4 ms·

Ok, I understand that this is trying to be decent and reasonable people here, in cases where it's truly an accident of including some GPL code. Shit happens, cl

Ok, I understand that this is trying to be decent and reasonable people here, in cases where it's truly an accident of including some GPL code. Shit happens, clean it up. If I were to do this with commercial code or assets, would they be so flexible in working with me, or do they go straight to shakedown? I'll give ye all a hint: go look at the MPAA and RIAA's views on that. I remembered when friends were back in the Napster times shook down for a few grand. Same with Bittorrent's earlier years. There was no amicable "Plz quit this and were good". In fact, they've lobbied multiple times for laws to permanently disconnect after X copyright claims. So, why should the Open Source community be so damned forgiving when we're surrounded by entities who'd eat every last one of us for lunch if we so much as accidentally used a copyrighted resource? (I'm thinking no further than Netflix ripping off a photographer https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-photos-stranger-things-boxed-set/ https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-... . Good luck for an Australian citizen to navigate international copyright law to become whole in this regard. )

sigzero 9y ago
I agree. This is a slide down a bad slope as people will now expect a hand slap the first time (at least).
- crankylinuxuser 9y ago
  I really think it matters in what context. If someone was hacking on a BSD based license, and included code they mistakenly mis-identified the license, I get that. It was an accident. Mention it to them as an issue or email. It's an oversight, accidents do indeed happen. It reminds me of the recent issue where nVidia copied some dev's code from their GH repo. The repo was unlicensed, but whomever did the copying included it as BSD license. After the dev contacted the repo owner, they fixed it (to my understanding). These cases are accidents and oversights. And the key here is they're corrected quickly after being brought attention to. Then you have the other class: habitual intentional infringers. Theyd lift all of Linux, and do. You like those illegal binary dumps with closed source in a release of Linux kernel? Or how about found in countless firmwares on consumer devices? Yeah, its all there, closed source badness and all. And the law allows up to $135k per violation. Ok, times 1 million devices sold. Please pay 135 billion USD.
  - sigzero 9y ago
    Does this have to be codified in the license though? I don't think so. All parties just agree on the outcome. That's the way it works. A "free pass" shouldn't be in the license proper.
jordigh 9y ago
> So, why should the Open Source community be so damned forgiving Because the point of free software isn't to shake down anyone. Because we're better than that. We want to make sure software stays free, and punishing people doesn't often help. Almost all copyleft enforcement is done without judges and courts, and that's how it should be. We want more friends, not less. This is not to mean we're pushovers. It just means we enforce free software as gently as possible. Once the software is free, there is no more conflict to resolve.
geofft 9y ago
One strategic reason is that it removes a disincentive to use GPL'd software. If I believe that screwing up an image build once is enough to permanently revoke my entire company's license to use Linux, the strategic thing to do is to not use Linux for anything. (I think people can legitimately disagree as to whether this disincentive is a thing people actually take into account)
- crankylinuxuser 9y ago
  I get where you're going with that line of argument. But lets take the counterpoint. How many times has Legal been introduced to go over Microsoft Windows contract/EULA? How about each other piece of software in your installation? Are you guaranteed any sort of amnesty or accident forgiveness with the BSA if they catch "incorrectly licensed software" on your network? Is the company guaranteed any sort of "fitness" if the software creators decide to remotely turn off their software? The GPL is cleanly written. And even to a non-legal person like me, seems pretty straight forward. The Apple/Microsoft/Google/Amazon/Oracle contracts and EULAs are most certainly not.
  - geofft 9y ago
    Microsoft has an incentive to sell licenses, though. If you're violating their license, they're much happier if you pay them for sufficient licenses than if you stop using Microsoft. So a business will understand this, and say that while in theory Microsoft could demand something unreasonable, in practice you'll be able to negotiate something (possibly even paying less than sticker cost) for the right to keep using the software you were using, so there's no realistic risk that you'll lose your ability to use MS software at all. The average GPL software has nobody who's even in a position to be negotiated with, because it has multiple authors who aren't communicating with each other. If I violate the Linux kernel's license, who do I offer to pay to get the license reinstated? How do I make sure some individual contributor I haven't paid who disagrees with me ideologically (say I'm Northrop Grumman, or Planned Parenthood, or something) won't sue me and refuse to settle for anything short of shutting down all my infrastructure and starting from scratch?
rmmm 9y ago
> So, why should the Open Source community be so damned forgiving when we're surrounded by entities who'd eat every last one of us for lunch if we so much as accidentally used a copyrighted resource? For a few reasons. 0. Because not only profitable large companies accidentally infringe on copyright (or copyleft). If for example OpenZFS somehow violated the GPL with the CDDL, you don't want someone using that to extort money from another free software project. 1. Because people using the GPL to extort money has already happened and it makes the GPL seem toxic. I love the GPL (GPLv2 or later), but it took me quite a bit of legwork to get it approved for use at my dayjob. The objections are based on FUD, and moves like this remove some of the FUD. 2. GPLv3 already has this clause. The FSF et al understood that it was good for the community AND good for the GPL. Extending this to GPLv2 brings the same good faith to projects that can't or won't re-license. I understand the desire to be as punitive as the bad guys, but the FOSS community is too small to get away with tactics like that. Besides, you shouldn't even if you could. Free Software is fundamentally about community, and attacking people is anti-community.
smhenderson 9y ago
(I'm thinking no further than Netflix ripping off a photographer https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-.. https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-.... . Good luck for an Australian citizen to navigate international copyright law to become whole in this regard. ) In all fairness to Netflix it took longer than it should have (for which they apologized) but they ended up compensating the guy to his satisfaction. Now perhaps that's just because of how publicly he stated his case but in the end Netflix did do the right thing. Edit: As for the rest of your post, you make a good point!
mikeash 9y ago
Why do we open source software in the first place? For most of us, I think it's because we want people to use it. And, yes, we want people to use it under certain conditions, it's not a free-for-all, but using it is an important part. If it wasn't, we'd just keep it closed. Going straight to harsh enforcement for a violation isn't going to help with that. There are already a lot of people unwilling to consider open source for anything because they misunderstand it and think that they'll automatically open source all of their own stuff if they do. Imagine if open source copyright owners had a reputation for going immediately for a lawsuit and statutory damages upon discovering a violation! Figure out what your goal is, then do whatever helps accomplish that goal. The behavior of organizations like the MPAA and RIAA probably doesn't enter into it.
- belorn 9y ago
  When people work on a volunteer basis, I would actually guess that people get more emotional when the social contract is broken by a profit seeking company. Going straight to harsh enforcement in order to strengthen the social contracts might sound illogical, but I would bet that its common through out history. Just look at historical societies that operated on a honor bound system and see how harsh enforcement were, even when the punishment has a cost to that society. There is multiple strategies to keep social contracts. Forgiveness is good, but so is enforcement. Site like HN do ban people, but also warn people. I am uncertain if any singular tactic is best.
forespacemou 9y ago
A lot of GPL violators are probably well-meaning individual hobbyists, not corporations. I am not a lawyer, but the language as I read it does not appear to give knowing abusers a big opening. They still have to correct license violations within 1-2 months, unless they're just hoping no one does anything about the violation.
bluGill 9y ago
Depends. Lawyers often do send cease and desist letters and nothing more. If a company discovers an infringement because of the letter they will stop as quickly as they can going to court probably isn't worth the lawyer fees so it most likely will end there. MPAA and RIAA are not a good example - they were willing to lose a lot of money enforcing their legal rights because they believed that would send an example and in turn stop everybody else. That is they were willing to spend $100,000 to get your to pay a $1,000 fine. This return on investment is generally something most companies are not willing for. Most companies would rather spend $200 and get nothing in return (other than the infringement stopped), then spend $100,000 or more to win $1,000. I think the reasons are obvious. Also, you don't want to be seen as a jerk. Many companies pay people to contribute to open source in some way. Some are full time, some are just as needed. Any large project that is seen as a jerk to companies is likely to find less contributors.
tzs 9y ago
> I remembered when friends were back in the Napster times shook down for a few grand. RIAA asked infringers for about $2 per infringed song. That seems a pretty fair price--it's only about twice what it would have cost for the people to legitimately purchase copies of the music.
- yebyen 9y ago
  Really? CNN said it was closer to $80,000 when the Napster cases were breaking.[1] Maybe they offered $2/song for the settlement, but according to this article the settlement offer was $5000 for 24 songs. The 2009 article says the statutory penalties were between $750 and $150,000 per willful infringement. I don't know where you're getting $2 from. [1]: http://scitech.blogs.cnn.com/2009/06/19/downloading-mom-fined-80000-per-song/ http://scitech.blogs.cnn.com/2009/06/19/downloading-mom-fine...
  - tzs 9y ago
    $2 or so (up to maybe $4 in some cases) per song is what they asked for when they sent an initial settlement offer to infringers, before taking any legal action. If the person would not settle and the RIAA went on to actually sue the person, the RIAA would only sue over a small fraction of the infringed songs. In the case the article you linked is talking about, they caught her infringing over 1700 songs, and asked for $5000. $5000/1700 = ~$3/song. When she would not settle, and they sued, they sued over 24 songs. I don't think I've ever seen an official explanation of why they only sue for a handful of songs, but a couple plausible reasons come to mind: 1. They will ask for statutory damages rather than actual damages [1]. Statutory damages are normally a minimum of $750 per infringed work, although that can be reduced to as low as $200 per infringed work if if the infringer was not aware and had not reason to be aware that they were infringing. They only need 7 songs to win the amount they were willing to settle for when they sent their first letter, or 25 if they think there is any chance the defendant might get the reduced $200 rate. 2. For each song they include in the lawsuit, they have to make sure all the paperwork is in order with the copyright office proving ownership. Copies of that have to be introduced into evidence at the trial. The defense is going to attack every one of these. The defense is going to ask for all the contracts with the artist and try to prove that the RIAA does not have the right to represent them. All of this takes time and costs money for no real gain. In the particular case you cited, the damage award went way above the minimum largely because the defendant tried to destroy evidence, tried to blame her children for the copying, and blatantly lied on the stand. The jury has wide discretion to pick the statutory damage amount from a range, and they picked from the high end of the range. And do you know what the RIAA did after the jury awarded that large amount? They again offered to settle for a relatively small amount. (I don't remember the exact amount--I think it was around $15000, which based on 1700 songs they caught her infringing would be around $9/song). That's been the pattern for every RIAA case that went to trial, I believe. (Only a handful went to trial, because most infringers were smart enough to realize that (1) they had no defense, and (2) minimum statutory damages were going to be way more than the RIAA was asking for, and so they settled early). [1] Actual damages are very hard to determine in most non-commercial copyright infringement cases (and actually they are often very hard to determine in commercial infringement cases, too).
marcoperaza 9y ago
>I remembered when friends were back in the Napster times shook down for a few grand. Same with Bittorrent's earlier years. There was no amicable "Plz quit this and were good". The recording industry did offer an amnesty at the start of their campaign. It required you to promise to delete all existing illegally-downloaded content and promise not to engage of file sharing of copyrighted works in the future. It was called Clean Slate and very few people signed up for it, and it was criticized for various reasons, but they did offer it.
jerf 9y ago
Lotta philosophical reasons as siblings to my reply here, and many of them are very fine. But let me give you a practical reason this forgiveness works out well: If you want to leap straight to aggressive compliance, you're gonna need a lawyer. That will cost you. So in a world where the choices are "ignore the infringement" or "aggressively enforce it", you've got the choice of either ponying up the dough up front, or losing your licensed rights. Now, sometimes reality hands you a bum deal and there's not much you can do about it, but that's a bum deal. If you add a third choice of "politely ask for them to comply first", then you've got a free option, that is likely (albeit not guaranteed) to produce good results, and as an added bonus, if the company blows you off you are helping your eventual lawyer-involving case when it comes time to prove they knew and infringed anyhow. So unless you've got bored lawyers sitting around who are going to charge you no matter what you do, there is a reason to be a bit gracious first, even for you, the programmer of the GPL'ed work. (And yes, this RedHat effort does not create this result; this has always been an option and IIRC most historical enforcement efforts that went to lawsuit first used this. But it answers the question, in very programmer-centric terms.)

sigzero 9y ago

I agree. This is a slide down a bad slope as people will now expect a hand slap the first time (at least).

crankylinuxuser 9y ago
I really think it matters in what context. If someone was hacking on a BSD based license, and included code they mistakenly mis-identified the license, I get that. It was an accident. Mention it to them as an issue or email. It's an oversight, accidents do indeed happen. It reminds me of the recent issue where nVidia copied some dev's code from their GH repo. The repo was unlicensed, but whomever did the copying included it as BSD license. After the dev contacted the repo owner, they fixed it (to my understanding). These cases are accidents and oversights. And the key here is they're corrected quickly after being brought attention to. Then you have the other class: habitual intentional infringers. Theyd lift all of Linux, and do. You like those illegal binary dumps with closed source in a release of Linux kernel? Or how about found in countless firmwares on consumer devices? Yeah, its all there, closed source badness and all. And the law allows up to $135k per violation. Ok, times 1 million devices sold. Please pay 135 billion USD.
- sigzero 9y ago
  Does this have to be codified in the license though? I don't think so. All parties just agree on the outcome. That's the way it works. A "free pass" shouldn't be in the license proper.

jordigh 9y ago

> So, why should the Open Source community be so damned forgiving Because the point of free software isn't to shake down anyone. Because we're better than that. We want to make sure software stays free, and punishing people doesn't often help. Almost all copyleft enforcement is done without judges and courts, and that's how it should be. We want more friends, not less. This is not to mean we're pushovers. It just means we enforce free software as gently as possible. Once the software is free, there is no more conflict to resolve.

geofft 9y ago

One strategic reason is that it removes a disincentive to use GPL'd software. If I believe that screwing up an image build once is enough to permanently revoke my entire company's license to use Linux, the strategic thing to do is to not use Linux for anything. (I think people can legitimately disagree as to whether this disincentive is a thing people actually take into account)

crankylinuxuser 9y ago
I get where you're going with that line of argument. But lets take the counterpoint. How many times has Legal been introduced to go over Microsoft Windows contract/EULA? How about each other piece of software in your installation? Are you guaranteed any sort of amnesty or accident forgiveness with the BSA if they catch "incorrectly licensed software" on your network? Is the company guaranteed any sort of "fitness" if the software creators decide to remotely turn off their software? The GPL is cleanly written. And even to a non-legal person like me, seems pretty straight forward. The Apple/Microsoft/Google/Amazon/Oracle contracts and EULAs are most certainly not.
- geofft 9y ago
  Microsoft has an incentive to sell licenses, though. If you're violating their license, they're much happier if you pay them for sufficient licenses than if you stop using Microsoft. So a business will understand this, and say that while in theory Microsoft could demand something unreasonable, in practice you'll be able to negotiate something (possibly even paying less than sticker cost) for the right to keep using the software you were using, so there's no realistic risk that you'll lose your ability to use MS software at all. The average GPL software has nobody who's even in a position to be negotiated with, because it has multiple authors who aren't communicating with each other. If I violate the Linux kernel's license, who do I offer to pay to get the license reinstated? How do I make sure some individual contributor I haven't paid who disagrees with me ideologically (say I'm Northrop Grumman, or Planned Parenthood, or something) won't sue me and refuse to settle for anything short of shutting down all my infrastructure and starting from scratch?

rmmm 9y ago

> So, why should the Open Source community be so damned forgiving when we're surrounded by entities who'd eat every last one of us for lunch if we so much as accidentally used a copyrighted resource? For a few reasons. 0. Because not only profitable large companies accidentally infringe on copyright (or copyleft). If for example OpenZFS somehow violated the GPL with the CDDL, you don't want someone using that to extort money from another free software project. 1. Because people using the GPL to extort money has already happened and it makes the GPL seem toxic. I love the GPL (GPLv2 or later), but it took me quite a bit of legwork to get it approved for use at my dayjob. The objections are based on FUD, and moves like this remove some of the FUD. 2. GPLv3 already has this clause. The FSF et al understood that it was good for the community AND good for the GPL. Extending this to GPLv2 brings the same good faith to projects that can't or won't re-license. I understand the desire to be as punitive as the bad guys, but the FOSS community is too small to get away with tactics like that. Besides, you shouldn't even if you could. Free Software is fundamentally about community, and attacking people is anti-community.

smhenderson 9y ago

(I'm thinking no further than Netflix ripping off a photographer https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-.. https://petapixel.com/2017/11/27/netflix-stole-vhs-cassette-.... . Good luck for an Australian citizen to navigate international copyright law to become whole in this regard. ) In all fairness to Netflix it took longer than it should have (for which they apologized) but they ended up compensating the guy to his satisfaction. Now perhaps that's just because of how publicly he stated his case but in the end Netflix did do the right thing. Edit: As for the rest of your post, you make a good point!

mikeash 9y ago

Why do we open source software in the first place? For most of us, I think it's because we want people to use it. And, yes, we want people to use it under certain conditions, it's not a free-for-all, but using it is an important part. If it wasn't, we'd just keep it closed. Going straight to harsh enforcement for a violation isn't going to help with that. There are already a lot of people unwilling to consider open source for anything because they misunderstand it and think that they'll automatically open source all of their own stuff if they do. Imagine if open source copyright owners had a reputation for going immediately for a lawsuit and statutory damages upon discovering a violation! Figure out what your goal is, then do whatever helps accomplish that goal. The behavior of organizations like the MPAA and RIAA probably doesn't enter into it.

belorn 9y ago
When people work on a volunteer basis, I would actually guess that people get more emotional when the social contract is broken by a profit seeking company. Going straight to harsh enforcement in order to strengthen the social contracts might sound illogical, but I would bet that its common through out history. Just look at historical societies that operated on a honor bound system and see how harsh enforcement were, even when the punishment has a cost to that society. There is multiple strategies to keep social contracts. Forgiveness is good, but so is enforcement. Site like HN do ban people, but also warn people. I am uncertain if any singular tactic is best.

forespacemou 9y ago

A lot of GPL violators are probably well-meaning individual hobbyists, not corporations. I am not a lawyer, but the language as I read it does not appear to give knowing abusers a big opening. They still have to correct license violations within 1-2 months, unless they're just hoping no one does anything about the violation.

bluGill 9y ago

Depends. Lawyers often do send cease and desist letters and nothing more. If a company discovers an infringement because of the letter they will stop as quickly as they can going to court probably isn't worth the lawyer fees so it most likely will end there. MPAA and RIAA are not a good example - they were willing to lose a lot of money enforcing their legal rights because they believed that would send an example and in turn stop everybody else. That is they were willing to spend $100,000 to get your to pay a $1,000 fine. This return on investment is generally something most companies are not willing for. Most companies would rather spend $200 and get nothing in return (other than the infringement stopped), then spend $100,000 or more to win $1,000. I think the reasons are obvious. Also, you don't want to be seen as a jerk. Many companies pay people to contribute to open source in some way. Some are full time, some are just as needed. Any large project that is seen as a jerk to companies is likely to find less contributors.

tzs 9y ago

> I remembered when friends were back in the Napster times shook down for a few grand. RIAA asked infringers for about $2 per infringed song. That seems a pretty fair price--it's only about twice what it would have cost for the people to legitimately purchase copies of the music.

yebyen 9y ago
Really? CNN said it was closer to $80,000 when the Napster cases were breaking.[1] Maybe they offered $2/song for the settlement, but according to this article the settlement offer was $5000 for 24 songs. The 2009 article says the statutory penalties were between $750 and $150,000 per willful infringement. I don't know where you're getting $2 from. [1]: http://scitech.blogs.cnn.com/2009/06/19/downloading-mom-fined-80000-per-song/ http://scitech.blogs.cnn.com/2009/06/19/downloading-mom-fine...
- tzs 9y ago
  $2 or so (up to maybe $4 in some cases) per song is what they asked for when they sent an initial settlement offer to infringers, before taking any legal action. If the person would not settle and the RIAA went on to actually sue the person, the RIAA would only sue over a small fraction of the infringed songs. In the case the article you linked is talking about, they caught her infringing over 1700 songs, and asked for $5000. $5000/1700 = ~$3/song. When she would not settle, and they sued, they sued over 24 songs. I don't think I've ever seen an official explanation of why they only sue for a handful of songs, but a couple plausible reasons come to mind: 1. They will ask for statutory damages rather than actual damages [1]. Statutory damages are normally a minimum of $750 per infringed work, although that can be reduced to as low as $200 per infringed work if if the infringer was not aware and had not reason to be aware that they were infringing. They only need 7 songs to win the amount they were willing to settle for when they sent their first letter, or 25 if they think there is any chance the defendant might get the reduced $200 rate. 2. For each song they include in the lawsuit, they have to make sure all the paperwork is in order with the copyright office proving ownership. Copies of that have to be introduced into evidence at the trial. The defense is going to attack every one of these. The defense is going to ask for all the contracts with the artist and try to prove that the RIAA does not have the right to represent them. All of this takes time and costs money for no real gain. In the particular case you cited, the damage award went way above the minimum largely because the defendant tried to destroy evidence, tried to blame her children for the copying, and blatantly lied on the stand. The jury has wide discretion to pick the statutory damage amount from a range, and they picked from the high end of the range. And do you know what the RIAA did after the jury awarded that large amount? They again offered to settle for a relatively small amount. (I don't remember the exact amount--I think it was around $15000, which based on 1700 songs they caught her infringing would be around $9/song). That's been the pattern for every RIAA case that went to trial, I believe. (Only a handful went to trial, because most infringers were smart enough to realize that (1) they had no defense, and (2) minimum statutory damages were going to be way more than the RIAA was asking for, and so they settled early). [1] Actual damages are very hard to determine in most non-commercial copyright infringement cases (and actually they are often very hard to determine in commercial infringement cases, too).

marcoperaza 9y ago

>I remembered when friends were back in the Napster times shook down for a few grand. Same with Bittorrent's earlier years. There was no amicable "Plz quit this and were good". The recording industry did offer an amnesty at the start of their campaign. It required you to promise to delete all existing illegally-downloaded content and promise not to engage of file sharing of copyrighted works in the future. It was called Clean Slate and very few people signed up for it, and it was criticized for various reasons, but they did offer it.

jerf 9y ago

Lotta philosophical reasons as siblings to my reply here, and many of them are very fine. But let me give you a practical reason this forgiveness works out well: If you want to leap straight to aggressive compliance, you're gonna need a lawyer. That will cost you. So in a world where the choices are "ignore the infringement" or "aggressively enforce it", you've got the choice of either ponying up the dough up front, or losing your licensed rights. Now, sometimes reality hands you a bum deal and there's not much you can do about it, but that's a bum deal. If you add a third choice of "politely ask for them to comply first", then you've got a free option, that is likely (albeit not guaranteed) to produce good results, and as an added bonus, if the company blows you off you are helping your eventual lawyer-involving case when it comes time to prove they knew and infringed anyhow. So unless you've got bored lawyers sitting around who are going to charge you no matter what you do, there is a reason to be a bit gracious first, even for you, the programmer of the GPL'ed work. (And yes, this RedHat effort does not create this result; this has always been an option and IIRC most historical enforcement efforts that went to lawsuit first used this. But it answers the question, in very programmer-centric terms.)