Friendlier GPL-Enforcement Permission Proposed By Linux Kernel Developers (kroah.com)
The former Executive Director of the Free Software Foundation -- and Slashdot user #41121 -- contacted Slashdot with this announcement. bkuhn -- now president of the Software Freedom Conservancy --
writes: Software Freedom Conservancy, home of the GPL Compliance Project for Linux Developers, publicly applauded today the proposal of the Linux Kernel Enforcement Statement, which adds a per-copyright-holder-opt-in additional permission to the termination provisions of Linux's GPLv2-only license.
It apparently addresses a developer who "made claims based on ambiguities in the GPL-2.0 that no one in our community has ever considered part of compliance," according to a statement from some of the kernel developers who drafted the statement. While the kernel community has always supported enforcement efforts to bring companies into compliance, we have never even considered enforcement for the purpose of extracting monetary gain... [W]e are aware of activity that has resulted in payments of at least a few million Euros. We are also aware that these actions, which have continued for at least four years, have threatened the confidence in our ecosystem. Because of this, and to help clarify what the majority of Linux kernel community members feel is the correct way to enforce our license, the Technical Advisory Board of the Linux Foundation has worked together with lawyers in our community, individual developers, and many companies that participate in the development of, and rely on Linux, to draft a Kernel Enforcement Statement to help address both this specific issue we are facing today, and to help prevent any future issues like this from happening again. It adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified.
It apparently addresses a developer who "made claims based on ambiguities in the GPL-2.0 that no one in our community has ever considered part of compliance," according to a statement from some of the kernel developers who drafted the statement. While the kernel community has always supported enforcement efforts to bring companies into compliance, we have never even considered enforcement for the purpose of extracting monetary gain... [W]e are aware of activity that has resulted in payments of at least a few million Euros. We are also aware that these actions, which have continued for at least four years, have threatened the confidence in our ecosystem. Because of this, and to help clarify what the majority of Linux kernel community members feel is the correct way to enforce our license, the Technical Advisory Board of the Linux Foundation has worked together with lawyers in our community, individual developers, and many companies that participate in the development of, and rely on Linux, to draft a Kernel Enforcement Statement to help address both this specific issue we are facing today, and to help prevent any future issues like this from happening again. It adopts the same termination provisions we are all familiar with from GPL-3.0 as an Additional Permission giving companies confidence that they will have time to come into compliance if a failure is identified.
Fines and penalties aren't always about pure monetary gain. They are a means of punishment for wrongdoing and a way to dissuade others from engaging in the same behavior. Absent payment as a penalty, I suppose we could take the board of directors of a company found in violation of the GPL and have them shot.
Have gnu, will travel.
but switched over to be more in favour of the BSD/ISC/MIT licences because they are maximally free. The GPL is largely unfriendly to corporate and academic interests. Some code needs to be proprietary--life is about pragmatism sometimes, not always about ideology. More and more, academics are releasing their code under the BSD/ISC licences because they realise that because they are receiving public money to fund their code and research, by dint of this, they must release the results of that money to the public in a maximally free way, even if some would take the results and monetise it. There is nothing wrong with proprietary code, guys. Not everything needs to be open source. It's preferabe, yes, but not always possible.
Presumably they're worried that enough big lawsuits would encourage companies to use BSD instead.
I think as Linux kernel developers we should take note of the very personal touch the MPAA has used to deal with violators: An early morning visit by a paramilitary police force.
“Common sense is not so common.” — Voltaire
Copyright law says you can't make copies for another without permission.
The BSD license grants an exception to copyright, (like all distribution licenses for copyrighted works,) which lets you copy it, but also lets you take away that permission from whoever you distribute the software too.
The GPL license also grants an exception to copyright, but says you can't take it away from whoever you distribute the software too. In other words, they get the same right to run, modify, and distribute the software as the licensed work you based your changes upon.
True, payment can also be used to encourage compliance BEFORE getting caught. "If you don't comply from the start, you'll have to pay when you get caught", is one approach. It seem McHardy is seeking personal gain, though, based on his tactics of putting time pressure on them, etc.
There may be no right way to do it. Giving a warning and allowing them to come into compliance with no penalty makes sense if someone just goofed. On the other hand, a policy of always allowing 30 days to cure with penalty could be interpreted as "there's no reason to comply until after you get caught". The best approach, IMHO, may be a small penalty for non-compliance as soon as someone gets caught - enough penalty that it makes sense for companies to comply BEFORE they get caught, and 30 days to fix it before more significant penalties are pursued.
The kernel is GPLv2 and has so many contributors that there is no hope of ever changing the license. You can only not enforce the license, but you cannot take away the right to enforce the license from other contributors.
Even in enforcing a license, a court must decide how exactly to do so. If monetary damages are appropriate, how much money exactly? A court should hear from the copyright holders and from the defendant before deciding on remedies.
As you said, there are many contributors to the kernel, and many contributors to netfilter. If the vast majority of copyright holders relevant copy right holders say "we just want them to start complying, we don't want any money other than expenses for this case", a court should duly noted that.
Where one person has contributed much less than 1% of the code
Irrelevant. License violations void the license. Continued use requires the consent of all contributors who choose to enforce the license. The 99.9% can't take that choice away from the 0.1%. Unless all contributors agree to renew the license, the court can only find that the license violator has no license to distribute. Monetary damages don't come into it. The court cannot force a contributor to give a license that they don't want to give.
Once a prominent contributor takes a substantial stand against this additional permission, watch someone file issues to replace this contributor's contributions.
Fixed link to the statement
This is a corporate push to protect corporate interests while they violate the GPL. The monetary findings that punish companies are so rare that there is no problem here at all. Liars working for moneyed interests.
It would have to be a clean implementation of an interface that existed before the contribution that they mean to eliminate. Otherwise it's still a derived work and the contributor maintains control over it through the "viral" nature of the GPL. Anyone who has worked on the part to be eliminated need not apply: They're too likely to end up with a result that would not elminate the claim.
It's fascinating that major open source proponents are trying to make an end run around one of the most well-known open source licenses and the rights it gives to countless authors who have contributed to one of the biggest open source projects.
Licensing differences lead to radically different outcomes. Free software (not just the variants of the Linux kernel containing only free software) is more attractive because the effect of the license on the users. Hollywood movies are licensed restrictively even disallowing verbatim non-commercial sharing (in other words, treating friends like friends). In addition, Hollywood movies often use digital restrictions management (a proper expansion of "DRM" from the majority standpoint, that of the viewer) to enforce more than the license restricts. DRM means non-free software control over one's computer since all DRM software is proprietary. Proprietary software is inherently unethical no matter its purpose. As people put more sensitive data on their computers, more use of proprietary software means predictably uglier outcomes even for those who participated fully in a DRM scheme.
Free software implements an environment of sharing and cooperation as well as individual control over one's computer (to the limits of one's interest and skill). These are good unto themselves but also have good consequences for businesses (which is a nice consequence but not chief goal of the free software movement). I trust I don't have to review how many commercial developers and distributors benefit from the Linux kernel. Commercial distribution of Hollywood movies as we currently see, by contrast, implements control over the viewer, fund an increasingly punitive copyright regime, and fund an unjustifiably long term of copyright. /.ers who pay to see the Star Wars movies would be wise to recall this; they're directly funding the organization most widely associated with the last copyright term expansion—Disney, for example.
Violating a free software license means mistreating a person or organization that was respecting a user's software freedom. But violating a proprietary license can be the "lesser evil" as Richard Stallman once put it in his talk about why society needs free software and why we should value software freedom for its own sake: Someone who had a useful nonfree program under a license that prohibited non-commercial verbatim copies had to choose between obeying the license of that program (and denying their friend a copy of the program) versus helping their friend who wanted a copy of a program by distributing a copy. This came up in the context of discussing free software freedom #2: "the freedom to help your neighbour. That's the freedom to make copies and distribute them to others, when you wish":
He goes on to explain that picking the lesser evil is not good, but one should aim the harm at the party that did harm (those that publish useful proprietary software) not to an innocent party (the friend). So the solution is to only have free software so you never get into this dilemma in the first place because all of the software you have you're free to share. Here we can see that the same copyright scheme grants power to radically different lic
Digital Citizen
This is a bad fix for the wrong problem. The real issue is that companies are violating the GPL license of the linux kerel.
Linus should announce the 'phase-out' of all non-GPL drivers and blobs from 2020. Plenty of time for everybody to get compliant then.
Lot's of positive effects: hardware vendors will simply have no choice. The current legal gray area of proprietary kernel code and binary blobs has no place in our ecosystem. Android phones with the new kernel will become upgradeable forever. Less e-waste.
Personally, I don't care is someone is profiteering of the GPL violations of companies, these companies should know better. Informed consultants should inform their customers: "Make all your kernel development GPL to avoid future legal problems. Yes, it is like that, period!"
Afraid that your competitor can see the code? "Well, policy is for userspace; your kernel code should be small and should only implement mechanism; it's the way any driver should work anyway. Period; again."
The FSF isn't dirty about asking monetary compensation for copyright or GPL license violations either. The term "undisclosed sum" passes a lot around. Sure, they do something good with the money, but should we become overly sympathetic with ignorant managers at larger companies who violate our (copy)rights?
There is absolutely nothing wrong with people aggressively going after GPL violators!
Let there be more 'copyright trolls'; it's the best way to ensure GPL compliance will happen more and better.
Let the multinationals do their proper due diligence with respect to their possible GPL abuse.
Don't think for one second that it would halt Linux adoption in any way; we passed beyond that point more than 10 years ago!
Copyright law is a joke and has functionally destroyed or delayed unfathomable levels of productive economic activity.
The Linux Foundation needs to bring in Stephan Kinsella on retainer to help with this. Probably no one else has done as much legal-philosophical work into the nature and practice of modern IP as he has.
"Replaces" does not mean "derived from". Cars replace horses. Cars are not derived from horses. More to the point, GPL Linux replaces Unix; Linux is not a derivative work of Unix.
SCO spent millions on lawyers arguing that Linux is a derivative work of Unix, which it replaces. Several courts ruled it is not. It's entirely possible to replace something without creating a derivative work.
> Anyone who has worked on the part to be eliminated need not apply
Partially true. Someone who really knows the old code inside and out would need to write a significantly better or different replacement, in order to make I clear that it's not essentially the same implementation. Someone very familiar with it may know of fundamental problems with the old approach and have ideas about a new, better approach. That would be fine. If an existing developer doesn't have ideas for a new approach, it's best that the new code be written by someone unfamiliar with the implementation details of the old code.
So I guess we're going to see yet another different network package management system in Linux soon? A clean replacement is not a derived work. A replacement that is based on the thing it replaces is a derived work. There are many different ways to do one thing with code, but if you have worked with a piece of code and then write a replacement, you're very likely going to create a derived work. In order to reliably replace the code without any copyright entanglement, you must not know the inner workings of the old code, just the API.
I for one don't accept streaming music and netflix. Those things have privacy violating surveillance built into the system. They got away with it because Snowden didn't happen until 2013. Things are still in a very bad place. Maybe it will take more elections with bigger weaponized psychology (targeted advertising) campaigns against the masses who have been foolish enough not to value their media intake details. When our grandparents read books, the government wasn't reading over their shoulders every second, recording every detail of pause, page turn, rewind. Today the government quite literally effectively is (call it fourth party collection or whatever you like, the situation is present). It may be that in the evolution of things, the abuses of this are less consequential than my alarmist instinct fears. Maybe.
Damn newbies, they ruined this place years ago!
Apparently, a few years ago, some Linux developer named McHardy started enforcing the GPL in Germany on his own. See e.g. the background article at https://sfconservancy.org/blog...
It looks like he tends to sue GPL-violators for about 2000€ + his costs (attorny fees for trying to settle out of court, costs for reverse engineering):
Example where he successfully sued the Germany subsidy of a Taiwanese hardware manufacturer for a total of about 2900€: LG Frankfurt, 2-6 O 224/06 http://www.jbb.de/fileadmin/do...
However, there was also a case where he demanded and got more: A GPL-violator that he had contacted in 2010, and got to comply with the GPL out of court back then became a repeat offender in 2012. He sued them for for 5000€ + attorny fees of 2000€: LG Hamburg, 308 O 10/13 http://www.damm-it-recht.de/lg...
On the other hand, most Linux developers apparently think that free software developers and organizations tasked with GPL enforcement should not profit from suing GPL violators. The Software Freedom Conservancy is losing money from enforcing the GPL, and asks for donations to be able to continue their work.
Philipp
So I guess we're going to see yet another different network package management system in Linux soon?
Unless I'm grossly misunderstanding what you mean by "network package management system":
A package management system is an independent process in user space. The only Linux interfaces on which APT or DNF relies are the syscall interfaces, which were already subject to an additional permission.