4 ms·

Just a reminder that BusyBox have been known to be quite litigious regarding licensing violations. Your company might want to look at Toybox instead, which has

Just a reminder that BusyBox have been known to be quite litigious regarding licensing violations. Your company might want to look at Toybox instead, which has a more permissive license. (Not criticising BusyBox's use of GPL or even the lawsuits. It's just an FYI, as it can be easy to get caught out by licensing requirements, especially for smaller companies)

cf100clunk 4y ago
> quite litigious I would have used the term "vigilant" instead of "litigious". There is much less connotation of barratry, shakedowns, and other distasteful activities. > it can be easy to get caught out by licensing requirements Indeed, a possibly dire situation to fall into.
- tastysandwich 4y ago
  Fair enough, hence the additional comment just clarifying that I'm not being critical of them for that.
  - imglorp 4y ago
    Maybe one could say Busybox is often used in situations where license obligations are easier to neglect, for example embedded devices and container farms.
chubot 4y ago
As far as I know, the requirement is to dump a tarball of any changes you made on a web server Is that an onerous requirement?
- zamadatix 4y ago
  And document that’s what you used and where to find the tarball (and include scripts/steps etc relating to building it). Not particularly difficult/onerous just easy to overlook or later forget, also something you need to pass to people that may redistribute your stuff in a larger package.
  - nix23 4y ago
    The GPLv2 (BusyBox) says the end-user needs to have access to the changed sources (for example a link to it) and a copy of the license IF and just IF you redistribute the Code. The link could be very well a magnetlink to a tar or a patch-file on pastebin (and since it's a patch you already say whats changed and when 2a from the GPLv2 resolved). You don't need to include scripts or documentation or anything relating to building or running it in production, who told you that BS?
    - zamadatix 4y ago
      Maybe you have this confused with a different license or non commercial use? GPLv2 requires full source + patches, you can’t just link a diff and call it a day. It also has to actually be reachable for a minimum period, you can’t just throw out a magnet link and say someone else will provide it when you are asked (always seeding the magnet link is valid but not particularly easier for you). Using a 3rd party puts you in an awkward place if that 3rd party host disappears next year for some crazy reason. Build scripts such as make files are definitely required with the exception of what the license gives. As for where I’m hearing this both the busy ox license FAQ and the gnu.org GPL FAQ agree, as does the text of the license.
      - nix23 4y ago
        Your making problem's up where no are, make a textfile trow in your for example *gnu.org links for the full source and trow in your patches at the end of the file. >you can’t just throw out a magnet link and say There are webseed's too with your 2kb textfile on a web-server or github, or hey just trow it on github completely, or send it to an archives maillist. I hope i never have a meeting with you, you act like it's a moon mission and not just a really simple copy-paste gist.
        zamadatix 4y ago
        As I said > Not particularly difficult/onerous just easy to overlook or later forget And as the busybox license page says > Complying with BusyBox's license is easy. Get your act together, fight with internal inertia inside your company and it will be okay. Neither of these statements are painting it out to be a moon mission but are acknowledging compliance is frequently a problem anyways. After all if it wasn't they wouldn't need dedicated pages about companies not knowing what to do when called out as non-compliant if companies didn't have issues staying compliant despite it being easy. Also again don't forget the build/installation scripts in your "full source" (or an explicit comment that it is unmodified), this is another common source of non-compliance. Despite this also being extremely simple to do from an effort perspective you yourself were saying was unneeded BS just a few comments ago. The relevant text from the GPLv2 itself: > For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. And the busybox license page's comment on this often going awry: > Some companies get in trouble because although they use an upstream vanilla source tarball, they don't say what version it was, or they don't explicitly say it wasn't modified, and they don't include “the scripts used to control compilation and installation of the executable”. Then when we approach them for more information, they don't understand what we could possibly want, and panic. Please don't panic; just work with us.
mdaniel 4y ago
Lazyweb, since searching for "Toybox" wasn't helpful: https://github.com/landley/toybox#readme https://github.com/landley/toybox#readme (although "toybox shell" did help) And it's BSD Zero Clause, for those who are curious: https://github.com/landley/toybox/blob/0.8.8/LICENSE https://github.com/landley/toybox/blob/0.8.8/LICENSE
burtness 4y ago
This misrepresents what happens if you use busybox in your product and don't comply with the license (posting a buildable version of your changes) - they first try and negotiate compliance before starting litigation. You won't get served papers until you refuse to comply with the license. This includes giving you time to fix the situation - https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...

cf100clunk 4y ago

> quite litigious I would have used the term "vigilant" instead of "litigious". There is much less connotation of barratry, shakedowns, and other distasteful activities. > it can be easy to get caught out by licensing requirements Indeed, a possibly dire situation to fall into.

tastysandwich 4y ago
Fair enough, hence the additional comment just clarifying that I'm not being critical of them for that.
- imglorp 4y ago
  Maybe one could say Busybox is often used in situations where license obligations are easier to neglect, for example embedded devices and container farms.

chubot 4y ago

As far as I know, the requirement is to dump a tarball of any changes you made on a web server Is that an onerous requirement?

zamadatix 4y ago
And document that’s what you used and where to find the tarball (and include scripts/steps etc relating to building it). Not particularly difficult/onerous just easy to overlook or later forget, also something you need to pass to people that may redistribute your stuff in a larger package.
- nix23 4y ago
  The GPLv2 (BusyBox) says the end-user needs to have access to the changed sources (for example a link to it) and a copy of the license IF and just IF you redistribute the Code. The link could be very well a magnetlink to a tar or a patch-file on pastebin (and since it's a patch you already say whats changed and when 2a from the GPLv2 resolved). You don't need to include scripts or documentation or anything relating to building or running it in production, who told you that BS?
  - zamadatix 4y ago
    Maybe you have this confused with a different license or non commercial use? GPLv2 requires full source + patches, you can’t just link a diff and call it a day. It also has to actually be reachable for a minimum period, you can’t just throw out a magnet link and say someone else will provide it when you are asked (always seeding the magnet link is valid but not particularly easier for you). Using a 3rd party puts you in an awkward place if that 3rd party host disappears next year for some crazy reason. Build scripts such as make files are definitely required with the exception of what the license gives. As for where I’m hearing this both the busy ox license FAQ and the gnu.org GPL FAQ agree, as does the text of the license.
    - nix23 4y ago
      Your making problem's up where no are, make a textfile trow in your for example *gnu.org links for the full source and trow in your patches at the end of the file. >you can’t just throw out a magnet link and say There are webseed's too with your 2kb textfile on a web-server or github, or hey just trow it on github completely, or send it to an archives maillist. I hope i never have a meeting with you, you act like it's a moon mission and not just a really simple copy-paste gist.
      - zamadatix 4y ago
        As I said > Not particularly difficult/onerous just easy to overlook or later forget And as the busybox license page says > Complying with BusyBox's license is easy. Get your act together, fight with internal inertia inside your company and it will be okay. Neither of these statements are painting it out to be a moon mission but are acknowledging compliance is frequently a problem anyways. After all if it wasn't they wouldn't need dedicated pages about companies not knowing what to do when called out as non-compliant if companies didn't have issues staying compliant despite it being easy. Also again don't forget the build/installation scripts in your "full source" (or an explicit comment that it is unmodified), this is another common source of non-compliance. Despite this also being extremely simple to do from an effort perspective you yourself were saying was unneeded BS just a few comments ago. The relevant text from the GPLv2 itself: > For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. And the busybox license page's comment on this often going awry: > Some companies get in trouble because although they use an upstream vanilla source tarball, they don't say what version it was, or they don't explicitly say it wasn't modified, and they don't include “the scripts used to control compilation and installation of the executable”. Then when we approach them for more information, they don't understand what we could possibly want, and panic. Please don't panic; just work with us.

mdaniel 4y ago

Lazyweb, since searching for "Toybox" wasn't helpful: https://github.com/landley/toybox#readme https://github.com/landley/toybox#readme (although "toybox shell" did help) And it's BSD Zero Clause, for those who are curious: https://github.com/landley/toybox/blob/0.8.8/LICENSE https://github.com/landley/toybox/blob/0.8.8/LICENSE

burtness 4y ago

This misrepresents what happens if you use busybox in your product and don't comply with the license (posting a buildable version of your changes) - they first try and negotiate compliance before starting litigation. You won't get served papers until you refuse to comply with the license. This includes giving you time to fix the situation - https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...