6 ms·

How to force disgruntled worker not to publicly disclose “GPL'ed code”

106 points by kioleanu 7y ago

Miner49er 7y ago
Some context that isn't immediately clear: this company is selling a compiled version of the Linux kernel in some way. They are required to disclose their source code if asked and make it clear their code is GPL'ed. They are in violation of the GPL, since they are not doing that.
- rurban 7y ago
  Only to their customers, not to the world. But most likely they are in violation.
  - deleted 7y ago
    [deleted]
  - imtringued 7y ago
    The GPL license allows the customers to hand it over to the rest of the world. I think this is overblown unless the code is containing secrets like API or private keys but then they only have themselves to blame for disregarding security.
- illys 7y ago
  Couldn't they write proprietary software with an API, then modify (under GPL) the Kernel to call that API? Their modified kernel with API calls is GPL while they keep their trade secrets... Am I correct?
  - Miner49er 7y ago
    I think so, this is what Google does with Android, but IANAL. But it seems the company hasn't been doing that, so even if they make the change now, their old code is still in violation of the GPL, and anyone they distributed it to has the right to request it.
    - noir_lord 7y ago
      Nvidia with their binary driver as well, that's why the kernel marks it as 'tainted'.
      - cvs268 7y ago
        Isn't "tainted" in the Linux kernel used to flag the presence of binary blobs? (and nothing to do with licensing) All binary blobs in the Linux kernel aren't automatically illegal according to the GPL, right? Binary blob kernel modules, in fact, have restricted access to the kernel frameworks (cannot access/use GPL symbols).
    - slrz 7y ago
      > I think so, this is what Google does with Android, but IANAL. Google doesn't ship any proprietary kernel code as part of Android. It's all GPL and available to the public at large. Some Android kernel parts are maintained separately from the kernel.org mainline tree (i.e. they maintain a fork) but that's not a legal issue (and they're getting better at it anyway).
- parliament32 7y ago
  If they have a custom kernel that only runs internally to provide some sort of SaaS, they don't have to disclose anything.
  - Miner49er 7y ago
    A moved comment by OP says this: "We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code""
- dTal 7y ago
  I am afraid the GPL simply isn't worth the paper it's not written on these days, due to the community's idealistic standpoint of "negotiate, not punish". Without the legal teeth of an actual threat of litigation, or the actions of a "rogue" employee like this one, there's no motivation whatsoever to comply. Violations are absolutely rampant.
  - deleted 7y ago
    [deleted]
iutiuesrer 7y ago
It looks like the manager was right and Francis wasn’t “mature enough” for that promotion. One thing companies overlook is employee loyalty. In hindsight, they should have gotten rid of Francis and kept Lee. Now they lost 2 engineers and maybe even the manager.
- FillardMillmore 7y ago
  From what I read, it sounds like Francis kinda got screwed by being vetoed for promotion. There was at least a possible conflict of interest and the fact that Lee knew about the particulars enough to gloat about it doesn't look good for the company. Employee loyalty is important to some degree. But knowing when your loyalty is being taken advantage of is also important.
- quaice 7y ago
  You would rather reward Lee's toxic behavior than Francis' loyalty to the company by pointing out Lee's technical issues?
- snagglegaggle 7y ago
  Which part of it isn't mature enough? He's just trying to argue for higher compensation. It looks like he is worth it based on how many problems he can cause for the company.
- randyrand 7y ago
  Lee gloating to Francis about not getting a raise is much less mature.
- yomly 7y ago
  From what I've read, I'm not convinced the company has done enough to earn Francis' loyalty. Francis has already invested ~years of time in this company and they've allowed other toxic people to poopoo his career. Sure they've fired Lee (who clearly needs to go) but Ling has yet to see any consequence, and they've stalled on reevaluating Ling's veto. In the meantime Francis apparently has to stomach this news and wait til the next promotion cycle in six months, one year? This is Francis' life - why should he waste that opportunity cost when he could be {saving for a house|supporting a family} (or some other life commitment). This is what you get when everything in your business is a process and dehumanized: to the stakeholders other than Francis, this is a headache - a fire to fight in your business as usual. To Francis this is trajectory altering, of course he has a right to be furious.
seren 7y ago
There is at least two entangled issues there, the first one is a human resource issue, and the second one is a legal issue. I got the feeling the person asking the question does not really understand what GPL entails. We lack some context but I am not sure that actually releasing the modified source code to their customer might sink the company. Likely a customer is buying a device or some code but also some expertise and support for future version, some client might try to use the modified version, but I am not sure this would be the majority of the cases in the real world.
Nasrudith 7y ago
Is it just what gets linked here or does "disgruntled" in an employer role question on Stack Overflow usually mean "I am about to be ripped a new one for entirely predictable reasons I failed to notice?".
- finnthehuman 7y ago
  Calling an employee "disgruntled" is one of those words like calling an ex "jilted". It's an attempt by a speaker to get you to side against the subject of the story they're about to tell, even though the story will likely make you side with the subject. When it's obvious that an employee/ex is acting rash or unreasonable, the adjective is superfluous and left out.
  - Doxin 7y ago
    To be fair, describing the employee in the post as disgruntled doesn't seem entirely unfair. I wouldn't be surprised at all if he is displeased and discontented. That said it's probably unnecessary to pre-label, they can let people come to their own conclusions.
spoonie 7y ago
It’s my understanding that non-competes have no teeth in Canada — in the software industry at least. Is there some except for comp/electrical/mechanical engineers as may be employed at this company?
- jrace 7y ago
  Correct. "These are generally only upheld in exceptional cases." ===https://www.canadaemploymenthumanrightslaw.com/2018/02/employees-non-compete-agreement-enforceable/ https://www.canadaemploymenthumanrightslaw.com/2018/02/emplo... Does not stop employers from trying...and most employees do not challenge it.
  - ThrustVectoring 7y ago
    Worth noting that employers can still try to enforce it via sending nasty-grams to your new employer, which can definitely cause you significant issues if your new employer isn't willing to take on the risk of being involved in a non-compete lawsuit on your behalf.
    - em-bee 7y ago
      how would they get involved? if the non-compete is invalid, and the new emoloyer gives me trouble because of it, can't i also go after the new employer for that? i mean, making non-competes invalid should protect me from that, otherwise it would still reduce my chances to get a job
      - jrace 7y ago
        Still requires you to take an active role in defending yourself,and some employers may not want the hassle.
        em-bee 7y ago
        they can't avoid the hassle. if they terminate me they'll face a wrong termination lawsuit.
robertbalent 7y ago
Seems like they have bigger problem than solving situation with their employees: > We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code"
nscalf 7y ago
First off, completely disregarding the legal status of this, it is both hilarious and encouraging to see this. Why? Because people too often seem to forget that companies you work for actively are likely trying to minimize how much you get from them, regardless of the value you give them. In this situation, Francis is a key employee on the team (the poster says as much), yet he has office politics torpedo a promotion. As far as the company training goes, Francis is doing everything wrong. As far as how you should behave towards a company that does not respect you or anywhere near your value, he's doing a good job playing the cards he has. I have no empathy for bad company policies or politics. In this situation, a good response would have been for HR to tell Francis how valuable they think he is to the company and that they were going to push through a different path for the promotion, and then to actually do it. Francis likely would not be acting this way without an obvious pattern of disrespect in the culture, and a feeling of being used by the company. If he sees the company (HR) show how much they value him and fight for him to be compensated more because of that, he would likely back off his defensive and combative stance.
berrynice 7y ago
Extremely based, I hope this Francis character shares the code
bjourne 7y ago
If I was Francis I'd be so pissed off. The company fucked him over and now thinks he is out of line for demanding compensation.
Porthos9K 7y ago
Francis shouldn't have negotiated. He should have immediately walked and then exposed his former employees. You just don't tolerate this sort of exploitation unless you approve of management taking advantage of workers.
wooptoo 7y ago
The GPL has been enforced by the FSF / Eben Moglen repeatedly and even defended in court by other companies (1)(2). To quote Moglen: > Despite the FUD, as a copyright license the GPL is absolutely solid. That’s why I’ve been able to enforce it dozens of times over nearly ten years, without ever going to court. [...] http://moglen.law.columbia.edu/publications/lu-12.pdf http://moglen.law.columbia.edu/publications/lu-12.pdf PDF The claim however has to come from the copyright owner, not a third party that attempts vigilante-style justice like the disgruntled employee. The employee should signal the license breach to the original authors. ---- 1. https://www.theregister.co.uk/2002/02/27/gpl_enforcement_goes_to_court/ https://www.theregister.co.uk/2002/02/27/gpl_enforcement_goe... 2. https://www.pinsentmasons.com/out-law/news/first-us-lawsuit-to-test-gpl-open-source-licence https://www.pinsentmasons.com/out-law/news/first-us-lawsuit-...
- karmajunkie 7y ago
  Exactly this. Francis would be deeply in the wrong in any court in the US (and, I presume, Canada) for unilaterally publishing their source code, even if required by the GPL. They can be forced to do so, but only by the courts. As for HR, they really should have handled this very differently. Ling should have been fired along with Lee for disclosing his veto to Lee, who then bragged about it. Francis should have been given the promotion he earned. If I were in their shoes now, I'd give him the severance package he wants unless he quits on his own—involutary termination of any sort should trigger the package.

106 points by kioleanu 7y ago

Some context that isn't immediately clear: this company is selling a compiled version of the Linux kernel in some way. They are required to disclose their source code if asked and make it clear their code is GPL'ed. They are in violation of the GPL, since they are not doing that.

rurban 7y ago
Only to their customers, not to the world. But most likely they are in violation.
- deleted 7y ago
  [deleted]
- imtringued 7y ago
  The GPL license allows the customers to hand it over to the rest of the world. I think this is overblown unless the code is containing secrets like API or private keys but then they only have themselves to blame for disregarding security.
illys 7y ago
Couldn't they write proprietary software with an API, then modify (under GPL) the Kernel to call that API? Their modified kernel with API calls is GPL while they keep their trade secrets... Am I correct?
- Miner49er 7y ago
  I think so, this is what Google does with Android, but IANAL. But it seems the company hasn't been doing that, so even if they make the change now, their old code is still in violation of the GPL, and anyone they distributed it to has the right to request it.
  - noir_lord 7y ago
    Nvidia with their binary driver as well, that's why the kernel marks it as 'tainted'.
    - cvs268 7y ago
      Isn't "tainted" in the Linux kernel used to flag the presence of binary blobs? (and nothing to do with licensing) All binary blobs in the Linux kernel aren't automatically illegal according to the GPL, right? Binary blob kernel modules, in fact, have restricted access to the kernel frameworks (cannot access/use GPL symbols).
  - slrz 7y ago
    > I think so, this is what Google does with Android, but IANAL. Google doesn't ship any proprietary kernel code as part of Android. It's all GPL and available to the public at large. Some Android kernel parts are maintained separately from the kernel.org mainline tree (i.e. they maintain a fork) but that's not a legal issue (and they're getting better at it anyway).
parliament32 7y ago
If they have a custom kernel that only runs internally to provide some sort of SaaS, they don't have to disclose anything.
- Miner49er 7y ago
  A moved comment by OP says this: "We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code""
dTal 7y ago
I am afraid the GPL simply isn't worth the paper it's not written on these days, due to the community's idealistic standpoint of "negotiate, not punish". Without the legal teeth of an actual threat of litigation, or the actions of a "rogue" employee like this one, there's no motivation whatsoever to comply. Violations are absolutely rampant.
- deleted 7y ago
  [deleted]

iutiuesrer 7y ago

It looks like the manager was right and Francis wasn’t “mature enough” for that promotion. One thing companies overlook is employee loyalty. In hindsight, they should have gotten rid of Francis and kept Lee. Now they lost 2 engineers and maybe even the manager.

FillardMillmore 7y ago
From what I read, it sounds like Francis kinda got screwed by being vetoed for promotion. There was at least a possible conflict of interest and the fact that Lee knew about the particulars enough to gloat about it doesn't look good for the company. Employee loyalty is important to some degree. But knowing when your loyalty is being taken advantage of is also important.
quaice 7y ago
You would rather reward Lee's toxic behavior than Francis' loyalty to the company by pointing out Lee's technical issues?
snagglegaggle 7y ago
Which part of it isn't mature enough? He's just trying to argue for higher compensation. It looks like he is worth it based on how many problems he can cause for the company.
randyrand 7y ago
Lee gloating to Francis about not getting a raise is much less mature.
yomly 7y ago
From what I've read, I'm not convinced the company has done enough to earn Francis' loyalty. Francis has already invested ~years of time in this company and they've allowed other toxic people to poopoo his career. Sure they've fired Lee (who clearly needs to go) but Ling has yet to see any consequence, and they've stalled on reevaluating Ling's veto. In the meantime Francis apparently has to stomach this news and wait til the next promotion cycle in six months, one year? This is Francis' life - why should he waste that opportunity cost when he could be {saving for a house|supporting a family} (or some other life commitment). This is what you get when everything in your business is a process and dehumanized: to the stakeholders other than Francis, this is a headache - a fire to fight in your business as usual. To Francis this is trajectory altering, of course he has a right to be furious.

seren 7y ago

There is at least two entangled issues there, the first one is a human resource issue, and the second one is a legal issue. I got the feeling the person asking the question does not really understand what GPL entails. We lack some context but I am not sure that actually releasing the modified source code to their customer might sink the company. Likely a customer is buying a device or some code but also some expertise and support for future version, some client might try to use the modified version, but I am not sure this would be the majority of the cases in the real world.

Nasrudith 7y ago

Is it just what gets linked here or does "disgruntled" in an employer role question on Stack Overflow usually mean "I am about to be ripped a new one for entirely predictable reasons I failed to notice?".

finnthehuman 7y ago
Calling an employee "disgruntled" is one of those words like calling an ex "jilted". It's an attempt by a speaker to get you to side against the subject of the story they're about to tell, even though the story will likely make you side with the subject. When it's obvious that an employee/ex is acting rash or unreasonable, the adjective is superfluous and left out.
- Doxin 7y ago
  To be fair, describing the employee in the post as disgruntled doesn't seem entirely unfair. I wouldn't be surprised at all if he is displeased and discontented. That said it's probably unnecessary to pre-label, they can let people come to their own conclusions.

spoonie 7y ago

It’s my understanding that non-competes have no teeth in Canada — in the software industry at least. Is there some except for comp/electrical/mechanical engineers as may be employed at this company?

jrace 7y ago
Correct. "These are generally only upheld in exceptional cases." ===https://www.canadaemploymenthumanrightslaw.com/2018/02/employees-non-compete-agreement-enforceable/ https://www.canadaemploymenthumanrightslaw.com/2018/02/emplo... Does not stop employers from trying...and most employees do not challenge it.
- ThrustVectoring 7y ago
  Worth noting that employers can still try to enforce it via sending nasty-grams to your new employer, which can definitely cause you significant issues if your new employer isn't willing to take on the risk of being involved in a non-compete lawsuit on your behalf.
  - em-bee 7y ago
    how would they get involved? if the non-compete is invalid, and the new emoloyer gives me trouble because of it, can't i also go after the new employer for that? i mean, making non-competes invalid should protect me from that, otherwise it would still reduce my chances to get a job
    - jrace 7y ago
      Still requires you to take an active role in defending yourself,and some employers may not want the hassle.
      - em-bee 7y ago
        they can't avoid the hassle. if they terminate me they'll face a wrong termination lawsuit.

robertbalent 7y ago

Seems like they have bigger problem than solving situation with their employees: > We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code"

nscalf 7y ago

First off, completely disregarding the legal status of this, it is both hilarious and encouraging to see this. Why? Because people too often seem to forget that companies you work for actively are likely trying to minimize how much you get from them, regardless of the value you give them. In this situation, Francis is a key employee on the team (the poster says as much), yet he has office politics torpedo a promotion. As far as the company training goes, Francis is doing everything wrong. As far as how you should behave towards a company that does not respect you or anywhere near your value, he's doing a good job playing the cards he has. I have no empathy for bad company policies or politics. In this situation, a good response would have been for HR to tell Francis how valuable they think he is to the company and that they were going to push through a different path for the promotion, and then to actually do it. Francis likely would not be acting this way without an obvious pattern of disrespect in the culture, and a feeling of being used by the company. If he sees the company (HR) show how much they value him and fight for him to be compensated more because of that, he would likely back off his defensive and combative stance.

berrynice 7y ago

Extremely based, I hope this Francis character shares the code

bjourne 7y ago

If I was Francis I'd be so pissed off. The company fucked him over and now thinks he is out of line for demanding compensation.

Porthos9K 7y ago

Francis shouldn't have negotiated. He should have immediately walked and then exposed his former employees. You just don't tolerate this sort of exploitation unless you approve of management taking advantage of workers.

wooptoo 7y ago

The GPL has been enforced by the FSF / Eben Moglen repeatedly and even defended in court by other companies (1)(2). To quote Moglen: > Despite the FUD, as a copyright license the GPL is absolutely solid. That’s why I’ve been able to enforce it dozens of times over nearly ten years, without ever going to court. [...] http://moglen.law.columbia.edu/publications/lu-12.pdf http://moglen.law.columbia.edu/publications/lu-12.pdf PDF The claim however has to come from the copyright owner, not a third party that attempts vigilante-style justice like the disgruntled employee. The employee should signal the license breach to the original authors. ---- 1. https://www.theregister.co.uk/2002/02/27/gpl_enforcement_goes_to_court/ https://www.theregister.co.uk/2002/02/27/gpl_enforcement_goe... 2. https://www.pinsentmasons.com/out-law/news/first-us-lawsuit-to-test-gpl-open-source-licence https://www.pinsentmasons.com/out-law/news/first-us-lawsuit-...

karmajunkie 7y ago
Exactly this. Francis would be deeply in the wrong in any court in the US (and, I presume, Canada) for unilaterally publishing their source code, even if required by the GPL. They can be forced to do so, but only by the courts. As for HR, they really should have handled this very differently. Ling should have been fired along with Lee for disclosing his veto to Lee, who then bragged about it. Francis should have been given the promotion he earned. If I were in their shoes now, I'd give him the severance package he wants unless he quits on his own—involutary termination of any sort should trigger the package.