4 ms·

Question for Kyle: Do you see the enterprise exploiting GPL loopholes often? I work at a FAANG, and there’s pretty much a hard ban on any copyleft code being a

Question for Kyle: Do you see the enterprise exploiting GPL loopholes often? I work at a FAANG, and there’s pretty much a hard ban on any copyleft code being a dependency outside of stuff installed via distro packages. The lawyers are tough about it; the advice is always to get an enterprise license (or of course, make your own cool BSD+patents library to ‘open source’ as marketing). I hear similar things from friends at other FAANG companies. Do you see/hear of this more from startups based around a specific technology, containerizing copyleft code and calling it exempt? Any examples you can share? P.S. Great blog!

twblalock 8y ago
I have the same experience at FAANG as well as startups. We have to be careful not to include GPL software as dependencies, except in cases with special exceptions such as OpenJDK. I suspect that a large proportion of the abuses of open source licenses are unintentional and happen because developers don't understand the licenses.
mr_toad 8y ago
> I work at a FAANG, and there’s pretty much a hard ban on any copyleft code I have trouble reconciling this with the existence of Android.
- icebraining 8y ago
  Why? Android didn't have any copyleft code besides the Linux kernel, which doesn't extend to the userland. The rest of the components were Bionic (BSD), Dalvik (Apache) and Harmony (Apache). They now use OpenJDK, but that was after getting sued.
- rlpb 8y ago
  Android went out of their way to avoid GPL code in userspace.
kemitchell 8y ago
You ask a very good question. I'm afraid the very strong rules about confidentiality that apply to me as a California attorney prevent me from answering as I'd like. I can say that I think your experience is typical of large software firms. Most still ban AGPLv3, if not all GPLs or all copyleft licenses, by policy. Even when there are exploitable loopholes, they're typically narrow enough to require very close collaboration between legal and engineering, in the context of a very specific project, especially the first time. It's possible to exploit those loopholes, but not possible to prescribe how to do so by general policy. That used to be true of private changes to GPLv2 and GPLv3 code. We've seen exercises of those intentional gaps in copyleft operationalized as policy in firms that rely on them daily. If you see posts on https://writing.kemitchell.com https://writing.kemitchell.com that you like, you may also find https://blog.licensezero.com https://blog.licensezero.com worth the candle.

twblalock 8y ago

I have the same experience at FAANG as well as startups. We have to be careful not to include GPL software as dependencies, except in cases with special exceptions such as OpenJDK. I suspect that a large proportion of the abuses of open source licenses are unintentional and happen because developers don't understand the licenses.

mr_toad 8y ago

> I work at a FAANG, and there’s pretty much a hard ban on any copyleft code I have trouble reconciling this with the existence of Android.

icebraining 8y ago
Why? Android didn't have any copyleft code besides the Linux kernel, which doesn't extend to the userland. The rest of the components were Bionic (BSD), Dalvik (Apache) and Harmony (Apache). They now use OpenJDK, but that was after getting sued.
rlpb 8y ago
Android went out of their way to avoid GPL code in userspace.

kemitchell 8y ago

You ask a very good question. I'm afraid the very strong rules about confidentiality that apply to me as a California attorney prevent me from answering as I'd like. I can say that I think your experience is typical of large software firms. Most still ban AGPLv3, if not all GPLs or all copyleft licenses, by policy. Even when there are exploitable loopholes, they're typically narrow enough to require very close collaboration between legal and engineering, in the context of a very specific project, especially the first time. It's possible to exploit those loopholes, but not possible to prescribe how to do so by general policy. That used to be true of private changes to GPLv2 and GPLv3 code. We've seen exercises of those intentional gaps in copyleft operationalized as policy in firms that rely on them daily. If you see posts on https://writing.kemitchell.com https://writing.kemitchell.com that you like, you may also find https://blog.licensezero.com https://blog.licensezero.com worth the candle.