×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Do Build Environments Give Companies an End Run Around the GPL?

timothy posted more than 3 years ago | from the technical-compliance dept.

Open Source 374

Malvineous writes "I have two devices, from two different companies (who shall remain nameless, but both are very large and well-known) which run Linux-based firmware. The companies release all their source code to comply with the GPL, but neither includes a build environment or firmware utilities with the code. This means that if you want to alter the free software on the device, you can't — there is no way to build a firmware image or install it on the devices in question, effectively rendering the source code useless. I have approached the companies directly and while one of them acknowledges that it is not fully GPL-compliant, due to other license restrictions it cannot make the build environment public, and the company does not have the resources to rewrite it. I have approached the FSF but its limited resources are tied up pursuing more blatant violations (where no code at all is being released.) Meanwhile I am stuck with two devices that only work with Internet Explorer, and although I have the skills to rewrite each web interface, I have no way of getting my code running on the devices themselves. Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

374 comments

IE only (0, Interesting)

Anonymous Coward | more than 3 years ago | (#32317222)

That's not acceptable in this day and age. It sounds like the device is old, so time for an upgrade and pick an open one next time.
If the device is new ... you bought a lemon, so also time for an upgrade.

Re:IE only (2, Funny)

Anonymous Coward | more than 3 years ago | (#32317576)

Some companies are still in the IT stone age. For example, one company - with which I just got an account - sells flatrates to video games for a monthly fee. So far so good but they actually use an IE-only plug-in that relies on ActiveX and only runs as administrator. And that's the "updated new version" of their client :D

Admittedly it's supposed to run on FF eventually ... some time in the future ... promise ;)

It would be nice to name names (5, Insightful)

postbigbang (761081) | more than 3 years ago | (#32317226)

so we can vilify them, castigate them, and otherwise snark.

Re:It would be nice to name names (4, Funny)

QuantumG (50515) | more than 3 years ago | (#32317290)

As if we don't know it's Cisco.

Re:It would be nice to name names (3, Informative)

Anonymous Coward | more than 3 years ago | (#32317396)

Do we? I've never seen a cisco or linksys device you could't load custom firmware onto.

My Linksys experience (5, Informative)

Mathinker (909784) | more than 3 years ago | (#32317588)

After getting the "our developers are working on it" runaround for months and months when Linksys didn't issue new drivers without the Broadcom vulnerability for my WPC54G v.4 adapter [linksysbycisco.com] , rendering it totally useless, I decided to never, never, again buy Linksys equipment.

So you might be right that the firmware of the Linksys device I bought was upgradable, but that's useless if you have no way to make custom firmware and the vendor doesn't issue bug fixes for its original firmware.

Re:My Linksys experience (1, Informative)

Anonymous Coward | more than 3 years ago | (#32317830)

I don't see any indication that there's any GPL code in those drivers, that's an adapter not a router. Most Cisco/Linksys routers are Linux based and are generally fully GPL compliant. Their wireless adapters on the other hand generally have 100% proprietary drivers.

Re:My Linksys experience (4, Informative)

natehoy (1608657) | more than 3 years ago | (#32318048)

Many Cisco/Linksys routers are, but I wouldn't call it "most" any more. They started building them using a closed-source OS about 3-4 years ago, and actually converted the WRT54G and WRT54GS to it mid-stream. Later, they re-released the Linux version of the WRT54G under the model name "WRT54GL".

Having said all that, Linksys has been pretty good about releasing the source code of those things they use GPL-licensed code for. Unfortunately, they tend to use the Broadcomm radios for which source code is not available, though they do publish their wrappers that control the Broadcomm binary driver.

Re:It would be nice to name names (1, Informative)

Anonymous Coward | more than 3 years ago | (#32317650)

Or Tivo, or Netgear, or Pioneer, or Samsung, or....

Re:It would be nice to name names (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#32317432)

nerd rage!!

Re:It would be nice to name names (2, Interesting)

Anonymous Coward | more than 3 years ago | (#32317682)

Got stuck in exactly the same situation: Panasonic TX-P46G15E TV admits using (L)GPL code in their system menu and points to http://www.am-linux.jp/dl/EUIDTV7/ However no utility or script to install modified firmware. I asked gpl-violations.org to help but without hard proof that TV runs Linux they didn't pursue further (even though Panasonic admits using (L)GPL software in system menu and user manual as well).

Find an author (5, Informative)

QuantumG (50515) | more than 3 years ago | (#32317232)

For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.

http://www.gnu.org/licenses/gpl-2.0.html [gnu.org]

It's a straight up violation. Go find the author of the software... any author of any part of the software will do.. and invite them to sue the manufacturer. Direct them to the Software Freedom Law Center.

Re:Find an author (1)

tuxish (1022783) | more than 3 years ago | (#32317300)

The scripts used means the scripts used. Not the compiler used. There isn't a violation there really. Just an annoyance.

Re:Find an author (1)

rcamans (252182) | more than 3 years ago | (#32317656)

the scripts used means the makefile they used. That is something you can read to tell what compiler they used, and even what version. But there may still be environmental variables not visible.

The loophole is bigger... (2, Informative)

leuk_he (194174) | more than 3 years ago | (#32317414)

However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

(from same link)

If the compiler is a special case then you have a problem there. If the target device is some special dedicated OS, it all comes under this exception? Notice that they do not require to release the compiler (unless is was adapted for this target).

Also remember a term called Tivoization [wikipedia.org] . You are starting the same discussion all over again.

But they are missing the largeste advantage of the GPL. They can have free mod version and bug fixes if they release their complete environment.

Re:The loophole is bigger... (3, Insightful)

QuantumG (50515) | more than 3 years ago | (#32317434)

Yes, because compilers are usually distributed with embedded operating systems. (not)

The part in question is the installation scripts.

Re:The loophole is bigger... (1)

yuhong (1378501) | more than 3 years ago | (#32317990)

Also remember a term called Tivoization [wikipedia.org]. You are starting the same discussion all over again.

Yes, GPLv3 addresses that one.

Re:Find an author (4, Insightful)

Xtifr (1323) | more than 3 years ago | (#32317448)

Direct them to the Software Freedom Law Center.

Indeed, it's worth another reminder that the FSF is not in the job of policing GPL abuse. They publish the license for others to use, but they're only going to (only can) try to enforce it for code they actually own. Asking the FSF to intervene in a random GPL case is sort of like asking the printers to intervene in a dispute between you and your car lease company, simply because they printed the lease forms.

Furthermore, while the GPL is intended to grant freedoms to you and other third parties, it is, by the fact that it leverages existing laws, difficult for a third party to enforce. It's easy to imagine the following dialog:

You: They won't give me all the code as required by the license.
Them: The license itself says its not mandatory and we don't have to accept it.
You: It also says that if you don't accept it, then normal copyright law applies, and they don't have permission to use the code.
Them: That's as may be, but you have no standing to sue us over the copyrights.
Judge: Agreed, case dismissed.

Of course, this means that they will have more-or-less admitted to copyright violation in open court, which is a pretty risky strategy, but suddenly, you're out a bunch of money and facing a dead end. Better, as QuantumG suggested, to get ahold of the copyright holders up front.

Re:Find an author (1)

BobPaul (710574) | more than 3 years ago | (#32317994)

Doesn't the FSF own the code for the GNU userspace utilities? If someone is selling a device with the Linux Kernel, most certainly it contains utilities the FSF has ownership over.

Re:Find an author (0, Troll)

BitZtream (692029) | more than 3 years ago | (#32317558)

And there is no way they (for any sane definition of 'they') really want to enforce this.

It would effectively cut off all GPLv2 and 3 distributions of Windows and Mac OS X binaries since regardless of how you look at it, there are portions of the build process which will never be open source.

So you have to draw the line some where, which neither GPLv3 or v2 define, so its effectively a worthless and unenforceable constraint.

At some point you've got to realize that GPL can not infect everything it touches.

And specifically since you didn't bother to read the summary:

I have approached the FSF but their limited resources are tied up pursuing more blatant violations (where no code at all is being released.)

I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.

They'll either lose any possibility of protection, further opening up the silliness that GPL tries to force on people OR ... they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.

You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.

Re:Find an author (1)

BitZtream (692029) | more than 3 years ago | (#32317600)

Might as well take this all the way to the limits.

Since hardware the code is running on is part of the build process, you'd also need to have not only entirely OSS software (ALL OF IT, firmware, bios, everything) but you'd also need entirely open source hardware.

I'll bet a months pay no one can make a valid claim of truly GPL compliant binary distributions if you follow that rule to the letter.

When you truely follow the full (and not some arbitrary version you create) dependancy tree, it would appear to me that all the major Linux distros are in violation of the GPL since I can't get source code to the transistors or the bios in their build farms.

Yes, I'm being entirely off the wall / bat shit insane / fubar / stupid. But where exactly do you draw the line on these sorts of things? You just stop when you get your way I guess?

As I said originally, push this issue legally, and you lose, regardless of the legal outcome.

Re:Find an author (1)

QuantumG (50515) | more than 3 years ago | (#32317606)

That's the author of the software's decision. Great thing about copyright law, the copyright holders get to pick and choose who they sue.

Re:Find an author (3, Interesting)

Anonymous Coward | more than 3 years ago | (#32317648)

It would effectively cut off all GPLv2 and 3 distributions of Windows and Mac OS X binaries since regardless of how you look at it, there are portions of the build process which will never be open source.

Even under the most stringent reading requiring the compiler to be freely available, companies could still build binaries for these.

GCC is not self-hosting on Windows last I checked but GCC can be cross-compiled to windows and that can be used as the developers' build compiler. So the full recursive chain ships a working Linux live CD with GCC, source for that, source for GCC, the command to cross-compile GCC resulting in a windows build of GCC, the product source code, and the scripts required to build and package.

Re:Find an author (4, Insightful)

RivieraKid (994682) | more than 3 years ago | (#32317832)

Since the OP has given us no details as to the specifics of the two cases, it's impossible to offer any kind of rational comment.

Though, for your information, the GPL does not "infect" anything. It is a copyright license like any other except that it puts most of the control in the hands of the beholder. To the extent that it "infects" anything, that's all the choice of the developer. Don't want to follow the terms of the GPL? Simple, don't use code that is covered by the GPL in your product. It's exactly the same as any other copyright license. If you don't agree to the terms, don't use it. It's not rocket science, and it's not some kind of virus that needs to be stamped out.

By the way, due to the lack of information from the OP, it's not even clear if the FSF has any standing here - mentioning that they are not willing/able/prepared to fight the good fight is worthless when they may not even own the copyright allegedly being infringed.

I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.

I'm more inclined to believe this is something the FSF simply don't have the right to push for the reason mentioned above.

they'll just make it obvious that GPL has no place anywhere near commercial software, which again, would be a huge blow for GPL software in general.

Are you confusing commercial with proprietary?

You REALLY REALLY don't want to push this one. Just ignore that clause like everyone else and everyone will be better off for it.

You see, there's the problem right there: Exactly what clause are these alleged companies accused of violating? They've provided the source code, Hell, the OP doesn't even mention what version of the GPL they think the companies are violating. I mean, really - how are we supposed to discuss the issue in such a scenario?

Re:Find an author (0)

Anonymous Coward | more than 3 years ago | (#32318050)

"there are portions of the build process which will never be open source" - this is false, at least on Windows. It is perfectly possible to build an executable, libraries, even device drivers using a completely open source build environment. You can even build them on a GNU system instead of Windows if you wish. Furthermore, using things like ReactOS, Wine, and cross-platform toolkits, you can take the executable and run it in a fully open-source execution environment. In other words, there is nothing the GPL could do to prevent Windows based GPL development, even the FSF wanted to, which it apparently doesn't, since the GPL contains a special exception clause anyway.

Re:Find an author (1)

phantomfive (622387) | more than 3 years ago | (#32318078)

I'm more inclined to believe this is something the FSF doesn't want to push as they'll most certainly loose ground on this one, regardless of the outcome of any legal battle.

This situation is one of the major reasons the FSF made a version 3 of the GPL. Releasing source code but using technical means to keep it from installing on a device is known as Tivoization [wikipedia.org] .

Now, it is not clear from the summary if the company is actively preventing source code from being installed on the device, or if it can still be installed but you have to find your own bootloader, etc. As long as it's standard stuff, the company shouldn't have trouble. You aren't required to release the source of GCC in order to comply with the GPL.

Internet Explorer? (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#32317234)

Windows Mobile is not based off Linux...

GPLv3 (5, Informative)

selven (1556643) | more than 3 years ago | (#32317252)

The loophole being proposed is just a variant of Tivoization. And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

Re:GPLv3 (1, Redundant)

phantomcircuit (938963) | more than 3 years ago | (#32317274)

Mod parent up. He is 100% correct.

Re:GPLv3 (2, Informative)

Anonymous Coward | more than 3 years ago | (#32317460)

You don't need the GPLv3 to fix this, though. It's addressed pretty directly in the GPLv2.

Mod parent down. He's only 50% correct.

Re:GPLv3 (5, Funny)

Anonymous Coward | more than 3 years ago | (#32317528)

I find this concept of moderating based on factual correctness quaint but interesting.

Re:GPLv3 (1)

selven (1556643) | more than 3 years ago | (#32317728)

I never said that you need the GPLv3 to fix it. I said that it does fix it, and everything similar you can think of. There's a slight but important difference there.

Re:GPLv3 (4, Insightful)

Anonymous Brave Guy (457657) | more than 3 years ago | (#32317792)

And the GPLv3 already fixes it, and anything else that gives out source while not giving you everything you need to build it.

Which may explain the almost complete absence of GPLv3 code in the software world.

In the embedded world, for example, your chances of getting permission to release the specs for any major chip to meet these requirements to the letter are probably zero. Several of the major players in the industry design chips but outsource the manufacture, and the whole ecosystem is so locked down under NDAs that anyone trying to get detailed specs out in public would wish it was only Microsoft's entire legal team suing them. That means GPLv3 software is basically useless in most of the embedded development world.

Much the same probably applies to systems software, so many of those working on OSS operating systems, device drivers, etc. are similarly unable to work with GPLv3 code.

The original GPL was a reasonable idea and made a lot of sense to a lot of people. GPLv3 is RMS and co's attempt to turn that popularity into a vehicle for their minority views on software development, and I guess we can see now how little of the community's support of the GPL was really down to believing in the FSF's political stance, and how much was just pragmatism.

Re:GPLv3 (2, Informative)

yuhong (1378501) | more than 3 years ago | (#32318022)

Luckily, I don't think that the GPLv3 actually require what you are talking about, nor do I think it was the intent of the GPLv3 to do this.

It's still a GPL violation (5, Informative)

mysidia (191772) | more than 3 years ago | (#32317262)

GNU GENERAL PUBLIC LICENSE Version 3 Free Software Foundation, Section 1, "Source Code.": The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work.

The GPL does not allow authors to hide or refrain from distributing any build scripts or information required to build/install the binaries.

They cannot have a "secret" build environment, the GPL requires that they reveal all scripts and information about the build environment.

I don't understand why the FSF would not pursue this with full vigor. Obviously you cannot exercise your freedom to modify code, if the vendor does not distribute the pieces required to build and install a binary.

Re:It's still a GPL violation (1)

penguinboy (35085) | more than 3 years ago | (#32317526)

It doesn't sound like that applies. The OP mentions being unable to get the compiler and firmware loader utilities (which I expect would be "general purpose tools ... used unmodified") - not build scripts referred to in the quoted section.

Embedded SDKs... (3, Interesting)

Anonymous Coward | more than 3 years ago | (#32317674)

It's an interesting problem with the GPL license text. There is a big difference between the "components released with the operating system" depending on whether you are talking about the full embedded SDK (often licensed for $$$ to product developers) or the final run-time OS (distributed in the product that goes to end-users). To which does the license text refer? Even back when GPLv2 was being authored, many Unix systems did not include compilers in the base release but they could be obtained by anybody willing to purchase licenses; developers would ship binaries of GPL source built with these commercial compilers, and nobody saw it as a problem that end-users could not rebuild it without also purchasing the compiler.

So, a reasonable interpretation says that the article's complaint is invalid, e.g. end users can obtain an SDK just like the product vendor did, and then modify their product instance as they see fit. However, a complicating factor is that these embedded SDKs are often heavily customized for a product vendor, and are not off the shelf systems another vendor (or end-user) could obtain. Where do you draw the line between generally available platforms and for-hire, integrated product build tools that can lead to lock-down?

A strict interpretation would be that one cannot use GPL source code in embedded products using traditional embedded development tools, because those tools have incompatible licensing terms which prevent end-user modification of systems. This is similar to the patent issue addressed in GPLv3.

Re:It's still a GPL violation (2, Insightful)

Hurricane78 (562437) | more than 3 years ago | (#32318106)

One of the companies still openly admitted that they violate the GPL:

one of them acknowledges that they are not fully GPL compliant, due to other license restrictions

I’d tell the FSF to sue them to hell and back! What is GPL? A second class license that can be just ignored due to some other stuff??

Re:It's still a GPL violation (1)

Dumnezeu (1673634) | more than 3 years ago | (#32317644)

But the build scripts were not written by us. They are general-purpose build scripts, written by a third party for which we paid and we don't have the right to distribute them to anyone. Oh, my! Did I just say general-purpose? I'm sorry, but you can't have them and you're not allowed to know anything about them!

Re:It's still a GPL violation (0)

Anonymous Coward | more than 3 years ago | (#32317718)

You just gave an excellent example of why YOU should donate to the FSF. Has your check gone in yet?

Re:It's still a GPL violation (0)

Anonymous Coward | more than 3 years ago | (#32318002)

How is it free software if I am sending people money to keep making it? I kid, I kid...but the whole free as in freedom thing is still not sinking in. Most folks, especially IT bosses, want free software because it is free as in beer, and don't want to join the crusade.

Re:It's still a GPL violation (2, Interesting)

Trivial Solutions (1724416) | more than 3 years ago | (#32317790)

If you can't build LoseThos with a GPL licenced compiler... maybe that's because there is no GPL code in LoseThos. I wrote everything from scratch, including the compiler. LoseThos began as a TASM project -- pure assembly in 1993. Download this http://www.losethos.com/files/HOPPY.ZIP [losethos.com] . As you will see, it has the embryo of my compiler. I let this sink into your fat heads. Go fish if you think you found a GPL violation. Losethos is business friendly -- public domain.

Re:It's still a GPL violation (0)

Anonymous Coward | more than 3 years ago | (#32317950)

Thats v3, while the Linux kernel source and a number of other projects still use v2. This is one of the issues that v3 addressed specifically.

No, they're just non compliant (3, Informative)

Pop69 (700500) | more than 3 years ago | (#32317264)

As far as I can read it, the corresponding source definition in clause 1, GPLv3 covers that situation

The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

My reading of "all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work" would cover the build environment. They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though.

build tools? Re:No, they're just non compliant (4, Interesting)

Anonymous Coward | more than 3 years ago | (#32317424)

"They could arguing that the build tools and environment are general purpose tools, etc used unmodified. I'd have to think that if that were the case you wouldn't be having any problems trying to make modifications though."

Would that it were that simple. There's lots of things out there where you can't just download the source and do a "make clean; make".... do you have the right libraries? (glibc version hell) The right version of the tools? (there's more than one version of gcc out there) The provider of the software might not even know... they just make it on their box, it goes ok, and they package up the source and distribute it.

Re:build tools? Re:No, they're just non compliant (0)

Anonymous Coward | more than 3 years ago | (#32317692)

That's also what we do and I swear, the configuration on that build box has been changed on a weekly basis in the past TEN FRIGGING YEARS! Seriously, nobody knows that proper build configuration anyway. It's stuffed with legacy tools and scripts and config files that it's nearly impossible to untangle everything. We also have lots of sensitive information there, so we can't just make an image of the whole drive and share it with everyone. There are even some proprietary tools that we use (paid for) and some that we used and we're pretty sure none of the components need them, but we don't dare remove them, because you never know what you might break in over 100 megs of source code.

Re:No, they're just non compliant (1)

Dr_Marvin_Monroe (550052) | more than 3 years ago | (#32317908)

No, I disagree. The section "However, this does not include the work's System Libraries, or general-purpose tools..."

I read this as you must include the defines that you used to build it, but not the build script or firmware loader utilities that you used to put it on the device. To point out, the GPLv3 is the strictest, GPL1 and GPL2 are not as strict.

Not a violation here.

The GPLv3 addresses this. (0)

Anonymous Coward | more than 3 years ago | (#32317272)

http://www.gnu.org/licenses/quick-guide-gplv3.html [gnu.org]

Protecting Your Right to Tinker

Tivoization is a dangerous attempt to curtail users' freedom: the right to modify your software will become meaningless if none of your computers let you do it. GPLv3 stops tivoization by requiring the distributor to provide you with whatever information or data is necessary to install modified software on the device. This may be as simple as a set of instructions, or it may include special data such as cryptographic keys or information about how to bypass an integrity check in the hardware. It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it.

This requirement is limited in scope. Distributors are still allowed to use cryptographic keys for any purpose, and they'll only be required to disclose a key if you need it to modify GPLed software on the device they gave you. The GNU Project itself uses GnuPG to prove the integrity of all the software on its FTP site, and measures like that are beneficial to users. GPLv3 does not stop people from using cryptography; we wouldn't want it to. It only stops people from taking away the rights that the license provides you—whether through patent law, technology, or any other means.

Obvious answer, old answer. (5, Insightful)

kurokame (1764228) | more than 3 years ago | (#32317288)

Have these companies found a convenient way to use GPL code, whilst preventing their customers from doing the same?

Yes - it's called "having more lawyers than you."

What are you going to do about it, sue? You can always sue...if you actually have the resources to fight it out. And even if you actually get it to stick, it could be years down the road before you actually get access.

Regarding your specific case, can you reverse-engineer a solution?

Re:Obvious answer, old answer. (1)

eclectro (227083) | more than 3 years ago | (#32317678)

Regarding your specific case, can you reverse-engineer a solution?

Firmware chips can desoldered and be disassembled in most instances. Unless this is a cellphone, where the firmware is integrated with the CPU and fuse links burned to prevent access. Then, more advanced and involved efforts could get at it. But it would be time consuming and require a team resources.

Depending on the device and circumstances (and I agree the community should know what the devices are) it might would be worth it to chase after it in court. If only to get the build environment released as GPL. As another poster noted, it needs to be known that "Tivoization" can not be used to steal code.

Re:Obvious answer, old answer. (4, Informative)

RivieraKid (994682) | more than 3 years ago | (#32317880)

He can't sue, because he has no standing. He's not the copyright owner.

Re:Obvious answer, old answer. (0)

Anonymous Coward | more than 3 years ago | (#32317928)

He should be able to sue if the company advertised the device as GPL and he bought it from and then found out it wasn't GPL, because they technically sold him something they don't own and that won't work as advertised. ...but that would only get him a refund.

Don't sue... (1)

SharpFang (651121) | more than 3 years ago | (#32317292)

This only adds bad press to Linux. OTOH an offer to cooperate with freeing up the firmware?
Sign an NDA on a tool-set for the company, then release a free version. Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.

Re:Don't sue... (3, Insightful)

TheRaven64 (641858) | more than 3 years ago | (#32317398)

He can't sue, because unless he is the author of one of the piece of software distributed on he device he doesn't have standing. I'm not sure that bad press is something to be concerned about though - does Microsoft get bad press when they go after people distributing machines pre-installed with Windows without complying with the license agreement (i.e. paying them)?

Re:Don't sue... (5, Insightful)

qbast (1265706) | more than 3 years ago | (#32317420)

This only adds bad press to Linux.

WTF? Making a company comply with a license gives "bad press" ? I think that current way (asking, nagging, offering help, refusing to take any serious step) is worse - it promotes idea that GPL and other free licenses don't really matter - you can ignore them all you want and in worst case they can string along the community by releasing small bits and "discussing the situation" until the product becomes obsolete anyway.

OTOH an offer to cooperate with freeing up the firmware? Sign an NDA on a tool-set for the company, then release a free version.

Sure. Why not become unpaid employee. It is the company's responsibility. If they are incapable of understanding license of software they distribute, then maybe it is time to fire (and sue for damages) their lawyers.

Simply reverse-engineer it with manufacturer's cooperation, access to docs and tools, then "hack" it in a blessed way that doesn't violate the company's licenses and complies with GPL. I'm sure they would be glad if someone helped them comply with GPL instead of forcing them to do it themselves.

Well, they did not comply with the license, so it has been automatically revoked, isn't that right?

Re:Don't sue... (1)

Rockoon (1252108) | more than 3 years ago | (#32318098)

Its bad press because

if such a lawsuit lost, then vendors have a clear path to using Linux while also not allowing modification.

if such a lawsuit won, then vendors would never be able to use custom-but-for-hire solutions again which translates into never using linux again.

Re:Don't sue... (3, Informative)

Arker (91948) | more than 3 years ago | (#32317430)

Don't ever sign an NDA. That's horrible advice.

If the build-system has to be reverse-engineered for this company to avoid being held accountable for their commercial infringement of copyright, it's on them to get it done. And the person implementing the new build-system will need to be working in a clean room, without ever seeing the old build system, so there is no call for an NDA there. Get one person to analyse and document the function of the old one, and write the specification, then the person who does the new build system only sees that spec.

No end run (4, Informative)

Todd Knarr (15451) | more than 3 years ago | (#32317296)

No, the build environment doesn't provide an end-run around the GPL. Both v2 and v3 of the GPL require the distributor to provide the scripts that control the build. In GPLv2 it's in section 3, in GPLv3 it's in section 1. GPLv3 also covers this again in section 6, in a more general form when it discusses installation information.

Re:No end run (5, Informative)

harlows_monkeys (106428) | more than 3 years ago | (#32317972)

The submitter didn't say that the scripts that control the build are missing. He said they don't provide a build environment. If I distribute GPL code that I build with Visual Studio, I don't have to distribute Visual Studio. I just have to distribute the project file (or whatever it is nowadays--haven't don't Windows in a long time).

It sounds like both companies are distributing embedded software for a hardware device. It's quite possible that the things they aren't distributing are part of some third-party expensive development environment, that they are using off the shelf. If that's the case, there's no GPL violation, as long as they distribute everything the submitter would need to build and install the software if he were to go obtain from that third party the development environment.

Hm.. (1)

oldhack (1037484) | more than 3 years ago | (#32317298)

What if the firmware is burned into ROM and hardware only supports ROM?

Re:Hm.. (1)

mpoulton (689851) | more than 3 years ago | (#32317348)

What if the firmware is burned into ROM and hardware only supports ROM?

You burn a new PROM (or EPROM, or EEPROM...) to replace the existing one. If you have the wherewithal to tinker with the firmware on a device that only supports ROM, then you certainly have the wherewithal to swap an IC on the board.

Re:Hm.. (2, Interesting)

Dun Malg (230075) | more than 3 years ago | (#32317392)

Like the GPL says, they need to supply everything necessary to compile, install, and run the software, except for perhaps the utility you'd use to burn the EPROM. The media they choose to distribute it on is irrelevant. It could be chiseled into stone tablets.

But this is largely irrelevant, as nobody with half a brain uses ROM firmware. Flash allows you to correct firmware errors later.

Re:Hm.. (1)

TheRaven64 (641858) | more than 3 years ago | (#32317532)

This is almost entirely wrong. Version 2 of the GPL does specify that you need to specify everything required to compile the software, but not to run it on any specific machine. That's what Tivoisation is about; you can grab the Linux code for the Tivo, you can compile it, you can run it, but you can't run it on a Tivo.

Secondly, the media is not irrelevant. The GPL specifically states that it must be a medium commonly used for software interchange. Stone tablets would most definitely not fit this description.

Sometimes I wonder if there is any overlap between people who advocate the GPL and people who have actually read it...

TIme to name names. (4, Insightful)

Vellmont (569020) | more than 3 years ago | (#32317322)

It sounds like you don't work for either of these companies. So why are you protecting them?

If you really want them to do the right thing, start making a stink about it. There's very little chance anything is going to change because one guy asked them to. There's at least some chance that they will if the companies start getting a bloody nose from it.

Re:TIme to name names. (1)

Sarten-X (1102295) | more than 3 years ago | (#32317416)

The names should be protected at this stage. It's not clear whether they're doing something wrong or not (see the Visual Studio example in a nearby comment), so calling them out and setting loose the /. horde is a bit extreme at this point.

Re:TIme to name names. (1)

lokpest (1136949) | more than 3 years ago | (#32317574)

The names should be protected at this stage. It's not clear whether they're doing something wrong or not

Or more importantly, its not clear if they are doing it knowingly, or just doesn't know they not in compliance with the license. If its the latter, a quick telling them that they might want to correct that one little mistake is better strategy than yelling out "OMFG, you violated the holy GPL, you burn in hell forever, kthxbye!"

However, if the dont care to answer what you point out or more specifically if they violates knowingly and doesnt give a rats ass about it, its up one level on the no more mister nice guy-scale.

Re:TIme to name names. (1)

Vellmont (569020) | more than 3 years ago | (#32317742)


a quick telling them that they might want to correct that one little mistake is better strategy than yelling out "OMFG, you violated the holy GPL, you burn in hell forever, kthxbye!"

A false dichotomy. Why are those the only two options? Why does naming names have to be your extreme example of dickishness?

Re:TIme to name names. (1)

Achromatic1978 (916097) | more than 3 years ago | (#32317978)

A false dichotomy. Why are those the only two options? Why does naming names have to be your extreme example of dickishness?

Because past experience on Slashdot and elsewhere shows that when names are named, there is a small but significant vocal collection of frothing at the mouth, militant types that will think nothing of leaving hundreds of VMs for the CEO, sending hundreds of faxes, thousands of emails, sign them up for a few spam lists along the way as a way of "making a point".

Re:TIme to name names. (1)

Vellmont (569020) | more than 3 years ago | (#32317634)


The names should be protected at this stage. It's not clear whether they're doing something wrong or not

It's not clear if they're violating the GPL because there's not enough information given. We have no idea if this is GPL 2 or GPL 3, no idea what build tools are/are not available, no idea what the product is, etc.

(see the Visual Studio example in a nearby comment),

The relevant part of the GPL2 is:

For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.

I read "normally distributed" as the build tools are readily available (it doesn't say free). It sounds at least close enough to a violation to warrant some pressure applied to these companies to give some sort of response. This isn't murder, and nobodies life is going to be ruined simply by letting it be known who and what we're actually talking about here.

Anyway, if any traction is to be gained the OP needs to provide specifics. That really means naming names, and specifics about what product is in potential violation. Maybe the companies aren't doing anything wrong, but keeping it all a big secret and releasing tidbits of generalized information helps nobody but the potential violators. It seems pretty obvious the OP doesn't know if they're in violation either, so why not turn to the crowd to figure out if they are? Without specifics, it's just a series of bad guesses.

Re:TIme to name names. (1)

Shulai (34423) | more than 3 years ago | (#32318036)

And while it can sound unfair, if you look on it on the right light, it isn't. A GPL'd project can be built on a platform where no free toolchain is available (hey, even GCC had to be compiled on a different compiler the first time!). Of course, the concept is about non-free but publicly available tools, as seems to be in this case.

Not really, no (3, Interesting)

SSpade (549608) | more than 3 years ago | (#32317346)

Is it a license violation to use GPL code in a Windows program that's built with Visual Studio, given the author is unlikely to provide a copy of Visual Studio on request? You cannot rebuild the application, even given the entire source code, without access to a non-GPL piece of software you don't have access to.

You might not like it. You might even think it's against the spirit of something or other. But it's not a GPL violation.

You could argue that one difference is that Visual Studio is available to anyone prepared to pay for it. I'm sure that the build environment for the device you're talking about is also available to anyone prepared to pay for it. It likely costs more than you'd want to pay, though.

Re:Not really, no (0)

Anonymous Coward | more than 3 years ago | (#32317428)

I don't think the GPL mentions anything about having to provide a legal copy of the build environment.

Re:Not really, no (0)

Anonymous Coward | more than 3 years ago | (#32317860)

Don't forget Visual Studio Express editions which actually do the job pretty well- what you don't get is having it all in one handy place.

Their bad (3, Insightful)

Arker (91948) | more than 3 years ago | (#32317402)

No sympathy for them, if they cannot comply with the license they are engaged in commercial copyright infringement and should be thankful you gave them an opportunity to fix it rather than going straight for statutory damages.

However the FSF has limited funds and they do have to pick their battles wisely. If all you can do about the situation is bump your FSF contribution then do it.

As for a practical workaround for your benefit, do you have the ability to write arbitrary bytes to the firmware? If so you should be able do this in a hexeditor. It wouldnt be trivial though - quite a few hours of work, depending on the specifics of how they screwed their HTML up so badly and how it's encoded. You might be able to shortcircuit it a bit by simply determining what IE sends to the device to perform each task, and then scripting your own pages that result in the correct bits being sent to the device. Would have to look at the actual device in-depth to determine which route is most practical.

Legally, no. Practically, yes. (5, Interesting)

fuzzyfuzzyfungus (1223518) | more than 3 years ago | (#32317450)

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites. If, as one of the unnamed companies claims, they used GPL code and proprietary build prerequisites that they cannot legally release, than their lawyer(s) fucked up big. Just because the GPL doesn't ask for money, and some of its friends have long hair, doesn't make it any less binding than whatever license governs their build environment. They've put themselves in the untenable situation of having two binding licenses that cannot both be satisfied(and losing redistribution rights for their firmware would probably hurt if they don't have the resources to re-do their build environment).

However, in practice, to uphold a right, no matter how solidly enshrined in law, generally takes time and money(particularly in civil cases, where the state won't provide you even a shitty lawyer). As long as they aren't the most blatant, the SFLC and their ilk probably won't go after them(especially if their hardware is uncommon or obscure; from a strategic standpoint, the SFLC probably cares more about improvements to OSS software flowing back to the community, and buildability on common devices than they do about buildability on obscure stuff). You might have slightly better luck if you can identify the specific authors/copyright holders of all the GPL code used in the firmware. Particularly for the company that put itself in a license bind, any of the authors could decide to sue them, possibly for real money, if they so chose.

For you personally, though, you are probably SOL. If you have to ask slashdot, you probably don't have the lawyers you need. About all you can do is make noise about the situation, naming names, ideally, and hope that somebody with firepower takes interest.

Re:Legally, no. Practically, yes. (1)

pclminion (145572) | more than 3 years ago | (#32317774)

As others have pointed out, GPLs 2 and 3 both require the release of the build-prerequisites.

I need to ship you a fucking computer along with the source code? A computer is a prerequisite to build the software.

Re:Legally, no. Practically, yes. (1)

JohnFluxx (413620) | more than 3 years ago | (#32317962)

Or you could just read the actual GPL text that many people have pasted and not be an idiot:

"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

Source code, not hardware.

Re:Legally, no. Practically, yes. (0)

Anonymous Coward | more than 3 years ago | (#32318028)

If you have to ask slashdot, you probably don't have the lawyers you need. About all you can do is make noise about the situation, naming names, ideally, and hope that somebody with firepower takes interest.

One problem is that the original poster presumably doesn't have much dog in this fight. His free use of the open-source software, which was intended by the GPL, may have been compromised. But he is not the holder of the violated license. FSF or whoever holds the older end of that contract.

Perhaps a more effective strategy would be to send friendly letters to all the vendors of these systems that you can identify. Inform them that they appear to be selling systems that contain IP apparently being used in violation of the license for that IP. You should be careful to state that you have no position in any resulting dispute, nor do you intend to take any further action, and that you are only providing this information in the interest of supporting free software and with the hope that the vendor will find it helpful.

Especially since he now knows there are IP issues with the product.

(I'm not a lawyer, but there is obvious risk to this approach. Even if the suggested action is fully defensible, legal action by any offended party could impoverish you. So, are you willing to starve for free software?)

It's not an end run, it's just a violation (1)

blp (4207) | more than 3 years ago | (#32317508)

GPLv2 says that source code includes "the scripts used to control compilation and installation of the executable". GPLv3 is even more explicit. So they are likely, depending on the details, just violating the GPL, not using any kind of loophole.

it is copyright (2, Insightful)

bravecanadian (638315) | more than 3 years ago | (#32317524)

I thought we hated copyright because it rewards people for too long now etc.

The company is not depriving anyone else of using the code so therefore there is no harm in it and no value lost etc etc etc

Funny how we want it both ways, huh?

Re:it is copyright (2, Insightful)

Arker (91948) | more than 3 years ago | (#32318044)

Copyright does last too long. Doesnt mean it should expire any quicker just because it's offered under a free license than otherwise. And chances are very good the code in question is still quite young.

A bigger problem is that it has been incorrectly interpreted to allow copyrighting of binary code. That is not consistent with the founders intentions. If you want to copyright software you should have to publish the source code. But in this case the source code that was licensed is published, obviously, so that isnt an issue here either.

Finally, copyright was not intended to, and should not, apply to non-commercial use. But this is commercial use.

So no, I dont see us 'wanting it both ways' here, at all.

Build scripts wouldn't help (2, Interesting)

Anonymous Coward | more than 3 years ago | (#32317544)

As others have posted, they are meant to give you a copy of the build scripts. These scripts may not work outside of their environment (due to hard coded paths, etc), but they are meant to give you those scripts.

But nothing in the GPL says that they have to give you the firmware utilities used to load a new firmware on.

No, this is missing the point (3, Informative)

Geoffreyerffoeg (729040) | more than 3 years ago | (#32317552)

The GPL doesn't require that hardware that has GPL code be modifiable to include updated versions of code. Build systems are a distraction here: a more direct form of the problem is that the GPL code is burned into ROM, and even the GPLv3's Tivoization section (number 6, paragraph starting "If you convey...") explicitly permits that. It would be dumb if it didn't. While it may well be the case that for GPLv3 (and not GPLv2) failing to give you a usable build environment for compiling modifying code so you can run it on your "User Product" is a violation, this is forgetting a large part of the purpose of free software.

The point of free software is that the software, the code, is free for the community to use. Thinking about free software as simply the ability to modify code within its original context causes us to forget opportunities for reusability that benefit the entire free software community, well past the lifetime of this one device, and encourages behavior where modified code isn't usable on other devices or in entirely different contexts. I've written a bit more about this on my blog [mit.edu] , with some examples of times when thinking about "free software"/"open source" only within the context of the original product has caused the free software ecosystem as a whole — the thing that's causing large companies to want to embed free software in their hardware devices in the first place — to be left behind.

What do you mean by "build environment" (2, Insightful)

coolgeek (140561) | more than 3 years ago | (#32317554)

Are you talking about makefiles and scripts, or are you talking about a proprietary compiler used to generate the code? There's a huge difference.

This is why we don't use GPL stuff (4, Insightful)

bsDaemon (87307) | more than 3 years ago | (#32317624)

The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this. We also employ people to make contributions back to the FreeBSD project as well, so we're not mooches, but seriously... this is why so many companies don't want to get involved with Linux or GPL solutions.

Re:This is why we don't use GPL stuff (-1, Redundant)

Vellmont (569020) | more than 3 years ago | (#32317802)


The company I work for builds our custom software environment for specialty networking hardware on top of FreeBSD specifically so we can avoid crap like this.

What, actually having to do something and let others modify what you've modified?


this is why so many companies don't want to get involved with Linux or GPL solutions.

Yah.. what a bunch of jerks these people who write GPL code are. Sharing it in exchange for agreeing to a set of relatively simple rules to follow!

You don't have to like the GPL, modify the code, or accept the license. But don't go around with this attitude like people who write GPL code owe you something simply because you prefer a different license. The truth is there's a LOT of companies that are perfectly fine with the GPL. There's some that aren't. That's fine. Why do you believe we have to attempt to appease everyone?

FSF-iaa (-1, Flamebait)

Anonymous Coward | more than 3 years ago | (#32317628)

Using their typical thug tactics to force people to their ways and suing people, this company should take their operations to Sweden to avoid this kind of crap copyright/patent bullshit.
That or a last result to screw the Gestapo Copyright whores to release the closed software on TPB.

FSF = RIAA/MAFIAA; but with a smaller budget and terrible endings for their movies
GPL = Draconian Copyright Laws

No such thing as "not fully GPL compliant" (0)

Anonymous Coward | more than 3 years ago | (#32317632)

You either have a license to use the code or you don't. If you don't comply with ALL of the terms of the software license, you can't use the code. It really IS that simple. The companies have stolen code.

If you own the copyright for the source and if you can't afford a lawyer, contact the press and let then know that the companies in question have stolen your code. They have the obligation to prove that they have the licenses in place.

A loophole, you say? (1)

Superdarion (1286310) | more than 3 years ago | (#32317660)

You said it yourself; this is as much a loophole to GPL as a criminal getting away with it because he has good lawyers.

It's not a loophole of GPL itself, but rather of the legal system in which it must rely.

This is not a violation of the GPL... (0)

Dr_Marvin_Monroe (550052) | more than 3 years ago | (#32317852)

Sorry to rain on the "GPL violation parade", but this really isn't a violation. The GPL covers the source code only, that's what the banner above the code indicates. It doesn't stretch to everything that's required to build a duplicate product. These companies are under no obligation to release their build environment, scripts, custom firmware utilities or whatever unless they contain GPL code AND they're releasing the binaries out into the public. Private build tools don't count. Doesn't matter if it makes your source useless, or you unable to build a new image. Nobody ever promised that you would be able to build some replacement code and drop it into the device. Indeed, there are reasons where companies may NOT want you do to that (think product liability), even if they do release the source code that they originally built from.

I'm a great supporter of GPL, but folks here are trying to stretch the GPL into something it's not. If what you propose is true, I should be releasing the source and binaries to Notepad because I used it edit some of my files. I would also be required to release my build scripts even if they're owned by another company, and the firmware loader that I used to load up the image into the device.

Perhaps if you worked with the companies in question without crying wolf over some GPL violation that isn't, they may actually help you more. Here's a suggestion: offer to build them a new script based on public tools...And I mean really "go the distance" with them, using something public like Ant. Help them work through the rough edges and show them that you can provide a "win-win" situation where they can actually trust you. They may not bite, but then again, they may... And you've helped show good faith rather than calling in the lawyers.

Re:This is not a violation of the GPL... (1)

JohnFluxx (413620) | more than 3 years ago | (#32317976)

Or you could just have spent a second reading the GPL, and then not bothered with your incorrect post.

"all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities."

If you bought the devices as is (0)

Anonymous Coward | more than 3 years ago | (#32318082)

If you bought the devices with no promise from the company that they would ever provide any kind of firmware upgrade, then you have no complaint against them because you bought the device based on what it had on it at the time, regardless of whether ROM can be flashed or not.

GPL v3 (1)

GNUALMAFUERTE (697061) | more than 3 years ago | (#32318100)

Well, the GPL version 3 does address this issue, and other limitations (like hypervisors that prevent you from installing unsigned code).

But the problem is not a license issue, since we don't have the resources to legally battle all companies that violate Free Software licenses.

It's about people understanding the importance of GPLed software, and the philosophy behind it. It's about building an ethical understanding of the issue in the population.

But the reason why people violate the GPL is obvious: Copyright isn't natural. Stealing is immoral, and also breaks the law. Copyright infringement only breaks the law, but it's not immoral. It's not a crime. And it'll never be. Copyright is an invention, and unnatural limitation. Therefore, people disregard it, just like many other things that aren't immoral, but are illegal. Illegal, but very convenient, will get you a lot of infractions. That's why we have a lot more traffic violations than murders.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...