8 ms·

The ability to correct errors in GPLv2 compliance: the right thing to do

92 points by swonderl 9y ago

wyldfire 9y ago
> The cure rights offer additional comfort that users of GPLv2 code have reasonable assurances of quiet use of that code, even if there is a temporary license noncompliance due to ambiguity, misunderstanding or otherwise. We also believe that community adoption of these rights will reduce the opportunity for copyright trolling. It's hard to understand the problem being solved here. While I've heard of "patent trolling" I guess I've only thought of copyright trolling in the sense of the (poorly tested) automatons who issue DMCA takedown requests for audio/video on youtube. I've heard about GPL enforcement but only in "good" context: copyright holders acting in good faith to get their licensees to comply with the license. Are there copyright holders engaging in abusive litigation?
- Ajedi32 9y ago
  Probably a response to this incident: https://news.ycombinator.com/item?id=16562525 https://news.ycombinator.com/item?id=16562525
  - crankylinuxuser 9y ago
    And pray tell me what Oracle, Microsoft, and the friends in the BSA do if you're caught violating the terms of the license? Do they kindly ask for apology? Do they offer, at cost, to make their licenses good? Are they a good steward when they find license mishaps? Or, why should Free Software foundations accept this against companies making decisions to cheat all of us?
    - bonzini 9y ago
      They don't do free software. FSF and Conservancy are trying to keep the moral high ground.
      - crankylinuxuser 9y ago
        I will concede that point for one class of violators. There's from what I see, 2 groups of GPL (and related) license violators. The first are unintentional ones. They didn't realize, for one reason or another, the ramifications of the GPL. Or, they just don't have a license but it's on Git(Hub/Lab). These people, if it is mentioned to, will fix it. You have the second group, that sells corporate, closed source hardware, with closed source linux kernel and associated GPL'ed tools. These care not for licenses, and would violate anything and everything for a nickel. They are bad actors, willing to do anything to disadvantage any suckers. Look no further than pretty much every Android phone vendor, Orange Pi, Banana Pi, and lots others. Intent is 90% of the law. I'm certainly willing to let the 10% drop (the action), but its clear whom is and isn't well meaning and who is a bad actor. Making a pile of money and intentionally breaking the license and copyright is usually a pretty strong indicator.
        bonzini 9y ago
        You only have 60 days to be compliant for your license to be reinstated. The ilks of Allwinner have failed to comply for years, and are outside the scope of the "GPLv2 safeguard" that's the topic here.
      - sametmax 9y ago
        The problem with moral is that it's in the eye of the beholder. While legal is described very clearly on paper. And how is it moral to be nice with immoral people ? Now I do believe it's good to let a chance to do the right thing. But if not, it must be followed by actions. E.G: I would add to the licence that it is illegal to give technical support or to provide a commercial service related to the product with a violated licence, for all the product with the same licence. If you can't get support for any of your linux servers, or you can't even rent a new VPS, you'll think twice about compliance.
    - LukeShu 9y ago
      The licenses used by Oracle, Microsoft, and friends are there to protect the monetary interests of Oracle, Microsoft, and friends. So, when you are caught violating the license, they offer to make their license good, conditioned on you serving their monetary interest. The licenses used by the FSF are there to protect the liberty of users. So, when you are caught violating the license, they offer to make their license good, conditioned on you restoring the users' liberty.
      - crankylinuxuser 9y ago
        Yes, and the liberty of the users (read: the price the developers would be if having to replace the violated code) is worth that much. How much is a team of developers for a month? So yeah, that's real money and time.
- toyg 9y ago
  > Are there copyright holders engaging in abusive litigation? Some enforcement efforts have been controversial, particularly the VmWare suit and other efforts by SFConservancy. I wouldn't call them trolls, but a lot of people think they are too heavy-handed. On the other hand, with nobody wielding a stick, there is no real incentive not to abuse free licenses - which is exactly why the GPL exists in the first place.
  - throwaway2048 9y ago
    How are they too heavily handed? the only thing they ask for in negotiation and lawsuits is GPL compliance, they dont demand money, or anything else. If following the license is too much to ask for, what exactly does "not heavy handed" mean?
    - anon1385 9y ago
      > they dont demand money A linux developer demanding money from GPL violators is (seemingly) what triggered this action. See http://www.zdnet.com/article/linux-beats-internal-legal-threat/ http://www.zdnet.com/article/linux-beats-internal-legal-thre... >McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions. >what exactly does "not heavy handed" mean It means not permanently revoking their licence to use the code again, even once they have become compliant. It's a common complaint made about the GPLv2 which was clarified in GPLv3
      - throwaway2048 9y ago
        The poster i was replying to was talking about SFC, not that case.
    - kuschku 9y ago
      > If following the license is too much to ask for, what exactly does "not heavy handed" mean? The "enforcement" that Torvalds wants is what you see with Android today: Everyone ships blobs of kernel builds, with the source never released.
sgift 9y ago
"The right thing to do" from a programmers perspective is to never use any dependency which uses anything with *GPL as its license if they can use something else instead. Sometimes, the only viable option is licensed under one of these licenses and then you have to look very carefully and probably involve legal support, but for all the other cases life gets far easier if you just don't use such dependencies and take something with a less restrictive license.
- pjc50 9y ago
  If you're not writing code that you yourself intend to make open, then this is actually what the GPL "wants" you to do.
- adrianN 9y ago
  The right thing to do is to just make the source available when the license requires you to do so. It's not that hard. If in doubt, just make it available.
  - johannes1234321 9y ago
    It's hard if you licensed some of the code elsewhere and boundaries are unclear (and then ignore all the fallout from publishing - others can't use it and will call support, security researchers might find bugs, ...) If more code would be shared it would be a better world, but the way s not simple. Respecting licenses of ocurse is a requirement.
- throwaway2048 9y ago
  Its the right thing to do if you are interested in people using your code, making money off of it, and not contributing anything back. Lots of people are not interested in this.
  - sgift 9y ago
    You seem to talk about what license to chose for your own libraries as a library developer. I didn't comment on that.
deleted 9y ago
[deleted]
gpm 9y ago
I don't think this is a good thing. The GPL is a tool to scare companies into doing the right thing and releasing their code. By committing to this we lose the ability to scare those companies. It becomes much more worthwhile to play chicken hoping no one will notice that you are using GPL code in your closed source binary.
- LukeShu 9y ago
  I disagree--I firmly believe that this is a good thing. If Foo Corp intentionally/accidentally violates the GPLv2 on software owned by CA/Cisco/HPE/Microsoft/SAP/SUSE, but decides to do the right thing/come clean and release the code... without this (plain GPLv2): Their license to the GPLv2 was revoked, is still revoked, and are liable to each of the owners. Even if one owner reinstates the license, the others don't have to. with this (GPLv2 with GPLv3-cure): Their license is provisionally reinstated upon coming in to compliance, and permanently reinstated 60 days later if none of the copyright holders object. With the plain GPLv2 it was worth it to play chicken. Now, it no longer is.
- eitland 9y ago
  IMO you underestimate the effort of rewriting released software in a shirt timeframe, especially software running on premise.
- _ph_ 9y ago
  Not all GPL violations are done in bad faith. So in many cases, it is better to give offenders the ability to fix the problem rather than revoking their license perpetually. Scaring is not a great tactic, if you really want more people to use open source code.
- bluGill 9y ago
  No, without this it goes to court. A court will already accept good faith arguments, but absent any good faith clause the court gets to decide what that means. By having a good faith clause the license can control better what happens when the court would determine good faith applys.
- ajross 9y ago
LukeShu 9y ago
Note that the FSF and the SF Conservancy have already been doing this, and recommending you do this, as part of their Principles of Community-Oriented GPL Enforcement. https://www.fsf.org/licensing/enforcement-principles https://www.fsf.org/licensing/enforcement-principles > Community-oriented compliance processes should extend the benefit of GPLv3-like termination, even for GPLv2-only works. > GPLv2 terminates all copyright permissions at the moment of violation, and that termination is permanent. GPLv3's termination provision allows first-time violators automatic restoration of distribution rights when they correct the violation promptly, and gives the violator a precise list of copyright holders whose forgiveness it needs. GPLv3's collaborative spirit regarding termination reflects a commitment to and hope for future cooperation and collaboration. It's a good idea to follow this approach in compliance situations stemming from honest mistakes, even when the violations are on works under GPLv2.
yarrel 9y ago
...is to move to GPLv3.
jlgaddis 9y ago
I would love to see the kernel community go after Mikrotik for license violations -- up to and including monetary damages, if they continue to refuse to comply.

92 points by swonderl 9y ago

> The cure rights offer additional comfort that users of GPLv2 code have reasonable assurances of quiet use of that code, even if there is a temporary license noncompliance due to ambiguity, misunderstanding or otherwise. We also believe that community adoption of these rights will reduce the opportunity for copyright trolling. It's hard to understand the problem being solved here. While I've heard of "patent trolling" I guess I've only thought of copyright trolling in the sense of the (poorly tested) automatons who issue DMCA takedown requests for audio/video on youtube. I've heard about GPL enforcement but only in "good" context: copyright holders acting in good faith to get their licensees to comply with the license. Are there copyright holders engaging in abusive litigation?

Ajedi32 9y ago
Probably a response to this incident: https://news.ycombinator.com/item?id=16562525 https://news.ycombinator.com/item?id=16562525
- crankylinuxuser 9y ago
  And pray tell me what Oracle, Microsoft, and the friends in the BSA do if you're caught violating the terms of the license? Do they kindly ask for apology? Do they offer, at cost, to make their licenses good? Are they a good steward when they find license mishaps? Or, why should Free Software foundations accept this against companies making decisions to cheat all of us?
  - bonzini 9y ago
    They don't do free software. FSF and Conservancy are trying to keep the moral high ground.
    - crankylinuxuser 9y ago
      I will concede that point for one class of violators. There's from what I see, 2 groups of GPL (and related) license violators. The first are unintentional ones. They didn't realize, for one reason or another, the ramifications of the GPL. Or, they just don't have a license but it's on Git(Hub/Lab). These people, if it is mentioned to, will fix it. You have the second group, that sells corporate, closed source hardware, with closed source linux kernel and associated GPL'ed tools. These care not for licenses, and would violate anything and everything for a nickel. They are bad actors, willing to do anything to disadvantage any suckers. Look no further than pretty much every Android phone vendor, Orange Pi, Banana Pi, and lots others. Intent is 90% of the law. I'm certainly willing to let the 10% drop (the action), but its clear whom is and isn't well meaning and who is a bad actor. Making a pile of money and intentionally breaking the license and copyright is usually a pretty strong indicator.
      - bonzini 9y ago
        You only have 60 days to be compliant for your license to be reinstated. The ilks of Allwinner have failed to comply for years, and are outside the scope of the "GPLv2 safeguard" that's the topic here.
    - sametmax 9y ago
      The problem with moral is that it's in the eye of the beholder. While legal is described very clearly on paper. And how is it moral to be nice with immoral people ? Now I do believe it's good to let a chance to do the right thing. But if not, it must be followed by actions. E.G: I would add to the licence that it is illegal to give technical support or to provide a commercial service related to the product with a violated licence, for all the product with the same licence. If you can't get support for any of your linux servers, or you can't even rent a new VPS, you'll think twice about compliance.
  - LukeShu 9y ago
    The licenses used by Oracle, Microsoft, and friends are there to protect the monetary interests of Oracle, Microsoft, and friends. So, when you are caught violating the license, they offer to make their license good, conditioned on you serving their monetary interest. The licenses used by the FSF are there to protect the liberty of users. So, when you are caught violating the license, they offer to make their license good, conditioned on you restoring the users' liberty.
    - crankylinuxuser 9y ago
      Yes, and the liberty of the users (read: the price the developers would be if having to replace the violated code) is worth that much. How much is a team of developers for a month? So yeah, that's real money and time.
toyg 9y ago
> Are there copyright holders engaging in abusive litigation? Some enforcement efforts have been controversial, particularly the VmWare suit and other efforts by SFConservancy. I wouldn't call them trolls, but a lot of people think they are too heavy-handed. On the other hand, with nobody wielding a stick, there is no real incentive not to abuse free licenses - which is exactly why the GPL exists in the first place.
- throwaway2048 9y ago
  How are they too heavily handed? the only thing they ask for in negotiation and lawsuits is GPL compliance, they dont demand money, or anything else. If following the license is too much to ask for, what exactly does "not heavy handed" mean?
  - anon1385 9y ago
    > they dont demand money A linux developer demanding money from GPL violators is (seemingly) what triggered this action. See http://www.zdnet.com/article/linux-beats-internal-legal-threat/ http://www.zdnet.com/article/linux-beats-internal-legal-thre... >McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions. >what exactly does "not heavy handed" mean It means not permanently revoking their licence to use the code again, even once they have become compliant. It's a common complaint made about the GPLv2 which was clarified in GPLv3
    - throwaway2048 9y ago
      The poster i was replying to was talking about SFC, not that case.
  - kuschku 9y ago
    > If following the license is too much to ask for, what exactly does "not heavy handed" mean? The "enforcement" that Torvalds wants is what you see with Android today: Everyone ships blobs of kernel builds, with the source never released.

sgift 9y ago

"The right thing to do" from a programmers perspective is to never use any dependency which uses anything with *GPL as its license if they can use something else instead. Sometimes, the only viable option is licensed under one of these licenses and then you have to look very carefully and probably involve legal support, but for all the other cases life gets far easier if you just don't use such dependencies and take something with a less restrictive license.

pjc50 9y ago
If you're not writing code that you yourself intend to make open, then this is actually what the GPL "wants" you to do.
adrianN 9y ago
The right thing to do is to just make the source available when the license requires you to do so. It's not that hard. If in doubt, just make it available.
- johannes1234321 9y ago
  It's hard if you licensed some of the code elsewhere and boundaries are unclear (and then ignore all the fallout from publishing - others can't use it and will call support, security researchers might find bugs, ...) If more code would be shared it would be a better world, but the way s not simple. Respecting licenses of ocurse is a requirement.
throwaway2048 9y ago
Its the right thing to do if you are interested in people using your code, making money off of it, and not contributing anything back. Lots of people are not interested in this.
- sgift 9y ago
  You seem to talk about what license to chose for your own libraries as a library developer. I didn't comment on that.

deleted 9y ago

[deleted]

gpm 9y ago

I don't think this is a good thing. The GPL is a tool to scare companies into doing the right thing and releasing their code. By committing to this we lose the ability to scare those companies. It becomes much more worthwhile to play chicken hoping no one will notice that you are using GPL code in your closed source binary.

LukeShu 9y ago
I disagree--I firmly believe that this is a good thing. If Foo Corp intentionally/accidentally violates the GPLv2 on software owned by CA/Cisco/HPE/Microsoft/SAP/SUSE, but decides to do the right thing/come clean and release the code... without this (plain GPLv2): Their license to the GPLv2 was revoked, is still revoked, and are liable to each of the owners. Even if one owner reinstates the license, the others don't have to. with this (GPLv2 with GPLv3-cure): Their license is provisionally reinstated upon coming in to compliance, and permanently reinstated 60 days later if none of the copyright holders object. With the plain GPLv2 it was worth it to play chicken. Now, it no longer is.
eitland 9y ago
IMO you underestimate the effort of rewriting released software in a shirt timeframe, especially software running on premise.
_ph_ 9y ago
Not all GPL violations are done in bad faith. So in many cases, it is better to give offenders the ability to fix the problem rather than revoking their license perpetually. Scaring is not a great tactic, if you really want more people to use open source code.
bluGill 9y ago
No, without this it goes to court. A court will already accept good faith arguments, but absent any good faith clause the court gets to decide what that means. By having a good faith clause the license can control better what happens when the court would determine good faith applys.
ajross 9y ago

LukeShu 9y ago

Note that the FSF and the SF Conservancy have already been doing this, and recommending you do this, as part of their Principles of Community-Oriented GPL Enforcement. https://www.fsf.org/licensing/enforcement-principles https://www.fsf.org/licensing/enforcement-principles > Community-oriented compliance processes should extend the benefit of GPLv3-like termination, even for GPLv2-only works. > GPLv2 terminates all copyright permissions at the moment of violation, and that termination is permanent. GPLv3's termination provision allows first-time violators automatic restoration of distribution rights when they correct the violation promptly, and gives the violator a precise list of copyright holders whose forgiveness it needs. GPLv3's collaborative spirit regarding termination reflects a commitment to and hope for future cooperation and collaboration. It's a good idea to follow this approach in compliance situations stemming from honest mistakes, even when the violations are on works under GPLv2.

yarrel 9y ago

...is to move to GPLv3.

jlgaddis 9y ago

I would love to see the kernel community go after Mikrotik for license violations -- up to and including monetary damages, if they continue to refuse to comply.