5 ms·

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not

License compliance is incredibly important and unfortunately overlooked by many smaller firms. The potential liability to a GPL or other violation is just not worth it. Anecdote: We have released code under the Apache 2 License (our biggest project by far is https://github.com/sheetjs/js-xlsx https://github.com/sheetjs/js-xlsx) and we've been roped into negotiations because some companies tried to take shortcuts by copying our code without proper attribution.

nugget 9y ago
What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer just had to re-write the offending module and make a $10k donation to an open source foundation. I've never knowingly infringed GPL and am not advocating that anyone should; it's just as I said, I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward.
- GFischer 9y ago
  Usually, when doing due diligence, anything that might conceivably be a lawsuit or ongoing lawsuits results in a lower price or funds in escrow or similar agreements. So, even if there never was a big payoff, the mere potential is a big red flag for the due diligence team (and leverage for negotiations as well). They can add indemnification clauses on contracts (they won't do that for a small company like the OP I guess).
- bonestamp2 9y ago
  > I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward. That seems true with pretty much any legal area. But, it's not their job to calculate risk, it's their job to tell you what is legal. It's management's job to decide if they want to take the risk or take the legal advice.
  - aquadrop 9y ago
    I think it's 100% their job to calculate risks and inform about legal customs/expected outcomes around something in question.
    - rhizome 9y ago
      You're going to be pedaling that idea for a long time before you convince lawyers that it's in their interest to generalize on expected outcomes.
- Jach 9y ago
  I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty for copyright infringement and will have to shell out a few hundred thousand dollars and someone goes to jail for a few years, and the company has to immediately stop distributing/serving products with the software on them until the software is either legally licensed, legally distributed, or replaced.
  - SwellJoe 9y ago
    Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.
    - donatj 9y ago
      Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.
      - cortesoft 9y ago
        That is completely different. You don't go to jail for a license violation.
        hackits 9y ago
        I remember in some situations that copyright infringement is cheaper than license violation. The former you can argue ignorance and pay a a fine the later you've knowing acknowledge what you've done is a violation of another person license but continued your behavior.
- TAForObvReasons 9y ago
  Most cases are settled out of court or aren't publicized. https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf interesting read
- amorphid 9y ago
  Not trying to troll here... The biggest violation might simply be the size of the attorney bills related to using GPL licensed dependencies in your code. There's simply no great way that I've found to get attorneys to give you a checklist of how to comply with licenses that aren't on a short list of reasonably well understood licenses. Saying "no GPL" is easier in many cases for practical reasons that kind of stink. To say it differently, how much time would you like to dedicate to getting GPL blessed when doing so is competing with all of your other priorities?
  - nugget 9y ago
    Fair point but doesn't this run directly counter to the trend of startups leveraging an increasing amount of open source code?
    - sverhagen 9y ago
      In my experience, having a good ratio of responsible, experienced developers on the team (one of those may do it, for a small startup) is often enough to keep an eye on it, and a lot of startups get quite far while avoiding the most risky (for them) licenses. If this is reasonably gated while starting a project, or whenever you want to add new dependencies, it's well possible to stay on course.
- emilfihlman 9y ago
  They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.
  - mikekchar 9y ago
    It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other remedies are usually possible from the copyright holder (usually just "stop infringing our copyright"), or imposed by a court. IANAL, but the act of a user linking GPL code to incompatible code without distribution is not copyright infringement IFAICT. I believe the FSF also agrees with that. In fact the GPL specifically states that you may run the code for any purpose. This leaves a kind of grey area where you could write code that can link to GPL code, but that you leave the end user to do the final linking. In the extreme these are the so-called "binary blobs" in things like the Linux kernel. My understanding is that the FSF thinks that these are an infringement but that other people disagree. I don't think it's ever been tested in court. Edit: I should point out that the reasoning for it being an infringement is that by intentionally writing code that can link to the GPL code, you are creating a derived work of the GPL code. Whether this argument holds water is anybody's guess and I would love to see it tested in court.
    - emacsgifs 9y ago
      IFAICT ?
      - mikekchar 9y ago
        Typo. As far as I can tell. Sorry!
        emacsgifs 9y ago
- exikyut 9y ago
  > What exactly is the potential liability for a GPL violation? An anecdote from 2001: http://web.archive.org/web/20061106184219/http://docs.gnu-designs.com/Sony-violation-GPL.txt http://web.archive.org/web/20061106184219/http://docs.gnu-de...
- kod 9y ago
  > otherwise well-measured calculations of risk and reward Where do you work that attorneys generally make well-measured calculations of risk? And are you hiring?
- paulajohnson 9y ago
  Cease and desist selling your core product until you replace the GPL bits, or else make your core produt open source.
kornish 9y ago
For companies interested in addressing licensing concerns before they balloon into real problems, FOSSA builds a platform which analyzes code and automates license disclosures and legal boilerplate: https://fossa.io/ https://fossa.io/ Full disclosure: founder is a friend and all around great person.
- Majora320 9y ago
  I don't own a company, but I'd like to try this out myself. Is there any possibility of having a "personal" trial mode instead of having to enter a company name?
  - XiZhao 9y ago
    From team FOSSA here, you can put in anything for the company name -- or leave it blank!
Buge 9y ago
I don't understand how license compliance matters here. Why does the big customer care about whether the seller has violated licenses? The seller would be the one in trouble, not the customer.
- Thiez 9y ago
  If the seller is in violation of one or more licenses, they might get sued and be forced to discontinue or significantly alter their product. If the big customer depends heavily on the product and cannot easily replace it, they are also screwed in this scenario, even if they aren't in violation of any laws.
- deleted 9y ago
  [deleted]

nugget 9y ago

What exactly is the potential liability for a GPL violation? I've gone 12 rounds with IP lawyers over these theoretical violations (static vs dynamic links). But I found it odd that I could never find a single case of significant liability due to infringement. The nature of damages is unclear and the landscape of counter-parties (with an incentive to sue) is amorphous. It seemed like worst-case, a proven infringer just had to re-write the offending module and make a $10k donation to an open source foundation. I've never knowingly infringed GPL and am not advocating that anyone should; it's just as I said, I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward.

GFischer 9y ago
Usually, when doing due diligence, anything that might conceivably be a lawsuit or ongoing lawsuits results in a lower price or funds in escrow or similar agreements. So, even if there never was a big payoff, the mere potential is a big red flag for the due diligence team (and leverage for negotiations as well). They can add indemnification clauses on contracts (they won't do that for a small company like the OP I guess).
bonestamp2 9y ago
> I found the legal community's focus on this area out of step with their otherwise well-measured calculations of risk and reward. That seems true with pretty much any legal area. But, it's not their job to calculate risk, it's their job to tell you what is legal. It's management's job to decide if they want to take the risk or take the legal advice.
- aquadrop 9y ago
  I think it's 100% their job to calculate risks and inform about legal customs/expected outcomes around something in question.
  - rhizome 9y ago
    You're going to be pedaling that idea for a long time before you convince lawyers that it's in their interest to generalize on expected outcomes.
Jach 9y ago
I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty for copyright infringement and will have to shell out a few hundred thousand dollars and someone goes to jail for a few years, and the company has to immediately stop distributing/serving products with the software on them until the software is either legally licensed, legally distributed, or replaced.
- SwellJoe 9y ago
  Jail for copyright violation? I guess people who've distributed pirated goods, like movies or music, have gone to jail, but I've never heard of it happening to a software developer. Fines are plausible, but I'm having a hard time imagining a scenario that leads to jail time.
  - donatj 9y ago
    Developers have gone to jail for stealing code from financial companies. See: https://en.wikipedia.org/wiki/Sergey_Aleynikov https://en.wikipedia.org/wiki/Sergey_Aleynikov Most GPL projects however don't have expensive, hateful, blood seeking lawyers behind them.
    - cortesoft 9y ago
      That is completely different. You don't go to jail for a license violation.
      - hackits 9y ago
        I remember in some situations that copyright infringement is cheaper than license violation. The former you can argue ignorance and pay a a fine the later you've knowing acknowledge what you've done is a violation of another person license but continued your behavior.
TAForObvReasons 9y ago
Most cases are settled out of court or aren't publicized. https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf interesting read
amorphid 9y ago
Not trying to troll here... The biggest violation might simply be the size of the attorney bills related to using GPL licensed dependencies in your code. There's simply no great way that I've found to get attorneys to give you a checklist of how to comply with licenses that aren't on a short list of reasonably well understood licenses. Saying "no GPL" is easier in many cases for practical reasons that kind of stink. To say it differently, how much time would you like to dedicate to getting GPL blessed when doing so is competing with all of your other priorities?
- nugget 9y ago
  Fair point but doesn't this run directly counter to the trend of startups leveraging an increasing amount of open source code?
  - sverhagen 9y ago
    In my experience, having a good ratio of responsible, experienced developers on the team (one of those may do it, for a small startup) is often enough to keep an eye on it, and a lot of startups get quite far while avoiding the most risky (for them) licenses. If this is reasonably gated while starting a project, or whenever you want to add new dependencies, it's well possible to stay on course.
emilfihlman 9y ago
They are just that: theoretical violations and even they are touted just by the FSF: no one else agrees that linking against source code taints your own code.
- mikekchar 9y ago
  It really depends what you mean by "linking" and what you mean by "taints". Linking GPL code to incompatible code is against the license terms and since you can't copy/distribute the code without a license you violate copyright if you distribute that code. Nobody, not even the FSF, believes that this means that your code must be under the GPL at that point -- it's just the remedy that the GPL explicitly allows. Other remedies are usually possible from the copyright holder (usually just "stop infringing our copyright"), or imposed by a court. IANAL, but the act of a user linking GPL code to incompatible code without distribution is not copyright infringement IFAICT. I believe the FSF also agrees with that. In fact the GPL specifically states that you may run the code for any purpose. This leaves a kind of grey area where you could write code that can link to GPL code, but that you leave the end user to do the final linking. In the extreme these are the so-called "binary blobs" in things like the Linux kernel. My understanding is that the FSF thinks that these are an infringement but that other people disagree. I don't think it's ever been tested in court. Edit: I should point out that the reasoning for it being an infringement is that by intentionally writing code that can link to the GPL code, you are creating a derived work of the GPL code. Whether this argument holds water is anybody's guess and I would love to see it tested in court.
  - emacsgifs 9y ago
    IFAICT ?
    - mikekchar 9y ago
      Typo. As far as I can tell. Sorry!
      - emacsgifs 9y ago
exikyut 9y ago
> What exactly is the potential liability for a GPL violation? An anecdote from 2001: http://web.archive.org/web/20061106184219/http://docs.gnu-designs.com/Sony-violation-GPL.txt http://web.archive.org/web/20061106184219/http://docs.gnu-de...
kod 9y ago
> otherwise well-measured calculations of risk and reward Where do you work that attorneys generally make well-measured calculations of risk? And are you hiring?
paulajohnson 9y ago
Cease and desist selling your core product until you replace the GPL bits, or else make your core produt open source.

kornish 9y ago

For companies interested in addressing licensing concerns before they balloon into real problems, FOSSA builds a platform which analyzes code and automates license disclosures and legal boilerplate: https://fossa.io/ https://fossa.io/ Full disclosure: founder is a friend and all around great person.

Majora320 9y ago
I don't own a company, but I'd like to try this out myself. Is there any possibility of having a "personal" trial mode instead of having to enter a company name?
- XiZhao 9y ago
  From team FOSSA here, you can put in anything for the company name -- or leave it blank!

Buge 9y ago

I don't understand how license compliance matters here. Why does the big customer care about whether the seller has violated licenses? The seller would be the one in trouble, not the customer.

Thiez 9y ago
If the seller is in violation of one or more licenses, they might get sued and be forced to discontinue or significantly alter their product. If the big customer depends heavily on the product and cannot easily replace it, they are also screwed in this scenario, even if they aren't in violation of any laws.
deleted 9y ago
[deleted]