17 ms·

BMW Australia Refusing to Comply with Terms of GNU Public License

534 points by jordigh 11y ago

jwildeboer 11y ago
History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Hand this over to the Free Software Conservancy or the SFLC. And that should have been the first step. Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm
- coldpie 11y ago
  Yeah, it's pretty clear the suit has no idea what they're talking about. I don't know if SFC operates in Australia, but probably they could get some attention from the US division of BMW. Speaking of which, the SFC is currently running a fundraiser. If GPL enforcement is important to you, please consider signing up for a recurring donation. http://sfconservancy.org/ http://sfconservancy.org/
  - ryao 11y ago
    Are there any organizations that pursue GPL violations that would stick to clear-cut cases of GPL violations where there is strong concensus among OSS developers that violations have occurred like the BMW case? For full disclosure, I am one of the ZoL developers. I believe that ZoL can prevent certain types of storage related failures that other production solutions do not, including those on systems intended to keep people alive. My desire to see that has required that I make an effort to understand what the GPL permits and what it restricts. So far, my talks with lawyers have suggested that my (and others') work in ZoL is legally alright under copyright law. The SFC considers easy access to ZoL binaries to complicate their arguments in certain GPL enforcement cases and rather than accept that reality to the benefit of the wider community, the SFC has opted to claim that ZoL binaries as distributed by Canonical are themselves a GPL violation. While I want to see the BMW case litigated, wanting to see GPL violations litigated and contributing to an organization that calls any use of OSS a GPL violation whenever it perceives the possibility of a court agreeing that claim to make litigation of certain cases of actual violations slightly easier are two different things.
    - coldpie 11y ago
      I haven't followed the ZFS stuff much at all, but SFC's news post about it the other day did make me wonder why they were doing it. I think it's important to enforce the GPL and other copy-left licenses when they are being blatantly violated, even if the original authors no longer care about the project. But if it's an unintentional license incompatibility, where the spirit of the licenses are roughly aligned, who really cares? Who is benefiting by bothering Canonical or the ZFS-on-Linux developers with these license concerns? In my case, SFC is pro-bono council for the Wine project, from which I derive my income. So even if I don't always completely understand what they do, I feel I should pitch in because they contribute to my livelihood. I'm not a legal guy, I don't pay super close attention to this stuff, I trust them to do something not far from "the right thing."
      - ryao 11y ago
        It might help if you wrote to them telling them how you feel. I will not think badly of you whatever you decide to do going forward. I realize that this is an awkward situation and if I were you, I would probably have made the same decisions. The unfortunate situation aside, thank you for your work on Wine. Wine has been helpful to me on multiple occasions. :)
- matt4077 11y ago
  I think that argument may have used to make sense in the 90ies when open source was new and was trying to establish itself, mostly with a dream of "Linux on every desktop". Now it has found its market and the ecosystem as a whole really couldn't give a damn if BMW is kind enough to use OSS or not.
  - jackhack 11y ago
    Respectfully, I don't think this is about 'kindness.' This is about BMW, a commercial entity, respecting the legal rights of the property creators as owners. The license agreement is clear, and certain actions must take place if BMW chooses to benefit from use of the software. BMW is free to NOT use the software if they feel these restrictions are too severe. Or am I missing something?
    - semi-extrinsic 11y ago
      I think they were trying to say that the OSS community at this point in time doesn't need BMW to be "kind" and use OSS to help OSS gain popularity. Especially not if they can't be bothered to comply with licenses.
    - pigpaws 11y ago
      the way I read its is that no, BMW is NOT legally required to release it as it is in a proprietary piece of HW, and releasing the code could thus cause harm to their business. and while they ARE using it for 'gain', no one can prove that they were HARMED or had a loss of income or even IP (outside of copyright) by their (BMW's) use of such as it is essentially 'free' in that no money or barter items were exchanged. They MAY have a copyright claim at best, but again, I am not a lawyer. That's just how I see it. Is there a precedent to enforce GNU licensing outside of copyright infringement?
      - witten 11y ago
        That's not how the GPL works. If it would be inconvenient for BMW to incorporate GPL software and properly comply with the license by providing source, then their only alternative is not to incorporate the GPL software. Full stop. Harm or proprietary hardware has no bearing on the rights granted by the GPL.
- cnvogel 11y ago
  I don't see any shame and blame yet. The only thing these emails show is the claim by BMW that no software not developed or fully owned by BMW is running on their cars infotainment system. A shame and blame game would start when one analyzes the software updates, is able to prove that the above statement is a lie, and make a big fuzz about it. This would BMW fear loosing their face and be counter productive, I fully agree.
- jMyles 11y ago
  > History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Is this true?
- cookiecaper 11y ago
  I disagree. The fact is that large companies like this are never open to "civil discourse and cooperative solutions" when it comes to copyright, trademark, or other intellectual property matters. BMW will see no reason to comply with the GPL. The only thing a big company responds to on such issues, other than bona fide legal action, is negative press. I think it'll be difficult to manufacture some over the technicalities of copyright compliance, but can't blame OP for trying and not wasting his time trying to navigate the corporate copyright labyrinth. Source: I have a C&D from a Fortune 500 alleging that I violated some intangible rights. Their argument is weak, but I don't have the millions of dollars every lawyer I've talked to has said I'll need to see the case through (tens of thousands to even get started). I've spent 6 months trying to navigate their corporate structure and get in front of someone who matters. Everyone just tells me to sod off, with varying degrees of politeness. I have not yet been able to locate someone in the company who actually seems willing to have any discussion, and their law firm is obviously not open to this since their instructions were to shut me down. I'm considering the alternatives I have, and wondering if it's time to try to work the media and attempt to get some movement from them that way (though I don't really think this will work, it's becoming the only option).
  - godzillabrennus 11y ago
    Post your story online and use something like thunderclap to get more awareness through your network.
- lucb1e 11y ago
  History has proven over and over again that naming and shaming works miracles. Companies that turned a blind eye and were completely unreachable suddenly turned active and kind just to save their reputation. Going to or even just threatening to go to the media, I know from experience, is indeed productive. I am really curious where you got the idea that it's counter productive. Asking the conservancy to clean up this dirty work is expensive and takes forever.
  - leereeves 11y ago
    Sometimes shaming works, sometimes it doesn't, and sometimes the mob is misinformed and crucifies an innocent.
    - lucb1e 11y ago
      The customer service rep might be spreading misinformation, true, but without attention or legal actions, odds are high we'd never know. Better put some pressure on them to actually give a true answer than assume they violate the license and quietly let them continue.
  - akamaka 11y ago
    The problem is when random people from the internet start unwarranted attacks over GPL violations when the problem can be dealt with constructively. The example that pops into my head is the time when some kid start working on a mod to the Quake 3D engine that was possibly in violation of a free software license. Instead of just reporting it to the copyright holder (id Software), they engaged in a campaign of harassment until John Carmack himself came out and told them to stop. It was some seriously shameful shit. Public shaming should be one of the last steps to take. Maybe before starting a lawsuit, or maybe after, that's up for debate, but certainly after other avenues have been exhausted.
    - lucb1e 11y ago
      I see your point but would say there is a difference between a kid and a multinational. The same law rules both but an individual doing this by accident vs. a company doing it due to ignorance (in the best case) is different. The multinational has enough money to defend itself in court, any individual is bound to have less, especially a kid (in your example).
- TelmoMenezes 11y ago
  > History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Can you please provide some evidence for this statement? > Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm Depends on what your goal is. If your goal is to obtain the source code in this specific instance, and if you don't care about the efforts of open source contributors, then I guess it would make sense to privately "discuss" and "cooperate" with BMW. On the other hand, if you want to scare companies into not stealing other people's work in the future, then I think naming and shaming is a reasonable strategy. This is a clear case of rationalization about rules not applying to the powerful. Surely you would not expect BMW to care about "burning bridges" and value "cooperation" and "discussion" with you had they caught you stealing their IP.
dmm 11y ago
What GPL licensed software are they actually infringing upon? The linked post[1] says they found mentions of systemd, but does the firmware actually contain a linux kernel? I don't see anything that looks like a kernel in the file listing. Also if the firmware is properly signed delivering it over http shouldn't matter, right? [1] https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-updates-une=ncrypted/ https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...
- noselasd 11y ago
  The specific update here is just a delta update, and doesn't contain the entire firmware. But it does contain shared libraries built for running on a linux system, so it stands to reason there's linux kernel running somewhere there. (On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux)
  - cynix 11y ago
    > (On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux) Yes, people have sent requests to Tesla, and they continue to ignore these requests to this day. See http://www.teslamotorsclub.com/archive/index.php/t-10748.html http://www.teslamotorsclub.com/archive/index.php/t-10748.htm...
  - dTal 11y ago
    >semi-officially said they're running Linux The Model S was independently confirmed to be running Linux 2 years ago: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network/page9?p=608435&viewfull=1#post608435 http://www.teslamotorsclub.com/showthread.php/28185-Successf...
- lucaspiller 11y ago
  Apparently Mini (also made by BMW) has a similar update structure, and that runs QNX, so it's likely this does too: http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/ http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/
_Codemonkeyism 11y ago
Poor customer support agent.
deleted 11y ago
[deleted]
strictnein 11y ago
I'm confused here. Where is the evidence that they've modified GPL'd software, which they are then distributing, and are refusing to distribute the source code for their modifications?
- nailer 11y ago
  > Where is the evidence that they've modified GPL'd software There's a Linux kernel and systemd in the 'i3'. See the links in the first few sentences of the article. > which they are then distributing BMW is a Bayerische Motor Work, a car company that distributes cars > and are refusing to distribute the source code for their modifications? The letters from BMW to the people asking for a copy of the source, stating they are refusing to distribute the source code for their modifications, linked to in the article.
  - strictnein 11y ago
    I read that, but isn't this is the lowest type of "violation" there is? People are just wanting them to host the source code that is already available in about a billion locations then? My question still stands, is there evidence that they're modifying GPL'd code and then not distributing that code?
    - bcook 11y ago
      Are you confusing source-code with machine-code? GPL is concerned with source-code.
      - ArbitraryHobo 11y ago
        http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html > object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:
        bcook 11y ago
sudhirj 11y ago
Is it a violation if they don't modify Linux itself? So if I make a device that runs Linux and my application binary, am I required to make my application code public?
- lucb1e 11y ago
  In that case, it shouldn't be a problem to point to Linux' code repository right?
  - ocschwar 11y ago
    And it won't be. But cut their public relations staff some slack. They can't tell Richard Stallman from Gregory Rasputin, and before saying or doing anything they're going to be bringing themselves up to speed on what the GPL is. No need to get rage-y just yet.
    - lucb1e 11y ago
      It's their obligation to forward what they don't understand. If I work for a mobile network carrier and say something that indicates we don't follow some privacy law, it's my fault for not asking my boss how we handle certain things. (And my boss might ask his/hers, etc.) Edit: I didn't downvote you, by the way.
    - ocschwar 11y ago
      All true. But until word comes down from legal about what to say, you can't blame the PR flacks for saying nothing.
- pyb 11y ago
  It would not be a violation in this case.
  - iajrz 11y ago
    It is if they don't redist the kernel code they're using - if it's GPL'd, and you redistribute the binaries, you acquire the responsibility to redist the source.
antocv 11y ago
Has anyone ever seen GPL being encorced in any country? Wont this end with BWM uploading a tar.gz of a kernel found on kernel.org and call it a good working day? Have seen it happen too many times, and in most countries the user has no claim on the license/copyright. So unless I contributed/own some copyright found in exact Linux kernel version/other software used by a distributor, and buy their stuff, there is zilch I can do. Which also means, you are free to sell/and break GPL software/license and as long as you dont upset somebody who owns the copyright to it, you're good to go.
- luso_brazilian 11y ago
  Yes, and actually on BMW home country, Germany. The summary can be read at this old Slashdot submission [1] from 2005 but the gist of it is that > Harald Welte of the netfilter/iptables core team sought to enjoin Sitecom from distributing its WL-122 router, which used netfilter's GPL'd code, without also providing the source code and a copy of the GPL, as that license requires and > The Munich Court granted Welte a preliminary injunction [2] and then upheld that injunction [3][4] I believe there are other instances of GPL being upheld in courts around the world and this one should be only one of many examples. GPL is not even necessary in these cases, in the absence of the (GP) license it reverts to the default copyright rules, with all rights of copy and distribution being at the hands of the copyright holders (save for Fair use and other exceptions). A company that would try to argue that GPL is not a valid license in court would actually be admitting in court that they are distributing the software without a license from the copyright holders all along. [1] Munich Court Again Enforces GPL: http://news.slashdot.org/story/05/04/14/2024258/munich-court-again-enforces-gpl http://news.slashdot.org/story/05/04/14/2024258/munich-court... [2] Preliminary injunction: http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=123 http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=... [3] Injunction upheld: http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=117 http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=... [4] Court's decision in English (pdf): http://www.jbb.de/judgment_dc_munich_gpl.pdf http://www.jbb.de/judgment_dc_munich_gpl.pdf
  - darkr 11y ago
    Yup, I can remember several companies settling and being forced to comply for violations of busybox GPL'd code in the US off the top of my head - Verizon, Extreme Networks and Xterasys. There are likely quite a few other examples of GPL being successfully enforced.
castis 11y ago
What is the worst-case scenario for an entity that refuses to comply?
- Kiro 11y ago
  Probably not much and that's why I don't put any licenses on my stuff.
  - Tyr42 11y ago
    Refusing to put a licence on your code does stop people from using it. If you really don't care, just slap a MIT license on it and be done with it, no one will bother you afterwards.
  - umanwizard 11y ago
    So, you release code but don't let anyone use it? Because that's the legal effect of not putting licenses on your stuff.
    - Kiro 11y ago
      Yep and I use code without license all the time. Show me one case where that has ever caused a problem.
      - oldmanjay 11y ago
        The point isn't that it may cause you a problem. The point is that the license is the structure by which people understand how they can use things, and the lack of a license is generally taken as "don't touch this" by the larger community. It's essentially opting out of the larger pool of contribution, which is of course totally valid and your right.
        umanwizard 11y ago
        It's not just how the community interprets it; it's the law.
fauria 11y ago
Harald Welte founded gpl-violations (http://gpl-violations.org/about/ http://gpl-violations.org/about/) 12 years ago. The have been offline for some time, but it looks like they plan to continue with their activities this year: "Actual GPL enforcement activity is expected to resume at some point in 2016." Maybe they can help sorting this out.
rattray 11y ago
Worth noting that the BMW people in the thread are in customer support, not legal.
- SyneRyder 11y ago
  Looking through the user's Github account, they have a history of contacting customer support representatives of companies and threatening to post the transcripts to Hacker News if their specific legal concerns are not addressed: https://gist.github.com/duncan-bayne/74d6e38c506000982237 https://gist.github.com/duncan-bayne/74d6e38c506000982237
  - pjc50 11y ago
    How else can one get in touch with a megacorp?
    - spiznnx 11y ago
      I would assume the legal department would generally read and respond to letters on legitimate concerns, even at a megacorp.
      - nevinera 11y ago
        Generally speaking, they will definitely read them (and occasionally take action), but only respond if they have some legal obligation to do so. Any reply they make to an inquiry or accusation of this type can be used against them, but a lack of response cannot (unless that lack of response violates some requirement of the law).
        anonbanker 11y ago
        This is why it's good to have a bilateral contract with them prior to your contact, so that they have a legal obligation to reply. When they dont reply to your offer of renegotiation or relief, you're safe to use their silence as acquiescence or dishonor, depending on circumstance.
SyneRyder 11y ago
Google could have helped here: BMW Car IT: Open Source http://www.bmw-carit.com/open-source/ http://www.bmw-carit.com/open-source/ I'll take a guess based on the filename "ConnStarter" in the BMW firmware that ConnMann is the primary GPL'd software. As the BMW site says: "The ConnMan project provides a daemon for managing internet connections within embedded devices running the Linux operating system.... ConnMan is available under the terms of the GPL v2." http://www.bmw-carit.com/open-source/connman.php http://www.bmw-carit.com/open-source/connman.php You can download the source if you like.
- jmiserez 11y ago
  The linked site may be useful, but where on that site did you find a download link for the specific software version (including modifications) used? All I see is a generic link to ConnMan's project website. I don't think that suffices?
  - knd775 11y ago
    This was linked from the project website http://git.kernel.org/cgit/network/connman/connman.git/ http://git.kernel.org/cgit/network/connman/connman.git/ edit Never mind, I misunderstood your comment
    - jmiserez 11y ago
      Yes, but that is just the ConnMan development repository. Correct me if I'm wrong, but I think BMW would need to redistribute the exact version of ConnMan that they used, including any modifications made. At least a deep link to a branch or tag would be nice.
      - the_mitsuhiko 11y ago
        But only on request.
      - deleted 11y ago
        [deleted]
jolux 11y ago
pretty sure it's this: http://www.magnetimarelli.com/excellence/technological-excellences/open-source-platform-genivi-compliant http://www.magnetimarelli.com/excellence/technological-excel... can't find the source for it though.
deleted 11y ago
[deleted]
greydius 11y ago
Please correct me if I'm wrong. I thought the GPL only required providing the source code to the purchasers of the product. (Who can then redestribute it if they'd like.) I didn't think it meant that if you use GPL code in your product, then you are obligated to make your code available to everyone.
- voxic11 11y ago
  You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public.
- voxic11 11y ago
  You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public. It seems in this case they released a patch to their software and made the patch available to the public.
  - 13of40 11y ago
    If I sell a computer with Linux on it, and I bundle on my own application that's compiled to run on Linux, am I required to make the source code for that application available? In this case, if they just have an unmodified copy of Linux to provide the run-time environment for their nav system or whatever, and the nav system itself is an application on top of it, I don't know if it follows that they need to release the source for their nav system.
    - icebraining 11y ago
      If it's an application, no, but if it's a kernel module (e.g. drivers to talk to their devices), then yes. They still have to offer a copy of the kernel source, even if they haven't modified it.
      - 11y ago
rewqfdsa 11y ago
Good. I'm sick of people walking over copyleft licenses generally. It's only because of copyleft that there exists a pro-sharing social norm in the software development community. If you kick down the GPL, the norm will shift back toward proprietary software everywhere. You, young developer, have no idea just how shitty a world that is.
OJFord 11y ago
It seems to me less like refusal to comply with the terms of GPL, and more like denial that they use GPLed code. > I have confirmed with our technical department who > advised that ... the usage rights agreement states that > the software is protected by copyright and BMW is the > sole owner... it is not subject to the requirements of a > "Public" licence That may or may not be the case, but to me that doesn't say "yeah we use, na you can't have it".
goerz 11y ago
It seems to me that they're not distributing any software (i.e., the product is a car, not software), which means licensing doesn't come into play. It would be akin to someone finding out that I'm privately using (and maybe modifying) GPL software, and then demand that I make the source code available to them. Only in GPLv3, the issue of selling a product that uses GPL software internally is addressed. The situation changes of course once they make the software itself accessible to third parties, in which case they'd also have to supply the source code.
- ceejayoz 11y ago
  If that were the case, you could get around the GPL by claiming to sell CDs, thumbdrives, or zip files. Including software in your hardware product is undeniably distributing that software, IMO.
  - goerz 11y ago
    I disagree. If you sell me a CD with software on it, I have the software. If you sell me a car that runs a software internally, I have a car, but not the software. The car, unlike the CD, is not a container for the software. In fact, there is no trivial or intended way to get the software out of the car. As I said, GPLv3 addresses this explicitly, but with GPLv2 the license just doesn't apply. Then again, lots of people strongly dislike GPLv3, possibly exactly for this reason.
    - goerz 11y ago
      Incidentally, if you send me a USB stick with some GPL software on it, I can demand that you give me the source code of that software. However, I can not demand that you also give me the source code for the firmware of the USB stick, even if the source code for that firmware is under GPL (v2)
      - cyphar 11y ago
        I would definitely demand the firmware if it is GPL. Just because it is "firmware" doesn't suddenly not make it software that you've given me.
famerr 11y ago
So it is strange for me even if I understand GPL. Does it means all the network routers running custom linux have to provide sources of entire modification? I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists).
- zmmmmm 11y ago
  No. There is a boundary between the "kernel" which is strictly GPL and the "user" operating system which is (in its interaction with the kernel) based on LGPL and weaker libraries. So these routers have to distribute changes they make to the kernel, yes, but not any and everything that runs on the router.
  - famerr 11y ago
    Makes sense, thank you for explanation.
- rbanffy 11y ago
  > Does it means all the network routers running custom linux have to provide sources of entire modification? Yes. > I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists) What problem? Making the source code of the programs you distribute to your clients available is not a problem - it's an obligation you agreed with when you used the GPL'ed program as a basis for your own. You could do like Sony, who used *BSD on the PS4.
  - famerr 11y ago
    Good point, thank you.
- st3v3r 11y ago
  What's the problem?
  - famerr 11y ago
zmmmmm 11y ago
To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. If he does then included with the car should be an offer for how to access the GPL source code. He should have followed that (or clearly stated that he could not locate it in his email). The requirement for him to enter the VIN to access the source code does not seem unreasonable since they are only required to distribute source code to customers, and he has simply emailed them out of the blue asking them to give him the source without any proof that he's a customer. The statement about BMW being the "sole owner" is probably concerning proprietary parts of the software that may not be subject to GPL at all. It is probably way beyond the skills of some random customer service rep to distinguish the subtleties of those kind of things. This kind of interaction actually looks to me to be counter to the spirit under which the Free Software Foundation tries to administer the GPL - which is that they work cooperatively to help companies comply rather than try to trick them into legal hot water. I agree with the FSF approach and I don't think this sort of PR ambush type tactic is helpful in promoting the use of free software.
- ratboy666 11y ago
  No, the offer for source must be to anyone -- the supply of a binary may be limited. BMW cannot be the "sole owner" of the copyright -- even if they own the part they wrote, they must still supply source for the GPL parts.
  - deleted 11y ago
    [deleted]
  - qznc 11y ago
    "the GPL requires you to make the modified source code available to the program's users" Source: https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourcePostedPublic https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc... BMW does not have to provide the sources to everybody. Only to its users. edit: tzs also has a point. Hm?
    - 11y ago
stusmall 11y ago
I've gotten the same response from a company when requesting kernel source before. What is the best source for help in dealing this? I reached out to GNU but got no response. I know the kernel isn't their project but didn't know where else to turn.
genericacct 11y ago
Frankly: given recent news (hacked jeeps, software used to cheat on emission tests) I think it is time to _require_ _all_ software used on vehicles that transit on public roads to be open sourced and available to the public. (for independent testing and verification in the name of public safety)
- lucb1e 11y ago
  Vehicles aren't the only things running software that might need verifying. Far from it. While I wholeheartedly agree that it would be an amazing step, I also fear the huge backlash from the car and IT industry. Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so). Of course Windows 10 wouldn't have to be open source just because Windows is older than 20 years, but Windows 95 would be. Anyway, that is just one of the many possible ways. I just think we should be weary of people stuck in the old ways and not limit the move to just cars.
  - cyphar 11y ago
    > Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so). In that case, the car software is still proprietary software so you've gained very little from making the source code public. If a vulnerability is found, you can't write a patch for it and you have to wait for BMW to "get around to you". Car software should be free software upfront.
    - lucb1e 11y ago
      > Car software should be free software upfront. Yes! Just like medical implants (and the server-side counterparts that control them), and my password manager, and actually any software that is in between me and my password manager (OS, drivers, perhaps a browser), and private stuff like my email client/server, and instant messaging client/server, and things that track my vitals like those smart watch-like wristbands, and any non-domestically developed software the government uses, etc. Except few people aside from a few "open source radicals" will think like that. For every person I know who will fully support this motion, I know five who will object and another one or two who aren't really sure, and I already have a biased social circle because I do believe in this cause. As it stands, we never get to peek under the hood. A system like this would at least make people aware that "gosh, if we implement this cheating now (or whatever), we have to make sure to cover it up before we have to go public with it. Better document extensively where it's implemented so we can remove it thoroughly". Which is a bigger step than just one manager going "do it". And we would be able to see trends over the past years and reflect necessary changes in new policy. Perhaps two decades too late by then, but as it stands, we have naught. Then once people get used to the idea that in 20 years, when the software is commercially useless anyway, perhaps we can open source it sooner. Or more companies will go "look at us, we publish after 5 years for transparency without loosing our cutting edge!" A bit of wishful thinking perhaps, but I'm sure some will, and everyone would be forced after a certain time anyway. But once again, this is just one way of doing it. There are almost certainly better ways I didn't think of yet. We should just be thinking about it in the first place.
y04nn 11y ago
At least their update binaries are unencrypted, which allow us to see what they are using. If some of you want to have a look: The article: https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-updates-unencrypted/ https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw... Direct link to the binary: http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07012.bin http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07...
kazinator 11y ago
Misleading title; it looks more like they in fact refuse to acknowledge at all that some of the code is someone else's. > Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence [sic] I.e. "This is all our software; there is no third-party GPL stuff in it, so we need not comply with any such license."
sargun 11y ago
Tesla still continues to violate the GPL as well - https://forums.teslamotors.com/forum/forums/gpl-sources https://forums.teslamotors.com/forum/forums/gpl-sources.
yeukhon 11y ago
This topic is getting dull every time on HN. Someone has to argue about GPL, free software vs proprietary software.
outworlder 11y ago
This is ridiculous. So now, any John Doe can contact customer support of any company, then publicly shame them for not getting the response they want? Aren't there organizations with the sole purpose of investigating Free Software license violations, with access to actual lawyers? Where's the email thread of such correspondence? This sounds like a child crying mommy. Oh, and while I usually approve attempts at breaking the way-too-serious corporate speak, smileys seem to detract from the gravity of the issue being discussed. Can we get responsible people to handle this, please? Like the Free Software Foundation? Not a flash mob on the internet. This is counter-productive.
duncan_bayne 11y ago
Duncan here. I'm the one who contacted BMW to ask about source code availability. I don't own one of the BMWs in question, but the chap who wrote the original article investigating the update contents did. I've since been contacted by someone clueful from BMW Germany, and have put him in touch with the car owner. They are working together to determine what needs to be done for BMW to be compliant. tl;dr: It looks like it's all going to be sorted out amicably.

534 points by jordigh 11y ago

History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Hand this over to the Free Software Conservancy or the SFLC. And that should have been the first step. Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm

coldpie 11y ago
Yeah, it's pretty clear the suit has no idea what they're talking about. I don't know if SFC operates in Australia, but probably they could get some attention from the US division of BMW. Speaking of which, the SFC is currently running a fundraiser. If GPL enforcement is important to you, please consider signing up for a recurring donation. http://sfconservancy.org/ http://sfconservancy.org/
- ryao 11y ago
  Are there any organizations that pursue GPL violations that would stick to clear-cut cases of GPL violations where there is strong concensus among OSS developers that violations have occurred like the BMW case? For full disclosure, I am one of the ZoL developers. I believe that ZoL can prevent certain types of storage related failures that other production solutions do not, including those on systems intended to keep people alive. My desire to see that has required that I make an effort to understand what the GPL permits and what it restricts. So far, my talks with lawyers have suggested that my (and others') work in ZoL is legally alright under copyright law. The SFC considers easy access to ZoL binaries to complicate their arguments in certain GPL enforcement cases and rather than accept that reality to the benefit of the wider community, the SFC has opted to claim that ZoL binaries as distributed by Canonical are themselves a GPL violation. While I want to see the BMW case litigated, wanting to see GPL violations litigated and contributing to an organization that calls any use of OSS a GPL violation whenever it perceives the possibility of a court agreeing that claim to make litigation of certain cases of actual violations slightly easier are two different things.
  - coldpie 11y ago
    I haven't followed the ZFS stuff much at all, but SFC's news post about it the other day did make me wonder why they were doing it. I think it's important to enforce the GPL and other copy-left licenses when they are being blatantly violated, even if the original authors no longer care about the project. But if it's an unintentional license incompatibility, where the spirit of the licenses are roughly aligned, who really cares? Who is benefiting by bothering Canonical or the ZFS-on-Linux developers with these license concerns? In my case, SFC is pro-bono council for the Wine project, from which I derive my income. So even if I don't always completely understand what they do, I feel I should pitch in because they contribute to my livelihood. I'm not a legal guy, I don't pay super close attention to this stuff, I trust them to do something not far from "the right thing."
    - ryao 11y ago
      It might help if you wrote to them telling them how you feel. I will not think badly of you whatever you decide to do going forward. I realize that this is an awkward situation and if I were you, I would probably have made the same decisions. The unfortunate situation aside, thank you for your work on Wine. Wine has been helpful to me on multiple occasions. :)
matt4077 11y ago
I think that argument may have used to make sense in the 90ies when open source was new and was trying to establish itself, mostly with a dream of "Linux on every desktop". Now it has found its market and the ecosystem as a whole really couldn't give a damn if BMW is kind enough to use OSS or not.
- jackhack 11y ago
  Respectfully, I don't think this is about 'kindness.' This is about BMW, a commercial entity, respecting the legal rights of the property creators as owners. The license agreement is clear, and certain actions must take place if BMW chooses to benefit from use of the software. BMW is free to NOT use the software if they feel these restrictions are too severe. Or am I missing something?
  - semi-extrinsic 11y ago
    I think they were trying to say that the OSS community at this point in time doesn't need BMW to be "kind" and use OSS to help OSS gain popularity. Especially not if they can't be bothered to comply with licenses.
  - pigpaws 11y ago
    the way I read its is that no, BMW is NOT legally required to release it as it is in a proprietary piece of HW, and releasing the code could thus cause harm to their business. and while they ARE using it for 'gain', no one can prove that they were HARMED or had a loss of income or even IP (outside of copyright) by their (BMW's) use of such as it is essentially 'free' in that no money or barter items were exchanged. They MAY have a copyright claim at best, but again, I am not a lawyer. That's just how I see it. Is there a precedent to enforce GNU licensing outside of copyright infringement?
    - witten 11y ago
      That's not how the GPL works. If it would be inconvenient for BMW to incorporate GPL software and properly comply with the license by providing source, then their only alternative is not to incorporate the GPL software. Full stop. Harm or proprietary hardware has no bearing on the rights granted by the GPL.
cnvogel 11y ago
I don't see any shame and blame yet. The only thing these emails show is the claim by BMW that no software not developed or fully owned by BMW is running on their cars infotainment system. A shame and blame game would start when one analyzes the software updates, is able to prove that the above statement is a lie, and make a big fuzz about it. This would BMW fear loosing their face and be counter productive, I fully agree.
jMyles 11y ago
> History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Is this true?
cookiecaper 11y ago
I disagree. The fact is that large companies like this are never open to "civil discourse and cooperative solutions" when it comes to copyright, trademark, or other intellectual property matters. BMW will see no reason to comply with the GPL. The only thing a big company responds to on such issues, other than bona fide legal action, is negative press. I think it'll be difficult to manufacture some over the technicalities of copyright compliance, but can't blame OP for trying and not wasting his time trying to navigate the corporate copyright labyrinth. Source: I have a C&D from a Fortune 500 alleging that I violated some intangible rights. Their argument is weak, but I don't have the millions of dollars every lawyer I've talked to has said I'll need to see the case through (tens of thousands to even get started). I've spent 6 months trying to navigate their corporate structure and get in front of someone who matters. Everyone just tells me to sod off, with varying degrees of politeness. I have not yet been able to locate someone in the company who actually seems willing to have any discussion, and their law firm is obviously not open to this since their instructions were to shut me down. I'm considering the alternatives I have, and wondering if it's time to try to work the media and attempt to get some movement from them that way (though I don't really think this will work, it's becoming the only option).
- godzillabrennus 11y ago
  Post your story online and use something like thunderclap to get more awareness through your network.
lucb1e 11y ago
History has proven over and over again that naming and shaming works miracles. Companies that turned a blind eye and were completely unreachable suddenly turned active and kind just to save their reputation. Going to or even just threatening to go to the media, I know from experience, is indeed productive. I am really curious where you got the idea that it's counter productive. Asking the conservancy to clean up this dirty work is expensive and takes forever.
- leereeves 11y ago
  Sometimes shaming works, sometimes it doesn't, and sometimes the mob is misinformed and crucifies an innocent.
  - lucb1e 11y ago
    The customer service rep might be spreading misinformation, true, but without attention or legal actions, odds are high we'd never know. Better put some pressure on them to actually give a true answer than assume they violate the license and quietly let them continue.
- akamaka 11y ago
  The problem is when random people from the internet start unwarranted attacks over GPL violations when the problem can be dealt with constructively. The example that pops into my head is the time when some kid start working on a mod to the Quake 3D engine that was possibly in violation of a free software license. Instead of just reporting it to the copyright holder (id Software), they engaged in a campaign of harassment until John Carmack himself came out and told them to stop. It was some seriously shameful shit. Public shaming should be one of the last steps to take. Maybe before starting a lawsuit, or maybe after, that's up for debate, but certainly after other avenues have been exhausted.
  - lucb1e 11y ago
    I see your point but would say there is a difference between a kid and a multinational. The same law rules both but an individual doing this by accident vs. a company doing it due to ignorance (in the best case) is different. The multinational has enough money to defend itself in court, any individual is bound to have less, especially a kid (in your example).
TelmoMenezes 11y ago
> History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite. Can you please provide some evidence for this statement? > Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm Depends on what your goal is. If your goal is to obtain the source code in this specific instance, and if you don't care about the efforts of open source contributors, then I guess it would make sense to privately "discuss" and "cooperate" with BMW. On the other hand, if you want to scare companies into not stealing other people's work in the future, then I think naming and shaming is a reasonable strategy. This is a clear case of rationalization about rules not applying to the powerful. Surely you would not expect BMW to care about "burning bridges" and value "cooperation" and "discussion" with you had they caught you stealing their IP.

dmm 11y ago

What GPL licensed software are they actually infringing upon? The linked post[1] says they found mentions of systemd, but does the firmware actually contain a linux kernel? I don't see anything that looks like a kernel in the file listing. Also if the firmware is properly signed delivering it over http shouldn't matter, right? [1] https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-updates-une=ncrypted/ https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...

noselasd 11y ago
The specific update here is just a delta update, and doesn't contain the entire firmware. But it does contain shared libraries built for running on a linux system, so it stands to reason there's linux kernel running somewhere there. (On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux)
- cynix 11y ago
  > (On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux) Yes, people have sent requests to Tesla, and they continue to ignore these requests to this day. See http://www.teslamotorsclub.com/archive/index.php/t-10748.html http://www.teslamotorsclub.com/archive/index.php/t-10748.htm...
- dTal 11y ago
  >semi-officially said they're running Linux The Model S was independently confirmed to be running Linux 2 years ago: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network/page9?p=608435&viewfull=1#post608435 http://www.teslamotorsclub.com/showthread.php/28185-Successf...
lucaspiller 11y ago
Apparently Mini (also made by BMW) has a similar update structure, and that runs QNX, so it's likely this does too: http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/ http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/

_Codemonkeyism 11y ago

Poor customer support agent.

deleted 11y ago

[deleted]

strictnein 11y ago

I'm confused here. Where is the evidence that they've modified GPL'd software, which they are then distributing, and are refusing to distribute the source code for their modifications?

nailer 11y ago
> Where is the evidence that they've modified GPL'd software There's a Linux kernel and systemd in the 'i3'. See the links in the first few sentences of the article. > which they are then distributing BMW is a Bayerische Motor Work, a car company that distributes cars > and are refusing to distribute the source code for their modifications? The letters from BMW to the people asking for a copy of the source, stating they are refusing to distribute the source code for their modifications, linked to in the article.
- strictnein 11y ago
  I read that, but isn't this is the lowest type of "violation" there is? People are just wanting them to host the source code that is already available in about a billion locations then? My question still stands, is there evidence that they're modifying GPL'd code and then not distributing that code?
  - bcook 11y ago
    Are you confusing source-code with machine-code? GPL is concerned with source-code.
    - ArbitraryHobo 11y ago
      http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html > object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:
      - bcook 11y ago

sudhirj 11y ago

Is it a violation if they don't modify Linux itself? So if I make a device that runs Linux and my application binary, am I required to make my application code public?

lucb1e 11y ago
In that case, it shouldn't be a problem to point to Linux' code repository right?
- ocschwar 11y ago
  And it won't be. But cut their public relations staff some slack. They can't tell Richard Stallman from Gregory Rasputin, and before saying or doing anything they're going to be bringing themselves up to speed on what the GPL is. No need to get rage-y just yet.
  - lucb1e 11y ago
    It's their obligation to forward what they don't understand. If I work for a mobile network carrier and say something that indicates we don't follow some privacy law, it's my fault for not asking my boss how we handle certain things. (And my boss might ask his/hers, etc.) Edit: I didn't downvote you, by the way.
  - ocschwar 11y ago
    All true. But until word comes down from legal about what to say, you can't blame the PR flacks for saying nothing.
pyb 11y ago
It would not be a violation in this case.
- iajrz 11y ago
  It is if they don't redist the kernel code they're using - if it's GPL'd, and you redistribute the binaries, you acquire the responsibility to redist the source.

antocv 11y ago

Has anyone ever seen GPL being encorced in any country? Wont this end with BWM uploading a tar.gz of a kernel found on kernel.org and call it a good working day? Have seen it happen too many times, and in most countries the user has no claim on the license/copyright. So unless I contributed/own some copyright found in exact Linux kernel version/other software used by a distributor, and buy their stuff, there is zilch I can do. Which also means, you are free to sell/and break GPL software/license and as long as you dont upset somebody who owns the copyright to it, you're good to go.

luso_brazilian 11y ago
Yes, and actually on BMW home country, Germany. The summary can be read at this old Slashdot submission [1] from 2005 but the gist of it is that > Harald Welte of the netfilter/iptables core team sought to enjoin Sitecom from distributing its WL-122 router, which used netfilter's GPL'd code, without also providing the source code and a copy of the GPL, as that license requires and > The Munich Court granted Welte a preliminary injunction [2] and then upheld that injunction [3][4] I believe there are other instances of GPL being upheld in courts around the world and this one should be only one of many examples. GPL is not even necessary in these cases, in the absence of the (GP) license it reverts to the default copyright rules, with all rights of copy and distribution being at the hands of the copyright holders (save for Fair use and other exceptions). A company that would try to argue that GPL is not a valid license in court would actually be admitting in court that they are distributing the software without a license from the copyright holders all along. [1] Munich Court Again Enforces GPL: http://news.slashdot.org/story/05/04/14/2024258/munich-court-again-enforces-gpl http://news.slashdot.org/story/05/04/14/2024258/munich-court... [2] Preliminary injunction: http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=123 http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=... [3] Injunction upheld: http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=117 http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=... [4] Court's decision in English (pdf): http://www.jbb.de/judgment_dc_munich_gpl.pdf http://www.jbb.de/judgment_dc_munich_gpl.pdf
- darkr 11y ago
  Yup, I can remember several companies settling and being forced to comply for violations of busybox GPL'd code in the US off the top of my head - Verizon, Extreme Networks and Xterasys. There are likely quite a few other examples of GPL being successfully enforced.

castis 11y ago

What is the worst-case scenario for an entity that refuses to comply?

Kiro 11y ago
Probably not much and that's why I don't put any licenses on my stuff.
- Tyr42 11y ago
  Refusing to put a licence on your code does stop people from using it. If you really don't care, just slap a MIT license on it and be done with it, no one will bother you afterwards.
- umanwizard 11y ago
  So, you release code but don't let anyone use it? Because that's the legal effect of not putting licenses on your stuff.
  - Kiro 11y ago
    Yep and I use code without license all the time. Show me one case where that has ever caused a problem.
    - oldmanjay 11y ago
      The point isn't that it may cause you a problem. The point is that the license is the structure by which people understand how they can use things, and the lack of a license is generally taken as "don't touch this" by the larger community. It's essentially opting out of the larger pool of contribution, which is of course totally valid and your right.
      - umanwizard 11y ago
        It's not just how the community interprets it; it's the law.

fauria 11y ago

Harald Welte founded gpl-violations (http://gpl-violations.org/about/ http://gpl-violations.org/about/) 12 years ago. The have been offline for some time, but it looks like they plan to continue with their activities this year: "Actual GPL enforcement activity is expected to resume at some point in 2016." Maybe they can help sorting this out.

rattray 11y ago

Worth noting that the BMW people in the thread are in customer support, not legal.

SyneRyder 11y ago
Looking through the user's Github account, they have a history of contacting customer support representatives of companies and threatening to post the transcripts to Hacker News if their specific legal concerns are not addressed: https://gist.github.com/duncan-bayne/74d6e38c506000982237 https://gist.github.com/duncan-bayne/74d6e38c506000982237
- pjc50 11y ago
  How else can one get in touch with a megacorp?
  - spiznnx 11y ago
    I would assume the legal department would generally read and respond to letters on legitimate concerns, even at a megacorp.
    - nevinera 11y ago
      Generally speaking, they will definitely read them (and occasionally take action), but only respond if they have some legal obligation to do so. Any reply they make to an inquiry or accusation of this type can be used against them, but a lack of response cannot (unless that lack of response violates some requirement of the law).
      - anonbanker 11y ago
        This is why it's good to have a bilateral contract with them prior to your contact, so that they have a legal obligation to reply. When they dont reply to your offer of renegotiation or relief, you're safe to use their silence as acquiescence or dishonor, depending on circumstance.

SyneRyder 11y ago

Google could have helped here: BMW Car IT: Open Source http://www.bmw-carit.com/open-source/ http://www.bmw-carit.com/open-source/ I'll take a guess based on the filename "ConnStarter" in the BMW firmware that ConnMann is the primary GPL'd software. As the BMW site says: "The ConnMan project provides a daemon for managing internet connections within embedded devices running the Linux operating system.... ConnMan is available under the terms of the GPL v2." http://www.bmw-carit.com/open-source/connman.php http://www.bmw-carit.com/open-source/connman.php You can download the source if you like.

jmiserez 11y ago
The linked site may be useful, but where on that site did you find a download link for the specific software version (including modifications) used? All I see is a generic link to ConnMan's project website. I don't think that suffices?
- knd775 11y ago
  This was linked from the project website http://git.kernel.org/cgit/network/connman/connman.git/ http://git.kernel.org/cgit/network/connman/connman.git/ edit Never mind, I misunderstood your comment
  - jmiserez 11y ago
    Yes, but that is just the ConnMan development repository. Correct me if I'm wrong, but I think BMW would need to redistribute the exact version of ConnMan that they used, including any modifications made. At least a deep link to a branch or tag would be nice.
    - the_mitsuhiko 11y ago
      But only on request.
    - deleted 11y ago
      [deleted]

jolux 11y ago

pretty sure it's this: http://www.magnetimarelli.com/excellence/technological-excellences/open-source-platform-genivi-compliant http://www.magnetimarelli.com/excellence/technological-excel... can't find the source for it though.

deleted 11y ago

[deleted]

greydius 11y ago

Please correct me if I'm wrong. I thought the GPL only required providing the source code to the purchasers of the product. (Who can then redestribute it if they'd like.) I didn't think it meant that if you use GPL code in your product, then you are obligated to make your code available to everyone.

voxic11 11y ago
You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public.
voxic11 11y ago
You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public. It seems in this case they released a patch to their software and made the patch available to the public.
- 13of40 11y ago
  If I sell a computer with Linux on it, and I bundle on my own application that's compiled to run on Linux, am I required to make the source code for that application available? In this case, if they just have an unmodified copy of Linux to provide the run-time environment for their nav system or whatever, and the nav system itself is an application on top of it, I don't know if it follows that they need to release the source for their nav system.
  - icebraining 11y ago
    If it's an application, no, but if it's a kernel module (e.g. drivers to talk to their devices), then yes. They still have to offer a copy of the kernel source, even if they haven't modified it.
    - 11y ago

rewqfdsa 11y ago

Good. I'm sick of people walking over copyleft licenses generally. It's only because of copyleft that there exists a pro-sharing social norm in the software development community. If you kick down the GPL, the norm will shift back toward proprietary software everywhere. You, young developer, have no idea just how shitty a world that is.

OJFord 11y ago

It seems to me less like refusal to comply with the terms of GPL, and more like denial that they use GPLed code. > I have confirmed with our technical department who > advised that ... the usage rights agreement states that > the software is protected by copyright and BMW is the > sole owner... it is not subject to the requirements of a > "Public" licence That may or may not be the case, but to me that doesn't say "yeah we use, na you can't have it".

goerz 11y ago

It seems to me that they're not distributing any software (i.e., the product is a car, not software), which means licensing doesn't come into play. It would be akin to someone finding out that I'm privately using (and maybe modifying) GPL software, and then demand that I make the source code available to them. Only in GPLv3, the issue of selling a product that uses GPL software internally is addressed. The situation changes of course once they make the software itself accessible to third parties, in which case they'd also have to supply the source code.

ceejayoz 11y ago
If that were the case, you could get around the GPL by claiming to sell CDs, thumbdrives, or zip files. Including software in your hardware product is undeniably distributing that software, IMO.
- goerz 11y ago
  I disagree. If you sell me a CD with software on it, I have the software. If you sell me a car that runs a software internally, I have a car, but not the software. The car, unlike the CD, is not a container for the software. In fact, there is no trivial or intended way to get the software out of the car. As I said, GPLv3 addresses this explicitly, but with GPLv2 the license just doesn't apply. Then again, lots of people strongly dislike GPLv3, possibly exactly for this reason.
  - goerz 11y ago
    Incidentally, if you send me a USB stick with some GPL software on it, I can demand that you give me the source code of that software. However, I can not demand that you also give me the source code for the firmware of the USB stick, even if the source code for that firmware is under GPL (v2)
    - cyphar 11y ago
      I would definitely demand the firmware if it is GPL. Just because it is "firmware" doesn't suddenly not make it software that you've given me.

famerr 11y ago

So it is strange for me even if I understand GPL. Does it means all the network routers running custom linux have to provide sources of entire modification? I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists).

zmmmmm 11y ago
No. There is a boundary between the "kernel" which is strictly GPL and the "user" operating system which is (in its interaction with the kernel) based on LGPL and weaker libraries. So these routers have to distribute changes they make to the kernel, yes, but not any and everything that runs on the router.
- famerr 11y ago
  Makes sense, thank you for explanation.
rbanffy 11y ago
> Does it means all the network routers running custom linux have to provide sources of entire modification? Yes. > I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists) What problem? Making the source code of the programs you distribute to your clients available is not a problem - it's an obligation you agreed with when you used the GPL'ed program as a basis for your own. You could do like Sony, who used *BSD on the PS4.
- famerr 11y ago
  Good point, thank you.
st3v3r 11y ago
What's the problem?
- famerr 11y ago

zmmmmm 11y ago

To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. If he does then included with the car should be an offer for how to access the GPL source code. He should have followed that (or clearly stated that he could not locate it in his email). The requirement for him to enter the VIN to access the source code does not seem unreasonable since they are only required to distribute source code to customers, and he has simply emailed them out of the blue asking them to give him the source without any proof that he's a customer. The statement about BMW being the "sole owner" is probably concerning proprietary parts of the software that may not be subject to GPL at all. It is probably way beyond the skills of some random customer service rep to distinguish the subtleties of those kind of things. This kind of interaction actually looks to me to be counter to the spirit under which the Free Software Foundation tries to administer the GPL - which is that they work cooperatively to help companies comply rather than try to trick them into legal hot water. I agree with the FSF approach and I don't think this sort of PR ambush type tactic is helpful in promoting the use of free software.

ratboy666 11y ago
No, the offer for source must be to anyone -- the supply of a binary may be limited. BMW cannot be the "sole owner" of the copyright -- even if they own the part they wrote, they must still supply source for the GPL parts.
- deleted 11y ago
  [deleted]
- qznc 11y ago
  "the GPL requires you to make the modified source code available to the program's users" Source: https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourcePostedPublic https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc... BMW does not have to provide the sources to everybody. Only to its users. edit: tzs also has a point. Hm?
  - 11y ago

stusmall 11y ago

I've gotten the same response from a company when requesting kernel source before. What is the best source for help in dealing this? I reached out to GNU but got no response. I know the kernel isn't their project but didn't know where else to turn.

genericacct 11y ago

Frankly: given recent news (hacked jeeps, software used to cheat on emission tests) I think it is time to _require_ _all_ software used on vehicles that transit on public roads to be open sourced and available to the public. (for independent testing and verification in the name of public safety)

lucb1e 11y ago
Vehicles aren't the only things running software that might need verifying. Far from it. While I wholeheartedly agree that it would be an amazing step, I also fear the huge backlash from the car and IT industry. Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so). Of course Windows 10 wouldn't have to be open source just because Windows is older than 20 years, but Windows 95 would be. Anyway, that is just one of the many possible ways. I just think we should be weary of people stuck in the old ways and not limit the move to just cars.
- cyphar 11y ago
  > Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so). In that case, the car software is still proprietary software so you've gained very little from making the source code public. If a vulnerability is found, you can't write a patch for it and you have to wait for BMW to "get around to you". Car software should be free software upfront.
  - lucb1e 11y ago
    > Car software should be free software upfront. Yes! Just like medical implants (and the server-side counterparts that control them), and my password manager, and actually any software that is in between me and my password manager (OS, drivers, perhaps a browser), and private stuff like my email client/server, and instant messaging client/server, and things that track my vitals like those smart watch-like wristbands, and any non-domestically developed software the government uses, etc. Except few people aside from a few "open source radicals" will think like that. For every person I know who will fully support this motion, I know five who will object and another one or two who aren't really sure, and I already have a biased social circle because I do believe in this cause. As it stands, we never get to peek under the hood. A system like this would at least make people aware that "gosh, if we implement this cheating now (or whatever), we have to make sure to cover it up before we have to go public with it. Better document extensively where it's implemented so we can remove it thoroughly". Which is a bigger step than just one manager going "do it". And we would be able to see trends over the past years and reflect necessary changes in new policy. Perhaps two decades too late by then, but as it stands, we have naught. Then once people get used to the idea that in 20 years, when the software is commercially useless anyway, perhaps we can open source it sooner. Or more companies will go "look at us, we publish after 5 years for transparency without loosing our cutting edge!" A bit of wishful thinking perhaps, but I'm sure some will, and everyone would be forced after a certain time anyway. But once again, this is just one way of doing it. There are almost certainly better ways I didn't think of yet. We should just be thinking about it in the first place.

y04nn 11y ago

At least their update binaries are unencrypted, which allow us to see what they are using. If some of you want to have a look: The article: https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-updates-unencrypted/ https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw... Direct link to the binary: http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07012.bin http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07...

kazinator 11y ago

Misleading title; it looks more like they in fact refuse to acknowledge at all that some of the code is someone else's. > Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence [sic] I.e. "This is all our software; there is no third-party GPL stuff in it, so we need not comply with any such license."

sargun 11y ago

Tesla still continues to violate the GPL as well - https://forums.teslamotors.com/forum/forums/gpl-sources https://forums.teslamotors.com/forum/forums/gpl-sources.

yeukhon 11y ago

This topic is getting dull every time on HN. Someone has to argue about GPL, free software vs proprietary software.

outworlder 11y ago

This is ridiculous. So now, any John Doe can contact customer support of any company, then publicly shame them for not getting the response they want? Aren't there organizations with the sole purpose of investigating Free Software license violations, with access to actual lawyers? Where's the email thread of such correspondence? This sounds like a child crying mommy. Oh, and while I usually approve attempts at breaking the way-too-serious corporate speak, smileys seem to detract from the gravity of the issue being discussed. Can we get responsible people to handle this, please? Like the Free Software Foundation? Not a flash mob on the internet. This is counter-productive.

duncan_bayne 11y ago

Duncan here. I'm the one who contacted BMW to ask about source code availability. I don't own one of the BMWs in question, but the chap who wrote the original article investigating the update contents did. I've since been contacted by someone clueful from BMW Germany, and have put him in touch with the car owner. They are working together to determine what needs to be done for BMW to be compliant. tl;dr: It looks like it's all going to be sorted out amicably.