Slashdot Mirror
Symantec May Violate Linux GPL in Norton Core Router (zdnet.com)
An anonymous reader writes: For years, embedded device manufacturers have been illegally using Linux. Typically, they use Linux without publishing their device's source code, which Linux's GNU General Public License version 2 (GPLv2) requires them to do. Well, guess what? Another vendor, this time Symantec, appears to be the guilty party. This was revealed when Google engineer and Linux security expert Matthew Garrett was diving into his new Norton Core Router. This is a high-end Wi-Fi router. Symantec claims it's regularly updated with the latest security mechanisms. Garrett popped his box open to take a deeper look into Symantec's magic security sauce.
What he found appears to be a Linux distribution based on the QCA Software Development Kit (QSDK) project. This is a GPLv2-licensed, open-source platform built around the Linux-based OpenWrt Wi-Fi router operating system. For Symantec's purposes, QSDK and OpenWrt are an excellent choice. Instead of a read-only firmware, OpenWrt has a fully writable filesystem with package management. This enables Symantec to easily customize its router with updated security features. But -- and it's a big but -- if it's indeed based on QSDK and OpenWrt, Symantec needs to share the Norton Core Router's code with the world.
What he found appears to be a Linux distribution based on the QCA Software Development Kit (QSDK) project. This is a GPLv2-licensed, open-source platform built around the Linux-based OpenWrt Wi-Fi router operating system. For Symantec's purposes, QSDK and OpenWrt are an excellent choice. Instead of a read-only firmware, OpenWrt has a fully writable filesystem with package management. This enables Symantec to easily customize its router with updated security features. But -- and it's a big but -- if it's indeed based on QSDK and OpenWrt, Symantec needs to share the Norton Core Router's code with the world.
The GPL doesn't require public release, only honouring requests from people who have been legitimately given the binary, i.e. customers. They may choose to do this by releasing it anyone who wants to down-load it but that's their choice.
Ahem. They have been illegally copying Linux. You're allowed to use Linux without any terms. Copying is the activity that Congress passed laws to restrict.
It's a minor detail, as long as everyone reading your words understands what you really meant. But imagine the various conclusions that a Trump-level intellect might make, and the misinformation they would spread. That's why you should really say what you mean, rather than having faith in readers.
If they would have used FreeBSD or NetBSD, it has no such requirements to share modified versions.Plus it has great networking and packet filtering.
But most companies would rather try to save some money and effort doing things the wrong way. Violating software licenses along the way, hoping they won't get caught. In the long run that strategy is most costly.
“Common sense is not so common.” — Voltaire
Wrong, even if they just use an off the shelf openWRT firmware image, they have to provide a way for you to have the source code. Additionally the declaration that it is licensed under the GPL.
Geesh, even my TV's manufacturer makes the source code available... http://oss.sony.net/Products/L...
Copying is the activity that Congress passed laws to restrict.
copying is what you do when you install the firmware onto the devices you're manufacturing.
Instead of a read-only firmware, OpenWrt has a fully writable filesystem with package management.
For devices like this, firmware should have a hardware-enforced read-only setting that is on by default. Signed binaries are only as "secure" as the master signing keys, and if I can't install my own firmware I don't really "own" it, now do I?
If I want to flash my firmware, I should have to toggle a switch.
Granted, if the router is going to be in an out-of-the-way place, then I might need to leave that switch enabled all the time, leaving me vulnerable to fake updates. But for everyone else, hardware should prevent a bad actor from installing a new binary, signed (with a stolen key) or not.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If Symantec are distributing Linux, then they need to make the source code for Linux available to their customers. If their system is based on OpenWRT, then they need to make the source code for OpenWRT available. Saying "Symantec needs to share the Norton Core Router's code with the world" is essentially saying that every piece of software written for Linux has to be open source - and it just ain't so. The GPL may be viral, but it's not that viral.
Slashdot - News for Nerds, Stuff that Matters, in ISO-8859-1 Has just realised that beta makes this signature redundant
Not counterproductive at all, there is a purpose that is for the customer's benefit to the GPL. How do you know the drivers they chose to use aren't GPL?
How do you know the drivers they chose to use aren't GPL?
WAG based on how other products of this type usually work.
Tell you what, start pirating Symantec's software, and see if they come after you for copyright infringement.
If you don't wish to comply with the GPL for Linux, you are entirely free to fuck off an not use Linux. If you use Linux, you have to accept the license, just like with every other piece of software.
If a company like Symantec is just going to steal other people's work and pass it off as their own, why should we refrain from stealing their work? Symantec doesn't get to take the stance that pirating their software is bad, but it's OK if they pirate someone else's. And I assure you, they would not accept you pirating their software.
As has been pointed out, the *BSD licenses basically say "hey, you want to take this and do something with it and turn it into closed source, be our guests". Linux, however, has said that you don't get to do that.
This isn't dogmatic, this is copyright law and software licenses. And the assholes who run corporations don't get to decide to take Linux and not abide by the terms and conditions.
It really is as simple as the fact that if you're not willing to follow the license agreement, don't use the software.
There is no software company on the planet who can make the argument they didn't know this, because this has been well known for 20+ years. It's hardly a secret.
Which means Symantec are assholes who feel they can do just ignore that, and profit off other people's work by stealing it. Allowing corporations to get away with that isn't dogmatic. It's holding them to the exact same fucking standards the use to protect their own work, which means they have no valid excuse for ripping off stuff from other people.
Corporate greed doesn't give them the right to software piracy. They don't have some inherent right to use that software any more than you have a right to theirs.
Their own website says:
and
Sorry, but there is no way in hell you can accept a company like Symantec ignoring the terms of the GPL and pretending it's not a big fucking deal. Because they can't possibly not know they're breaking the law.
Fuck that, stop making excuses for them. This isn't 'counterproductive', this is the entire point of the fucking GPL.
My understanding is that Open BSD is the most secure of the OS's and uses the BSD license which is 'looser' as in, it lets you get away with more.
My speculation is laziness, so many hands have developed so much software around Linux, OpenWRT being a good example, that the programmers hired by these companies can just drop the stuff in.
But maybe there's more to it than that, which is why I'm posting the question.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
This is why I'm against the soft-shoe approach to GPL violations in every case. Symantec is a large enough company and the people working there absolutely know what their responsibilities are. We need people who'll go after them for statutory damages to make an example.
Do you have ESP?
See, if they complied with the GPL2 we'd know the answer to that. Very useful thing for the customer.
For what many of these vendors want to do, the BSD license is more useful.
A simple statement that the source is freely available elsewhere is sufficient to fulfill this requirement.
Again - not true. This option is available only in the case of non-commercial distribution. If you want a copy of Linux and I fling you one of my old CDs then I don't need to make you an offer of the source as well.
If OTOH, I sell CDs of Linux as a business, I do need to make provision for you to be able to ask for the source as well.
The text of the GPLv2 is freely available and very comprehensible - why don't people read it?
Wouldn't that be true only if they actually modified any of the original source? If they've made no modifications to any of the packages, then all the source for the thing is still freely available. Just not from them.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Actually, they are obligated to provide the drivers. Some people (never me) used to think that dynamically linking device drivers protected them from the GPL. But besides the other arguments that dynamic linking is not protective, we've just had the Oracle v. Google case declare that APIs are copyrightable, overturning what we thought we knew for 20 years from CAI v. Altai. One effect of this new court precedent is that it doesn't matter how you link, it's using the API that makes your code a derivative work.
Of course some future case could change this - and in general Free Software folks have good reasons not to want APIs to be copyrightable. But you can take that decision to court and win your infringement case, and most likely the folks you charge don't want to argue this up to the Supreme court rather than release their device driver.
Bruce Perens.
Just in case anyone didn't already realize, this AC is wrong :-)
Bruce Perens.
YES, they need to distribute the source code of the GPL components to customers who ask for it.
NO, they do not need to release the source code of their proprietary software components as long as they are stand-alone programs (just like Oracle doesn't need to release the source code of their expensive database). A mix of OpenSource components and proprietary software is perfectly fine.
YES, they also should add the correct license statement additions into their EULA.
In Europe, we http://www.linuxbe.com/ can help, in the US, they can ask Bruce Perens if something would be confusing...
GPL compliance IS important, but lets not turn it into a witch hunt.
The GPLv2 license is simple that if you have used anything that is released under the license, then you need to make that available to your customers as well. This includes any modifications you may have made to the original software. The accepted line for this has been that as long as you are not linking anything with the GPL software, you do not have to make your software open as well. This gets even more interesting as the apps that have been written that are dynamically linked with standard libraries are also not subject to being released under the same license. This last part is sometimes debated by a lot of folks and GPLv3 makes this use even more complex, as it puts restrictions on how the software can be used.
So what does Symantec need to do here? Simple, own up that they are using the QSDK and as long as they have not made any changes to this, they just need to point folks to the release tarball. If all that they have done is add some new binaries in the filesystem then that is not a violation of the GPL. However, if they have made changes to the packages that openwrt builds, then they need to publish that.
This might be what you feel is the meaning of the GPL, but that isn't what the GPL states.
When a customer asks for the source code of the GPL licensed software, Symantec is legally obligated to provide it.
Also, they are (legally) required to add the GPL (and other licenses) additions to their EULA. Including where to write to, to obtain the source code.
They are not required to 'publish' anything. Merely provide the source code when asked for it (including possible changes to openwrt builds). They might find it practical to 'publish' or 'collaborate upstream', but are under no legal obligation to do so.
Wow, no need for $50k annual license for Qualcomm closed source drivers anymore. Their drivers have always been shit, but the ones in OpenWRT are just shit.
Releasing source code is a NO effort thing.
I spend such a tremendous quantity of time on this in my current job that I'm a little offended.
“Common sense is not so common.” — Voltaire
They have been illegally copying GNU-Linux? Or at they just breaking the law with the Linux kernel and not using any of the GNU utilities?
"Symantec needs to share the Norton Core Router's code with the world."
1. Not the world, but with customers, though practically speaking, might as well be the world.
2. Not all of the code, but all of the GPL and LGPL code and anything linked to the GPL code and strictly speaking, if they statically linked LGPL code, then at a minimum the object files needed to recreate the executables.