23 ms·

The kernel community confronts GPL enforcement

125 points by corbet 10y ago

samfisher83 10y ago
A lot companies use Linux kernel and don't release any of the source. They are working on the backs of millions of hours of human labor. For example DJI uses linux on its drone and open wrt on its controller. I don't see any source code for that. LeTv and many other Chinese cellphone makers don't release source code for their kernels. They really have no alternate they could go to. I think it makes sense that kernel community would be more aggressive about making companies return the code with which their products couldn't really exist without.
- delinka 10y ago
  The Linux kernel codebase is pretty flexible. Are there really changes that had to take place to put the kernel into a drone? If not, there's nothing for DJI to release. Isn't there already a mechanism for handling binary-only kernel modules/drivers? Perhaps DJI's 'changes' can be expressed in such a binary-only module. There seems to be a fairly large part of the tech community that is willfully ignorant of how these licenses work and how the kernel copyright holders have addressed violations in the past. These folks seem to think that because some corporation downloaded the Linux kernel source, that the company's entire codebase should be open source. As always, it's much more complex.
  - davexunit 10y ago
    >Are there really changes that had to take place to put the kernel into a drone? If not, there's nothing for DJI to release. Yes, there is. If they distribute a product with binaries built from GPL'd code in it, they must provide the source upon request. It doesn't matter if they've changed it or not.
    - tzs 10y ago
      > If they distribute a product with binaries built from GPL'd code in it, they must provide the source upon request. That's a little bit of an overstatement. It is sometimes possible to distribute GPL binaries without incurring any source obligation, and I suspect that this is going to be come a lot more common as IOT devices become more popular. For example, Amazon, Best Buy, Walmart, and others sell assorted consumer products, such as televisions and routers, that contain Linux-based firmware, but they do not have any obligation to provide the source. All they are doing is receiving boxes of televisions and routers and other goods from the manufacturers (or from the distributors who receive them from the manufacturers), and then selling those items to the consumer on a one to one basis. A copy of Linux comes in to them embedded in some physical thing, such as the FLASH memory in a television or router, and they sell that particular physical hardware and that particular copy of Linux to a consumer. The first sale doctrine, which pretty much every major country I believe has in some form in its copyright law, says that doing this does not require permission of the copyright owner. If you aren't doing anything with GPL code that requires permission of the copyright owner, GPL has no power over you. Right now, I don't think this is a big issue because usually you can find out who does have an obligation to provide the code. Buy a television or router from Best Buy, and it will be from some reasonably prominent manufacturer, such as Samsung or Netgear, and that manufacturer probably is the one who was actually making copies and putting them on the device. They have the obligation to provide source, and they usually have some reasonable way to contract support and find out how and where to actually get it. I think this may change as IOT becomes more common. I think we'll see several companies that make generic IOT base platforms, which they sell to companies that want to make IOT devices for specific applications. Those companies will add their software to the software of the base device, and hook up the specific sensors and actuators needed for their application. A technically sensible way to make the generic base platforms is to make a Linux-based system that has the kernel and the standard utilities on a root partition in FLASH memory, and has a memory card slot. Upon startup have the init system wait for a memory card to be inserted that contains a valid filesystem, mount that filesystem on /home, and then look for /home/iot/startup.sh. If that exists, it becomes the iot user and runs /home/iot/startup.sh. Companies that use this generic base to build their IOT device do not have to modify or copy the kernel or anything else on the root partition. All of their code lives on that separate memory card, as user mode applications and scripts. These companies, when they want to make a manufacturing run of, say, 5000 devices, would buy 5000 units of the generic IOT base system, build and connect 5000 of their sensor and actuator modules, insert 5000 copies of their user mode application and script memory card, and ship the 5000 devices out to customers, distributors, and stores. So you go to Best Buy and buy one of these things and want source code to the Linux contained therein, what do you do? If you ask Best Buy, they say they just passed on the box they received, and point you to the manufacturer listed on the box. When you contact them, they say the same thing...they just bought these generic Linux IOT bases, and plugged in their hardware modules and inserted their memory cards (which contain no GPL software), and if they are feeling nice they tell you the name of the company that made the IOT base. If they are not feeling nice, or they consider information like who their suppliers are to be a trade secret, they may decline to tell you where they got the base platform, and you are pretty much stuck. It could even get worse, because I suspect that in some markets there may be multiple layers of this. You'll have at the bottom layer companies making a fairly generic Linux-based system for embedded use. At a layer above them you'll have companies that take those generic systems and partially specialize them for particular industries or fields or activities. They may add special hardware interfaces, put them in rugged cases, or things like that. A layer up from that would be the companies that turn these into products for end users. And that isn't even the worst it can get. It is actually possible to get a GPL binary commercially that nobody has obligation to provide source for. That's because GPLv2 provides two ways to satisfy your source code obligation if you commercially distribute a GPL binary: 1. Include the source when you distribute binary. 2. Provide a written offer, valid for at least three years, to provide the source to any third party who requests it. Suppose the maker of the generic IOT base device, the one that has Linux on its root filesystem and on startup tries to mount the memory card and run the user mode application found there, includes in each box a CD-ROM that contains the source for all the software on the root filesystem. (That's what I would do...I'd rather go to the slight added trouble up front of adding a CD-ROM to the shipment now and be done with it than have to deal with it spread out over several years). Their customer, the company that is making, say, an IOT nose hair trimmer, doesn't care about those CD-ROMs. They just want to add their hair length sensor module, and their clipper module, insert their memory card with their software, package it all up nicely, and ship it off to the retailers. They toss the CD-ROMs in the trash. You buy one of these nose hair trimmers. Who is obligated to give you the source? How about the generic IOT base device maker? Nope. Every GPL binary they shipped was accompanied by the complete source code, so they satisfied their GPL obligation. How about the nose hair trimmer company? Nope. They are just shipping out copies they received, and are covered by the first sale doctrine. If this becomes common enough for the FSF to see it as an issue that needs to be addressed in GPLv4, it will be interesting to see if they can come up with a good solution. The basic problem is that the option to satisfy your GPL obligation by including the source with the binary extinguishes your obligation in regard to that binary without guaranteeing that when the recipient of that binary redistributes that they will incur a source obligation (because first sale provides a situation in which they can distribute without incurring any copyright obligation). Offhand, I only see one way to address this. Make it so that if you distribute a GPL binary (in a way that required copyright owner permission) then you must provide source to any third party that requests it. Back when GPLv2 was written, that could have been quite onerous, because distributing source usually meant sending a tape. Nowadays, distributing only is easy, and there are plenty of free hosting services for source code, so it probably wouldn't be too onerous. Still, that would be a pretty big change, and I think a lot of people would be very upset at the "fire and forget" option that "include the source code when you distribute the binary" provides. Anyone see any other ways to address this?
  - pricechild 10y ago
    Via https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html ... From section 3, my understanding is that if you distribute then you must do one of the following: a) include complete source code b) include an offer of source code if contacted c) include the offer of source code you originally received (It's a bit more complicated than that... but close enough) So... if they're distributing the kernel as part of a drone they're selling, these clauses would apply? I'm not sure why "changes" they may or may not have made would have anything to do with it?
    - palunon 10y ago
      If they didn't change anything, they can simply point you to kernel.org to comply with c), can't they
      - mjg59 10y ago
        Only if they received code from kernel.org with a 3(b) written offer.
        tzs 10y ago
        Can that happen? 3(c) is only applicable if they received the code in object or executable form. Does kernel.org distribute object code, or just source code?
        ashitlerferad 10y ago
        Just source code.
  - new299 10y ago
    My understanding is that they have to provide clear instructions on where to get the source. In general, bringing up Linux on a new platform does require extensive modifications. They often use u-boot too, things like switching on the system DDR, DDR timing etc require significant changes to u-boot (which is also gpl). In my experience those changes rarely get released. I've never heard anyone say a company should release everything just because they used the Linux kernel... But that's just me.
    - mpol 10y ago
      > My understanding is that they have to provide clear instructions on where to get the source. No. Only when they distributed their software to you (the Linux kernel under the GPL) then you can request the sourcecode for that under the GPL. If you never had any code being distributed by them to you, they have no obligation to you.
      - mjg59 10y ago
        This is a common misunderstanding. You have two choices when distributing GPLv2 software commercially: you can either provide the source code alongside the binaries (section 3(a)), or you can provide a written offer to provide the source code on request to any third party (section 3(b)). Non-commercial distribution can forward on a 3(b) offer rather than making their own.
        infinite8s 10y ago
        Exactly. Except that if you as third party do not receive the the Program (or a work based on it, under Section 2) in object code or executable form, then you have no rights under section 3. So a company that sells GPL'd software is only required to provide the source to any of their purchasers (however, those purchasers are not restricted in any way and can give the source to someone else). So the only way I could get the source code from that company is if I purchase their product.
        tzs 10y ago
karma_vaccum123 10y ago
I see this as a stealth attempt by the Software Conservancy to hijack the direction and tone of kernel development, dragging it more to FSF-style militancy. Linus is right, there is no crisis in GPL violation. There will always be violators. Any law or contract or license will be violated. Becoming more militant about enforcement will simply cause most corporate partners to disengage. Most users comply with the license. Users have access to interesting and useful source code and have never been restricted from accessing the kernel. The kernel team is on good terms with most corporate users. Going after the 5% of violators will change how the kernel team interacts with the 95% of good partners. The only thing Linus seems to be disingenuous about is his claim of support for the GPLv2. My guess is he secretly wishes he had chosen a different, non-copyleft license.
- Karunamon 10y ago
  >Going after the 5% of violators will change how the kernel team interacts with the 95% of good partners. How do you figure that? The only way this could apply is if the "good partners" are violating the GPL on the sly, or with a wink and a nod (not bloodly likely) which would make them not so good anymore. The GPL has no reason to exist if its terms are not enforced.
  - karma_vaccum123 10y ago
    ....and Linus' point is that the victory will be pyrrhic, since people will simply avoid the GPL altogether. We've already seen this with the GPLv3/AGPL. Really outside of the FSF, the only adoption is in dual-licensers who use it to drive purchases of the alternatively-licensed sources.
    - Karunamon 10y ago
      Enforcement of the license people agreed to will cause people to avoid using the license? The only way that makes sense is if people thought that the GPL was the thing to use was due to it being toothless, a notion that it's strictly better to disabuse people of.
wyldfire 10y ago
> ... Bradley isn't the one making the decisions here. It's the developers Gee, this debate seems to have given some large amount of power to the individual contributors to the kernel. Any individual developer could defect from Linus' stance and work with the SFC on an infringement case. I'm curious to see if any of them are more dogmatic with respect to copyleft. I suppose it makes sense that features CONFIG_'d off shouldn't be considered for infringement, but for many binary distributions of the kernel it probably still catches a lot of developers. I always thought it was baloney red tape to do copyright assignments but if it had taken place here it would be a very different debate. The developers would have effectively ceded all control over this discussion to the assignee (who probably would've been The Linux Foundation, if anywhere).
- mordocai 10y ago
  > Any individual developer could defect from Linus' stance and work with the SFC on an infringement case. I was looking for a source and was unable to find it quickly, but I'm pretty sure a significant number of kernel developers have joined some kind of SFC organization that allows the SFC to use their copyright in order to sue for compliance. Edit: Thanks ashitlerferad, I missed the section on linux here: https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/. That's the source. Edit2: Please read JoshTriplett's comment below for some clarifications on this subject.
  - ashitlerferad 10y ago
    https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/linux-compliance/
  - JoshTriplett 10y ago
    As mentioned in the linked email thread, the kernel developers working with Conservancy do not typically assign their copyright to Conservancy, and do not cede their decision-making authority over legal matters to Conservancy. (Also, they go by "Conservancy" or "Software Freedom Conservancy", not "SFC", to avoid acronym confusion.) Some developers on various projects (including the kernel) have voluntarily signed over copyrights to Conservancy for various reasons, but their GPL compliance project does not require that.
pjc50 10y ago
As mentioned in the article, forswearing lawsuits is a bad idea: then companies have no downside to not cooperating.
- karma_vaccum123 10y ago
  They can already hide behind legal firewalls like the Chinese border. If the Software Conservancy continues, they'll just push more development to places where scofflaws can ignore them.
  - qaq 10y ago
    If they are OK with loosing western markets they sure can
    - bcoates 10y ago
      This makes me wonder if they'd be better off pursuing complaints with Customs than with lawsuits. Getting a shipment of infringing hardware impounded at the border would be a lot of leverage.
      - ashitlerferad 10y ago
        That has happened before: https://lwn.net/Articles/404450/ https://lwn.net/Articles/404450/
- yxhuvud 10y ago
  Yes they do. They have to maintain their own branch, which may be very costly when new versions of linux would arrive. Successful upstreaming mitigates that.
  - pjc50 10y ago
    Maintain? These are hardware vendors. Once it's shipped they rarely care.
lamarkia 10y ago
It looks like a simple issue that transformed into drama due to the attitudes on the lkml. It is obvious that there will be cases that the GPL will have to be enforced. Was accepted by the other side in the end. The SFLC will only undertake a case if they have the support of copyright owners, not on their own volition.
- JoshTriplett 10y ago
  Note that there exists a different organization known as "SFLC", but the linked discussion occurred with the Software Freedom Conservancy (or just "Conservancy"), which specifically avoids using the acronym "SFC" to avoid confusion with SFLC.
  - lamarkia 10y ago
    Thanks for the clarification.
  - lamarkia 10y ago
    Thanks for the clarification.
smitherfield 10y ago
One thing that wasn't brought up (edit: ok, quickly glossed over) in the article — if you go to court, you can lose! There are various legal arguments I can think of, that would essentially trash the GPL, and a company with 8 figures to spend on lawyers could make very convincing (I don't agree with these, but a judge and jury could easily): 1. It's unclear whom the actual copyright holder or holders of Linux are, and who has standing to sue on their behalf. 2. Since Linux is open-source, free-as-in-beer, etc, it's public-domain. 3. Linux is a derivative work not entitled to copyright protection. And so on. Again, when one side might have orders of magnitude more budget for lawyers, this kind of stuff will be very convincing. (Many corps will pony up money to protect Linux, but they'll generally be on the opposite side when it comes to the GPL).
- bryanlarsen 10y ago
  That was one of the first points addressed in the article: the OP referenced the recent outcome in the VMWare case as an example of an undesirable outcome.
  - smitherfield 10y ago
    Fair enough; it was one fairly ambiguous sentence and easy to miss. Not meaning to criticize the article - which I found very interesting - just felt it could be a good conversation thread to discuss an aspect the article didn't really cover.
- databus 10y ago
  Going to court and losing, while not fun, should be instructive to the GPL community. A loss will either point out areas that need to be changed in the next GPL license version, or that a GPL-style license is not viable.
  - AstralStorm 10y ago
    Or that lawyers in that country are terrible?
  - 10y ago
ksk 10y ago
Interesting to note the tone of the comments when it comes to enforcing copyright law - Piracy vs GPL.
saynsedit 10y ago
Something that isn't transparent in this discussion is the fact that Linux is extremely corporate now. By that I mean, the vast majority of contributions are sponsored by corporations. Both Linus and Greg know that. They are keenly aware that if Linux takes a hardline GPL approach it will gain the reputation of being unfriendly to corporations. That perception will kill Linux in the long run. When they say they "Care about Linux more than GPL" they are really saying they care about corporate Linux since non-corporate Linux virtually doesn't exist anymore. I have nothing against that and honestly I think they have more clear opinions due to their positions as top-level maintainers. I just think the motivations and incentives behind their opinions should be clear to more people. The people's Linux is virtually dead. People need to eat. An analysis of that phenomenon would be interesting as well but is beyond the scope of this discussion.
- karma_vaccum123 10y ago
  By that argument, every non-copyleft licensed codebase is "dead" with respect to the "people". In reality, the opposite is true even though it burns up FSF folks. Linux is alive and well. You can download, read, edit and contribute back to the kernel for free. Maybe your patches won't be accepted, but the license doesn't guarantee that they will be anyway. It is true that you may periodically experience a scofflaw that sells you a router that hides some kernel code, but this should only bother you on philosophical grounds. The vendor has no obligation to allow you to "repair" or modify the device. The vendor is under no obligation to accept a patch from you if you find a flaw. Putting linux in a device does not grant the end user any specific right to change the device's behavior. People seem to be confusing "hackable" with "has GPL code". A shitty router with linux code will probably remain a shitty router. I can see why the FSF and SFC might be throwing a fit; Clang and LLVM can replace GCC, and Linus isn't at all militant about license enforcement. The effective power of the FSF is in rapid decline.
  - notalaser 10y ago
    > In reality, the opposite is true even though it burns up FSF folks. Linux is alive and well. You can download, read, edit and contribute back to the kernel for free. Maybe your patches won't be accepted, but the license doesn't guarantee that they will be anyway. This isn't untrue, but it does not take away the main point: the community that drives the development agenda and dictates priorities is no longer a community of independent programmers (in the broad sense of the word; many contributions used to come from people who were hired by commercial entities, but they were still relatively small groups, and contributions were limited to small pieces that were specifically interesting for their small-ish employers: a driver for this or that network card, improvements in this routing protocol and so on). This is no longer the case, and the development agenda of the Linux kernel is almost completely dictated by large players, at the expense of small ones and, to a large degree, individual users.
notacoward 10y ago
The Linus/GregKH attitude might work because it's the Linux kernel. It's almost irreplaceable for those who are using it, it has a huge developer community, it has many corporate sponsors to back up those developers, etc. It's not at all clear that the same approach would work for another project without those things. The way Linux kernel developers make such assumptions and pronouncements reminds me a lot of the way some people talk about social issues from a highly privileged position - utterly blind to the reality for those in different circumstances. As I immediately reacted on Twitter, I think lawsuits are a lot like nukes. Using them might always be terrible, but their absence negates all leverage in any other kind of negotiation. That includes the kind of negotiation that Greg K-H talks about. In those negotiations, he still benefits from the kind of enforcement he himself eschews. Those who live under an umbrella shouldn't dump on the people holding it up IMO, as the LF stalwarts are doing in their attempts to defend their turf. Disclosure: I work for Red Hat, which as a company and a community has probably held just about every possible position on this issue - often simultaneously.
- ashitlerferad 10y ago
  Has RH ever assigned its lawyers to enforce the GPL?
  - notacoward 10y ago
    I know of one case where Red Hat countersued a patent troll over a GPL violation. It was a pretty good illustration of the "nuclear deterrent" effect that such litigation can have. I'm not aware of any cases where Red Hat has brought any original suits of this nature, but then again I probably wouldn't be even if they did exist.
ausjke 10y ago
I agree on the analysis. You don't need enforce Linux in court, Linux will then keep getting more popular, to the point that those GPL-violation will gradually find that upstreaming/releasing their code is actually more beneficial than making the code closed. In the long run everybody wins. Even Microsoft is embracing Linux as it pretty much has no other choices due to the ever increasing popularity of Linux.
belorn 10y ago
The whole discussion has been one of the best example of people violently agreeing with each other. Sadly, the article only mention the first few statements and not one of the later done by Greg, which makes it look like a bigger disagreement than it is. Ok, I'm not saying "never should legal action be taken", but what I am saying is the same thing that Linus said, "only under the most dire circumstances", the nuclear option. - (https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003678.html https://lists.linuxfoundation.org/pipermail/ksummit-discuss/...) "Lawsuits are always a last resort after nothing else works." - (https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003620.html https://lists.linuxfoundation.org/pipermail/ksummit-discuss/...) That is a far cry from implied disagreement from the earlier quoted "I do [want companies to comply], but I don't ever think that suing them is the right way to do it". Maybe the Gregs comment is more colorful and has some slight implied differences, but so far I have see little in the discussion to specific when exactly those differences has an practical impact. Both sides seems to be in an agreement (or atleast, not in explicit disagreement) about the status of VMware, as none in the mailinglist (from what I can see) has said that the lawsuit should not exist. What left is the last paragraph of the article, where at least there is direct conflict. Linus don't trust/like FSF and by extension, SFC. For that, one of the other developers described the situation perfectly. If developers went to SFC instead of the lawyers of LF, maybe Linus should ask why that happened in the first place.
- notacoward 10y ago
  > If developers went to SFC instead of the lawyers of LF, maybe Linus should ask why that happened in the first place. I think the answer to that is another question: why would LF bother, when they can reap all of the benefits while SFC bears the cost and takes the flak? They get to play godfather in this situation, pretending their hands are clean. The analogy only falls down because godfathers don't typically rat out their own triggermen.

125 points by corbet 10y ago

A lot companies use Linux kernel and don't release any of the source. They are working on the backs of millions of hours of human labor. For example DJI uses linux on its drone and open wrt on its controller. I don't see any source code for that. LeTv and many other Chinese cellphone makers don't release source code for their kernels. They really have no alternate they could go to. I think it makes sense that kernel community would be more aggressive about making companies return the code with which their products couldn't really exist without.

delinka 10y ago
The Linux kernel codebase is pretty flexible. Are there really changes that had to take place to put the kernel into a drone? If not, there's nothing for DJI to release. Isn't there already a mechanism for handling binary-only kernel modules/drivers? Perhaps DJI's 'changes' can be expressed in such a binary-only module. There seems to be a fairly large part of the tech community that is willfully ignorant of how these licenses work and how the kernel copyright holders have addressed violations in the past. These folks seem to think that because some corporation downloaded the Linux kernel source, that the company's entire codebase should be open source. As always, it's much more complex.
- davexunit 10y ago
  >Are there really changes that had to take place to put the kernel into a drone? If not, there's nothing for DJI to release. Yes, there is. If they distribute a product with binaries built from GPL'd code in it, they must provide the source upon request. It doesn't matter if they've changed it or not.
  - tzs 10y ago
    > If they distribute a product with binaries built from GPL'd code in it, they must provide the source upon request. That's a little bit of an overstatement. It is sometimes possible to distribute GPL binaries without incurring any source obligation, and I suspect that this is going to be come a lot more common as IOT devices become more popular. For example, Amazon, Best Buy, Walmart, and others sell assorted consumer products, such as televisions and routers, that contain Linux-based firmware, but they do not have any obligation to provide the source. All they are doing is receiving boxes of televisions and routers and other goods from the manufacturers (or from the distributors who receive them from the manufacturers), and then selling those items to the consumer on a one to one basis. A copy of Linux comes in to them embedded in some physical thing, such as the FLASH memory in a television or router, and they sell that particular physical hardware and that particular copy of Linux to a consumer. The first sale doctrine, which pretty much every major country I believe has in some form in its copyright law, says that doing this does not require permission of the copyright owner. If you aren't doing anything with GPL code that requires permission of the copyright owner, GPL has no power over you. Right now, I don't think this is a big issue because usually you can find out who does have an obligation to provide the code. Buy a television or router from Best Buy, and it will be from some reasonably prominent manufacturer, such as Samsung or Netgear, and that manufacturer probably is the one who was actually making copies and putting them on the device. They have the obligation to provide source, and they usually have some reasonable way to contract support and find out how and where to actually get it. I think this may change as IOT becomes more common. I think we'll see several companies that make generic IOT base platforms, which they sell to companies that want to make IOT devices for specific applications. Those companies will add their software to the software of the base device, and hook up the specific sensors and actuators needed for their application. A technically sensible way to make the generic base platforms is to make a Linux-based system that has the kernel and the standard utilities on a root partition in FLASH memory, and has a memory card slot. Upon startup have the init system wait for a memory card to be inserted that contains a valid filesystem, mount that filesystem on /home, and then look for /home/iot/startup.sh. If that exists, it becomes the iot user and runs /home/iot/startup.sh. Companies that use this generic base to build their IOT device do not have to modify or copy the kernel or anything else on the root partition. All of their code lives on that separate memory card, as user mode applications and scripts. These companies, when they want to make a manufacturing run of, say, 5000 devices, would buy 5000 units of the generic IOT base system, build and connect 5000 of their sensor and actuator modules, insert 5000 copies of their user mode application and script memory card, and ship the 5000 devices out to customers, distributors, and stores. So you go to Best Buy and buy one of these things and want source code to the Linux contained therein, what do you do? If you ask Best Buy, they say they just passed on the box they received, and point you to the manufacturer listed on the box. When you contact them, they say the same thing...they just bought these generic Linux IOT bases, and plugged in their hardware modules and inserted their memory cards (which contain no GPL software), and if they are feeling nice they tell you the name of the company that made the IOT base. If they are not feeling nice, or they consider information like who their suppliers are to be a trade secret, they may decline to tell you where they got the base platform, and you are pretty much stuck. It could even get worse, because I suspect that in some markets there may be multiple layers of this. You'll have at the bottom layer companies making a fairly generic Linux-based system for embedded use. At a layer above them you'll have companies that take those generic systems and partially specialize them for particular industries or fields or activities. They may add special hardware interfaces, put them in rugged cases, or things like that. A layer up from that would be the companies that turn these into products for end users. And that isn't even the worst it can get. It is actually possible to get a GPL binary commercially that nobody has obligation to provide source for. That's because GPLv2 provides two ways to satisfy your source code obligation if you commercially distribute a GPL binary: 1. Include the source when you distribute binary. 2. Provide a written offer, valid for at least three years, to provide the source to any third party who requests it. Suppose the maker of the generic IOT base device, the one that has Linux on its root filesystem and on startup tries to mount the memory card and run the user mode application found there, includes in each box a CD-ROM that contains the source for all the software on the root filesystem. (That's what I would do...I'd rather go to the slight added trouble up front of adding a CD-ROM to the shipment now and be done with it than have to deal with it spread out over several years). Their customer, the company that is making, say, an IOT nose hair trimmer, doesn't care about those CD-ROMs. They just want to add their hair length sensor module, and their clipper module, insert their memory card with their software, package it all up nicely, and ship it off to the retailers. They toss the CD-ROMs in the trash. You buy one of these nose hair trimmers. Who is obligated to give you the source? How about the generic IOT base device maker? Nope. Every GPL binary they shipped was accompanied by the complete source code, so they satisfied their GPL obligation. How about the nose hair trimmer company? Nope. They are just shipping out copies they received, and are covered by the first sale doctrine. If this becomes common enough for the FSF to see it as an issue that needs to be addressed in GPLv4, it will be interesting to see if they can come up with a good solution. The basic problem is that the option to satisfy your GPL obligation by including the source with the binary extinguishes your obligation in regard to that binary without guaranteeing that when the recipient of that binary redistributes that they will incur a source obligation (because first sale provides a situation in which they can distribute without incurring any copyright obligation). Offhand, I only see one way to address this. Make it so that if you distribute a GPL binary (in a way that required copyright owner permission) then you must provide source to any third party that requests it. Back when GPLv2 was written, that could have been quite onerous, because distributing source usually meant sending a tape. Nowadays, distributing only is easy, and there are plenty of free hosting services for source code, so it probably wouldn't be too onerous. Still, that would be a pretty big change, and I think a lot of people would be very upset at the "fire and forget" option that "include the source code when you distribute the binary" provides. Anyone see any other ways to address this?
- pricechild 10y ago
  Via https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html ... From section 3, my understanding is that if you distribute then you must do one of the following: a) include complete source code b) include an offer of source code if contacted c) include the offer of source code you originally received (It's a bit more complicated than that... but close enough) So... if they're distributing the kernel as part of a drone they're selling, these clauses would apply? I'm not sure why "changes" they may or may not have made would have anything to do with it?
  - palunon 10y ago
    If they didn't change anything, they can simply point you to kernel.org to comply with c), can't they
    - mjg59 10y ago
      Only if they received code from kernel.org with a 3(b) written offer.
      - tzs 10y ago
        Can that happen? 3(c) is only applicable if they received the code in object or executable form. Does kernel.org distribute object code, or just source code?
        ashitlerferad 10y ago
        Just source code.
- new299 10y ago
  My understanding is that they have to provide clear instructions on where to get the source. In general, bringing up Linux on a new platform does require extensive modifications. They often use u-boot too, things like switching on the system DDR, DDR timing etc require significant changes to u-boot (which is also gpl). In my experience those changes rarely get released. I've never heard anyone say a company should release everything just because they used the Linux kernel... But that's just me.
  - mpol 10y ago
    > My understanding is that they have to provide clear instructions on where to get the source. No. Only when they distributed their software to you (the Linux kernel under the GPL) then you can request the sourcecode for that under the GPL. If you never had any code being distributed by them to you, they have no obligation to you.
    - mjg59 10y ago
      This is a common misunderstanding. You have two choices when distributing GPLv2 software commercially: you can either provide the source code alongside the binaries (section 3(a)), or you can provide a written offer to provide the source code on request to any third party (section 3(b)). Non-commercial distribution can forward on a 3(b) offer rather than making their own.
      - infinite8s 10y ago
        Exactly. Except that if you as third party do not receive the the Program (or a work based on it, under Section 2) in object code or executable form, then you have no rights under section 3. So a company that sells GPL'd software is only required to provide the source to any of their purchasers (however, those purchasers are not restricted in any way and can give the source to someone else). So the only way I could get the source code from that company is if I purchase their product.
        tzs 10y ago

karma_vaccum123 10y ago

I see this as a stealth attempt by the Software Conservancy to hijack the direction and tone of kernel development, dragging it more to FSF-style militancy. Linus is right, there is no crisis in GPL violation. There will always be violators. Any law or contract or license will be violated. Becoming more militant about enforcement will simply cause most corporate partners to disengage. Most users comply with the license. Users have access to interesting and useful source code and have never been restricted from accessing the kernel. The kernel team is on good terms with most corporate users. Going after the 5% of violators will change how the kernel team interacts with the 95% of good partners. The only thing Linus seems to be disingenuous about is his claim of support for the GPLv2. My guess is he secretly wishes he had chosen a different, non-copyleft license.

Karunamon 10y ago
>Going after the 5% of violators will change how the kernel team interacts with the 95% of good partners. How do you figure that? The only way this could apply is if the "good partners" are violating the GPL on the sly, or with a wink and a nod (not bloodly likely) which would make them not so good anymore. The GPL has no reason to exist if its terms are not enforced.
- karma_vaccum123 10y ago
  ....and Linus' point is that the victory will be pyrrhic, since people will simply avoid the GPL altogether. We've already seen this with the GPLv3/AGPL. Really outside of the FSF, the only adoption is in dual-licensers who use it to drive purchases of the alternatively-licensed sources.
  - Karunamon 10y ago
    Enforcement of the license people agreed to will cause people to avoid using the license? The only way that makes sense is if people thought that the GPL was the thing to use was due to it being toothless, a notion that it's strictly better to disabuse people of.

wyldfire 10y ago

> ... Bradley isn't the one making the decisions here. It's the developers Gee, this debate seems to have given some large amount of power to the individual contributors to the kernel. Any individual developer could defect from Linus' stance and work with the SFC on an infringement case. I'm curious to see if any of them are more dogmatic with respect to copyleft. I suppose it makes sense that features CONFIG_'d off shouldn't be considered for infringement, but for many binary distributions of the kernel it probably still catches a lot of developers. I always thought it was baloney red tape to do copyright assignments but if it had taken place here it would be a very different debate. The developers would have effectively ceded all control over this discussion to the assignee (who probably would've been The Linux Foundation, if anywhere).

mordocai 10y ago
> Any individual developer could defect from Linus' stance and work with the SFC on an infringement case. I was looking for a source and was unable to find it quickly, but I'm pretty sure a significant number of kernel developers have joined some kind of SFC organization that allows the SFC to use their copyright in order to sue for compliance. Edit: Thanks ashitlerferad, I missed the section on linux here: https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/. That's the source. Edit2: Please read JoshTriplett's comment below for some clarifications on this subject.
- ashitlerferad 10y ago
  https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/linux-compliance/
- JoshTriplett 10y ago
  As mentioned in the linked email thread, the kernel developers working with Conservancy do not typically assign their copyright to Conservancy, and do not cede their decision-making authority over legal matters to Conservancy. (Also, they go by "Conservancy" or "Software Freedom Conservancy", not "SFC", to avoid acronym confusion.) Some developers on various projects (including the kernel) have voluntarily signed over copyrights to Conservancy for various reasons, but their GPL compliance project does not require that.

pjc50 10y ago

As mentioned in the article, forswearing lawsuits is a bad idea: then companies have no downside to not cooperating.

karma_vaccum123 10y ago
They can already hide behind legal firewalls like the Chinese border. If the Software Conservancy continues, they'll just push more development to places where scofflaws can ignore them.
- qaq 10y ago
  If they are OK with loosing western markets they sure can
  - bcoates 10y ago
    This makes me wonder if they'd be better off pursuing complaints with Customs than with lawsuits. Getting a shipment of infringing hardware impounded at the border would be a lot of leverage.
    - ashitlerferad 10y ago
      That has happened before: https://lwn.net/Articles/404450/ https://lwn.net/Articles/404450/
yxhuvud 10y ago
Yes they do. They have to maintain their own branch, which may be very costly when new versions of linux would arrive. Successful upstreaming mitigates that.
- pjc50 10y ago
  Maintain? These are hardware vendors. Once it's shipped they rarely care.

lamarkia 10y ago

It looks like a simple issue that transformed into drama due to the attitudes on the lkml. It is obvious that there will be cases that the GPL will have to be enforced. Was accepted by the other side in the end. The SFLC will only undertake a case if they have the support of copyright owners, not on their own volition.

JoshTriplett 10y ago
Note that there exists a different organization known as "SFLC", but the linked discussion occurred with the Software Freedom Conservancy (or just "Conservancy"), which specifically avoids using the acronym "SFC" to avoid confusion with SFLC.
- lamarkia 10y ago
  Thanks for the clarification.
- lamarkia 10y ago
  Thanks for the clarification.

smitherfield 10y ago

One thing that wasn't brought up (edit: ok, quickly glossed over) in the article — if you go to court, you can lose! There are various legal arguments I can think of, that would essentially trash the GPL, and a company with 8 figures to spend on lawyers could make very convincing (I don't agree with these, but a judge and jury could easily): 1. It's unclear whom the actual copyright holder or holders of Linux are, and who has standing to sue on their behalf. 2. Since Linux is open-source, free-as-in-beer, etc, it's public-domain. 3. Linux is a derivative work not entitled to copyright protection. And so on. Again, when one side might have orders of magnitude more budget for lawyers, this kind of stuff will be very convincing. (Many corps will pony up money to protect Linux, but they'll generally be on the opposite side when it comes to the GPL).

bryanlarsen 10y ago
That was one of the first points addressed in the article: the OP referenced the recent outcome in the VMWare case as an example of an undesirable outcome.
- smitherfield 10y ago
  Fair enough; it was one fairly ambiguous sentence and easy to miss. Not meaning to criticize the article - which I found very interesting - just felt it could be a good conversation thread to discuss an aspect the article didn't really cover.
databus 10y ago
Going to court and losing, while not fun, should be instructive to the GPL community. A loss will either point out areas that need to be changed in the next GPL license version, or that a GPL-style license is not viable.
- AstralStorm 10y ago
  Or that lawyers in that country are terrible?
- 10y ago

ksk 10y ago

Interesting to note the tone of the comments when it comes to enforcing copyright law - Piracy vs GPL.

saynsedit 10y ago

Something that isn't transparent in this discussion is the fact that Linux is extremely corporate now. By that I mean, the vast majority of contributions are sponsored by corporations. Both Linus and Greg know that. They are keenly aware that if Linux takes a hardline GPL approach it will gain the reputation of being unfriendly to corporations. That perception will kill Linux in the long run. When they say they "Care about Linux more than GPL" they are really saying they care about corporate Linux since non-corporate Linux virtually doesn't exist anymore. I have nothing against that and honestly I think they have more clear opinions due to their positions as top-level maintainers. I just think the motivations and incentives behind their opinions should be clear to more people. The people's Linux is virtually dead. People need to eat. An analysis of that phenomenon would be interesting as well but is beyond the scope of this discussion.

karma_vaccum123 10y ago
By that argument, every non-copyleft licensed codebase is "dead" with respect to the "people". In reality, the opposite is true even though it burns up FSF folks. Linux is alive and well. You can download, read, edit and contribute back to the kernel for free. Maybe your patches won't be accepted, but the license doesn't guarantee that they will be anyway. It is true that you may periodically experience a scofflaw that sells you a router that hides some kernel code, but this should only bother you on philosophical grounds. The vendor has no obligation to allow you to "repair" or modify the device. The vendor is under no obligation to accept a patch from you if you find a flaw. Putting linux in a device does not grant the end user any specific right to change the device's behavior. People seem to be confusing "hackable" with "has GPL code". A shitty router with linux code will probably remain a shitty router. I can see why the FSF and SFC might be throwing a fit; Clang and LLVM can replace GCC, and Linus isn't at all militant about license enforcement. The effective power of the FSF is in rapid decline.
- notalaser 10y ago
  > In reality, the opposite is true even though it burns up FSF folks. Linux is alive and well. You can download, read, edit and contribute back to the kernel for free. Maybe your patches won't be accepted, but the license doesn't guarantee that they will be anyway. This isn't untrue, but it does not take away the main point: the community that drives the development agenda and dictates priorities is no longer a community of independent programmers (in the broad sense of the word; many contributions used to come from people who were hired by commercial entities, but they were still relatively small groups, and contributions were limited to small pieces that were specifically interesting for their small-ish employers: a driver for this or that network card, improvements in this routing protocol and so on). This is no longer the case, and the development agenda of the Linux kernel is almost completely dictated by large players, at the expense of small ones and, to a large degree, individual users.

notacoward 10y ago

The Linus/GregKH attitude might work because it's the Linux kernel. It's almost irreplaceable for those who are using it, it has a huge developer community, it has many corporate sponsors to back up those developers, etc. It's not at all clear that the same approach would work for another project without those things. The way Linux kernel developers make such assumptions and pronouncements reminds me a lot of the way some people talk about social issues from a highly privileged position - utterly blind to the reality for those in different circumstances. As I immediately reacted on Twitter, I think lawsuits are a lot like nukes. Using them might always be terrible, but their absence negates all leverage in any other kind of negotiation. That includes the kind of negotiation that Greg K-H talks about. In those negotiations, he still benefits from the kind of enforcement he himself eschews. Those who live under an umbrella shouldn't dump on the people holding it up IMO, as the LF stalwarts are doing in their attempts to defend their turf. Disclosure: I work for Red Hat, which as a company and a community has probably held just about every possible position on this issue - often simultaneously.

ashitlerferad 10y ago
Has RH ever assigned its lawyers to enforce the GPL?
- notacoward 10y ago
  I know of one case where Red Hat countersued a patent troll over a GPL violation. It was a pretty good illustration of the "nuclear deterrent" effect that such litigation can have. I'm not aware of any cases where Red Hat has brought any original suits of this nature, but then again I probably wouldn't be even if they did exist.

ausjke 10y ago

I agree on the analysis. You don't need enforce Linux in court, Linux will then keep getting more popular, to the point that those GPL-violation will gradually find that upstreaming/releasing their code is actually more beneficial than making the code closed. In the long run everybody wins. Even Microsoft is embracing Linux as it pretty much has no other choices due to the ever increasing popularity of Linux.

belorn 10y ago

The whole discussion has been one of the best example of people violently agreeing with each other. Sadly, the article only mention the first few statements and not one of the later done by Greg, which makes it look like a bigger disagreement than it is. Ok, I'm not saying "never should legal action be taken", but what I am saying is the same thing that Linus said, "only under the most dire circumstances", the nuclear option. - (https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003678.html https://lists.linuxfoundation.org/pipermail/ksummit-discuss/...) "Lawsuits are always a last resort after nothing else works." - (https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003620.html https://lists.linuxfoundation.org/pipermail/ksummit-discuss/...) That is a far cry from implied disagreement from the earlier quoted "I do [want companies to comply], but I don't ever think that suing them is the right way to do it". Maybe the Gregs comment is more colorful and has some slight implied differences, but so far I have see little in the discussion to specific when exactly those differences has an practical impact. Both sides seems to be in an agreement (or atleast, not in explicit disagreement) about the status of VMware, as none in the mailinglist (from what I can see) has said that the lawsuit should not exist. What left is the last paragraph of the article, where at least there is direct conflict. Linus don't trust/like FSF and by extension, SFC. For that, one of the other developers described the situation perfectly. If developers went to SFC instead of the lawyers of LF, maybe Linus should ask why that happened in the first place.

notacoward 10y ago
> If developers went to SFC instead of the lawyers of LF, maybe Linus should ask why that happened in the first place. I think the answer to that is another question: why would LF bother, when they can reap all of the benefits while SFC bears the cost and takes the flak? They get to play godfather in this situation, pretending their hands are clean. The analogy only falls down because godfathers don't typically rat out their own triggermen.