Slashdot Mirror
'Open Source Security' Loses in Court, Must Pay $259,900 To Bruce Perens (theregister.co.uk)
Bruce Perens co-founded the Open Source Initiative with Eric Raymond -- and he's also Slashdot reader #3872. Now he's just won a legal victory in court. "Open Source Security, maker of the grsecurity Linux kernel patches, has been directed to pay Bruce Perens and his legal team almost $260,000 following a failed defamation claim," reports The Register. Slashdot reader Right to Opine writes:
The order requires Spengler and his company to pay $259,900.50, with the bill due immediately rather than allowing a wait for the appeal of the case. The Electronic Frontier Foundation's attorneys will represent Perens during OSS/Spengler's appeal of the case.
Perens was sued for comments on his blog and here on Slashdot that suggested that OSS's Grsecurity product could be in violation of the GPL license on the Linux kernel. The court had previously ruled that Perens' statements were not defamatory, because they were statements by a non-attorney regarding an undecided issue in law. It is possible that Spengler is personally liable for any damages his small company can't pay, since he joined the case as an individual in order to preserve a claim of false light (which could not be brought by his company), removing his own corporate protection.
Perens was sued for comments on his blog and here on Slashdot that suggested that OSS's Grsecurity product could be in violation of the GPL license on the Linux kernel. The court had previously ruled that Perens' statements were not defamatory, because they were statements by a non-attorney regarding an undecided issue in law. It is possible that Spengler is personally liable for any damages his small company can't pay, since he joined the case as an individual in order to preserve a claim of false light (which could not be brought by his company), removing his own corporate protection.
I am very lucky to have my attorneys from the Electronic Frontier Foundation, and my attorneys from O'Melveny and Meyers who won the lower court case and will continue to help EFF during the appeal.
My attorneys have requested that I not comment about the case at this time. Obviously, I'd love to discuss it with you sometime, when it's all over.
Valerie, Stanley and I are doing well and send you our best wishes.
Thanks
Bruce
Bruce Perens.
According to TFA, the $260k was awarded due to California's anti-SLAPP law. However, this is half of what Perens asked for to cover legal fees. I'm really wondering why he chose to spend over $500k on lawyers, for a defamation and business interference case. Surely the default judgement wouldn't even be that much money? Posting a comment to slashdot leads to half a million dollars in legal fees for the poster? Doesn't anyone else see this as insane? Imagine how many slashdotters would be bankrupted daily by various posts about Theranos, Microsoft, Systemd, Yahoo, Google, or various government officials, if robo-lawyers automatically filed charges for every arguably-defamatory post about them, leading to $500k legal fees each.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
"Bruce Perens defamed the plaintiffs" and "the plaintiffs violated copyright law" is not a true dichotomy. Zero, one, or both statements could be true in the abstract. This court case only resolved the first question.
My, I should have gotten an account like a year before I did... I remember when Rob told me about /. on #Linux96 and so I was like, ok sure I'll check it out... then it became Slashdot... and finally I was like, damn, perhaps I should have an account. I could have had a cool reader #. :( Maybe even in the double digits lol.
Ok, yeah this comment adds exactly zero to the conversation. Sorry.
I do want to say I remember when Bruce and Eric were coming out of the office after they were having meetings about this stuff when I worked at VA... I'd be like "Larry, wtf were they doing in there?" and he'd be like "Shut up Trae and get back to work." Actually, no, he would just tell me what they were doing; Larry is a super nice guy. I'm old, I'm rambling and I just wanted to post.
Jeff, Rob, etc... if you read this, I finally turned 50. Yeah... I'm getting old AF. Miss all you guys, hope you are well.
geeky stuff I'm proud to have been a part of: linux.com / themes.org / sourceforge.net / sicnus.com
3872? Punk kid needs to get off my lawn. :)
He's standing up not just for himself but everybody.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
No. A court just ruled that Perens did not defamate GR Security by claiming that their patchset may violate the GPL. Full stop. This was not a copyright case.
If I understand correctly, Bruce has been claiming that GR security isn't following the licenses - in other words is breaking the law
No. GR Security wasn't following the GPLv2 license stipulations and could be in violation of the license. The GPL isn't codified into law. And the phrasing that Perens used was "could be".
Loss of this court case could then be effectively seen as a court judgement that GR Security's patches are illegal. Has anyone read the court judgement in enough detail and with enough understanding to confirm that?
No, GR Security patches are not illegal because the GPLv2 isn't law. The patches may be in non-compliance with GPLv2 though.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Don't be stupid; he has more than enough support.
I think grsecurity is a great set of patches to the linux kernel, most of which were originally provided by others and integrated into his combo-patch set. I think it was better when he offered it for free and only charged commercial users. It would be like linus all of sudden start making linux a pay-only piece of software. Most people would be turned off or have a bad taste in their mouths. He should realize that these patches, things like untrusted path execution, /proc restrictions and so on, although they are great concepts, they were initially provided by other people as separate sets of patches to the linux kernel offered for free.
NO, not even close. The judgement is purely around the defamation case and specifically that his comments were not defamation.
If the patches are not in compliance with the GPL, then they're being distributed in violation of copyright law. Which is illegal, last I checked.
The GPL doesn't have to be "codified into law", because nothing else gives you permission to distribute the code in question. The only purpose of the GPL, really, is to provide people with a defense against infringement charges by the copyright holders. And technically, it contains no restrictions at all--it simply has limits on the otherwise-illegal things allows you to do. Anything copyright law allows, the GPL allows. So the only way to "violate the GPL" is to do something against the law.
That said, we still have no idea whether GR Security is violating the GPL (and thus copyright law). All we really know is that Bruce is entitled to his opinion.
Just to get this out of the way, while I disagree strongly with Bruce about the merits of his claim, I do not in any way support the defamation claim against him for saying it. A differing view is not the same as a defamatory statement.
That said, the idea that a set of modifications to a copyright product, distributed separately, constitutes a derivative work is terrible policy and is philosophically counter to the 'freedom to tinker' that the tech community holds dear. I don't know if it is is the law right now (and absent. a very expensive test case, we aren't likely to find out), but just as a matter of policy I think it would be a Very Bad Ideaâ.
Consider, for instance, a student or researcher that patches the software in a commercial digital microscope to improve image quality or performance in a fashion. Let's further suppose they release the patch under some F/OSS license both to benefit other users of the product but also as part of disclosing their methods for the purpose of scientific integrity and reproducibility. It's undisputed that the company selling the microscope retains copyright. in the original software, but under Perens' claim they also have rights to the patch as a derivative work.
To me, this cannot be right. A modification to a work, distributed separately, is not derivative. It is not a copy with some changes, it is just the changes. To say that one violates copyright without distributing a single bit of the underlying work inflates the power of rights holders at the expense of everyone else, in a regime that's already quite solicitous of the rights holders.
[ Of course, GRSecurity are not the greatest poster boys for this claim. But bad examples should not make bad policy. The claim here is a one that has broad implications beyond the individual lawsuit-happy jerks involved this time. ]
If the patches are not in compliance with the GPL, then they're being distributed in violation of copyright law. Which is illegal, last I checked.
The problem is that using the term "illegal" which has very specific legal and judicial meaning. In terms of GPL and copyright, it's a violation of the license and a breach of contract. When we talk about copyright legal terms like "theft" and "illegal" keep being thrown around when they are not precisely used. As an example, if I have an agreement with a consignment store to sell some items for 35% but after selling my items they only give me 25%. Did the consignment store "steal" my property? No, there may be a dispute about terms of the contract and payment, but the store didn't "steal" property. The store didn't "illegally" sell my goods. That's the difference.
The GPL doesn't have to be "codified into law", because nothing else gives you permission to distribute the code in question.
I'm not sure what your point is here. Copyright law says only the copyright holder can distribute work with exceptions like fair use. Copyright law leaves open the idea that the copyright holder can impose restrictions on distribution; it does not clarify what kind of restrictions. Restrictions have been clarified by the courts as valid or invalid. For example, if a music company gives away demo CDs, it cannot declare that those demo CDs cannot be sold later. If a music company licenses music to be used in a movie that does not automatically grant the same music can be used in a video game unless a licensing agreement stipulates it, etc.
The only purpose of the GPL, really, is to provide people with a defense against infringement charges by the copyright holders. And technically, it contains no restrictions at all--it simply has limits on the otherwise-illegal things allows you to do.
I don't think that was the point of the GPL. It was to ensure that code in particular remain open source with stipulations. Other open source licenses like BSD imposes fewer restrictions.
Anything copyright law allows, the GPL allows. So the only way to "violate the GPL" is to do something against the law.
I don't understand your logic here. You said that the GPL isn't law yet you say violating it is against the law. That's not how the law works. When you violate the GPL, you violate a contract because the GPL is additional conditions imposed that are not in the law. If you violate copyright laws that's illegal. Violating GPL is not per se illegal.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Spengler: You have no chance to survive. Make your time!
Judge: Yawn. lolwhat? omgwtfbbq. Next case!
Love grsec, but Spengler is such a prick.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
Was pretty confident that the suit would fail, too bad it takes $500k to make the court see common sense.
If you violate the GPL you have no right to distribute. Distributing anyway is against copyright law. Thus, if you distribute while not adhering to GPL what you are doing is against the law.
No, if you violate the GPL, you violate the GPL. You do not necessarily violate copyright. You are equating the two as the same and they are not. GPL is an extension of copyright. A truck is an automobile; not all automobiles are trucks.
GPL does not stipulate restrictions.
Yes it does. Either you don't understand the GPL or you are lying. Specifically, you may modify the source code but you must publish your modifications if you re-distribute.
Yes it does. Specifically you must publish and maintain copyright notices.
Both stipulate under what conditions you are allowed to distribute, something you otherwise would not be allowed to do at all.
Dude, you have to be more precise in your words. You just said above that neither stipulate restrictions then you say that they do stipulate restrictions. Second, distribution rights are always with permission of the copyright holder and the whole point of this conversation is about granting permission.
Neither stipulates restrictions on something you would have been allowed to do. Both stipulate a *removal* on restrictions to distribute.
Again, be clear on your use of words.
If someone acts beyond the freedoms granted by GPL or BSD, their acts then - by definition - violate copyright law, because the acts occur without the freedoms the licences would otherwise have provided.
Again, no. A truck is an automobile. An automobile is not necessarily a truck. A violation of the GPL does not necessarily violate copyright. A violation of copyright will definitely violate the GPL.
Well, there's spam egg sausage and spam, that's not got much spam in it.
His point is that it is "illegal" and that if violates copyright if you violate the GPL. No you breach a contract if you violate the GPL.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Sigh. Let me explain this in a programmer's way: GPL extends copyright. GPL != copyright. That's what people don't understand. If you violate the GPL, it's not necessarily a violation of copyright law. The GPL is in essence a license which IS a contract.
Well, there's spam egg sausage and spam, that's not got much spam in it.
All it does is conditionally grant some rights that by default go to the author. If you violate the terms, you have no permissions to the work under copyright law.
The only way to violate the license is to distribute against the terms, which is illegal because your conditional permissions have been revoked. If you don't distribute, then there is nothing to legally bind you. That is why violating the GPL is necessarily and sufficienty a copyright violation.
No, it is not, although it has been contested. Why? No consideration. You do not commit to actually do ANYTHING by accepting the GPL--but informally you commit to abiding by the terms. Even the "requirement" that you provide source when distributing binaries is not something you agree to do, because distributing binaries with source is permitted and binaries without source is not. You are not obligated to anything, you can simply choose (or not) to do what the license permits.
https://lwn.net/Articles/61292/
"Slow down, Cowboy! It has been 3 years, 7 months and 26 days since you last successfully posted a comment."
No, if you violate the GPL, you violate the GPL. You do not necessarily violate copyright.
The GPL says that you do not have to accept its terms, and can simply abide by normal copyright rules instead. So, unless you're doing something that would otherwise violate copyright, it doesn't even apply. And you can't violate the GPL when it doesn't even apply!
So that only leaves cases where 1. you're violating what copyright law would allow, but following the GPL (which is fine) or 2. violating what copyright law would allow and violating the GPL. Thus, if you're violating the GPL, you're violating copyright law.
It's really that simple.
Specifically, you may modify the source code but you must publish your modifications if you re-distribute.
That's not a restriction. Copyright law doesn't allow you to redistribute in the first place, so that's a merely a limited grant of permission. You can redistribute (which copyright law doesn't allow) if and only if you do X. That doesn't make X a restriction. It makes X a contingent condition on the permission you wouldn't otherwise have. The sum total is still more permissions than you would have had otherwise. Even if you don't like the specific conditions.
After all, if you don't like the GPL's conditions, you can ignore them and follow copyright law instead. So how can that possibly be a restriction of any sort? The only immutable restrictions are those which are not allowed by copyright law or by the GPL. And the only reason you have to obey those restrictions is because they're part of copyright law. The GPL doesn't restrict you at all. Copyright law does all the restricting. The GPL simply outlines the very specific terms under which you can ignore the normal restrictions of copyright law.
All it does is conditionally grant some rights that by default go to the author. If you violate the terms, you have no permissions to the work under copyright law.
No part of US Copyright Law determines HOW an owner can grant distribution rights. It only says that owners have permission. No part of it determines what constitutes a violation of permission. Please cite anywhere in 17 USC 117 where it says this.
The only way to violate the license is to distribute against the terms, which is illegal because your conditional permissions have been revoked. If you don't distribute, then there is nothing to legally bind you. That is why violating the GPL is necessarily and sufficienty a copyright violation.
Again a truck is an automobile. An automobile is not always a truck.
No, it is not, although it has been contested.
Are you arguing that the GPL isn't a contract? Because Bruce Perens (the same person in this article) says otherwise: "What’s made news recently is that the court found that the GPL was an enforceable contract, and is allowing the case to proceed as a complaint of breach of contract, not just copyright infringement (as most similar cases have). . . But the FSF had its own reasons to say it’s a license, reasons that might be more important to the philosophy of Free Software than the court , . .Does the FSF lose anything because the court said the GPL is a contract? I don’t see how. The court didn’t say it’s not a license."
Well, there's spam egg sausage and spam, that's not got much spam in it.
So that only leaves cases where 1. you're violating what copyright law would allow, but following the GPL (which is fine) or 2. violating what copyright law would allow and violating the GPL. Thus, if you're violating the GPL, you're violating copyright law.
Again, a truck is an automobile. An automobile is not always a truck. If you violate the GPL you may not be violating copyright. You are violating an enforceable contract. See ARTIFEX SOFTWARE, INC v. HANCOM, INC.
Well, there's spam egg sausage and spam, that's not got much spam in it.
It doesn't matter that it's a contract. You still can't violate the GPL without violating copyright, because you can't agree to the GPL except by engaging in behavior (distribution) which would be a copyright violation if not for the GPL. If you haven't distributed the code, you're not bound by the contract. If you have, and you violate the GPL, then you've also violated copyright, because you distributed the code without a valid contract/license. There are no other possibilities with the GPL (even if there certainly are with contracts in general).
Not all automobiles are trucks, but all automobiles which are trucks are trucks, and all violations of the GPL are copyright infringements, because the GPL doesn't apply to any not-potentially-infringing activities.
And I'm not sure what you think Artifex proves, since Artifex sued for copyright violation as well as contract violation. Which is sensible, because it's impossible to violate the GPL without violating copyright law.
We've been arguing generalities, but please give a SPECIFIC example of something you can do that violates GPL but does not violate copyright.
The person making the claim must provide the evidence. What you're saying is that I must provide a negative example which can be impossible. I did however link to an actual court case that cites that the GPL is an enforceable contract.
Well, there's spam egg sausage and spam, that's not got much spam in it.
It doesn't need to specify how you grant permission. It's up to the defendant in an infringement case to demonstrate that they had permission to copy/distribute. In a case of GPL violation, all they have to point to is the terms of the license which, if they did not respect, means they do not have any rights to the work by default under law. How can you not get this?
Again, the GPL is a LICENSE. The GPL is not codified into law; therefore a breach of the license does not necessarily mean a breach of copyright. See MDY vs Blizzard.
Uh, I don't know how you get from that Bruce saying GPL is a contract. He's saying the courts said GPL is a contract.
Let me see if I understand you: You said the GPL isn't a contract. I pointed out that Perens said it is and you're now arguing that technically the courts said it was a contract. Doesn't that still make you just wrong that in fact, the GPL is a contract?
Anyway, the court did not issue any kind of ruling that the GPL is a contract in that case. All they did is say that, in that specific instance, the claims could proceed under contract law. Hardly a ruling for the ages.
Did you not just argue that it wasn't contested? I've pointed out that it has been contested. And you're now saying because the court said the claims could proceed "under contract law" that it's not a contract? Do I understand that you're basically in full denial mode of facts?
Well, there's spam egg sausage and spam, that's not got much spam in it.
Sigh. How much common sense does it take to realize an automobile is not a truck. In the full thread people are claiming that violation of the GPL is a violation of copyright; however, no one single person including you has provided any evidence to that fact. I said that it's not. Then you say I have to prove that. Why don't you prove your case first? But if you must have a case: See MDY v Blizzard.
Well, there's spam egg sausage and spam, that's not got much spam in it.
It doesn't matter that it's a contract.
Let me see if I understand you: You claim it doesn't matter that it's not a contract. Here's why you don't get it. If a violation of the GPL is a violation of copyright, the courts would NEVER have to rule whether or not the GPL is an enforceable contract. They would have ruled that it was a violation of copyright. Period. The fact that they didn't rule that GPL is an enforceable contract means that it is not necessarily true that a violation of the GPL is a violation of copyright.
Not all automobiles are trucks, but all automobiles which are trucks are trucks, and all violations of the GPL are copyright infringements, because the GPL doesn't apply to any not-potentially-infringing activities.
Your failing premise first asserts that GPL==copyright. The GPL is nowhere codified as copyright and you cannot show me where it has been.
And I'm not sure what you think Artifex proves, since Artifex sued for copyright violation as well as contract violation. Which is sensible, because it's impossible to violate the GPL without violating copyright law.
Again my point was that the GPL extends copyright. Artifex sued for both because they felt the defendant violated both. If a violation of the GPL was a violation of copyright, why did Artifex sue also for contract breach under the GPL and why did the court grant them that the GPL can be considered an enforceable contract? Again, if a violation of the GPL was a violation of copyright, the court would never had to rule that the GPL was an enforceable contract. The court would have dismissed the claim because Artifex's claims would have fallen entirely under copyright.
Well, there's spam egg sausage and spam, that's not got much spam in it.
A single action can be the subject of multiple charges. In this case, Artifex decided to sue for both copyright infringement and breach of contract for the same action--distributing a derived version of their software. Why? 1. it's considered good practice to throw all the charges you can in court, in case some of them don't stick. 2. It can result in a bigger judgment/more money to win on multiple charges.
And no, the courts wouldn't have dismissed the claim just because it was also a copyright violation. That's not how things work. If you steal from your employer, they're likely to charge you with both theft (or embezzlement) and breach of your employment contract. The fact that your behavior was against the law doesn't change the fact that it also violated your contract, and certainly doesn't render it irrelevant. Why would it? Why on earth would those charges be dismissed? The things you people come up with. Sheesh!
Bottom line, the GPL only covers the distribution of software, and thus, it is impossible to violate the GPL without distributing the software, and distributing without the permission granted by the GPL is a copyright violation, so any violation of the GPL is, inherently, a copyright violation.
Second by your logic a violation of the GPL is a violation of copyright. If your logic is true then ALL of Artifex's claims fall under copyright violation claims. There would be no breach of contract to dispute and the judge would have dismissed those claims. Do you see how your point doesn't make any sense?
Well, there's spam egg sausage and spam, that's not got much spam in it.
First of all, you missed the point. The judge did not have to decide merely that there was a breach of contract; he had to first decide that there was an enforceable contract. By your logic, that should never be because the GPL is copyright. This is where your logic fails. Many copyright and breach of contract suits start with a signed contract which this suit did not have.
Well, there's spam egg sausage and spam, that's not got much spam in it.
No one in this thread (neither me nor anyone else) has claimed that "the GPL is copyright"--your reasoning here is pure strawman--but that doesn't change the fact that all possible violations of the GPL are also copyright violations. In the eyes of the law, this is purely a coincidence (even though the GPL was carefully written to ensure that this would be the case). Thus, the violation of copyright and the breach of contract are separate matters to be judged separately.
The GPL explicitly allows anything copyright allows. Thus, all violations of the GPL are violations of copyright law. Not because the law says so, but because it's logically impossible for it to be otherwise.
But because they're separate issues in the eyes of the law, you can still be guilty of both. The contract issue isn't going to be dismissed just because it happens to involve copyright violation. Even though all possible contract violations happen to be copyright violations, the law is still going to judge on a case-by-case basis, since the GPL is a contract/license, not a law.
So, the bottom line is that the OP's claim ("violating the GPL is violating the law") is true, not because the GPL is part of copyright law (your bizarre strawman theory), but because only actions which would otherwise violate copyright law are capable of violating the GPL. There doesn't have to be an explicit legal link if one set of actions is a strict subset of the other. Which it is.
No one in this thread (neither me nor anyone else) has claimed that "the GPL is copyright"--your reasoning here is pure strawman--but that doesn't change the fact that all possible violations of the GPL are also copyright violations. In the eyes of the law, this is purely a coincidence (even though the GPL was carefully written to ensure that this would be the case).
NOWHERE in this thread have you used the term "possible". Instead you said this: "If the patches are not in compliance with the GPL, then they're being distributed in violation of copyright law. Which is illegal, last I checked."
And this: "So that only leaves cases where 1. you're violating what copyright law would allow, but following the GPL (which is fine) or 2. violating what copyright law would allow and violating the GPL. Thus, if you're violating the GPL, you're violating copyright law."
And this: " If you have, and you violate the GPL, then you've also violated copyright, because you distributed the code without a valid contract/license. There are no other possibilities with the GPL (even if there certainly are with contracts in general)."
Are you now going to deny you said those things?
The GPL explicitly allows anything copyright allows. Thus, all violations of the GPL are violations of copyright law. Not because the law says so, but because it's logically impossible for it to be otherwise.
I'm tired of having to explain it to you. Why don't you show me one court case or law that backs up this claim. Just one. I suspect you can't.
So, the bottom line is that the OP's claim ("violating the GPL is violating the law") is true, not because the GPL is part of copyright law (your bizarre strawman theory), but because only actions which would otherwise violate copyright law are capable of violating the GPL. There doesn't have to be an explicit legal link if one set of actions is a strict subset of the other. Which it is.
Again show me one case that backs up your claim. Otherwise, you're just dead wrong and in full denial.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Oh, for Pete's sake, quit flailing at your strawman. Nobody claimed GPL = copyright, just that you can't violate GPL without infringing copyright.
He clearly did so: "So that only leaves cases where 1. you're violating what copyright law would allow, but following the GPL (which is fine) or 2. violating what copyright law would allow and violating the GPL. Thus, if you're violating the GPL, you're violating copyright law." Scroll up. Want to retract your statement?
Well, there's spam egg sausage and spam, that's not got much spam in it.