Slashdot Mirror


Emacs Has Been Violating the GPL Since 2009

Digana writes "Emacs, one of GNU's flagship products and the most famous software creation of Richard Stallman, has been discovered to be violating the GPL since 2009-09-28 by distributing binaries that were missing source. The CEDET package, a set of contributed files for giving certain IDE functionality related to static code analysis, has distributed files generated from bison grammars without distributing the grammar itself. This happened for Emacs versions 23.2 and 23.3, released during late 2009, and has just been discovered."

47 of 295 comments (clear)

  1. How does this happen? by Hatta · · Score: 2

    Doesn't anyone test the source tarball to ensure you can recreate the binary from it?

    --
    Give me Classic Slashdot or give me death!
    1. Re:How does this happen? by chrisj_0 · · Score: 2, Funny

      Because no one uses Emacs any more ;D

    2. Re:How does this happen? by Enleth · · Score: 4, Insightful

      The problem in this case is that the concepts of "source code" and "object code" are a bit fuzzy with generated code that is GPL-licensed.

      Someone wrote the bison grammar files (which are the missing source code in this case) and "compiled" them, by running bison over them. The resulting files were "object code" in the light of GPL, as they're not really intended nor suitable to be read or edited by a human (and the GPL's definition of source code is "the preferred form of the work for making modifications to it"), but at the same time, they were still technically source code, as in something that can be fed to another compiler, together with the actual source code of Emacs to build the executable Emacs binary.

      Thus, the final binary can be recreated from those tarballs just fine, because *technically* it's the full Emacs source code all right. Legally, though, it's not, because of the definitions in GPL.

      --
      This is Slashdot. Common sense is futile. You will be modded down.
    3. Re:How does this happen? by iceaxe · · Score: 3, Funny

      Oh crap, I am no one and didn't even know it? No wonder I'm underpaid...

      --
      WALSTIB!
    4. Re:How does this happen? by xouumalperxe · · Score: 3, Insightful

      because *technically* it's the full Emacs source code all right

      Except that, if I wanted to change the grammar, I'd have to plod through the horrid code bison generated rather than the bison grammar files (which are the "true" source) so even technically it's no more the full Emacs source code than releasing the unassembled ASM output of gcc would be the full source for a C program. In this case, the common technical definition and the legal definition seem to be in unison.

    5. Re:How does this happen? by anyGould · · Score: 2, Insightful

      Because no one uses Emacs any more ;D

      I still use emacs from time to time. My biggest complaint is that it's not particularly friendly to occasional users. When I used it full time at university, I developed a fairly solid grasp of it. Now that I live in a world that expects Office, I find I have a heck of a time going back - if you don't remember the shortcuts, you're fairly SOL.

    6. Re:How does this happen? by Anonymous Coward · · Score: 5, Funny

      they're not really intended nor suitable to be read or edited by a human

      You mean, like Perl ?

    7. Re:How does this happen? by sxeraverx · · Score: 2

      Thus, the final binary can be recreated from those tarballs just fine, because *technically* it's the full Emacs source code all right. Legally, though, it's not, because of the definitions in GPL.

      Not so. If what you seem to be implying were true (that there's no ethical problem with this, just a legal one because of the wording of the GPL), people could simply compile their source down to assembly and distribute the "source" that way. The final binary could be created from the compiler-generated assembly just fine, but that's not the issue here. The goal of the GPL is to prevent distribution of any generated machine instructions (in any form or language) without distribution of the original (in any form or language).

      This is exactly the kind of behavior that the GPL was intended to prevent.

    8. Re:How does this happen? by fusiongyro · · Score: 2

      No, there's really no question that the Bison grammar is preferred. The only real question is why this is news at all. It's such a minor violation it's a complete technicality. The code for the Bison implementation and the grammar file are all GPL and available as well, they just weren't in the tarball for distribution due to a small oversight.

    9. Re:How does this happen? by NoOneInParticular · · Score: 2

      This is news because it gives a great Nelson Muntz moment: HA HA!

    10. Re:How does this happen? by schlunk · · Score: 2

      That is a ridiculous setup. Intuitively, pressing the 'a' key should let you start inserting characters after the cursor location.

  2. Oh, FFS... by Penguinisto · · Score: 2

    ...just hit Ctrl + R and Alt + Shift + P + OMG and they're right there!

    On a more serious note, It was probably a goof on their part. The fact that no one noticed until now is pretty strange, though.

    --
    Quo usque tandem abutere, Nimbus, patientia nostra?
    1. Re:Oh, FFS... by Anrego · · Score: 2, Insightful

      The fact that no one noticed until now is pretty strange, though.

      Does anyone care?

      The fact that no one has noticed/complained would to me indicate that no one wants them. If someone wanted them, they would look for them, not find them, inquire, and it would probably have been fixed.

      Yes they should be there, and yes this should be fixed but is an (assumably) reasonable mistake this big a deal?

      Would be different if someone was refusing to provide the source material or something, but this just seems like a case of “oops, forgot.. give me a sec..”. Certainly not what I would consider a VERY BAD MISTAKE!!! Can they be sued for this or something? Then maybe its bad

      Then again this is RMS, and as we know he kind of sees things in a different .. reality .. then most of us.

      Any before anyone accuses me of being a fanboy/astroturfing I _hate_ emacs. I’ve tried to learn to like it (it was used as the standard editor at a previous employer, with a variety of in-house plugins that made life easier) but I can’t.

      For that matter, I’m not really a big fan of the GPL either in that I think it does more damage than it prevents in terms of wide scale open source adoption and especially compatibility.

    2. Re:Oh, FFS... by geekoid · · Score: 3, Funny

      Sued for what? I can see it now:

      If you win, you get a hug from Stallman. if you lose you get 2 hugs.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    3. Re:Oh, FFS... by anyGould · · Score: 2

      Certainly not what I would consider a VERY BAD MISTAKE!!!

      It's a bad mistake in that one of the flagship GPL products isn't currently GPL-legal.

      It's not so much a legal mistake as massively embarrassing - like the Apple Store signs that have a Windows blue screen of death showing.

    4. Re:Oh, FFS... by gknoy · · Score: 2

      As an anonymous poster above mentioned, I believe it's only a GPL violation if they refused to provide it, right? If no one found out until now, that leads me to believe that no one had asked. This certainly seems in the realm of "whoops, my bad" than in any nefarious hypocrisy from RMS and the Emacs developers.

    5. Re:Oh, FFS... by anyGould · · Score: 2

      At the risk of feeding the trolls...

      b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.

      I ain't no fancy-pants lawyer, but section c pretty clearly says you only get to do this if you specifically include the written offer to provide the source. Presumably emacs didn't do that (presumably using sections d or e - the "available for download" clauses).

  3. BURN THE WITCH!! by elrous0 · · Score: 5, Funny

    I saw them consorting with Lucifer in the fields--with mine own eyes, I did! They was compiling binaries with unreleased source and plotting against FOSS hippies, they was!

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
    1. Re:BURN THE WITCH!! by Anonymous Coward · · Score: 5, Funny

      And they compiled me into a newt.

    2. Re:BURN THE WITCH!! by FadedTimes · · Score: 2

      I assume you got better?

    3. Re:BURN THE WITCH!! by Obyron · · Score: 2

      I saw Goody Stallman with the Devil!

      --
      --Obyron
    4. Re:BURN THE WITCH!! by MacGyver2210 · · Score: 2

      Don't you mean GNUWT?

      --
      If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
  4. Accident or Malice? by captaindomon · · Score: 2

    That's the most important question.

    --
    Just because I can hook a shark from a boat, I do no offer to wrestle it in the water.
    1. Re:Accident or Malice? by grimmjeeper · · Score: 2

      On the face of it, this looks like an accident. There really wasn't a lot to be gained by not publishing the source. And the initial message notifying the public was a "we need to fix this yesterday, one way or another". Someone who was doing this out of malice would have put out a "we were notified of the problem and are taking appropriate steps to address the issue" while they covered their asses.

  5. Re:The sad thing is... by rbrausse · · Score: 3, Funny

    RMS will sue himself?

  6. Is that really a GPL violation? by FooAtWFU · · Score: 5, Insightful

    I was really under the impression that the GPL said you had to distribute the source to anyone you sent the binaries if they actually bothered to request it. I mean, usually that means you publish both, just as a matter of convenience, but not of necessity.

    --
    The World Wide Web is dying. Soon, we shall have only the Internet.
    1. Re:Is that really a GPL violation? by Baloroth · · Score: 2

      I was coming here to post this. A quick check on Wikpedia:

      The fourth section for version 2 of the license and the seventh section of version 3 require that programs distributed as pre-compiled binaries are accompanied by a copy of the source code, a written offer to distribute the source code via the same mechanism as the pre-compiled binary, or the written offer to obtain the source code that you got when you received the pre-compiled binary under the GPL

      source. So, in other words, not distributing the source with it isn't a problem necessarily, although I imagine they didn't add any written offers to provide the source, so it may be a technical violation. Since I'm sure they would distribute the source on request, and since I imagine you can get the source easily enough if you want, this really doesn't seem to be an issue at all. Except that RMS is... well, a little on the obsessive side, to say the least.

      --
      "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
    2. Re:Is that really a GPL violation? by 0racle · · Score: 3, Informative
      That is the basic gist of it. Source doesn't have to be shipped together with binaries. GPLv3 changes the 'bothered to request it' part as that is something of an artifact of physical media distribution of GNU software.
      Quick Guide to GPL v3

      One of the fundamental requirements of the GPL is that when you distribute object code to users, you must also provide them with a way to get the source. GPLv2 gave you a few ways to do this, and GPLv3 keeps those intact with some clarification. It also offers you new ways to provide source when you convey object code over a network. For instance, when you host object code on a web or FTP server, you can simply provide instructions that tell visitors how to get the source from a third-party server.

      The actual wording for network distribution in the GPLv3 says you just have to make or have the source available in the same methods that the binaries were
      GPLv3

      d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.

      I bet we can find Emacs source on the same server we can find Emacs binaries.

      --
      "I use a Mac because I'm just better than you are."
    3. Re:Is that really a GPL violation? by HarrySquatter · · Score: 4, Interesting

      Mod parent up. There is no stipulation in the GPL that source code must accompany any distribution of binaries. Total myth.

      Then you better make sure rms knows this since he's the one apparently pertuating this "total myth". You know, since he was the one who wrote the email saying that Emacs was in violation of the GPL.

    4. Re:Is that really a GPL violation? by WatchMaster · · Score: 2

      please refer to GPL, section 6, part c. There is no obligation to bundle source with the object/binary distribution.

      one of the acceptable methods of distributing source code is :

      c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.

  7. Overblown by Spazmania · · Score: 3, Insightful

    The source code is included. Just not the source for the source code.

    --
    Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
    1. Re:Overblown by Sponge+Bath · · Score: 3, Funny

      Yo dawg! I hurd you like emacs so I put some source code in your source code so you can compile while you compile!

  8. Re:The sad thing is... by Anrego · · Score: 2

    RMS will sue himself?

    Oh now that's just redicu... hmm

    Yup, he actually might!

  9. Did anyone ASK for that source? by Anonymous Coward · · Score: 4, Informative

    If not, then it's not breaking GPL.

    1. Re:Did anyone ASK for that source? by msauve · · Score: 2, Informative

      "If not, then it's not breaking GPL."

      Yes, it is. See GPLv3, section 6. If you make the object downloadable, the source must be, too - no request necessary.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    2. Re:Did anyone ASK for that source? by BitZtream · · Score: 4, Informative

      Not really strange, no one cares except pedants who were too busy slurping Stallman's wiener and bitching about everyone else to notice their own hypocrisy.

      This is simply no big deal, the source to the files IS available. There really ISN'T a GPL violation. Its just not in a specific set of packages, which there is no requirement for it to be so.

      The GPL requires the source to be available, it is, its just not included by default, which is perfectly acceptable.

      Second, in order for this to be a violation, the authors of said files have to call it a violation. You (nor I) get the right to determine its a violation (again, this goes contrary to what most GPL zealots think). The copyright holder does, to which, the copyright holder may have granted an exception or special license to Emacs for this purpose.

      The only thing going on here is a few people getting their panties in a bunch over nothing. Another fine example of why any intelligent company keeps as far away from GPL as possible, the followers of the Cult of GPL will happily stab themselves in the eye because a doctor gives them pink eye medicine.

      If the original author of these files hasn't bitched, there is no violation. If he or she has/is then we have something to talk about, but I find it highly unlikely that said person will be raising much hooha about it.

      Mistakes happen, everyone needs to not go retarded nuts over shit like this in relation to the GPL, you just make yourselfs look like a bunch of dick heads.

      (Note: This post isn't entirely directed at the person I'm responding too, just happens to be the place I decided to post my thoughts)

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    3. Re:Did anyone ASK for that source? by aristotle-dude · · Score: 2

      RMS already said it's in violation of the GPL. However, to humor you, the "by request" clause is for physical media. Downloadable binaries require downloadable source.

      Interestingly, this incident has proven how few of Slashdot's readers actually know the GPL.

      Citation needed. Please quote the section that explicitly states this otherwise you are playing lawyer/judge.

      --
      Jesus was a compassionate social conservative who called individuals to sin no more.
    4. Re:Did anyone ASK for that source? by Chris+Burke · · Score: 4, Interesting

      The GPL requires the source to be available, it is, its just not included by default, which is perfectly acceptable.

      No, it isn't available, which is the entire problem.

      If you downloaded the source package for emacs from the repositories of your chosen distro, you would not receive the files in question.

      Again: Many organizations are distributing emacs binaries, but not making the full source available. That's a GPL violation.

      Second, in order for this to be a violation, the authors of said files have to call it a violation

      That's simply not true. If you are not in compliance with the terms of a license agreement, then you are not in compliance with the terms of that license agreement whether anyone knows or cares that you are.

      For this violation to result in legal action the copyright holder has to know and care.

      The only thing going on here is a few people getting their panties in a bunch over nothing.

      It isn't nothing, but it also isn't a huge deal because the non-compliance was accidental and the solution straightforward.

      The response seems commensurate with the issue. Oh Shit we screwed up, but oh well shit happens.

      How about you just ignore whatever few people you see as over-reacting as the outliers they are, and I'll ignore the idiocy you spouted immediately after the last quote up there. Deal?

      --

      The enemies of Democracy are
  10. It's not really Emacs... by mmcuh · · Score: 2

    ...that has violated the GPL, it's anyone who has _redistributed_ Emacs. The original distributors (FSF, I assume) have presumably had the source available and could have given it to anyone who asked for it, which is what the GPL requires. They just forgot to put it in the tarball.

    But people who have redistributed the Emacs package, like for example GNU mirrors or every desktop Linux distribution in the world, could not have made the source available upon request, since they never had it.

  11. text of RMS's mail by ciaran_o_riordan · · Score: 4, Informative
    For anyone who didn't click the link, here's RMS's reaction:

    We have made a very bad mistake. Anyone redistributing those versions is violating the GPL, through no fault of his own.

    We need to fix those releases retroactively (or else delete them), and we need to do it right away.

    I see two quick ways to fix them: to delete the compiled files, or to add the sources they are made from.

    From the mail linked to in the story: http://lists.gnu.org/archive/html/emacs-devel/2011-07/msg01155.html

    1. Re:text of RMS's mail by Beelzebud · · Score: 5, Insightful

      People seem to love hating on this guy, but let's look at how he handled the situation:

      "We have made a very bad mistake."

      No PR bullshit, or excuses, just acknowledgment followed by a suggested solution. In this day it's not often you see that above-quoted sentence. Especially from know-it-alls on the internet who just shoot spitballs at people who get things done.

  12. FSF owns Emacs by Alan+Shutko · · Score: 2

    The FSF is the copyright holder of Emacs. All code that is integrated with Emacs is covered by a copyright assignment. They can't violate the GPL when they distribute Emacs, because they are not bound by it.

  13. You know what to do, RMS by AdmiralXyz · · Score: 5, Funny

    It's a good thing people gave Stallman that katana after the xkcd strip came out, because there's now only one option. Reclaim your honor, sir.

    --
    Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
  14. No, it isn't source by AlecC · · Score: 2

    No, it is not source code in the sense the GPL requires: "the preferred form of the work for making modifications to it". Just because something is in compilable ascii code doesn't make it the source code. You could no doubt convert a binary into some huge hex constant which would be valid C and would compile back to the binary, but nobody would accept that as the source code.

    That said, the problem is trivial. It is obviously just a minor cock-up which no-one has noticed. Formally, they should either have included the bison source, which they have just realised they didn't. or have include a formal offer to provide it on demand, which they probably didn't do because they thought they were offering full source. But I think anybody would realise that such an offer was implicit in any software released by the FSF. To worry that the FSF would /not/ releas source should they have been found to have accidentally omitted something, as appears to have happened here, is frankly perverse.

    --
    Consciousness is an illusion caused by an excess of self consciousness.
  15. Re:The sad thing is... by AdamWill · · Score: 5, Insightful

    Yes. And this is what happens all the time in F/OSS license violation cases. No-one pays out zillions of dollars: they fix the infringement. Happens to hardware vendors who haven't got a clue, malicious software vendors who got caught, well-intentioned ones who made a mistake...happens all the time. I dunno why this is suddenly news.

    (For example, I suspect it's somewhat unlikely that any Linux distribution's 'F/OSS only' repositories are actually F/OSS only. The distros which take license compliance most seriously - Debian and Fedora/Red Hat - actively search out licensing issues, find them all the time, and get them resolved. This is a deeply un-sexy ongoing background process which most people are shielded from by the power of not giving a crap. But yeah, since we've been finding licensing issues that affect all distros that haven't been caught in years _all the time_, it seems unreasonable to assume that the last big one we found was the last one and everything's fine now.)

    tl;dr summary: licensing is hard, mmkay?

  16. GPL violation by DragonWriter · · Score: 2

    As an anonymous poster above mentioned, I believe it's only a GPL violation if they refused to provide it, right? If no one found out until now, that leads me to believe that no one had asked.

    If they have failed to provide it when requested, not "refused", and they have: the thing that is purported to be the complete source code that is available on request is not the complete "source code" as defined in the GPL, so insofar as everyone who has downloaded the thing purporting to be the complete source code has, in sending the download request, requested the source code and as the FSF has failed to deliver the source code in response to those requests, they have failed to provide the source code on request.

    Now, because the whole thing builds fine, and its quite likely very few people were concerned about editing the grammar files, its quite likely that people didn't notice that they didn't have the "source code" as defined in the GPL, which is not merely "some files from which the executables can be built", but "the preferred form of the work for making modifications to it."

  17. Re:The sad thing is... by GofG · · Score: 2

    Here is the difference:

    The GPL implies free-as-in-beer, which is a major point. If there were a story about a copyright violator who downloaded Inception.720p.xvid.GROUPNAME from thepiratebay, burned lots of copies of it to DVD, and then sold each copy on the street, I have no doubt every person on slashdot would see this as a morally reprehensible act (perhaps some would say that "turnabout is fair play" but even these people see it as an ethical wrong.)

    Copyright is supposed to keep *that* from happening. Making a profit off of someone else's creativity without permission. That is what most GPL violations are.

    --
    GFA/M/S d-- s: a--- C++++ UBL++$ P+ L+++ !E- W++ N+ !o K- w--- !O !M !V PS++ PE Y+ PGP+ t+++ 5- X+ R tv@ b++ DI++++ D+ G