How Ubiquiti Networks Is Creatively Violating the GPL

New submitter futuristicrabbit writes: Networking company Ubiquiti Networks violates the GPL, but not in the way you'd expect. Not only did the kernel shipped in their router firmware not correspond to the sources given, but their failure to provide the source led to a vulnerability they created being unpatched long after its disclosure. They're maintaining the appearance of compliance without actually complying with the GPL.

Comments

It's rape Jim, but not as we know it

[Anonymous Coward]

The GPL was violated. Doesn't matter how they did it.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

Yet another brand of router to avoid.
At least unless there's DD-WRT or something for the hardware, I won't buy one that isn't supported by real open-source software (even if I stick with their router SW).

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

> router

IoT hub, please.

Re:It's rape Jim, but not as we know it

[Opportunist]

Worthless junk, please!

Re:It's rape Jim, but not as we know it

[aristotle-dude]

The GPL was violated. Doesn't matter how they did it.

The GPL is rape in license form. Viral infection of the GPL sounds like an STD left behind by a rapist.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

The GPL is rape in license form. Viral infection of the GPL sounds like an STD left behind by a rapist.

Sure. Now go grow your own STD (or BS), don't use ours. You aren't gonna pull a Montsanto on GPL software.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

Yeah, we should all be using closed source shit and live hapily in laa-laa land. Or we could use BSD kind of licenses, create software for free and pay money to get closed source shit back. Wohoo!

Re:It's rape Jim, but not as we know it

[maligor]

Yet another brand of router to avoid.
At least unless there's DD-WRT or something for the hardware, I won't buy one that isn't supported by real open-source software (even if I stick with their router SW).

DD-WRT is hardly a posterchild of open router software, they extensively use binary drivers in their releases, especially on the BCM platform.

OpenWRT is what you want as a baseline.

Re:It's rape Jim, but not as we know it

[Coren22]

Actually, their stuff is lightyears ahead of most of the 802.11 stuff you can buy for home use (as it is enterprise grade) while being in the same price range.

That however does not give them an excuse to violate the GPL and just ignore the terms of the agreement.

I hope they realize the error of their ways and fix the issue before they have to be sued into oblivion.

Re:It's rape Jim, but not as we know it

[ClickOnThis]

The GPL is rape in license form. Viral infection of the GPL sounds like an STD left behind by a rapist.

The GPL may be viral, but to correct your metaphor, the only way to catch it is via consensual intercourse with GPL source. There's no rape going on.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

Actually, their stuff is lightyears ahead of most of the 802.11 stuff you can buy for home use (as it is enterprise grade) while being in the same price range.

Horseshit. I've used Ubiquiti crap before. It's terrible, especially for the price. They frequently advertise features that simply are NOT there and have no plans to be there. One of the most egregious examples I found was that they advertised Zero Hand Off capability. That feature was nowhere to be found, and the assumption was "it would just work". Multiple tests found this to be complete and utter bunk. Their next biggest competitor, Ruckus, does it, and offers a quality product.

Re:It's rape Jim, but not as we know it

[mark-t]

The GPL is just the terms and conditions that you have to agree to in order to have permission to copy the work, and in particular, to create derivative works from it. The GPL can do this because stuff put under it is copyrighted, and you need the copyright holder's permission to make copies of copyrighted works outside of what would have ordinarily been considered fair use in the first place.... all the GPL does is outline the terms you have to agree to in order to receive such permission. If you don't want to comply, there's no permission given in the first place, so there's actually no unwanted viral aspect to it at all. If the terms are simply disagreeable to you, you may, at your option, try and contact the copyright holder to obtain alternate licensing arrangements for your special case, but the copyright holder is no more obligated to give anyone such permission than Paramount is obligated to give anyone permission to make their own for-profit Star Trek film.

Re:It's rape Jim, but not as we know it

[dargaud]

Don't like the license ? That's absolutely fine. But then don't use it and write your goddamn operating system FROM SCRATCH !

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

Any chance you can link to some tests/reviews of their claims?

Re:It's rape Jim, but not as we know it

[Shakrai]

It can't be rape; the router has ways of shutting itself down when that happens.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

The GPL is rape in license form. Viral infection of the GPL sounds like an STD left behind by a rapist.

STFU and shoot yourself in the head with the largest caliber bullet available.

Re:It's rape Jim, but not as we know it

[whh3]

After significant experience deploying embedded wireless routers, I've always been impressed with their physical manufacturing. Their outdoor devices are extremely resilient to weather and the casing generally seals as designed. They do operate at a pricepoint above average consumer grade hardware. What's more, and this was always more important to me, their hardware is extremely well supported by OpenWRT. In fact, the OpenWRT derivative I used was frequently cited by Ubiquiti itself -- it seemed like they were happy to promote the fact that their OS was not the end all be all.

Which makes news like this all the more disappointing to me. I consider abiding by the GPL to be a very important part of user (corporate) responsibility and do not tolerate violations.

As another poster said, just another company to scratch off my list.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

> The GPL may be viral, but to correct your metaphor, the only way to catch it is via consensual intercourse with GPL source. There's no rape going on.

Yeah, but everyone says GPL gives it away for free... she was askin' for it!

Re:It's rape Jim, but not as we know it

[Enter the Shoggoth]

Replying to undo a mod I didn't select... fuck what is it with slashdot these days.

Re:It's rape Jim, but not as we know it

[khellendros1984]

Wait. Are you talking about software or hardware? A laptop, tablet, smartphone, activity tracker, or smartwatch is a piece of hardware. All of those things can, and often *do* have a core of open-source software that they're built around. Hardware is much more difficult to manufacture than software is. If someone sends me the appropriate source code, I can get a working product by typing a few things in on my keyboard. If someone sends me hardware design files, I suppose that I'd either have to buy a FPGA of the appropriate size and speed for the hardware or I'd have to start talking to chipfabs about the 1-device manufacture run that I'd like them to undertake.

Hardware and software are apples and oranges. Although it would be convenient if open hardware were as easy to make as open software, it's not.

Fact is restrictive open source isnt producing innovation

I've never felt restricted by open-source software. The problem has always been closed systems, for me. Although, I suppose that the licensing issues go to the back of your mind anyhow when you've got a system that won't do what you want, and there is no way for you or anyone else but the vendor to fix it.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

Wait. Are you talking about software or hardware?

I am talking about products in general.

A laptop, tablet, smartphone, activity tracker, or smartwatch is a piece of hardware.

No they are not, they are a combination of hardware and software. Can you show me a tablet, smartphone, activity tracker or smartwatch that you can buy that has no software on it? Or even a laptop for that matter will come with at least some software.

All of those things can, and often *do* have a core of open-source software that they're built around.

Yes, like the Linux kernel. But there isnt much you can do with just that.

Hardware and software are apples and oranges. Although it would be convenient if open hardware were as easy to make as open software, it's not.

But where is the free software (let's exclude the hardware component for a minute) version of these products? My point is that the idea that everybody should ditch closed source and proprietary software in favor of FOSS is misguided because FOSS doesn't have all the answers. Proprietary and Free software work together to produce innovative products but there are a lot of absolutists with very limited vision that seem to think FOSS is the answer to everything.

I've never felt restricted by open-source software.

Sorry I mean restrictive open source (GPL) as opposed to permissive open source (BSD, et. al).

Re:It's rape Jim, but not as we know it

[khellendros1984]

No they are not, they are a combination of hardware and software

But we *have* open software to run on those. That just leaves the hardware that you could be talking about.

Yes, like the Linux kernel. But there isnt much you can do with just that.

Well, and the entire rest of the OS, if you don't count some of the drivers and firmware (which require either reverse engineering or published hardware specs from the manufacturers to implement openly).

But where is the free software (let's exclude the hardware component for a minute) version of these products?

Well, again, aside from BIOS/firmware and some drivers if I want all my hardware's features to work, it's here. We don't just have a kernel, we have full general-purpose OSes.

My point is that the idea that everybody should ditch closed source and proprietary software in favor of FOSS is misguided because FOSS doesn't have all the answers.

...And if the closed/proprietary software were to be open, then FOSS *would* have all the answers. As far as I can tell, that's the end goal of "the movement".

Sorry I mean restrictive open source (GPL) as opposed to permissive open source (BSD, et. al).

So did I. I see GPL-like licenses as being more protective than restrictive. They protect my access to code derived from the projects that are licensed that way. It's just a matter of perspective. I don't *want* to take someone else's open source code and make a closed-source derivative product. Until we have non-eternal copyright terms, I wouldn't really want to see someone *else* doing that either.

Proprietary and Free software work together to produce innovative products but there are a lot of absolutists with very limited vision that seem to think FOSS is the answer to everything.

I can see the benefit of a system where proprietary software is closed for a period of time, in order to encourage development of new technology, and then made open to enrich the public as a whole. I don't see that happening, so out of practicality, I'll accept closed/proprietary software and hardware as a stopgap. It does the job right now, and I'll just buy the next-available closed system when my current one doesn't have the functionality that I need.

Re: It's rape Jim, but not as we know it

[cthulhu11]

I bought one for home based on glowing recommendations from someone at my previous employer. Managing the WAP was a pain, a proprietary app launching a web interface or something, unique to each firmware version. The release firmware seemed to never be updated, there were occasional betas if you knew where to look. My unit became very flaky, I sent it in under warranty and it took several months for them to send a replacement, they claimed they didn't have any stock! The last straw was realizing that the thing didn't even do 5GHz. The recommender was like oh you didn't buy the $300+ Pro model? Yeah no, trucks don't drive up and spill cash at my doorstep. Gave it away and bought an ASUS.

Re:It's rape Jim, but not as we know it

[Coren22]

If they correct the issue after this, would you consider penciling them back in? :)

If you have better suggestions of units that act as APs and can do bridging (for the Bluray downstairs), I am all ears.

Re:It's rape Jim, but not as we know it

[Anonymous Coward]

But we *have* open software to run on those. That just leaves the hardware that you could be talking about.

Like what? Pretty much all laptops still require at least some proprietary software even today, it has taken decades to get to this point and we still aren't fully there. On smartphones and tablets sure there is Android but that sits atop proprietary software (mostly drivers for proprietary hardware) and then most applications require a proprietary API layer on top of the operating system too so that is still a mess, same goes for Android Wear on smartwatches, not sure what you are referencing for activity trackers.

Well, and the entire rest of the OS, if you don't count some of the drivers and firmware (which require either reverse engineering or published hardware specs from the manufacturers to implement openly).

Or all the stuff included in Google Play Services for which there is still no FOSS equivalent.

Well, again, aside from BIOS/firmware and some drivers if I want all my hardware's features to work, it's here. We don't just have a kernel, we have full general-purpose OSes.

We have *one* and the full OS was provided by Google (not the open source community) which is now deep into the process of proprietary lock-in with Google Play Services that the open source community is not providing an alternative to. Point is it has been decades and there is still a *heavy* reliance on proprietary software not to mention the free software that has been provided was provided by a company now hellbent on locking it down. So Android will be locked down from a practical perspective yet some will continue to claim "but it is FOSS" which then just undermines the FOSS community as a whole.

Also as I already said the FOSS version is just a me-too attempt to copy an existing proprietary product, not innovation which is why FOSS cannot stand on its own (or if it can it has yet to prove it).

...And if the closed/proprietary software were to be open, then FOSS *would* have all the answers. As far as I can tell, that's the end goal of "the movement".

But closed source software is not produced with a FOSS ideology, there's no reason closed source software developers would just release their code. If the FOSS community has a compelling one I would like to hear it.

So did I. I see GPL-like licenses as being more protective than restrictive.

Well I just used the well-known term to reference it.

I can see the benefit of a system where proprietary software is closed for a period of time, in order to encourage development of new technology, and then made open to enrich the public as a whole.

Sure, but that is not practical until the authors do as well.

I don't see that happening, so out of practicality, I'll accept closed/proprietary software and hardware as a stopgap. It does the job right now, and I'll just buy the next-available closed system when my current one doesn't have the functionality that I need.

That is what most people do, but what I still dont get is all the people evangelizing the FOSS movement when it is yet to provide competitive products. The GPL does everything possible to be anti-proprietary software and they (RMS in particular) say don't use proprietary software but what are people supposed to use instead? It is a confused message, most people do indeed compromise but there are people that still push the no-compromise approach despite it being unworkable.

I am not anti-FOSS, I just think many people give it more credit than it deserves. It does well in providing bits and pieces but it isnt innovative, even Linux is an attempt to copy UNIX, Android an attempt to copy iOS, desktop Linux distributions are copying Windows and OSX. Where is the innovation?

Re:It's rape Jim, but not as we know it

[bhiestand]

Any chance you can link to some tests/reviews of their claims?

Not the AC, and too lazy to google this again, but I was going to post the same experience with ZH. They announced support for zero hand off when it was in ages, never got it working well, and seem to have given up on it.

The basic idea was "set all APs to use the same channels, then clients will just use the strongest signal". Of course, even after hours of research and trying to fix the configs, clients lost connection when physically walking around. And if they managed to find a spot where the signals were similar, they could get some really fun rapid switching between APs.

But...

[Gription]

Isn't outing a manufacturer over product issues more of a Twitter thing?

Unexpectedly expected?

[Anonymous Coward]

How is this not the way you'd expect? What were you expecting?

Re:Unexpectedly expected?

[Anonymous Coward]

I was expecting three things: fear, surprise, ruthless efficiency, and an almost fanatical devotion to the Pope.

Re:Unexpectedly expected?

[Archangel Michael]

that is four things ...

Re:Unexpectedly expected?

[Anonymous Coward]

that is four things ...

https://www.youtube.com/watch?v=vt0Y39eMvpI

Re:Unexpectedly expected?

[thaylin]

Probably that they were not providing the source at all, not that they were providing a fake source.

Re:Unexpectedly expected?

[Anonymous Coward]

Fetch "the Comfy Chair"!!!!

Ubiquiti Networks

[WillRobinson]

Interesting, I have been looking at their WISP stuff for awhile, and one thing I liked was they were using lots of COTS and open source software. Funny I would not want to publish my code either, as apparently it was buggy, they would have been lash wipped by Linus!

Re:Ubiquiti Networks

[TheCarp]

If you are so embarassed by your code as to not want to publish it, might I suggest you SHOULD be too embarassed to sell products based on it or otherwise distribute it in binary form.

Re:Ubiquiti Networks

[Anonymous Coward]

If you've written any significant amount of code and never made an embarrassing mistake that ended up in a release... well, you don't exist and therefore I'm not talking to anyone and should stop rambling on...

Realistically, it's probably just a screw up by some employees who were either pressured by a deadline, didn't know better, or weren't trained properly (or a process failed after someone who had set it up, later left the company under non-ideal circumstances). Stuff like this happens all.the.time. Find it, fix it, put polices and procedures in place to prevent it, (and take care of the legal consequences of your screw-up), then move on.

Re:Ubiquiti Networks

[MtHuurne]

Funny I would not want to publish my code either, as apparently it was buggy, they would have been lash wipped by Linus!

Linus will only rant at bad code being submitted to the kernel mailinglist for integration into the mainline kernel. If you publish code on your own website, he's not even going to look at it.

Re:Ubiquiti Networks

[TheCarp]

Oh my code is embarassing as shit, don;'t get me wrong on that point. However, most code is a bit of a mess and a lot of it is not terribly well organized. So if yours is so much of a mess that it is actually the reason you don't want to release it (rather than a philosophical disagreement with open source/free software, which while i don't share, I do understand), then maybe basing products around it is something you should at least think twice about.

And thats before even getting to how its no excuse for vipolating the license.

However, I think you are actually right. This is very likely a simple screw up, and its of exactly the type I see all the time when you have people working towards deadlines and manual processes. I would almost bet you dollars to donuts that somewhere there is an email that was the only instruction a guy got that poorly outlined how to package it all up, which left out half the details or wasn't updated between its first version and when development changed their paths.

Seriously, I could totally see this sort of error as a simple fuckup. My only objection here is to the proposition made by others that it might be intentional due to the state of the code, because, that just doesn't fly in any good way for them in this situation.

This DOES however look like exactly the sort of error you get from bitrot in documentation for manual processes though.

What?

[gstoddart]

And in what way is this not how I'd expect?

Sleazy corporation skirts around rules, film at 11.

Re:What?

[NoNonAlphaCharsHere]

Probably more like "Docs out of date with production code, film at 11".

Re:What?

[Anonymous Coward]

Can't release the code until we've got a release ready version. We've got a release ready version? Cool - now we can outsource your job, starting as soon as security can dump the contents of your desk into a box.

Re:What?

[Anonymous Coward]

This is almost a Uber story!

edgerouter..

[bored]

I have the edgerouter POE, which is a fantastic piece of hardware, but it still doesn't support proper vlan tagging controls on the embedded switch ports. A feature I would add myself but the hardware isn't open enough to do it without a lot of reverse engineering.

So, this makes me wonder if they are sort of stuck between stupid hardware companies and the GPL. They may not be able to publish changes to the open source products without violating their NDAs with the manufactures of assorted chips/etc they use.

I'm not trying to defend them, just point out a situation I've found myself in. GPL software is great for bootstraping a project, but for some of these platforms it can be a real PITA. I feel for small companies like Ubiquiti. But I'm pretty irritated by Sony, broadcom, cisco, etc which are also playing the same game.

Re:edgerouter..

[gstoddart]

So, this makes me wonder if they are sort of stuck between stupid hardware companies and the GPL. They may not be able to publish changes to the open source products without violating their NDAs with the manufactures of assorted chips/etc they use.

You know, that's a self-inflicted problem, and not deserving of sympathy.

Either you run closed source stuff and write your own stuff, or you comply with the GPL.

It's a bummer if a small company got themselves into a predicament. But, nobody cares.

I know you're not defending them, but honestly if a company decided it wanted to steal someone else's code and not play by the rules of the GPL, that's their own damned problem.

From the sounds of it, they knew damned well they were not compliant.

Re:edgerouter..

[awing0]

I just (as in this morning) ordered a pair of radios from them for a point to point link. Can anyone recommend good competitors for ubiq's point to point radios?

Re:edgerouter..

[caseih]

I haven't anything at that price point. I gave half a dozen their point to point devices and they rock. I get a full 100MBs over about 800 feet. I'm very happy with them. Hope this issue with the kernel source gets sorted out. They seem like a good little company and they have good affordable hardware.

A local wireless ISP in my area uses their equipment exclusively. Works very well.

Re:edgerouter..

[Anonymous Coward]

Their product is the best in the price range. If you are willing to go above a few thousand € per radio you can get better things (at this point you will be better off asking a company with experience what they recommend and to install it, the extra cost will be low compared to unit cost of the radio equipment).

There is Mikrotik, but the radio performance is not as good. Their DFS implementation is also not compliant AFAIK.

Re:edgerouter..

[Anonymous Coward]

GPL software is great for bootstraping a project, but for some of these platforms it can be a real PITA

... in which cases where you HAVE to use binary blobs create a wrapper or broker and communicate with it over an IPC or IP mechanism to avoid the linking issue, then you can open up everything and adhere with the GPL, and the wrapper and broker will enable the end user to maintain and update the product, and you remain in full compliance. Performance might suffer slightly but should be unnoticeable in most cases.

Re:edgerouter..

[Anonymous Coward]

Either you run closed source stuff and write your own stuff, or you comply with the GPL.

Third choice: use a BSD derivative, which I suppose in this case could be considered a subset of closed source, if they don't reveal their changes.

Re:edgerouter..

[Anonymous Coward]

They stole code? So they deprived all other people of the Linux kernel code?

Re:edgerouter..

[Anonymous Coward]

There are comptitors: Cambium, Alvarion, ...

Don't be surprised if you request a quote and are asked 3000$ for one end of the link though.

Re:edgerouter..

[Anonymous Coward]

YES. Not "all" people, but they did deprive some people (their customers) the linux kernel code that was owed them.

Or is it OK for companies to get you to buy something and then not supply it?

Re:edgerouter..

[SuiteSisterMary]

At that price point, and in that space? Cambium ePMP.

Re:edgerouter..

[Anonymous Coward]

How did they "steal" the Linux kernel code when I can download it from Github right this moment?

Re:edgerouter..

[Anonymous Coward]

Just cancel the payment to them. Keep the goods. They can hardly complain you stole their stuff when they stole the code,can they.

Re:edgerouter..

[Anonymous Coward]

Just pony up and buy a juniper SRX 220h2 or 240h2. They're super cheap and fantastic.

Re:edgerouter..

[Anonymous Coward]

You can't download the version that they supply in compiled form on their routers. That still doesn't make it stealing, but they definitely are withholding something that other people have a contractual right to.

Re:edgerouter..

[Grishnakh]

There's ways around the NDA problem: put that code in a separate place where it interfaces with GPL code, but does not require actually modifying the GPL code with anything NDA-tainted, for instance. If you can't figure out how to do that, then you really have no business working with this stuff. Or just use a proprietary OS like VxWorks.

Re:edgerouter..

[Grishnakh]

I've never actually heard of any BSD derivative used in a small, embedded system. Usually the choice is between Linux (on ARM or MIPS or maybe ppc) and a proprietary RTOS like VxWorks or QNX. There's probably a reason for this.

Re:edgerouter..

[Grishnakh]

They're violating the license agreement. That code is copyrighted, and is only provided to you under the conditions stated in the GPL license, which govern how that code is distributed, and in a nutshell requires you to make the source code available to any changes you distribute to anyone in binary form (i.e., in products you sell which use that code). If you refuse to follow the terms of that license, then you automatically have no right to use the code at all, and are now in violation of copyright. If you don't like the terms of this license, you're free to not use the software, and find an alternative or make your own.

Re:edgerouter..

[Anonymous Coward]

>They stole code?

Yes. As a purchaser of Ubiquiti's GPLed products, you have a right to the source code for the GPLed software running on them. They refuse to provide this. It is stealing much the same as I give you $20 for a 10 pound sack of potatoes and a recipe for potato soup (as advertised the potato soup is complete, tasty and wholesome), and you just give me the potatoes and a scrap of paper that says "Recipe: Put potatoes in water and hope a soup happens" (the results of which are nothing like the soup advertised nor anything like the soup you sampled from their company). You also and refuse to give me the full recipe (which it is now obvious I'm missing), nor do you offer my money back. You owe me $20 for busting a deal. In this case, Ubiquiti owes their customers a refund for refusing to provide source code as advertised.

It is theft of money and fraud.

>So they deprived all other people of the Linux kernel code?

No. Ubiquiti is partially using linux code, and partially using their own code, all of which is licensed under the GPL. The Ubiquiti code is not provided. Whether that *also* counts as stealing is an academic issue. However, we've already proven Ubiquiti owes their customers money or code. Not providing either is theft and fraud.

Just as in my potato example someone would say "stolen recipe" as a shorthand for "Fraudulent transaction involving missing goods", one could easily say "stolen code" and not only be understood, but not violate the maxim of "pirating =/= stealing" which I believe you're alluding to.

Re:edgerouter..

[Coren22]

Here is what they did, with Windows replacing Linux:

They downloaded Windows 8, cracked the licensing mechanism, then redistributed the software on their own hardware. When someone pointed out to them that what they did is against the law, they ignored the request to rectify the situation.

Would this be illegal? How is it different when it is a piece of GPL software?

Re:edgerouter..

[Anonymous Coward]

Hahaha - the difference is a couple hundred billion dollars dude.

Re:edgerouter..

[BronsCon]

Can you download the kernel code used by Ubiquiti? If so, please tell me where. If not, well... Under the GPL, that source code is the property of anyone to whom they distribute a product that makes use of the code in any format (including binary) and they've simply stolen that code from those people. Personally, I think it's silly to call it stealing, as well, but that's effectively what the GPL does in these instance. It's not right, but it's not stealing, either.

Re:edgerouter..

[Anonymous Coward]

Then you get shit on by the open community for violating the point of open code in the first place. Just write your own shit if you want to keep it closed.

Re:edgerouter..

[loonycyborg]

No, it's not GPL that is PITA but closed specs and NDA requirements. They're PITA no matter whether you're using BSD or GPL. So who cares if GPL prevents you from doing things in lawyer approved OCD way those companies want? It just won't work. At most you'll end up with some BLOB nobody maintains and which gets obsolete within a year.

Re: edgerouter..

[bill_mcgonigle]

photocopiers often run ancient unpatched versions of BSD.

Re:edgerouter..

[Grishnakh]

The big difference here is the DMCA, which makes it illegal to crack the licensing mechanism like this; this makes the action in your scenario a crime.

Violating the GPL is not (AFAIK) a crime, it's a tort, just like any normal copyright violation. The party harmed has to sue for damages.

Re:edgerouter..

[adri]

The reason is because the manufacturer gives you some old version of linux that they have included as their "base" reference design OS, and .. people just build on that.

It's purely inertia.

Re:edgerouter..

[Grishnakh]

That doesn't sound right. If everyone were just using Linux, that would make sense, but they're not, they're also using QNX and VxWorks and some other RTOSes. Manufacturers are not giving anyone reference designs with proprietary RTOSes, so any company choosing those is doing so for a specific reason (probably they want lower resource-usage than Linux can achieve). If so many companies can do this, some would also be choosing BSD. But that doesn't seem to be happening, so I would think this is probably because BSD can't compete at all with the RTOSes in terms of resource usage, and doesn't offer enough over Linux to bother with it.

Re:edgerouter..

[Anonymous Coward]

Same price point? The cheapest ePMP is 400$ without antenna if I remember correctly. And you need at least two to have a useful link. The entire link with ubiquity may cost 200$...

Re:edgerouter..

[orasio]

So it's not stealing. It's something else.

And you might want to get your analogy checked, I don't thing it holds. Maybe if it was potato soup + recipe or something like that. In any case, no need for analogies. It's easier to get it without them.

They are not stealing anything from anyone. The users didn't have any source to begin with, for example. They are not entitled to the source. The problem lies in the other end. Ubiquiti is licensing some code, and not complying with the license, by not providing source. This means they are not covered by the license.

This is plain, simple, copyright infringement. Not stealing, something else. And when you do it for profit, most people agree it's a bad thing. At least in the current context.

Re:edgerouter..

[Anonymous Coward]

>They are not stealing anything from anyone

They are stealing from their customers because, AFAIK, claiming a GPL violation doesn't get you a refund, which is the only way to sidestep the stealing argument. Ubiquiti customers paid for source code and cannot receive it. When you pay for something and don't receive it, it is a very obvious form of theft.

>This is plain, simple, copyright infringement.

That is part of it. The part you are missing is that the customers paid for source code (whether they realized it or not) and did not receive it. That's stealing.

It's no different than a scummy computer reseller separating the CDs a computer comes with and selling them separately. If a customer checks a site detailing their computer, they'll notice they didn't get everything they paid for. It was stolen before they got it.

Re:edgerouter..

[Anonymous Coward]

Maybe the reason is that you are in a Linux biased environment...

BSD used in smal, embedded systems do exist (pfSense is one). There are others. There are also large BSD embedded environments.

The reason that you have not heard of this maybe because you have a limited view of embedded systems, not because BSD is not used in embedded systems.

Get your razor out

[NotFamous]

Never attribute to malice that which is adequately explained by stupidity.

This issue is why people are leaving...

[Anonymous Coward]

the GPL and going to BSD, MIT, others.

For my group, we are heading BSD. It just makes more sense to us to avoid stepping on toes, and the license is maximally free. Personally, I'm a pragmatist and not opposed to proprietary or open -- use what works for a given situation.

Still, if this company has violated the GPL, they should have been outed and still need to find remedy.

Re:This issue is why people are leaving...

[danbob999]

This issue is why people are leaving... the GPL and going to BSD, MIT, others.

Last time I checked, WiFi routers are still full of GPLed software such as Linux, u-boot and busybox. What's the BSD or MIT alternative? The only manufacturer selling BSD-based routers I know is Apple. I don't think companies such as Linksys, Netgear or TP-Link have the resources to develop their own OS. It's either they use Linux and comply with the GPL, or pay for a proprietary alternative.

Re:This issue is why people are leaving...

[afidel]

Plenty of higher end networking gear is BSD based, there's really no reason you couldn't use BSD for lower end gear other than your parts supplier might not have ready made drivers or images for you to modify (although even Atheros has support for current chips in FreeBSD so that appears to no longer be much of an issue).

Re:This issue is why people are leaving...

[Grishnakh]

Higher-end networking gear has serious CPU horsepower compared to your average Belkin or Linksys consumer-grade router, enough horsepower to rival a high-end PC probably, if not more.

How often do you see BSD used on any small embedded device with an ARM or MIPS CPU? I can't say I've ever even heard of this. It's always either Linux or something proprietary like QNX or VxWorks.

Re:This issue is why people are leaving...

[danbob999]

Plenty of higher end networking gear is BSD based, there's really no reason you couldn't use BSD for lower end gear other than your parts supplier might not have ready made drivers or images for you to modify

You pretty much nailed the problem. Board support packages (not just raw drivers) for WiFi router chips are much more available/complete/mature for Linux than for BSD.
So people are not leaving the GPL. Linux probably never had such a large share of the WiFi router market, while BSD is close to 0%.

Re:This issue is why people are leaving...

[ClickOnThis]

the GPL and going to BSD, MIT, others.

I think you're confused about what "the issue" is.

Ubiquiti Networks modified GPL code and released binaries, and in the process, created a security problem with their product that they have yet to fix themselves. Under the GPL, they are obliged to release their modifications to the GPL code, but they refuse to do so. If they released the changes, then their customers could find and fix the problem without having to wait for Ubiquity Networks to do it.

Now, if Ubiquity Networks had used BSD or MIT code, they would be under no obligation to reveal the changes they made. Therefore, they could continue to ignore the problem, and the customers would be unable to find and fix the problem themselves. In short, a BSD/MIT license would benefit Ubiquity Networks, but obviously not its customers.

Linus owns some of their Equipment

[Anonymous Coward]

Get Linus to make the request and force the copyright issue. What are they going to say? No?
He owns their equipment now.

Get your axe out

[Lead Butthead]

Never attribute to malice that which is adequately explained by stupidity.

Never attribute to stupidity when it's a habitual offender.

Re:Get your axe out

[Anonymous Coward]

Plenty of people are habitually stupid.

Re:Get your axe out

[Coren22]

Habitual? Do you have links to other instances? Also, how exactly are they not complying? My understanding was that compliance in this case requires that they offer up the source code for whatever they use. If they then make changes, there is no requirement to post their changes as well.

Re:Get your axe out

[gstoddart]

No, modifying the code means you have created a derivative work and need to release those code changes to anybody using it.

Which is what the license has said for at least 20 years.

There is no provision to make changes to GPL code and not release it.

If you have an application which is only ever inside your corporate firewall, it's unlikely the people in accounting will want to see the source code. But you sure as hell can't modify it, build a product around it, and then not release those changes.

Your understanding is wrong.

Re:Get your axe out

[Anonymous Coward]

Um, have you ever read the GPL, like section 2 (GPL 2.0, which I believe the Linux kernel still uses)?

Re:Get your axe out

[Anonymous Coward]

GPL requires that you provide complete source code to binaries you distribute that are derived from that source code. That includes any changes that you have made and code you have added.

So either you get a head start from the existing code and then share your changes. Or you write it all yourself. Pretty straight forward tradeoff.

Re:Get your axe out

[gmack]

The GPL is designed to avoid the "What's yours is mine and what's mine is mine" scenario where someone uses the code +their changes to always stay one step ahead of the free version and so the GPL requires that they hand over the full source with any changes they made that were used to build whatever product they shipped. If they made changes to the GPL code that were included in the shipped product, they must publish those changes. On the other hand, if they made changes they did not ship with any product(internal releases etc), they are under no obligation to release those changes.

In this case, they are not shipping all of the changes they made to their source code that was used to build their firmware so that is a clear violation of the GPL.

Re:Get your axe out

[Coren22]

Thank you for your polite response (unlike the three above you). I was asking a question and you answered it. I unfortunately can't bring up the link in TFS, as it is blocked by the corporate firewall, so I can't see what they did.

I don't routinely deal with GPL code beyond just use, so am unfamiliar with the inner workings of the GPL.

Thank you again.

Re:Get your axe out

[linuxrocks123]

To be fair, stupid people act stupidly on a fairly regular basis.

Re:Get your axe out

[Anonymous Coward]

> If they then make changes, there is no requirement to post their changes as well.

Have you met the GPL?
If they distribute those changes then they damn well do have a requirement to post their changes.

Don't want to make those changes available? Don't distribute anything that uses them. Keep them in house all you want, but give the binary to a 3rd party and you are 100% on the hook. That is the entire reason the GPL exists in the first place.

Re:Get your axe out

[Grishnakh]

I'm not trying to be rude, but this isn't some kind of secret, nor some obscure "small text" in the GPL license, it's the entire reason for the GPL. If you use GPL code at all, it's good to understand the license at a very basic level; furthermore, the GPL license itself is very simple as far as licenses go, and was intentionally designed that way because it's meant for developers and users, not lawyers to argue in courtrooms for $$$/hour. It's simple: if you're given access to GPL code by its copyright owner, you're allowed to distribute that to others, with the one condition that you must also give those people access to the source code for any changes you make that are in the binary you give them. Since almost all GPL code is freely-available on the internet, that just means it's free to use and modify, but if you do modify it and give that to someone, you have to give them the source too. That way, you can't make critical changes, keep them secret, and profit from that secrecy (or just make people's life harder by them not being able to see how it works). The whole idea is to promote sharing and discourage secrecy.

Re:Get your axe out

[Anonymous Coward]

Four ways Ubiquiti Networks is creatively violating the GPL
Ubiquiti Networks is a company which makes long-range wireless equipment. Admittedly, you can do some pretty amazing stuff with it, but the company has a dark history of securities fraud, violation of U.S. sanctions, trademark and copyright lawsuits and software patents, which isn't as amazing.

In addition to this, they have been violating the GPL. However, because they did it creatively, most people don't know about it, and Ubiquiti still hasn't come into compliance.

Here are four ways that they have succeeded in making the violations hard to notice, and even harder to act upon.

1. Giving the appearance of compliance

'You can find the complete and corresponding source in the GPL archive.'
Ubiquiti had a website set up where you can download tarballs purportedly containing all GPL source for each and every firmware release. (I can't find it any more, but that doesn't mean that it isn't still there.) When you look through these tarballs, they appear to be complete, and there are build instructions which allow you to make your own custom firmware.

It's only when you look closer that you start to notice problems, such as...
2. Refusing to provide the source to their modified bootloader, even though they made changes that introduced security vulnerabilities

Security keys
Up until version 5.5.4 of Ubiquiti's airOS, the locally-modified u-boot bootloader contained a security issue - It was possible to extract the plain-text config from devices running the firmware, without leaving a trace. And the plain-text config contains unencrypted WPA/WPA2/RADIUS passwords.

Even worse than this security issue, was Ubiquiti's response to it. Namely, they:

Refused to provide the source code, even though u-boot is under the GPL
Didn't fix the security issue for a long time after it was publicly disclosed

To this day, Ubiquiti still has not provided the u-boot source code.
3. Providing source code to a version of Linux, just not the one that they actually ship, and hoping that nobody notices

Ubiquiti Source Ubiquiti Binaries
It would be natural to think that the binaries that Ubiquiti provides were compiled from the source code that Ubiquti provides. As it turns out, for a large number of their releases, the kernel source given does not correspond to the kernel in the official firmware images.

As evidence, consider that in version 5.5.4 of the AirMax firmware, the kernel was modified such that the MTD partitions would be read only, however this change cannot be found in the corresponding kernel patches or source.

Such practices make finding violations extremely difficult, and we can't know for certain that they haven't done this with anything else in the GPL tarball. It's possible that this was just a mistake, but remember that people have complained about this without much of a response.

And speaking of complaining...
4. Dragging out GPL code requests for months on end, then inexplicably going silent

Bureaucracy is a challenge to be conquered with a righteous attitude, a tolerance for stupidity, and a bulldozer when necessary
In case you think that I am being mean to Ubiquiti by going public, please note that I have been trying to contact Ubiquiti for the past year about the issue of the u-boot source code. You can see my attempts here, here and here.

In fact, I even got a copyright holder of u-boot to ask for the source, and they still haven't provided it.

From my conversations with Ubiquiti, I have found that they claimed that it's alright to refuse to provide source code to GPL-licensed software if "This decision was taken with the security of the users in mind". Furthermore, my conversations were endlessly delayed by the supposed necessity to forward my query to another, unnamed, team.

And ultimately, the relevant team never responded, hoping that I would simply forget about it or give up

Re:Get your axe out

[Anonymous Coward]

You post could be clearer, you are using "release" in a manner confusing to someone not familiar with software licensing. The key element is (re)distribution.

If you make changes to GPL code, and distribute the result, you need to release the source code to your changes as well.

But if you don't redistribute the changed software, you aren't required to release anything to anyone.

In this case though, the seller was redistributing the software, and that's why they need to publish changes. It's the redistribution that requires them to do so, not simply the usage of it.

Re:Get your axe out

[Coren22]

I was thinking of commenting on the copyright issues with posting the full text of the post, then got to the bottom where he actually says feel free to report my stuff :) pretty cute there.

Interesting what they are doing, it does sound much worse than what I understood from the summary. I wonder if enough attention being brought to this may help the developers in Ubiquiti to understand what they are doing to maybe fix it. I like Ubiquiti's equipment, as they make great hardware that "just works", I replaced a dual band wireless router from Netgear with one of their single band 802.11 N APs, and have been very happy with the device so far, I would hate to see the company get sued into oblivion because of stupid decisions like this.

Hopefully the issue can be resolved to the satisfaction of all parties involved.

Re:Get your axe out

[Anonymous Coward]

Might want to cite the page you copypastad

Re:Get your axe out

[Holi]

Still think you should cite your source, otherwise its just pure plagiarism.

Re:Get your axe out

[cHiphead]

My understanding was that compliance in this case requires that they offer up the source code for whatever they use. If they then make changes, there is no requirement to post their changes as well.

Your self proclaimed understanding was incredulously incorrect and shows that you did not actually have an understanding of the GPL. Playing to some niceties of politeness when you yourself are bullshitting is less than honest, sir. You asserted understanding that was false. No need to get upset when someone attempts to correct your assertion.

Have a nice day.

Re:Get your axe out

[Coren22]

The source is the linked article in the summary.

Re:Get your axe out

[Anonymous Coward]

Someone explains a situation and cHiphead becomes a shithead. Classy. You are why Slashdot is losing eyes.

Re:Get your axe out

[Anonymous Coward]

There is no provision to make changes to GPL code and not release it.

Wrong. You can make whatever changes you like to GPL code, compile it, and use it yourself.

But when you start selling or distributing the changed code, then you have to provide source.

Re:Get your axe out

[Anonymous Coward]

cHiphead explains a situation and an AC moron becomes a twat. Classy. You are why Slashdot loses intelligent posts.

PS I note that coren22 let slip their real motivation: they hate RMS and therefore the GPL.

Re:Proper, fair punishment (Score:3)
by Coren22 (1625475) on Tuesday April 07, 2015 @04:09PM (#49424783) Journal

Forget to check the post anonymously box? Be careful, you might get attacked by Stallman and his followers :)

===

Ooops for coren. Found out.

Re:Get your axe out

[Anonymous Coward]

Except the article doesn't contain that scenario.

Did you make it up? Did you "reinterpret" it from something else?

Did you just lie about where you got it from?

Re:Get your axe out

[Coren22]

Um, how is that me hating on Stallman? The guy made a tasteless joke about Stallman and I poked him for not posting anonymous and suddenly I think Stallman is a terrible person?

And to respond to cHiphead, I clearly stated that it was my understanding of the GPL, I am no lawyer, nor do I deal with software licenses on a daily basis, I am a user of GPL software (as in I have a couple Linux servers at home), I am no zealot on either side, and was saying thank you to the one person who didn't use personal attacks, but I guess it is too much to ask for people to be civil in an online conversation.

Re:Get your axe out

[Coren22]

I didn't post anything, I made an assumption as to what it was in reply to (my company blocks the link, what was the problem). I don't post AC, I put my handle on every one of my posts.

BroadBand HamNet

[Rufty]

How will this impact BroadBand HamNet (formerly HSMM) which mainly targets Ubiquiti hardware, and obsolete Linksys stuff?

Re:BroadBand HamNet

[Anonymous Coward]

Given the illegality of Ubiquiti shipping the factory firmware, BroadBand HamNet might be the only solution for using the hardware.

Re:BroadBand HamNet

[Anonymous Coward]

Not at all I guess. They just use the ubiquiti GPL sources to make their images. They may not match exactly (I don't know, believing the article) but they seem to work to make custom firmware.

Re:BroadBand HamNet

[bradvoy]

In the short term it shouldn't have much effect on BroadBand HamNet because the BroadBand HamNet project replaces Ubiquiti's proprietary software with software based on OpenWRT. In the longer term this could help BroadBand HamNet. If this results in Ubiquiti releasing the source to their software, that could make it easier for the OpenWRT and BroadBand HamNet developers to add additional features/performance/reliability to their builds that target these devices.

Official build systems ...

[perpenso]

Never attribute to malice that which is adequately explained by stupidity.

Raise your hands if you have ever worked somewhere where there was an official build system and most developers did not get matching binaries from their development systems.

Re:Official build systems ...

[gstoddart]

Dude, this isn't binaries which have different checksums. This is binaries which don't in any way correspond to the code they provided.

This is a case of any sufficiently advanced incompetence is indistinguishable from malice.

They're either grossly inept, or knew damned well what they were doing.

Re:Official build systems ...

[Rufty]

They're either grossly inept, or knew damned well what they were doing.

NB, these options are not mutually exclusive.

Re:Official build systems ...

[Anonymous Coward]

oh, sure they do. you just need to use their specifically-patched version of gcc which injects the real code. of course, they're not required to release the compiler they use; that would be crazy. ;-)

captcha: "injected" (!!)

Re:And this is why corporations don't trust the GP

[danbob999]

So you are saying that corporations don't trust the GPL because they do not comply with the GPL? Seems like an easy fix isn't it?

Re:And this is why corporations don't trust the GP

[gatkinso]

What's not to trust? Either you use the GPL code knowing full well the ramifications of doings so... or you Write It Yourself.

Re:And this is why corporations don't trust the GP

[Holi]

Why because they want to steal other peoples work? It's a fucking copyright violation regardless of it's GPL status.

Re:And this is why corporations don't trust the GP

[Anonymous Coward]

Yeah, really odd that. They don't trust the GPL because they can get into trouble when ignoring the license of someone else's code.

Unlike Microsoft...

Uh...

Well, I guess corporations don't trust EULAs or ToS either, then.

Right?

Re:And this is why corporations don't trust the GP

[gstoddart]

Sad, but true.

Sorry, but what?

Nobody forced the company to use GPL stuff. Nobody forced them to build a product around it.

That they failed to comply with their obligations under the license is their own damned problem.

Use the GPL stuff, don't use the GPL stuff .. it's your choice. But if you choose to use the GPL stuff, you don't get to piss and moan that you don't want to live by the license.

Corporations aren't entitled to use GPL code and not adhere to the license. It's not a situation in which you can just decide how you'll interpret releasing the code.

These corporations which don't trust the GPL are entirely free to piss off and write their own code, or start with something like BSD which says "go ahead, do whatever you want with it".

Re:And this is why corporations don't trust the GP

[ClickOnThis]

So you are saying that corporations don't trust the GPL because they do not comply with the GPL? Seems like an easy fix isn't it?

This.

It isn't the GPL that has earned distrust here. It's Ubiquiti Networks.

Also, a company is != an individual

[Anonymous Coward]

People talk like companies are some single monolithic thing but that's seldom, if ever, the case, especially with anything bigger than a tiny startup. Companies are run by people but no matter how involved an upper manager or CEO thinks he or she is in the daily operation of the company it's 100% impossible for them to make, or even be aware of every single little decision (let alone every honest mistake, or poor training issue, or stupid/lazy practice) that goes on in the whole company. Sure, at the end of the day, management is _accountable_ for what employees do, but there's essentially no way some CxO said "hey, screw this GPL stuff, nobody will notice anyway." It's FAR more likely that some low-level employee (maybe with the knowledge of his low-level manager, maybe not) just screwed up, or two teams failed to communicate effectively, or similar. If outing them brings enough attention to the issue that upper management actually takes action and establishes strict polices for the use of open source/GPL code to avoid such things, that's probably a net-positive, but all this talk of "if company A decides X..." with regard to specific technical issues like this, is mostly just BS. A COMPANY IS NOT A PERSON. (and also shouldn't be able to "vote" and so forth, but that's another topic entirely).

Re:Also, a company is != an individual

[Grishnakh]

The problem with this "it's probably not malice" idea is that, usually, whenever a public GPL project complains about some company violating the GPL, they've already contacted the company through official channels, seeking to rectify the situation, because they have the exact same idea: that this is just a misunderstanding, the right hand doesn't know what the left is doing, etc. Most of the time, this is most likely the problem, and the company, after consulting with their lawyer, realizes its mistake and fixes it, and we never see a story like this with the title "ABC Corp is violating the GPL!!!". However, when the company refuses to comply, then we get what we're seeing now. Occasionally, some dumb company even gets dragged into court over it, and loses: this happened not too long ago in Germany I believe.

Re:Also, a company is != an individual

[mcl630]

Your theory that one employee or one team screwed up might fit if this were just a case of a single customer requesting the source and the employee or team mistakenly saying no, but that's not the case here. This has been going on for months now, with multiple contacts to the company. Even the copyright holder of uboot sent them a letter last July threatening legal action if this doesn't get resolved, and they've ignored it for 9 months now. That's far beyond a single person or team making a mistake, or a miscommunication, now you're in the territory of a company willfully violating the licence.

Re:Also, a company is != an individual

[Antique Geekmeister]

> Your theory that one employee or one team screwed up might fit if this were just a case of a single customer requesting the source

There is another potential source of the problem. One of the most difficult situations I've encountered is when developers build software, including kernels, on their own workstations with their own source code and never submit their changes to the corporate source control. I've especially encountered this when the code is heavily customized with "optimizations" that do not match the normal distribution, especially with kernels that do not build modules that the developers has decided they do not need and statically loaded the ones they do want. It's been a screaming nightmare to get these developers to share their work and get their changes in source code, partly because on code review it turns out to be _horrible_. One of my worst such experiences involved a highly paid developer cutting and pasting public patches they did not understand and did not test into the kernel, taking credit for the "improvements" they did not write and which were only detectible in contrived and unrealistic performance tests, and breaking entire deployments by including broken old code from their private source branches, which were impossible to merge due to unnecessary rewrites and re-organizations of upstream code.

The chaos in production use was predictable. Features which were included, and tested, in the standard kernel were left out of the "tuned" kernel, for which there is no reference code available to anyone else, and debugging its failures is a QA and systems debugging nightmare. It's part of the reason to build the code only on a well defined build environment, and only build from a defined source control repository that is checked out with every build.

Re:Also, a company is != an individual

[Anonymous Coward]

> People talk like companies are some single monolithic thing but that's seldom, if ever, the case, especially with anything bigger than a tiny startup.
That's right. However the company has a board and executive officers such that, when it is required that the company acts like a legal personage, such as in the case of legal or tax compliance, it can.

What is your point?

Re:Also, a company is != an individual

[Eunuchswear]

The way this worked when I was working for a big company was that the people who did the final build weren't the developers, and the build team only worked from the checked in versions of the code.

People seem to have got a lot sloppier these days.

(System-X , Plessey Telecommunications, 1980).

its pobably less of a conspiracy.

[nimbius]

Dev: we moved to new Gentoo servers over the weekend and the script that exports builds is broken. it dies trying to get to the compliance server
Ops: we shut that thing down, its ancient and would take too much time to patch for heartbleed. besides it only hosted an FTP server with some open source code. use the new server, USCMPSRV013435 to sync the GPL code outside the firewall
PHB: NO DONT i read an article on how GPL code is viral and also Edward Snowden stole Wikileaks 6 months ago from chinese hackers in the presidents internet.
Ops: er...okay...sooo....the last data up there is what we restored from old sparky...
Dev: oh dear thats ancient....we had to patch new GPL'd code into the product to get ipv6 to stop crashing

Re:its pobably less of a conspiracy.

[Anonymous Coward]

Wait, someone commenting here who has actually done work in such environments and knows how things (unfortunately) sometimes end up going in reality? Inconceivable! We have to be all holier than thou here and treat any violation of the GPL as a personal and deliberate attack on each and every one of us; one that has been explicitly designed by the CEO to undermine and destroy the entire open source community in order to drive up short term profits.

Re:its pobably less of a conspiracy.

[Anonymous Coward]

That's nice and all, but if you read the actual FA he says UBNT was given plenty of time and opportunity to mend their ways, it wasn't just a drive-by GPL bitch-fest.

Re:its pobably less of a conspiracy.

[Anonymous Coward]

According to one person, who seems to be pissed off by Ubiquiti. I'd like less generalization and more specifics (code examples, dates, method and content of contact and response, etc) before getting out the torches and pitchforks. Even then it's likely just a screw up or oversight on Ubiquiti's part. If so, they need to fix it and resolve any legal issues resulting from it, but they don't necessarily need to be attacked and strung up over it. Given the options, I've actually come to prefer their equipment to the competition so far, but still evaluating.

The author of TFA REALLY comes across as someone with a major axe to grind. Anyone or any company can be accused of or sued for anything at any time, but instead of saying the company has faced accusations of certain things we get "the company has a dark history of..." Seriously? Oh and from one of those terrible "dark history" links:

"This is a major victory for Ubiquiti and a validation of its business practices."

Are you sure this person didn't just get fired from Ubiquiti last month or something? Or maybe they work for a competitor and as part of their competitive analysis they came across this and decided to milk it for all the negative publicity it's worth? It sure sounds kind of similar to something like that at first glance.

Re:its pobably less of a conspiracy.

[Anonymous Coward]

I R'd TFA, and here's what I noticed:

- "I can't find it anymore, but that doesn't mean that it isn't still there." So basically, the author of TFA admits that he hasn't done his homework.
- It's all about airOS, not any of their other devices' software/firmware.
- He links to a GPL'ed project named "u-boot". He then works from the assumption that this must be the same exact software as is used by Ubiquiti, who couldn't possibly have any in-house projects named "u-boot" that would boot a Ubiquiti device. No, that's just too far-fetched. Some proof of it even being the same software would be in order. Even if there's some documentation from Ubiquiti themselves, it would be something that would at least tie them together, rather than falling into the category of "strange coincidence".
- "They didn't fix the security issue fast enough to suit me." *whine, whine, whine* *bitch, bitch, bitch* This has nothing to do with GPL violations.
- The kernel was supposedly modified in a way that was recognizable as a legitimate configuration decision, but somehow, this couldn't possibly be in a config file somewhere, or be a compilation switch, or any number of other ways that a given, bog-standard kernel version could be a different binary than another compiled binary of that same code. No! It must be a GPL violation, even though I have no proof!
- Ubiquiti declined to comment, so they must have something to hide! Because the inverse of that is also true, and if they have nothing to hide, they have nothing to fear. Or maybe they're just sick of dealing with whiny little bitch-tards that have conspiracy theories and axes in need of grinding.

I personally like Ubiquiti's products, but like any other corporation, my loyalty to them ends with the purchase and subsequent support and warranty obligations. I expect nothing of them beyond what is legally required, and if they're being GPL-abusing bastards, then give 'em hell. But this guy just acts like a complete douchebag about the whole thing, and expects them to respond to crackpot bullshit that doesn't even stand up to basic logic. The first thing anyone should do is ask themselves "could there be another explanation for this?" and if the answer is "yes", then they should test it, not ignore it because it doesn't fit their preconceived ideas or biases.

Re:its pobably less of a conspiracy.

[Anonymous Coward]

This. And not only that, you totally glossed over the most obvious douchebaggery of all, that whole "the company has a dark history of" this and that, but some of the links are actually favorable toward Ubiquiti. The TFA author didn't even bother to read their OWN links, which must have been gleaned by simply googling the company name plus negative terms. Disgruntled former employee perhaps? Or works for a competitor? Or just a know-it-all, who doesn't, and gets offended when called out on it and tries to get revenge to prove they are "right."

Re:its pobably less of a conspiracy.

[mcl630]

Your scenario would make sense if this was just a one time thing, but the issues with Ubiquiti have been going on for many months.

Re:its pobably less of a conspiracy.

[mcl630]

- He links to a GPL'ed project named "u-boot". He then works from the assumption that this must be the same exact software as is used by Ubiquiti, who couldn't possibly have any in-house projects named "u-boot" that would boot a Ubiquiti device. No, that's just too far-fetched. Some proof of it even being the same software would be in order. Even if there's some documentation from Ubiquiti themselves, it would be something that would at least tie them together, rather than falling into the category of "strange coincidence".

So you think they wrote their own bootloader for their router, named it the same as a well known bootloader that's used in lots of other routers, and then when people request the source (including one of u-boot' copyright holders) they wouldn't just say "it's not *that* u-boot, it's are own proprietary bootloader and we're keeping it closed"? Grasping at straws much?

Get lost

[0dugo0]

You are not getting my .config and trivial kernel patches either (for value of patches, a few well placed /* */'s). Do your own homework.

Re:Get lost

[Anonymous Coward]

> Do your own homework.

Same to you asshole. Write your own damn kernel if you don't want to play by the rules of the people who gave you theirs.

Pretty much.

[Anonymous Coward]

Finally, someone who has apparently actually worked in software...
It's at LOT easier to (even unintentionally) mess up than to get it right. Management should establish better polices and checks to ensure compliance and they deserve to suffer the legal consequences of failing to do so, but things like this are almost always "honest mistakes" by specific employees or sometimes specific teams and are very rarely if ever deliberate strategic decisions. This is made even worse by things like high turnover, offshoring, etc.

I have no affiliation with Ubiquiti, other than as a small customer, but I've had very good experiences with their products thus far and hope they fix their policy/training/oversight issue and move on. They're just another among thousands of companies who happen to employ one or more people that (strangely enough) aren't perfect and can therefore possibly screw up at times.

Re:Pretty much.

[maugle]

Honest mistakes happen, but copyright violation is copyright violation. Ubiquiti needs to put things right ASAP, and thank their lucky stars that the copyright they violated was owned by a bunch of copyleft hippies and not a big lawsuit-happy corporation.

Re:Pretty much.

[Anonymous Coward]

Agreed in general, if this is substantiated (sounds like at this point we basically have to take just one, seemingly disgruntled, person's word for it, but there's some supporting evidence), then they need to fix it and deal with any legal fallout. Now that they've been outed they should also publish a public statement apologizing, explaining the situation, and detailing the steps they've taken to prevent it from happening again* That would, and should put the issue to bed. There'd be no need to try to make a martyr out of them over it. I've only used their UniFi stuff a bit, but it's worked pretty well thus far (connecting via one right now) and I'd sure as heck rather deal with (and pay for) them than Cisco at this point.

*Unfortunately, that sometimes has to wait until any legal fallout has finished... falling out.

Re:Pretty much.

[Anonymous Coward]

No! It's ebil corporashuns that did dis to us! WE ARE LINUX!!!!!!

Re:Pretty much.

[Grishnakh]

The problem with this "maybe it's just a mistake" line of thought is that, usually, whenever these GPL violation issues come up publicly, it's because the accusers have already contacted the alleged infringer and sought to rectify the situation, and it didn't go over well.

Re:Pretty much.

[msauve]

Ubiquiti, and others. GPL2:

You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License.

Note that if anyone with copyright over the kernel wins such a suit, the rights to use the kernel are lost for all time ("terminated"). And, there's no way to get those rights to use the kernel back. (Well, maybe they could negotiate with every individual copyright holder...)

Those who don't honor the requirements are playing with fire, and risking their entire business. That includes large firms like Samsung, who makes a habit of not releasing Linux (Android) kernel source for a considerable time after releasing new phones.

Someday, someone with a copyright interest in the kernel is going to sue a Samsung, and get a billion dollar negotiated settlement because their business couldn't exist without a valid license to the kernel.

Re:Pretty much.

[elgaard]

==
  GPL2:
>You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License.

Note that if anyone with copyright over the kernel wins such a suit, the rights to use the kernel are lost for all time ("terminated").
==

That is not what that clause means. For example GPL also says that they not have to accept the license.

What it means, is that they then have distributed the kernel without permission from the GPL.
And they could get in trouble for that.

Well, this just screwed the legal pooch...

[tlambert]

Well, this just screwed the legal pooch... your posting pretty much kills any recovery change you hd in court.

They could easily claim:

(1) Witness tampering
(2) Jury tampering
(3) Impossibility of a fair hearing (and they get to pick the venue; how's East Texas sound?)
(4) They were attempting to remedy the issue, and this posting did irreparable harm to their business

Most likely they are just trying to hide a hard-coded signing key.

Most likely, you are just bitching because you can't run your firmware on their hardware without the hard coded signing key.

Re:Well, this just screwed the legal pooch...

[phantomfive]

(1) Witness tampering
(2) Jury tampering
(3) Impossibility of a fair hearing (and they get to pick the venue; how's East Texas sound?)
(4) They were attempting to remedy the issue, and this posting did irreparable harm to their business

If a single blog post were enough to make it impossible to get a fair hearing, then no one would ever get a fair hearing.

Re:Well, this just screwed the legal pooch...

[Anonymous Coward]

Well, this just screwed the legal pooch... your posting pretty much kills any recovery change you hd in court.

They could easily claim:

(1) Witness tampering
(2) Jury tampering
(3) Impossibility of a fair hearing (and they get to pick the venue; how's East Texas sound?)
(4) They were attempting to remedy the issue, and this posting did irreparable harm to their business

They could claim those things. Then they'd have to wait for the judge to change his underwear because he laughed so hard he wet himself.

Man, you do read some inane things on this site, but every now and then, there's a real prize-winner. Congratulations.

Re:Well, this just screwed the legal pooch...

[Drachs]

They probably are just trying to hide a hard coded signing key, but that's the whole point of the GPL isn't it? That you can't get away with that kind of crap. The GPL exists to keep the ecosystem open for the people that want to use it, and prevent big portions of it from being co-opted by commercial organizations and hidden behind DRM like signing keys burried in bootloaders.

If someone wants to hide their firmware behind a hard coded signing key they have to write they're own boot loader, they're not allowed to use a GPL'd bootloader and then just ignore the rules because it's cheaper to steal someone elses.

And I think your legal analysis is incorrect, the gentlemen who wrote this blog entry doesn't have standing to sue and wouldn't be part of the case. My understanding is only the original copyright holder has standing to sue.

The original copyright holder wrote a threatening letter a year ago and did nothing. If he did sue he would win but get nothing, and probably doesn't think it's worth the trouble. Ubiquity is banking on him thinking it won't be worth the trouble because they know if they get sued and loose all they have to do is what they should have done in the first place.

Back in the day the GPL used to have a nuclear option that said that if you were found in violation of the GPL by any court you lost your ability to distribute any GPL software from that point on without the explicit permission of all copyright holders. Back in the day, the GPL had some teeth, and corporate legal departments did't fuck around with it like this. That was considered too extreme, unfortunately, and new versions make being found in violation pretty harmless.

Re:Well, this just screwed the legal pooch...

[Pentium100]

Isn't it possible to comply with GPL and still have the restriction on what can run on the hardware?

For example: sign the binaries and put a pre-bootloader (something small you wrote yourself (no need to open the source) put on protected memory of the CPU (no way to read or modify it)) that check the signature and either starts the bootloader (open source) or not.

Or how about a modified version of gcc (not distributed, so no need to provide the source) that inserts the key when compiling, so the source just says "{_PUT_KEY_HERE_}"?

Re:Well, this just screwed the legal pooch...

[tlambert]

They probably are just trying to hide a hard coded signing key, but that's the whole point of the GPL isn't it? That you can't get away with that kind of crap.

No, actually, that's the point of the GPLv3. GPLv2 is perfectly happy with it, and it's why vendors are happy using Linux in embedded devices.

The u-boot code is GPLv2, and it's perfectly OK to "TIVO-ize" it. It's what we did in Chrome OS, in fact. It's just that, in Chrome OS, the BIOS that loads the u-boot checks the signature block on the u-boot, too, and sends it the signature verification key to use on the kernel, and on the rest of the OS.

You're not allowed to change the boot code, and you're not allowed to change the kernel image, and so on, unless you enable "programmer mode" for the BIOS, and then it gets bitchy on boot to warn a user that they're on a potentially compromised machine.

I suspect that instead of "Turtles, all the way down", they missed a turtle at the bottom. I suspect that they are furiously working to correct this by adding another turtle, and, technically, under U.S. law, after receiving notification and acknowledging receipt (this is usually done using a constable, process server, or registered mail), they have 90 days in which to respond.

So at the very least, the blogger jumped the gun.

The GPL exists to keep the ecosystem open for the people that want to use it, and prevent big portions of it from being co-opted by commercial organizations and hidden behind DRM like signing keys burried in bootloaders.

You are once again speaking incorrectly. I suspect that you have not read Richard Stallman's "GNU Manifesto". I'll summarize it for you without the rationalizations and justifications: "I hate copyright. So I have written the GPL to fuck over copyright *using* copyright."; there is some other crap in there as well, about preventing the existance of professional programmers as a class, rather than as work for hire contractors, yada yada, but that's the gist of it.

And again: the code in question is GPLv2; the GPLv3 is what addresses patents and DRM. And it's irrelevant here.

If someone wants to hide their firmware behind a hard coded signing key they have to write they're own boot loader, they're not allowed to use a GPL'd bootloader and then just ignore the rules because it's cheaper to steal someone elses.

Again, incorrect; they just have to give out the sources to the GPL'ed boot loader. There's nothing stopping them having a BIOS or boot ROM mask programmed onto their SOC that refuses to run the u-boot if it's modified, and there's nothing preventing them from having the u-boot code (for which they must give away sources) have modifications (for which they give way sources) which *also* enforces DRM on the kernel.

And I think your legal analysis is incorrect, the gentlemen who wrote this blog entry doesn't have standing to sue and wouldn't be part of the case. My understanding is only the original copyright holder has standing to sue.

I thought he was a u-boot contributor, and so had a copyright interest? If I'm mistaken, I apologize, and amend the hypothetical charges to slander, libel, defamation of character, disclosure of trade secrets, and tortious interference of business. They could potentially sue his ass off on those grounds.

P.S. as a u-boot contributor, I *do* have standing.

Re:Well, this just screwed the legal pooch...

[tlambert]

Isn't it possible to comply with GPL and still have the restriction on what can run on the hardware?

With GPLv2 code, yes; with GPLv3 code, which was supposed to close the patent and DRM "loopholes" to prevent "TIVO-ization", it's unclear; those clauses of the GPLv3 haven't been tested, mostly because as soon as something goes from GPLv2 to GPLv3, companies tend to use the older code and maintain it themselves, find an alternative, or run screaming, like Apple did with LLVM.

The code in question is GPLv2.

Re:Well, this just screwed the legal pooch...

[Anonymous Coward]

So at the very least, the blogger jumped the gun.

At the very, very least, especially considering some of the other unsubstantiated nonsense on that page. Presenting it this way not only failed to make TFAuthor's argument more convincing, it actually made it laughable. Not nearly enough specifics were presented to even assert that the problem actually exists. It _probably_ does, and it's most likely a simple mistake that the company will fix and bring into compliance within weeks. The author, however, immediately lost all credibility at the very second sentence; as soon as that crap about the company's alleged "dark history" was spewed out. Just in case any of us had doubts about whether the author was being reasonable and honest, we then knew for sure. For that reason, it was nice that it occurred right at the beginning of the page.

Of course that didn't stop the bandwagon of "rich evil corporation disregarding all rule of law and preying upon poor open source developers out of pure greed and avarice" here on Slashdot. I wish the issue had been presented honestly and with the necessary specifics so we would actually be able to determine if the company deserves all the backlash or if it's just whining, extreme negative spin over a minor and temporary oversight, or possibly even a fabrication for some nefarious purpose known only to the author.

Re:Well, this just screwed the legal pooch...

[mcl630]

If they were doing what you suggest, why wouldn't they just release their u-boot source?

Re:Well, this just screwed the legal pooch...

[tlambert]

The bottom turtle is missing (u-boot itself is not signed and checked by the BIOS/SOC POST code... I'm sure they are working on fixing it; if not, I charge unreasonable consulting fees, and I'm available;) ... also worked with the same problem on Chrome ...).

Re:Well, this just screwed the legal pooch...

[Antique Geekmeister]

> You are once again speaking incorrectly. I suspect that you have not read Richard Stallman's "GNU Manifesto". I'll summarize it for you without the rationalizations and justifications: "I hate copyright. So I have written the GPL to fuck over copyright *using* copyright.";

No, I'm afraid that _you_ are speaking incorrectly. Don't paraphrase it, there's no need. It's at https://www.gnu.org/gnu/manife.... In particular, read the Review the paragraphse surrounding this statement:

        > The copyright system was created expressly for the purpose of encouraging authorship. In the domain for which it was invented—books, which could be copied economically only on a printing press—it did little harm, and did not obstruct most of the individuals who read the books.

That manifesto is not a "all information should be free!" or an "I hate copyright" document. It's a well reasoned analysis of the purposes and benefits versus the costs, of copyright restrictions for software.

Re:Well, this just screwed the legal pooch...

[Paul Jakma]

The GPLv2 is not perfectly happy with DRM. It is very much possible to read the GPLv2 as requiring *all* material needed to install an executable, which would include keys:

“For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.”

The GPLv2 was very much intended to allow end-users to be able to *install* modified works. The incident which motivated RMS to start this whole free software thing and come up with the GPL was a printer whose software he wanted to fix but couldn't. The freedom to modify software on hardware you own is what the GPL was intended to provide.

The GPLv2 is *not* "happy" with DRM. At best, this is an untested grey area simply because the GPLv2 predates the notion of DRM and so could not use the language we use today. However, it clearly intended to cover installation. The GPLv3 unambiguously fixes this wording issue. That does not mean the GPLv2 allows it though.

Slashdotted

[ClickOnThis]

The linked site in TFS is suffering from (possibly slashdot-induced) overload. Here's the text from the linked page:

Four ways Ubiquiti Networks is creatively violating the GPL
Ubiquiti Networks is a company which makes long-range wireless equipment. Admittedly, you can do some pretty amazing stuff with it, but the company has a dark history of securities fraud, violation of U.S. sanctions, trademark and copyright lawsuits and software patents, which isn't as amazing.

In addition to this, they have been violating the GPL. However, because they did it creatively, most people don't know about it, and Ubiquiti still hasn't come into compliance.

Here are four ways that they have succeeded in making the violations hard to notice, and even harder to act upon.

1. Giving the appearance of compliance

'You can find the complete and corresponding source in the GPL archive.'
Ubiquiti had a website set up where you can download tarballs purportedly containing all GPL source for each and every firmware release. (I can't find it any more, but that doesn't mean that it isn't still there.) When you look through these tarballs, they appear to be complete, and there are build instructions which allow you to make your own custom firmware.

It's only when you look closer that you start to notice problems, such as...
2. Refusing to provide the source to their modified bootloader, even though they made changes that introduced security vulnerabilities

Security keys
Up until version 5.5.4 of Ubiquiti's airOS, the locally-modified u-boot bootloader contained a security issue - It was possible to extract the plain-text config from devices running the firmware, without leaving a trace. And the plain-text config contains unencrypted WPA/WPA2/RADIUS passwords.

Even worse than this security issue, was Ubiquiti's response to it. Namely, they:

Refused to provide the source code, even though u-boot is under the GPL
Didn't fix the security issue for a long time after it was publicly disclosed

To this day, Ubiquiti still has not provided the u-boot source code.
3. Providing source code to a version of Linux, just not the one that they actually ship, and hoping that nobody notices

Ubiquiti Source Ubiquiti Binaries
It would be natural to think that the binaries that Ubiquiti provides were compiled from the source code that Ubiquti provides. As it turns out, for a large number of their releases, the kernel source given does not correspond to the kernel in the official firmware images.

As evidence, consider that in version 5.5.4 of the AirMax firmware, the kernel was modified such that the MTD partitions would be read only, however this change cannot be found in the corresponding kernel patches or source.

Such practices make finding violations extremely difficult, and we can't know for certain that they haven't done this with anything else in the GPL tarball. It's possible that this was just a mistake, but remember that people have complained about this without much of a response.

And speaking of complaining...
4. Dragging out GPL code requests for months on end, then inexplicably going silent

Bureaucracy is a challenge to be conquered with a righteous attitude, a tolerance for stupidity, and a bulldozer when necessary
In case you think that I am being mean to Ubiquiti by going public, please note that I have been trying to contact Ubiquiti for the past year about the issue of the u-boot source code. You can see my attempts here, here and here.

In fact, I even got a copyright holder of u-boot to ask for the source, and they still haven't provided it.

From my conversations with Ubiquiti, I have found that they claimed that it's alright to refuse to provide source code to GPL-licensed software if "This decision was taken with the security of the users in mind". Furthermore, my conversations were endlessly delayed by the supposed necessity to forward m

Re:Slashdotted

[Anonymous Coward]

In fact, I even got a copyright holder of u-boot to ask for the source, and they still haven't provided it.

unless and until wolfgang pursues legal action, there really isn't anything that can be done for force the company's hand. and that's part of the problem. you have big giant company doing whatever the hell they want to, trampling all over the license and rights granted by a much, much smaller entity who cannot afford to do anything about it.

Re:Slashdotted

[Anonymous Coward]

Write to Ubiquiti requesting the source - their email addresses are support@ubnt.com and info@ubnt.com. You should try both.

This is bad advice. Don't do this unless you own one of the Ubiquiti devices. The GPL only requires one to provide the source if they also provided the binaries. If you haven't purchased one of these devices then Ubiquiti is under no legal obligation to provide you with the source. Getting everyone to email them is a waste of everyone's time and could be viewed as a form of harassment if the author tries to press this issue through the courts.

The author should contact either the Free Software Foundation or the Software Freedom Law Center for advice.

Re:Slashdotted

[cas2000]

wrong. read GPLv2 section 3:

3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:

        a) Accompany it with the complete corresponding machine-readable
        source code, which must be distributed under the terms of Sections
        1 and 2 above on a medium customarily used for software interchange; or,

        b) Accompany it with a written offer, valid for at least three
        years, to give any third party, for a charge no more than your
        cost of physically performing source distribution, a complete
        machine-readable copy of the corresponding source code, to be
        distributed under the terms of Sections 1 and 2 above on a medium
        customarily used for software interchange; or,

        c) Accompany it with the information you received as to the offer
        to distribute corresponding source code. (This alternative is
        allowed only for noncommercial distribution and only if you
        received the program in object code or executable form with such
        an offer, in accord with Subsection b above.)

(bolding/emphasis added by me)

i.e. you must either provide the source WITH the binaries (e.g. by including a source CD with the router product), *OR* you must supply the source to *anyone* who asks for it.

Or you write a separate process...

[Anonymous Coward]

from scratch to deal with the proprietary hardware, and talk to that from your GPL app. Or the other way around. It's not
impossible.

Re: Or you write a separate process...

[shitzu]

We are talking about kernel accessing hardware here.

Pera gets rich of other's backs ...

[Resol]

I used to work for a company that was meant to be a partner of Ubiquiti -- from the first meeting with Robert, one could tell this was not going to be a "share and share alike" partnership -- more likely it was going to be a one party gives, the other takes partnership. We as partners needed access to some parts of the code, and in meetings said we'd like to get the source, and given that it was built on GPL'd code, we figured it would be a non-issue. How wrong we were. Basically told that was never gonna happen, not for us, nor anyone else that wanted it, it was their IP. Robert's one of Forbe's 10 youngest billionaires. He's gotten stinking rich off others, and refuses to give back. It certainly douses your faith in the human spirit somewhat. Anyway, not that it's much better, but you can always buy from MikroTik (ducks! ;-) )

Re:Pera gets rich of other's backs ...

[Resol]

I apologize for offending you, it was certainly not my intention. Rather, I intended it (along with the ducks! comment) to indicate that I appreciated that I was suggesting another vendor with similar products that also has "issues" with making source available. Next time I'll leave out the emoticon. I am interested to know what you suggest for indicating that text you've written is meant to be sarcastic, ironic, or other. Do you just avoid using constructs that are common in speech in your writing?

Re:Pera gets rich of other's backs ...

[don.g]

Mikrotik appears to have its own GPL issues. And good luck getting OpenWRT to run on any of their recent devices :-(

Re:Pera gets rich of other's backs ...

[TCM]

Stop apologizing to a random text on the Internet. WTF is wrong with you?

Re:Pera gets rich of other's backs ...

[sjames]

P{erhaps he was bitten by a duck as a child. Now he's quacking up.

I'll be here all week. Try your waitress, tip the beer.

Re:Pera gets rich of other's backs ...

[Anonymous Coward]

Robert's one of Forbe's 10 youngest billionaires. He's gotten stinking rich off others, and refuses to give back.

And how is this different from any other billionaire? To get there, you need to either be a sociopath, or inherit it from others (and you'll find sociopaths at some point on the family tree), or be carried along for the ride by somebody who falls into the first two categories. In all cases, getting "stinking rich off others" is paired with a lack of integrity on somebody's part.

Re:And this is why corporations don't trust the GP

[lgw]

If "you" are a one-man shop, that's fine.

If "you" are the legal department for a company with 10,000 developers, the GPL is scary. You can either blanket-ban GPL code, and make your life easy, or create a system for separately evaluating the use of each and every piece of GPL code you allow in, plus some auditing process to catch cheaters (who check in GPL code as their own work, which happens).

Cloud services companies usually go with the latter: because you don't have to share your code if you don't distribute it, the payoff is good to allow use of GPL code, and police the corner cases where you do distribute code. Blanket bans on GPL code are still common at old-school software companies.

Author asks for your help by emailing

[monkeyzoo]

If you can spare a minute, please do any or all of the following so that we can retain the GPL's power to help the community:
- Raise awareness - upvote it, send it to friends or write a blog post about it
- Write to Ubiquiti requesting the source - their email addresses are support@ubnt.com and info@ubnt.com. You should try both.
- Send me an email telling me what you've done. My email address is riley@openmailbox.org

Re:Author asks for your help by emailing

[Anonymous Coward]

Also from the author's page: "but the company has a dark history of securities fraud, violation of U.S. sanctions, trademark and copyright lawsuits and software patents, which isn't as amazing."

These references are a little misleading. The securities fraud is half advertisement for a layer trying to develop a case in 2012 with no further followup. The sanctions violation was going astray by selling equipment to Iran, and they paid ~half a million in fines as punishment. The copyright and trademark lawsuit was dismissed in their favor (that is, NOT guilty). The software patent link just points to a software patent, no grievance.

The author might consider removing the "dark history" claim or risk the label of hyperbole.

This is too bad

[Anonymous Coward]

This is too bad. They are currently the only supported hardware maker for one of ham radio's more interesting projects: A self discovering/healing/organizing mesh network providing WiFi networking over dozens of miles on the portions of the WiFi spectrum available to hams. http://www.broadband-hamnet.org The project still officially supports the venerable Linksys WRT54G, but official support for this router is ending this month and it is a pretty old router. Then again, when you use Ubiquiti hardware and this firmware, I suppose you are no longer violating the GPL! Still, it'd be nice to not give your dollars to a GPL violator.

Re:This is too bad

[Anonymous Coward]

Umm it also supports wrt54g so not the only supported hardware.

Re:This is too bad

[Anonymous Coward]

So, where can I get one of those, new? And where can I get hsmm support for it after this month?

Re:Proper, fair punishment

[aristotle-dude]

Shouldn't that be to give head to Stallman? Having to put your face in his unwashed, lice-infested bush would be a fitting punishment.

The problem is that nobody would be able to find his member. In fact, he has not seen his penis in years.

Do the developers care?

[Anonymous Coward]

The question is... do the developers of the Linux kernel actually care enough to do something about it? I tried getting the Linux kernel source from Checkpoint for the latest Linux kernel a few years ago to troubleshoot a problem myself but support claimed they don't release the source (???). I eventually found a link on their site to an old version which was not the latest that they had modified. I never could get the latest version that they released. I bet this happens a lot more than anyone realizes. The question is... do the developers of the Linux kernel actually care enough to do something about it? I don't know the current status of Checkpoint kernel source releases but I doubt it has changed.

Re:And this is why corporations don't trust the GP

[Anonymous Coward]

How does this disagree with the GP? Comply with the license, or pay to license something proprietary. It's not that hard.

Re:This. This is why the GPL is hated

[Anonymous Coward]

So if you make a deal, in your mind the deal does not have to be honored, because some part of it is inconvinient?

Yes, that's exactly what a rapist would say.

[Anonymous Coward]

Breech of license of GPL code is like raping a three year old, and blaming the license for being restrictive is like blaming the child for being cute, therefore its their fault you raped them.

There is no viral nature to GPL.

The only viral nature is copyright. Get copyright banned if you like.

Re:And this is why corporations don't trust the GP

[gmack]

If you can't trust your developers, you have more than the GPL to worry about. If you think the cost of a GPL violation is bad, just wait and see the results of someone borrowing code claimed by a former employer (or even writing code too similar). Just ask Google where the one thing that has cost them the most pain so far, was a 9 line function that one of their programmers copied into the Android source code..

Re:And this is why corporations don't trust the GP

[lgw]

How does this disagree with the GP? Comply with the license, or pay to license something proprietary. It's not that hard.

I'm sure these guys did it on purpose, but that's not always the case. Many junior developers are simply oblivious to any concern about mixing GPL code in with their own work, and a few will cheat deliberately. Do you rely on code reviews? Do you run an auditing tool like Black Duck? In a large enough shop, you can't just make a policy and hope for the best, so the very existence of GPL code causes headaches for the legal team.

Yeah, sure, someone could copy closed source too, but that's much less likely to happen, especially by ignorance or accident.

Re:Proper, fair punishment

[Coren22]

Forget to check the post anonymously box? Be careful, you might get attacked by Stallman and his followers :)

Re:And this is why corporations don't trust the GP

[kthreadd]

If "you" are a one-man shop, that's fine.

If "you" are the legal department for a company with 10,000 developers, the GPL is scary. You can either blanket-ban GPL code, and make your life easy, or create a system for separately evaluating the use of each and every piece of GPL code you allow in, plus some auditing process to catch cheaters (who check in GPL code as their own work, which happens).

Cloud services companies usually go with the latter: because you don't have to share your code if you don't distribute it, the payoff is good to allow use of GPL code, and police the corner cases where you do distribute code. Blanket bans on GPL code are still common at old-school software companies.

Most non-free licenses are quite scary too, but they often get a pass since they are not that open to begin with.

Re:And this is why corporations don't trust the GP

[danbob999]

However, if GPL had been more permissive this whole incident would never have happened.

Of course it wouldn't. And Linux/U-Boot/Busybox wouldn't be as great as they currently are because corporations wouldn't have contributed back to these projects.

Re:And this is why corporations don't trust the GP

[lgw]

Legal departments already know how to deal with that (I've signed something at every new job promising I wouldn't do that, as a condition of employment), and it's obviously the wrong thing to do. Open source code is right there when you google for a solution to the problem in front of you, and it's often fine to incorporate. Quick, what license is the code you find on Stack Overflow under? OK to copy into commercial code or not?

p.s., probably not

Do I gotta be the guy to ask?

[ckatko]

What if this was an intentional backdoor so that they-who-shall-not-be-named can spy on internet traffic of closed networks and WISPS?

And it was not included in the the source packages because the source is subjected to a gag order and publishing it would be showing it to the world.

Lastly, if this is true, what if this is "standard procedure" for backdoors inserted into many open-source projects, where the code presented is actually a fork of the true, backdoored code, running on lots of hardware? Or, as per Ken Thompson's watershed article, "Reflections on Trusting Trust", they-who-shall-not-be-named has a version of GCC capable of adding backdoors to open source code and we're all blaming Ubiquiti for something they didn't even put there?

I'll be the first to admit, there's plenty of speculation here. But if there's anything we've learned in the last few years, the state of spying is way more prevalent than we thought it was. So while I have no proof, I'm certainly holding onto this information should more evidence come out.

Obvious axe to grind blogger is obvious

[Anonymous Coward]

I'd bet good money this person feels they've been "wronged" by Ubiquiti and is essentially trying to get them back. Nobody writes unsubstantiated crap like "the company has a dark history of..." without an axe to grind. I'm actually very surprised you're the only one who apparently even noticed this. It's clear all they did was a few searches on terms like Ubiquiti [lawsuit, copyright, violation, business practices, fraud] in an attempt to dig up dirt and portray the company in as negative a light as possible. That's a very powerful indication that ALL OF THE STATEMENTS on that page need to be taken with a large grain of salt. I also notice most of the negatives are presented as generalities or are subjective. As such, it's certain that all details not directly supporting the author's position were also deliberately omitted in order to make the argument sound more convincing. The author may have a bight future in politics.

In short, be sure to take note of the axe to grind before getting out your pitchforks.

Re:Obvious axe to grind blogger is obvious

[monkeyzoo]

The author might consider removing the "dark history" claim or risk the label of hyperbole.

... or risk the *libel* of hyperbole!

wikipedia

[Anonymous Coward]

This 'news' should be posted on their wikipedia page, https://en.wikipedia.org/wiki/...

Re:And this is why corporations don't trust the GP

[Anonymous Coward]

fuck the legal team they are the main cause for shit!

Mod parent down

[Prune]

I feel for small companies like Ubiquiti.

So a multi-billion dollar company like Ubiquiti, which has made its CEO one of Forbes' 10 youngest billionaires, is a small company?

Re:And this is why corporations don't trust the GP

[hairyfeet]

Yeah either use BSD like Apple or pull a EEE like Google and be showered with praise for the teabagging by the FOSS community. Since they don't have the funds to pull the latter? The former would be the wise move.

hmmm

[Anonymous Coward]

Microtik! Microtik!Microtik! Microtik!Microtik!Microtik!

Re:This. This is why the GPL is hated

[Anonymous Coward]

Contract law is only supposed to be used against people taking out mortgages they can't afford. No corporation should ever be held to their signature.

Re:And this is why corporations don't trust the GP

[danbob999]

They use Linux because they think it's a superior product. Despite the license. If they thought *BSD was superior, they'd use it. If they preferred the GPL, then they would make a GPL fork of *BSD.
So you are suggesting them to use an inferior product, just so that they don't have to release their minor modifications to the Linux kernel? Remember they are hardware companies. Their profit isn't on the kernel they are shipping with their routers.

Yeah, let's all be assholes

[Anonymous Coward]

And post unsubstantiated BS like the company's "dark history" to Wikipedia so it can just be reverted again by the few remaining non-idiots left on the Internet...

Internet lynch mobs have rarely benefited anyone much, and have demonstrably caused a lot of harm, often to the falsely accused or those guilty of nothing more than their accusers (and frequently guilty of /less/ than their accusers).

Sue them for $1 MILLION

[Anonymous Coward]

The authors of u-boot are stupid.
They can sue for wilful violation of copyright. According to the MPAA it is more than $1000 per copy. The u-boot team could easily sue for $1 MILLION.
The u-boot copyright holders need their head checked - this is a golden opportunity for them to make some big $$$.

I want to see Ubiquiti pay a huge sum for their GPL violation.

Hopefully the u-boot authors get their act together and go for them.

Re:And this is why corporations don't trust the GP

[adri]

No, they used linux because that's what Atheros gave them as a base for the Atheros reference AP implementation.

Please don't make stuff up.

Ubiquiti has form

[lordlod]

As the article said "the company has a dark history of securities fraud, violation of U.S. sanctions, trademark and copyright lawsuits and software patents".

I personally discovered that their standard wifi board didn't follow the mini-pcie spec on flight mode (W_DISABLE). In fact there is no way, other than cutting power to the card, of disabling radio transmissions. Multiple inquiries on this topic were all met with stunned silence. At the time I was working for a substantial company buying boxes of cards at a time, I can't imagine their response to individuals raising issues would be better.

I wouldn't trust a Ubiquiti device in the future, their attitude to standards and specifications could best be described as flexible. As a manufacturer once you incorporate their device into your product you become liable for all their RF creativity, not something any rational company should accept.

Re:Ubiquiti has form

[Anonymous Coward]

As the article FALSELY CLAIMS "the company has a dark history of securities fraud, violation of U.S. sanctions, trademark and copyright lawsuits and software patents".

Fixed that for you. Really, did you actually follow some of those links? Apparently TFAuthor didn't either.

There are bigger issues with fake/missing sources

[Anonymous Coward]

Not so long ago we get told the NSA is intercepting and modifying Cisco routers. Now we have a major router manufacturer shipping modified "black box" binaries in the firmware.

It's at least possible that the reason they won't release the correct sources is because they didn't actually write the modified code but were induced to include it by a secret order or agreement with a spy agency.

Until Ubiquiti come clean I think this should be the default assumption.

Another possible cause

[Gazzonyx]

My company (specifically, my department) uses and contributes to a number of open source projects. From time to time stuff gets lost in revision control and either a commit isn't upstreamed, upstream doesn't merge pull our changes right away, the patch hasn't made it to the mainline trunk or is staged for the next release.

It's not completely uncommon for me to pull from an upstream project and hit a bug I know we patched and then have to track down that patch's merge history internally (sometimes it doesn't make it from one developer's local working copy to our git/svn server) and then see if it's been accepted upstream. It's nothing intentional, but it happens; sometimes a commit just slips through the cracks and you don't realize it right away.

Re:Another possible cause

[Anonymous Coward]

> It's nothing intentional, but it happens; sometimes a commit just slips through the cracks and you don't realize it right away.

Yeah, right. And mulling over it for *over one year* after having been made aware of it is unintentional too.

I think that's exactly the problem: probably the developers are long gone and those left at the helm have *no fucking idea* of what to do with those requests. But this situation stems from the overall attitude of not allocating the needed resources (record keeping, support contract with devels, (gasp!) source code control) in the first place.

Any company has to alloc the resources to keep financials in order, otherwise they'll be tarred and feathered, quartered and deep-fried by the IRS or however those nice folks are called in your country. But a comparable tiny allocation to comply with free licenses seems to high (prop licenses seem to be no problem, though).

Summing up, I think the current approach of GPL folks to be extremely nice: knock at their door, try to get things resolved the nice way, wait for a while (one year in the current case, ffs!) and then publically shame. I seriously hope Software Freedom Conservancy or similar jumps in, making them pay through the nose.

Re:Another possible cause

[Eunuchswear]

I don't understand your point. The GPL doesn't say you have to send your changes upstream (that's just politeness). The GPL says that if you release binaries you have to make the corresponding source available.

If you ever find yourself in the situation where you can't re-create your binaries from source you've fucked up big time.

Re:And this is why corporations don't trust the GP

[Anonymous Coward]

> However, if GPL had been more permissive this whole incident would never have happened.

Riiiiight. "If only she had consented, I wouldn't have had to rape her!"

Classic.

Hyperkin is doing the SAME THING with the Retron5.

[Anonymous Coward]

Hyperkin Games sells a console (Retron5) that runs emulation software in clear violation of various licenses that the original emulator developers used. They have released the source code to appear compliant but absolutely are not.

http://www.libretro.com/index.php/retroarch-license-violations/

Not new...

[Anonymous Coward]

This isn't a new thing at all. Amstrad did the same thing with (at least) the E3 Emailer.

People are rude to others who openly lie.

[Anonymous Coward]

The reason why some were rude was because you either thought them idiots or were just so completely careless that yours was an obvious lie.

You claimed, and I quote, "My understanding was that..." followed by a claim that CANNOT have been gained by ANY reading of the GPL.

Either you knew you had no understanding of the license (had not read it at all), knew you were lying (but didn't care) or heard something that you thought, saw reality was not in accord, then didn't even bloody bother with the effort of reading the GPL, ****BUT STILL PUT THE EFFORT TO WRITE ABOUT YOUR IGNORANCE***. The latter showing complete and utter disregard for everyone else involved merely so you could preen yourself in public.

ANY of those are reason enough to treat your comment with contempt. IT DESERVED CONTEMPT.

Re:People are rude to others who openly lie.

[Coren22]

As others said, it is your type no one wants to deal with.

I never said "the GPL is this" I said my understanding of it was X. I am no lawyer, nor do I have a couple hours to dedicate to reading a license I already know I don't break (I don't distribute, at all). I was asking a damn question and get attacked by morons like you that have nothing better to do than rage at someone that was wrong on the internet.

Here is something for you, now go chill out.

https://xkcd.com/386/

Re:And this is why corporations don't trust the GP

[JoelKatz]

Actually, their profit is in the software. Their hardware isn't significantly different from everyone else's hardware. The reason most people buy their hardware is because their software makes that hardware very easy to monitor and manage. With routers, just like with phones, good software sells hardware.

Ignorant much?

[Anonymous Coward]

I love the comments from folks that either haven't really read the license terms, or just plain don't understand them. If this license was a GPL2 license then while Ubiquity does indeed have an obligation to post source, they still maintain the right to do so at their determination (in time) and in some cases just because the used GPL code it doesn't actually mean they need to release their code. A specific example of this would be a company that uses a GPLd kernel (unmodified) and writes custom code on top of it. In that case according to the official GPL FAQ (for laypersons)

"If the two programs remain well separated, like the compiler and the kernel, or like an editor and a shell, then you can treat them as two separate programsâ"but you have to do it properly. The issue is simply one of form: how you describe what you are doing. Why do we care about this? Because we want to make sure the users clearly understand the free status of the GPL-covered software in the collection."

Also you can restrict source distribution to people that buy your GPL based product and not to everyone, (again from the FAQ)

"I want to make binaries available for anonymous FTP, but send sources only to people who order them.
If you want to distribute binaries by anonymous FTP, you still have to provide source through one of the options listed in section 3. This should not be hard. You can provide a written offer for source if you want; section 3(b) allows this. But if you can find a site to distribute your program, you can surely find one that has room for the sources."

If this case since the binary hasn't been released to the public (it's a commercial sale) the subsequent public release of source is NOT required, however the release of source to binary obtainers is required and their subsequent release to a third party (everyone else) cannot be barred by the originator of the code.

Re:And this is why corporations don't trust the GP

[danbob999]

They all have the same software functionality. Most people never access their router's web interface. They can differentiate their product on the web interface, but switching from Linux to BSD won't help them sell more routers.

Re:And this is why corporations don't trust the GP

[david_thornley]

You're suggesting that they should violate license terms because the product with the inconvenient license is superior? Most people consider Windows 7 to be a more useful operating system than Fedora Linux, so you say they should make their own copies of Windows 7 rather than use an inferior product?

They're a hardware company. In what way would releasing the kernel modifications they made hurt them?

Re:And this is why corporations don't trust the GP

[danbob999]

Uh? Were you replying to me?

Re:And this is why corporations don't trust the GP

[DeVilla]

Why did Atheros use it? And was it theirs to "give".