5 ms·

> We have found that neither company complies properly with the GPL. Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fa

by shakna 7y ago

> We have found that neither company complies properly with the GPL. Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points, even when we repeatedly asked over the course of several weeks, starting more than 30 days ago. Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code. The mentioned GPL in the article is v2, so lifting from there, the valid parts are probably: > a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, > b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.

russdill 7y ago
The sfconservancy is quite well versed in GPL enforcement. They typically have someone who has purchased the device send a request or they just buy a device.
- mikekchar 7y ago
  They say that aren't litigating, so it's moot for now, but I wonder... If they do want to sue, they will have to find someone with standing in order to do so. I suppose that won't be difficult for them, but I'm curious how they might go about it.
  - pabs3 7y ago
    Conservancy represents various Linux kernel and other developers who hold copyright on parts of the Linux kernel and other projects. In other cases developers reassign their copyright directly to Conservancy. Then Conservancy performs copyleft compliance actions, aimed at code release, with lawsuits being a very last resort reserved for wilfully non-compliant organisations. https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...
  - pjc50 7y ago
    Buy a device? Costing a few minutes of lawyer time.
    - Fnoord 7y ago
      I was wondering: what if I am able to extract the firmware from a device, or download the firmware from their website? Should I then also be able to ask for the source? AFAICT, the answer to this question is: Yes.
      - toyg 7y ago
        IANAL but yes, distribution is distribution. If one distributes GPLed code, one is subject to GPL terms towards whoever received such software. I guess the exception would be malice or misrepresentation, e.g. faking you are a customer in order to download the firmware, or hacking servers and grabbing stuff. In that case the vendor is not wilfully distributing, and hence not subject to GPL terms. In the case of extracting firmware, though, one might run afoul of anti-reverse-engineering provisions in laws like DMCA.
  - PeterisP 7y ago
    They don't have to buy a device - Ubiquity has distributed a a device with a copy of the copyrighted thing without fulfilling the GPL conditions (since neither the code nor a legally binding offer to provide the code was attached). That's a simple copyright violation (making and distributing copies without a valid license to do so), and since Conservancy represents copyright holders (some of the developers) whose copyright has been violated, they have standing to sue.
fuzzy2 7y ago
It says "any third party".
- pricechild 7y ago
  That language seems to exist only in GPL v1. It is also part of a list of 'or' options. You can abide by one of the other options and not need to adhere to this one.
  - teddyh 7y ago
    No, that language is in both GPLv1 and GPLv2 (in GPLv3 it’s “anyone who possesses the object code”). Yes, it’s one of a list of alternatives. The GPLv1 and GPLv2 sole applicable alternative to the written offer is to send the source code together with the compiled code; i.e. to all customers, in the box. Which they presumably didn’t do, so I don’t know why you bring it up. (GPLv3 adds the allowable alternative to point to a web page or similar where the source code may be downloaded. I.e. you don’t have to waste money by shipping a CD, you can just print the URL on a note or in the manual. But this was the GPLv2, not v3, so it’s not applicable here, nor has anyone said that any such URL was provided.)
    - pricechild 7y ago
      My mistake, you are right in that the same language appears in v2. My point is that the op commented: > No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer. ...and I am agreeing to this position, against fuzzyh. Specifically "anyone" != "any third party" != "any third party... unless you've abided by a) or b), which don't require distribution to 'anyone' either."
      - teddyh 7y ago
        But it’s obvious that neither a) or b) applies in this case.
  - fuzzy2 7y ago
    It’s in the quote. ^^ That’s correct, in case they actually ship the source code with the hardware, they’re complying. I very much doubt they do that. As such, option b) comes into play. The GPL FAQ is very clear on the point that "any third party" means exactly that: Anyone that gets a hold of the offer (which you’re required to provide, otherwise probably also a violation) can request the source code.
MertsA 7y ago
Also, while Ubiquiti is failing to provide the source code for AmpliFi, they do comply in other areas. Their claim that they don't provide the GPL licensed code at all is flat out false. https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0.6.5208554.tar.bz2 https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0.... All you have to do is click on "GPL Archive" on the download page for the firmware.
- vetinari 7y ago
  Where do you see the link "GPL Archive"? I wanted to download the archive for Unifi nanoHD, the GPL archive is mentioned in the download blurb, but there's no link to it and the normal download shows classic proprietary EULA, including no reverse engineering.
  - MertsA 7y ago
    I thought they were compliant for UniFi AP firmware but not 100% sure on that. I've seen in the past where upon a new release being published they would forget to update the GPL archive on the site. Just email support@ui.com and they do have it internally. At the very least I found a current copy on the downloads page for EdgeMax and I've seen others mention it for UniFi, mFi, and airMax. The only thing Ubiquiti seems to be openly flaunting the GPL on is AmpliFi where I've personally emailed them, escalated the request to their "Development team" and received a response more or less equating to "go pound sand". They seem to be skirting their requirements in not providing the full git repository for the GPL portions which might be a bit of a gray area but AFAIK the GPLv2 stipulates "The source code for a work means the preferred form of the work for making modifications to it." which I would think would encompass the git repo as well but IANAL. In the past they also refused to provide the source code for their modified version of uboot claiming some nebulous security reasons but that stopped a little while back.
    - aidenn0 7y ago
      It does not include the VCS. Gnu did not make their VCS publicly readable for many of their projects back in the day.
teddyh 7y ago
Well, technically… The GPL does not actually force anyone to give out source code. The GPLv2 requires to either give out source code to customers, or to give customers a written offer (valid for anyone, not just customers). It is this optional offer, which, being a promise, forces the giving out of source code to anyone in possession of this offer. Failure to honor such an offer is probably not a GPL violation, but a simple breach of contract/promise. If no such offer was given, then the GPLv2 was violated, full stop. The Conservancy had really no need to ask for source code, since the GPLv2 violation occurred when no offer nor source code was given to customers. The fact that the Conservancy did offer the violators a way out by asking for source code is a pure nicety on their part, since they really didn’t have to.
- pricechild 7y ago
  Well technically... you left out an important word after "offer": > a written offer, valid for at least three ... So it's not just requiring an offer be made, it's requiring a offer being made which is valid (with certain conditions) If you make an offer you have no intention of honouring, surely that's not a valid offer?
  - teddyh 7y ago
    Unless Ubiquiti actually provided such an offer (valid or not), this discussion is getting unnecessarily complicated.
- shakna 7y ago
  > Some of the software in the firmware is licensed under the GNU General Public License and other Open Source and Free Software licenses. You can find the complete and corresponding source in the GPL archive. [0] They seem to have plenty of GPL sources available for download when you grab the firmware (and without having a device to test, it may actually include the source code with itself), so it seems they do offer up this source code. (The firmware download does come with a EULA, but the EULA specifically spells out it only applies to the proprietary bits, and not GPL and other Open Source software.) So it seems that the claim "Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points..." needs more information before we can be certain that it is correct. [0] https://www.ui.com/download/edgemax/default/default/edgeswitch-firmware-v190 https://www.ui.com/download/edgemax/default/default/edgeswit...
zAy0LfpBZLC8mAC 7y ago
> Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code. They don't represent users, they represent copyright holders. A copyright holder does not need to buy a violating product in order to enforce their copyright.
- shakna 7y ago
  Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL. GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
  - zAy0LfpBZLC8mAC 7y ago
    > Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL. Which is the same thing. The only way to "claim breach of GPL" is to enforce copyright. These companies have no right to use the respective copyrighted software without a license, and as they are not using it under the terms of the GPL, they have no right to use it at all, which is why their use of the software is a violation of copyright. > GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy? They wouldn't be. But they are still in violation of copyright, so they better do what the copyright holder demands to rectify that situation if they don't want to be sued over that copyright violation. They are distributing software that they don't own the copyright to, and as they are violating the GPL by not providing the source or a valid offer to provide the source on request with the software, they have voided their rigfhts under the GPL as well, so they are illegaly distributing that software. The copyright owners therefore probably could get their products pulled from the shelves to stop that copyright violation. Instead of doing that, the copyright owners are offering them the option to reinstate their rights under the GPL if they provide them with a copy of the source code they would have to provide their customers under the GPL and get compliant with the terms of the GPL.

by shakna 7y ago

russdill 7y ago

The sfconservancy is quite well versed in GPL enforcement. They typically have someone who has purchased the device send a request or they just buy a device.

mikekchar 7y ago
They say that aren't litigating, so it's moot for now, but I wonder... If they do want to sue, they will have to find someone with standing in order to do so. I suppose that won't be difficult for them, but I'm curious how they might go about it.
- pabs3 7y ago
  Conservancy represents various Linux kernel and other developers who hold copyright on parts of the Linux kernel and other projects. In other cases developers reassign their copyright directly to Conservancy. Then Conservancy performs copyleft compliance actions, aimed at code release, with lawsuits being a very last resort reserved for wilfully non-compliant organisations. https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...
- pjc50 7y ago
  Buy a device? Costing a few minutes of lawyer time.
  - Fnoord 7y ago
    I was wondering: what if I am able to extract the firmware from a device, or download the firmware from their website? Should I then also be able to ask for the source? AFAICT, the answer to this question is: Yes.
    - toyg 7y ago
      IANAL but yes, distribution is distribution. If one distributes GPLed code, one is subject to GPL terms towards whoever received such software. I guess the exception would be malice or misrepresentation, e.g. faking you are a customer in order to download the firmware, or hacking servers and grabbing stuff. In that case the vendor is not wilfully distributing, and hence not subject to GPL terms. In the case of extracting firmware, though, one might run afoul of anti-reverse-engineering provisions in laws like DMCA.
- PeterisP 7y ago
  They don't have to buy a device - Ubiquity has distributed a a device with a copy of the copyrighted thing without fulfilling the GPL conditions (since neither the code nor a legally binding offer to provide the code was attached). That's a simple copyright violation (making and distributing copies without a valid license to do so), and since Conservancy represents copyright holders (some of the developers) whose copyright has been violated, they have standing to sue.

fuzzy2 7y ago

It says "any third party".

pricechild 7y ago
That language seems to exist only in GPL v1. It is also part of a list of 'or' options. You can abide by one of the other options and not need to adhere to this one.
- teddyh 7y ago
  No, that language is in both GPLv1 and GPLv2 (in GPLv3 it’s “anyone who possesses the object code”). Yes, it’s one of a list of alternatives. The GPLv1 and GPLv2 sole applicable alternative to the written offer is to send the source code together with the compiled code; i.e. to all customers, in the box. Which they presumably didn’t do, so I don’t know why you bring it up. (GPLv3 adds the allowable alternative to point to a web page or similar where the source code may be downloaded. I.e. you don’t have to waste money by shipping a CD, you can just print the URL on a note or in the manual. But this was the GPLv2, not v3, so it’s not applicable here, nor has anyone said that any such URL was provided.)
  - pricechild 7y ago
    My mistake, you are right in that the same language appears in v2. My point is that the op commented: > No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer. ...and I am agreeing to this position, against fuzzyh. Specifically "anyone" != "any third party" != "any third party... unless you've abided by a) or b), which don't require distribution to 'anyone' either."
    - teddyh 7y ago
      But it’s obvious that neither a) or b) applies in this case.
- fuzzy2 7y ago
  It’s in the quote. ^^ That’s correct, in case they actually ship the source code with the hardware, they’re complying. I very much doubt they do that. As such, option b) comes into play. The GPL FAQ is very clear on the point that "any third party" means exactly that: Anyone that gets a hold of the offer (which you’re required to provide, otherwise probably also a violation) can request the source code.

MertsA 7y ago

Also, while Ubiquiti is failing to provide the source code for AmpliFi, they do comply in other areas. Their claim that they don't provide the GPL licensed code at all is flat out false. https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0.6.5208554.tar.bz2 https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0.... All you have to do is click on "GPL Archive" on the download page for the firmware.

vetinari 7y ago
Where do you see the link "GPL Archive"? I wanted to download the archive for Unifi nanoHD, the GPL archive is mentioned in the download blurb, but there's no link to it and the normal download shows classic proprietary EULA, including no reverse engineering.
- MertsA 7y ago
  I thought they were compliant for UniFi AP firmware but not 100% sure on that. I've seen in the past where upon a new release being published they would forget to update the GPL archive on the site. Just email support@ui.com and they do have it internally. At the very least I found a current copy on the downloads page for EdgeMax and I've seen others mention it for UniFi, mFi, and airMax. The only thing Ubiquiti seems to be openly flaunting the GPL on is AmpliFi where I've personally emailed them, escalated the request to their "Development team" and received a response more or less equating to "go pound sand". They seem to be skirting their requirements in not providing the full git repository for the GPL portions which might be a bit of a gray area but AFAIK the GPLv2 stipulates "The source code for a work means the preferred form of the work for making modifications to it." which I would think would encompass the git repo as well but IANAL. In the past they also refused to provide the source code for their modified version of uboot claiming some nebulous security reasons but that stopped a little while back.
  - aidenn0 7y ago
    It does not include the VCS. Gnu did not make their VCS publicly readable for many of their projects back in the day.

teddyh 7y ago

Well, technically… The GPL does not actually force anyone to give out source code. The GPLv2 requires to either give out source code to customers, or to give customers a written offer (valid for anyone, not just customers). It is this optional offer, which, being a promise, forces the giving out of source code to anyone in possession of this offer. Failure to honor such an offer is probably not a GPL violation, but a simple breach of contract/promise. If no such offer was given, then the GPLv2 was violated, full stop. The Conservancy had really no need to ask for source code, since the GPLv2 violation occurred when no offer nor source code was given to customers. The fact that the Conservancy did offer the violators a way out by asking for source code is a pure nicety on their part, since they really didn’t have to.

pricechild 7y ago
Well technically... you left out an important word after "offer": > a written offer, valid for at least three ... So it's not just requiring an offer be made, it's requiring a offer being made which is valid (with certain conditions) If you make an offer you have no intention of honouring, surely that's not a valid offer?
- teddyh 7y ago
  Unless Ubiquiti actually provided such an offer (valid or not), this discussion is getting unnecessarily complicated.
shakna 7y ago
> Some of the software in the firmware is licensed under the GNU General Public License and other Open Source and Free Software licenses. You can find the complete and corresponding source in the GPL archive. [0] They seem to have plenty of GPL sources available for download when you grab the firmware (and without having a device to test, it may actually include the source code with itself), so it seems they do offer up this source code. (The firmware download does come with a EULA, but the EULA specifically spells out it only applies to the proprietary bits, and not GPL and other Open Source software.) So it seems that the claim "Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points..." needs more information before we can be certain that it is correct. [0] https://www.ui.com/download/edgemax/default/default/edgeswitch-firmware-v190 https://www.ui.com/download/edgemax/default/default/edgeswit...

zAy0LfpBZLC8mAC 7y ago

> Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code. They don't represent users, they represent copyright holders. A copyright holder does not need to buy a violating product in order to enforce their copyright.

shakna 7y ago
Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL. GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
- zAy0LfpBZLC8mAC 7y ago
  > Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL. Which is the same thing. The only way to "claim breach of GPL" is to enforce copyright. These companies have no right to use the respective copyrighted software without a license, and as they are not using it under the terms of the GPL, they have no right to use it at all, which is why their use of the software is a violation of copyright. > GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy? They wouldn't be. But they are still in violation of copyright, so they better do what the copyright holder demands to rectify that situation if they don't want to be sued over that copyright violation. They are distributing software that they don't own the copyright to, and as they are violating the GPL by not providing the source or a valid offer to provide the source on request with the software, they have voided their rigfhts under the GPL as well, so they are illegaly distributing that software. The copyright owners therefore probably could get their products pulled from the shelves to stop that copyright violation. Instead of doing that, the copyright owners are offering them the option to reinstate their rights under the GPL if they provide them with a copy of the source code they would have to provide their customers under the GPL and get compliant with the terms of the GPL.