and routinely they are unable to get the unmodified code to work properly. The interface to something has changed, the database they are using is just a tiny bit different. So if GPLV3 says I must distribute anything I modify and MUST SUPPORT other people getting it to run, whether or not they changed anything, that's just too much of an exposure to accept. Yes, I know, if it is true, don't use GPLV3 code. But is it true?
Now, I understand that not providing the modified source is a violation, but does GPLV3 really make not being able to run code on a specific device a violation, too?
I'm told it's a GPL3 version of GPG. In that case, they'd have to remove the GPL3 version, and document their compliance with the remaining GPL2 software to the copyright holder (who would probably be represented by one Bradley Kuhn of the Software Freedom Conservancy and SFLC). Not the end of the world.
Bruce Perens.
"What a lot of companies are having problems with is establishing a compliance program ..."
Bruce, do you think companies made a genuine effort to establish a compliance program early, or is it more a case of them wanting to save money and try and get away with it, or at least delay the costs until a later stage ?
Im following up on a violation right now for a company right now, 6 months ago i queried them about "scripts used to control compilation and installation" i only recently got a response where they state it was an oversight. (pressuring the distributor seems to be the best way to get manufacturers to respond)
My experience is companies will ignore open source licenses (treat it as public domain) until its a threat. I struggle to think of any hardware companies (box makers) that have always dont the right thing.
What hardware companies would you consider open source friendly ?
You dense idiot, a EULA does not mean it has to put restrictions on use, it can also grant rights of use. The GPL is a EULA. It restricts those that do not want to follow the GPL and it grants rights and USE to those that respect the agreement. Do the world a favor and don't breed.
I would say hes the Antichrist of the Open Source world.
As I don't support anything related to GPLv3 I just don't care. Its a flawed political license that has no place with open source or free software. I hope that it is tested in court a few more times and found to be invalid so it can just go away.
Regarding the violation, please notify Bradley Kuhn and do not publicly harangue them. It's my understanding that Bradley prefers to be the one to make the contact, rather than having the company dragged through publicity first.
I regularly speak to perfectly intelligent lawyers who work for companies with billions of dollars, and have trouble getting their companies to adopt a company-wide compliance program. When I had a management position with HP, I found that from my section-manager equivalent position it was very difficult to get the whole company marching in the same direction, even with support from higher-level executives. It was easier for me than it is for folks in some companies overseas, who will destroy their careers if they make the wrong step, regardless of whether they are right or not. Often they hire me to say things to their management that an insider could not say safely.
I am also available to talk to the company, but I'd try to sell them my own services to implement a compliance program. So, you can give me their name or not, as you please. Company email is bruce at perens dot com, and company phone is 510-4PERENS.
Thanks
Bruce
Bruce Perens.
Not sure where you live, but EULA's have been legally classified as UNENFORCEABLE in Canada since they are not presented at the time of purchase. Oh yeah, and if you pirate Windows, you are NOT violating the EULA since you were never presented with it. The person who uploaded it is violating their EULA (though that legally means nothing) and you are both violating *copyright*.
I just read the GPLV3 and don't find a clear statement that you must be able to run the modified source code on the same system upon which the modified object code has been received. You must get source, yes. Must execute, I don't see.
It's there, in section 6:
Second, doesn't the GPL specifically deny any warrantee of any kind, even for "usability and fitness of purpose" or whatever, to anyone who modifies the code? If you modify the code and try to install it and it does not run, doesn't the GPL specifically release the provider from ANY requirement to support the modified code? Doesn't that mean "if you change it and it doesn't run, tough luck?"
Not quite. That disclaimer is saying "if the code doesn't perform in the way you want, you can't hold us responsible", and it applies whether you modify the code or not. There's a big difference between being able to run the code and it not working, and it not running at all. In the first case, if it doesn't work as I like, I can fix it. In the second case, I can't, and this is exactly what the GPL is designed to prevent.
I would be very scared of any code that says anything other than that last bit. I write code and send it off to other people, and routinely they are unable to get the unmodified code to work properly. The interface to something has changed, the database they are using is just a tiny bit different. So if GPLV3 says I must distribute anything I modify and MUST SUPPORT other people getting it to run, whether or not they changed anything, that's just too much of an exposure to accept. Yes, I know, if it is true, don't use GPLV3 code. But is it true?
No, it's not true. You don't have to guarantee that the code will work, in the sense of being free from bugs, but if you're distributing someone else's GPLv3 code, then you do have to guarantee that they can at least compile and run it... once it's running, it's up to them whether it works or not.
Now, I understand that not providing the modified source is a violation, but does GPLV3 really make not being able to run code on a specific device a violation, too?
If you sold the device with the GPLv3 code running on it, and won't let other people do the same with their modified versions, then yes.
Need to type accents and special characters in Windows? Use FrKeys
If you cannot use your own custom version of gpgv2 in place of what they are without their magic keys... then they would be in violation of the GPLv3.
And that's exactly what the article says:
Contact D-Link AND Boxee and request the ability to modify the GPLv3 Software included in your Boxee Box. Specifically you require the OpenSSL keys to generate the signature files found in the boxee.iso firmware file, and the scripts and instructions for their use.
Yet you're saying "it is not clear that the copy of gpgv2 is in violation of the GPLv3", i think the article has made it quite clear.
I just read the GPLV3 and don't find a clear statement that you must be able to run the modified source code on the same system upon which the modified object code has been received. You must get source, yes. Must execute, I don't see.
It's quite clear:
"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information.
Section 6. of GPLv3
Second, doesn't the GPL specifically deny any warrantee of any kind, even for "usability and fitness of purpose" or whatever, to anyone who modifies the code? If you modify the code and try to install it and it does not run, doesn't the GPL specifically release the provider from ANY requirement to support the modified code? Doesn't that mean "if you change it and it doesn't run, tough luck?"
Yes, that's correct.
It's there, in section 6:
Yes. The next paragraph, however, deals with the provider not being able to modify the object being distributed. The example is "in ROM", but that is not normative. If the provider cannot install the modified software either, then they meet the requirements of GPLV3, and in this case, he can't unless he also modifies non-GPL code.
It appears there is a requirement that the very next paragraph cancels. Yes, it also appears to be a violation of the spirit of the GPL, but the exception is arguable. How can the GPL force someone to modify code that is not released under that license?
No, it's not true. You don't have to guarantee that the code will work, in the sense of being free from bugs, but if you're distributing someone else's GPLv3 code, then you do have to guarantee that they can at least compile and run it... once it's running, it's up to them whether it works or not.
Which is it? Is it not true that I must support other people getting that code to run ("So if GPLV3 says I must distribute anything I modify and MUST SUPPORT other people getting it to run,...") or do I have to guarantee that they can compile and run it? I asked if it was true, you said 'no', and then told me I have to do exactly that which I asked about.
If I have to make sure that anyone who gets the code from me can compile it no matter what, then that's a really large support service I'm required to provide. The change I make may compile just fine under GCC 3.1 that I'm using, e.g., but fail under GCC 3.3, which is what the next guy in the chain uses. I've got to spend my time fixing every version issue just to make sure he can compile it? Wow. If none of the code compiles under 3.3 (or whatever the most recent version is), I'm stuck updating ALL the code so someone else can compile it? Why would any sane person accept such an open-ended support role?
If you sold the device with the GPLv3 code running on it, and won't let other people do the same with their modified versions, then yes.
Except for the exceptions.
The fact they removed it in a software upgrade doesn't change the fact that a GPLv3-licensed binary was distributed: the fact that the binary is still on the machine (and able to be restored by a factory reset) actually proves that GPLv3 code is likely STILL being distributed.
How does that prove it's being distributed? They've actioned it by forcing a removal in a firmware update.
It's a lot more than a technicality. A common-sense interpretation of both the GPLv3 and case law says that there is an actionable claim here for a license violation.
Really? The resolution is either to release the "Installation Information" and source code, or to stop distributing the software, they've done the latter.
Is anyone looking at some kind of moderation to flush that kind of post, such that we don't have to waste time with it?
Why, you some sort of censor? Ignore it, or better yet, get good at putting it in its place amusingly.
I'd rather deal with it here than be blindsided by it when trying to actually get something done. Here we get to hone our attacks and learn which way to best mock these people when we encounter them.
Boxee has confirmed the presence of GPLv3 software distributed in the Boxee Box. In the response, it is noted that gpgv2 was included in a pre-release. This release is, however, the software that comes loaded on the device from retail. Is that a pre-release? In any case, gpgv2 itself was also released in subsequent firmwares. It has been removed from the current firmware, but other GPLv3 binaries are still being distributed in the current firmware. Every Boxee Box on the globe currently has GPLv3 software in it, in the factory-reset memory AND the currently running binaries. There are further now questions. Is yes-I-stole-the-candy-bar-but-I-did-not-eat-it-so-I-will-put-it-back-now-that-I-am-busted a valid argument? Can Boxee un-distribute the binaries already distributed? The GPLv3 binaries were not only in the pre-release version. They were in the release version. And the versions after that. And the CURRENT version. Can Pandora's Box be closed again? See below for details on the current version. Even if they delete the binaries in future releases, anyone can simply put them back into violation with a factory restore. Does Boxee have the right to change that factory restore firmware? Can Boxee reach into the homes of users and change devices the users paid for? Is "Yes we stole software but we want to make money" an adequate excuse? How does the US Government and Customs and Border Protection view Boxee making them implicitly profit (via import tariffs) from the import of software piracy? The full details are at http://infinityoverzero.com/bbox/ Openboxee
According to the GPL:
So, not an EULA, a copyright license. Note the bold section (my emphasis) specifically says there are no use restrictions. Only copying.
God is imaginary