11 ms·
Software Freedom Conservancy: New Strategy for GPL Enforcement
- hda2 6y agoThis is great news. A lot of companies like Onyx[1] need to be whipped back into compliance. Here's to the next openwrt! 1: https://news.ycombinator.com/item?id=23735962 https://news.ycombinator.com/item?id=23735962
- wmf 6y agoFrom a company's perspective, it must suck to get nagged or even sued over GPL compliance and then have no one use the code. So combining enforcement with firmware development is a much more positive approach that will hopefully generate less ill will.
- metiscus 6y agoSo I'll be a cynic and say that it's often due to the actions of the company that prevent the user from "using" the code, at least on that device. How many devices have a linux kernel but lock the bootloader down for example?
- bgorman 6y ago99.9% of embedded Linux devices.
- j1elo 6y agoNote that allowing this is 100% intended: https://www.youtube.com/watch?v=5PmHRSeA2c8&t=47m20s https://www.youtube.com/watch?v=5PmHRSeA2c8&t=47m20s
- ramshorns 6y agoYeah, though a really strict reading of GPLv2's "the scripts used to control compilation and installation" might suggest that it's not, since maybe the source code has to include the signing key to get it onto the device. But I don't think anyone's dying on that hill, they just made a new license.
- smichel17 6y agoI believe Bradley Kuhn does subscribe to this interpretation of GPLv2, based on watching this talk he gave at LibrePlanet 2020 https://media.libreplanet.org/u/libreplanet/m/preventing-the-iot-dystopia-with-copyleft/ https://media.libreplanet.org/u/libreplanet/m/preventing-the... First slide on the topic at 13:55 Returns to the slide at 17:20 If I remember correctly, somewhere else in the talk he says something like, "I don't think we need GPLv3 for this", but I don't remember where (earlier or later) and don't have time to re-watch the whole talk to hunt for it right now. (edit: although I think he still prefers v3 / thinks it is stronger. Really you should just watch the talk instead of taking my memory of what he said for granted)
- rvense 6y agoIs it? The one new thing I've looked at (the Akai MPC Live drum machine) had everything wide open. Root console, no password. This also seems to have been the case for a lot of older network appliances etc, but it might have changed in recent years?
- 6y ago
- zanny 6y agoIt would also suck more to write a kernel from scratch because you didn't want to follow a simple rule when using the most popular and well developed kernel in the world.
- Polylactic_acid 6y agoIf no one used it then there is no difference from it being closed source so there is no reason not to open source it.
- wmf 6y agoNo, GPL compliance has significant cost, especially if the company doesn't know what they're doing.
- cycloptic 6y agoIt would be nice if there was less misinformation out there about what the cost actually is. Companies are required to pay that cost if they intend to ship Linux legally. They should not be using Linux otherwise.
- rvense 6y agoNot sure I agree there's a big cost if you do know what you're doing, THB. I'm notsure about Yocto, but I think the buildroot system has GPL compliance baked in. Like packages have licenses and you can export a dump of what you're required to provide. If you're using a proper distro it should be even easier.
- ece 6y agoI think he's talking about companies that don't know what they're doing. Keeping track of changes is one thing, but even if it takes companies like Tesla years to become compliant, it's seems pretty clear that companies might not know what they should do once they start shipping devices. Raising awareness and offering alternatives all seems good, but I still hope litigation is a last ditch effort.
- MaxBarraclough 6y agoI don't get the ill will point. We're talking about companies that are knowingly and wilfully breaking the terms of the GPL. They aren't entitled to violate the terms of the GPL. They aren't entitled to sell unauthorised copies of Disney DVDs either, and for the same reasons. Compliance with copyright law, and compliance with the licence terms of software that doesn't belong to you, are not optional.
- deleted 6y ago[deleted]
- tim-- 6y agoIt's worth pointing out that this is funded by AMPRNet, the people who sold 44.192.0.0/10 to Amazon a few years ago (https://news.ycombinator.com/item?id=20477670 https://news.ycombinator.com/item?id=20477670)
- wmf 6y agoDid we ever find out what the price was?
- pabs3 6y agohttps://en.wikipedia.org/wiki/AMPRNet#Block_size https://en.wikipedia.org/wiki/AMPRNet#Block_size
- jrochkind1 6y agoI guess this is what they're doing with some of the money? The OP announcement doesn't say the amount of funding.
- wmf 6y ago$250K from https://www.ampr.org/grants/ https://www.ampr.org/grants/ (there are two line items)
- mimi89999 6y agoWas it unreadable? Sometime ago everybody believed that after the IPv4 exhaustion everybody will quickly switch to IPv6. It was quite reasonable to sell them while they were still worth something if they believed that they will be worthless is several years. Sadly, there was no big switch to IPv6 and double NAT is the thing now.
- p1mrx 6y ago~0% to ~30% in 10 years isn't perfect, but it's a pretty big switch: https://www.google.com/intl/en/ipv6/statistics.html https://www.google.com/intl/en/ipv6/statistics.html
- webmaven 6y agoHmm. From the Firmware Liberation Project page[0]: "Second, depending on what subindustry (i.e., specific class of devices) seems most responsive to increased enforcement activity and willing to provide compliant source releases quickly, we will launch, coordinate and fund an alternative firmware project for that class, or, if appropriate, merge our efforts with an existing alternative firmware project for that class of device." It is hard to read that as anything but an incentive for vendors to be less responsive, in the hopes that the SFC focus their efforts elsewhere. [0] https://sfconservancy.org/copyleft-compliance/firmware-liberation.html https://sfconservancy.org/copyleft-compliance/firmware-liber...
- ramshorns 6y agoIt suggests that vendors would want alternative firmwares to be developed for the hardware they sell. Do you think they wouldn't want that?
- jobigoud 6y agoMost companies nowadays want to have total control on how users use their hardware. For many IoT things the product is in the patterns they collect when the device sends data home to "backup on the cloud".
- webmaven 6y agoThat entirely depends on whether the attractive profit margins are on the hardware itself, or adjacent (complementary) to it, in software or services tied to the hardware through the firmware.
- baybal2 6y agoWell this is what was apparent for me on day one, and I genuinely did not understand people calling for "DON'T SUE THEM, YOU WILL SCARE THEM AWAY FROM LINUX!" I see no goodwill from those types, and the simplest explanation for their stance is them being material beneficiaries from that. People like Patrick McHardy do an enormous service to the Linux community, and he alone provably did more in the last few years than what that GPL conservancy did for its entire existence. Nothing will be more educational than a "GPL death sentence" to some multi-billion dollar multinational like Broadcom. If it will not be McHardys doing the hard work of suing such companies, who will? I don't see those conservancy guys, Linus' associates, or meek Linux Foundation raising a hand on kinds of Qualcomm, or Samsung (from whom, coincidentally, lots of Linux Foundation funding comes) I completely don't understand people who direct flak on them, and the brouhaha with the "pledge." The only rationale I can fathom, is again is that material beneficiaries of GPL violation have now penetrated the circles who made the "GPL Cooperation Commitment"
- matheusmoreira 6y ago> I genuinely did not understand people calling for "DON'T SUE THEM, YOU WILL SCARE THEM AWAY FROM LINUX!" Bringing lawyers in always makes people really defensive. People are unlikely to take risks if there's liability involved. Whether this is good or bad for free software I don't know. Probably not. Linux needs more leverage over companies. Not necessarily legal leverage.
- avmich 6y agoThe idea of GPL is to move towards better software, better rights of users of software and developers of software. So > People are unlikely to take risks if there's liability involved. people are free to choose inferior products, ways of development, components and libraries, but that would - probably - make them less competitive, so e.g. their investors may become worried. Not only Linux needs more leverage - it also needs to use it, because otherwise it's a moot point.
- SpicyLemonZest 6y ago
- pjmlp 6y ago> Today, we observe almost universal failure in compliance throughout the (so-called) Internet of Things (IoT) market. Only unrelenting enforcement that holds companies accountable can change this abysmal reality. Which is why Linux on embedded is facing competition full of non-copyleft based OSes. NutXX, RTOS, Azure RTOS, mbed, Arduino, Zephyr (ironically from Linux Foundation partners), Fuchsia, ....
- mtgx 6y agoI thought that would be more because of the Linux bloat + security risk. I don't think it makes much sense to use Linux in the embedded space, but something that is 100x smaller. I certainly wouldn't want self-driving car systems to be powered by Linux...
- raxxorrax 6y agoFrom a stability perspective I would. Linux had much more time to harden than comparable OS. From a technical perspective it isn't a real time OS and does come with unnecessary functions that are probably not relevant to the application, but I think people underestimate the amount of bugs in embedded systems. Minimal OS or bare metal doesn't really matter much. To my knowledge there was never an incident where common OS was responsible for failure, but it has been a myth for ages. If it does fail it is probably due to a hardware defect, but a risk analysis would show a plethora of possibilities for fail safe systems.
- imtringued 6y agoGPU drivers aren't going to run on microcontrollers. If the processor isn't running Linux then it will run something equivalent like BSD.
- MaxBarraclough 6y agoThe BSDs are the obvious 'copycenter' alternatives to GNU/Linux, not sure if they have any traction in IOT though.
- 6y ago
- Rochus 6y agoIt is good if there are more decisions of the highest court. Legal uncertainty is harmful for open source. And as long as there are points in the GPL without leading decisions, this legal uncertainty will continue and open the door for trolls to blackmail open source users with out-of-court settlements in order to enrich themselves. Actually it would be so simple: I give you source code, you give me changes back, we're even. [...] If you make hardware that locks down software, it's your decision as a hardware maker; it has no impact on my decision as a software maker to give you the software. [...] To me the important part was always: I give you software, you can do whatever you want with it; if you make improvements, you have to give them back. (source: https://www.youtube.com/watch?v=PaKIZ7gJlRU https://www.youtube.com/watch?v=PaKIZ7gJlRU).
- m463 6y agoI think there is a spectrum of opinions on where the dial is set, but what is best for all of us, from say a 10 or 30 year viewpoint? I wonder if GPL3 didn't have quite so many changes if it would have been more widely accepted. But listening to RMS he said he didn't realize that companies would "tivoize" everything so he added: "(0) The freedom to run the program as you wish, for whatever purpose." Personally I think it kind of sucks that much of computing coming out nowadays has locked bootloaders.
- Rochus 6y agoIn European law, the actual party will is the determining factor in contracts, not the (possibly ambiguous) wording. This is especially important with licenses such as GPL, which are full of unclear, secondary regulations. That is why the clear, unambiguous statement of the original Linux author is important. Good software, which is not used due to (unnecessary) legal uncertainties, and thus cannot benefit from the support of potent companies, is of no use to anyone, neither in the short nor the long term. The sooner legal uncertainties are removed, the better. Unfortunately, companies avoid legal disputes, often at all costs; that is why it is so easy to blackmail them with out-of-court, very often unfounded claims from patent and copyright law. When I buy a product, I want it to work well and have good value for money. For this it is irrelevant if the bootloader is locked. If I want to make a system to tinker where I can replace the firmware, I buy a Raspi. The Raspi also benefits from contributions from companies that use Linux in devices where I might not be able to replace the system.