7 ms·

B&N refuses to release source code of Nook Tablet, censors user requests

138 points by recoiledsnake 15y ago

projectileboy 15y ago
What options does the community have to compel Barnes and Noble to satisfy their obligations?
- RexRollman 15y ago
  A copyright lawsuit requesting damages and a cease and desist, I would imagine.
- aquayellow 15y ago
  Technically, anyone who has contributed to the Linux kernel can drag them to court. Probably not something an average developer will jump into :) That said, Harald Welte has a dedicated site for this : http://gpl-violations.org/ http://gpl-violations.org/ and he is pretty active chasing violators. Personally, I believe if there is straightforward evidence that the sources they are providing is incomplete, spreading the word around is a good start!
  - nknight 15y ago
    > I believe if there is straightforward evidence As far as I could tell from that thread, there isn't, just a lot of ignorance. B&N has no legal obligation to tell them how to get a custom kernel to boot on the Nook.
    - rbanffy 15y ago
      > B&N has no legal obligation to tell them how to get a custom kernel to boot on the Nook Nor the obligation to make it possible. Signed boots are OK.
- rbanffy 15y ago
  First of all, make sure B&N is violating the GPL. GPLv2 does not require them to make it possible to flash a new OS into the device and boot off it. As long as you can compile the sources into an executable that can possibly run, they are compliant. I too would like Linux to be licensed under GPLv3, but a lot of companies wouldn't. I seriously doubt my TV manufacturer would be OK with me running my own code on it. Or my cable box.
  - burgerbrain 15y ago
    I suppose I can see cable box manufacturer, but why would the maker of your TV care in the slightest?
    - robin_reala 15y ago
      Warranty claims, and upselling. Samsung use (used?) Linux as the base OS for a large number of their TVs so of course replacement firmware projects sprang up (e.g. SamyGo [1]). The project added additional functionality to their TVs like playing movies from a USB stick - features that Samsung had restricted to their higher-end TVs. Within a few months Samsung had released an ‘official’ firmware upgrade that removed the ability to load unofficial (unsigned I guess?) updates. [1] http://forum.samygo.tv/ http://forum.samygo.tv/
alain94040 15y ago
Contrary to the title, it looks like Barnes & Nobles did release some sort of source code. The fact that the author wasn't able to compile them into something doesn't mean BN is violating the GPL. I'd cool down before making such accusations.
- duskwuff 15y ago
  Based on some of the screenshots, it might just be the case that the author doesn't know how to upload the kernel to the Nook correctly. Moreover -- correct me if I'm wrong -- GPLv2 doesn't require that the device manufacturer support software upgrades anyway. It's only v3 that introduced the "anti-TiVoization" clause, and the kernel isn't GPLv3.
  - ktsmith 15y ago
    AdamOutler is not one that would have trouble uploading source code to the device. He's saying that it's not compilable. There are other threads and statements saying there are missing components from the source release.
    - nknight 15y ago
      You should read past the first post in the thread. It apparently compiled just fine. They just can't get it to boot. http://forum.xda-developers.com/showpost.php?p=21113848&postcount=6 http://forum.xda-developers.com/showpost.php?p=21113848&...
ChuckMcM 15y ago
I suspect that the author of this piece is taking a very optimistic interpretation of the GPL and Barnes and Noble a very conservative interpretation. They only GPL'd code on the Nook as far as I can tell is the Android kernel. So if they distribute the patches they made to the kernel to support their tablet then they are done. They have no obligation whatsoever to distribute source to their book display application, their UI, or their other 'user land' applications. Its the same with Google, the 'Google Experience' applications (mail, maps, Etc) are neither GPL'd nor 'free' for manufacturers to put on their boxes.
- ktsmith 15y ago
  He's asking for them to release the Kernel source in compilable/working form which it doesn't currently appear to be in. He's not asking for the userland apps, or even binary kernel modules to be released.
- JohnTHaller 15y ago
  He's not asking for that. He's an experienced Android kernel hacker. He knows the difference between kernel and userland. He's informing B&N that their kernel source is incomplete. B&N is required by the GPL to release the full source of the kernel, build instructions and everything they compile directly into it (read: not 'apps') in order for another developer to be able to compile the full kernel. All of that is required by the GPL. If you don't follow it, you're not permitted to redistribute works under the license.
drinian 15y ago
I applaud his efforts, but he's aggressively misspelling Barnes and Noble's name in that post, and that lack of attention to detail makes him much harder to take seriously.
- Joakal 15y ago
  Please do not attack based on what could be company name typos. The content is presently clearly enough to discuss.
  - drinian 15y ago
    It's not an attack, I'm just pointing out that it's unprofessional and makes the author look like he pays no attention to detail. When dealing with legal issues, detail is of course paramount.
    - Joakal 15y ago
      The legal discussion is about the content, not the author.
tzs 15y ago
B&N was right to delete his worthless request/complaint. It contained no information that would actually help them resolve the problem. All it said in his post on their forums was that: 1. He could not get the source they released to compile. 2. Quoted a GPL violations FAQ. 3. Told them they are doing a bad thing. 4. Told them to fix the problem. How about actually giving them DETAILS about what failed to compile. From his complaint they have no idea if the problem is because they made a mistake in the source release, or if there is something wrong with his environment, or whatever.
- JohnTHaller 15y ago
  He's an experienced Android kernel hacker, so he's no amateur. He's saying it won't compile using what they've given. He's also stated it fails under the common Android build setups he's used for other Android kernels. One of the requirements of the GPL is to provide the build/make instructions to allow other developers to build it themselves. It would appear B&N isn't quite doing this.
  - burgerbrain 15y ago
    Exactly: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."
  - nknight 15y ago
    No, he's saying it won't boot. Big, huge, enormous difference. He can clearly get it to compile, since he apparently produced some image that he thought (apparently wrongly) that the Nook would be willing to boot.
- lotu 15y ago
res0nat0r 15y ago
Not to be a jerk here, but has the bug submitter ever worked for a large company before? From the screenshots and the timestamp of the xda post, it looks like this issue he's submitted is roughly only two days old. Forum posts such as these have to get triaged by their forum managers, TT's cut to the appropriate groups responsible for the issue mentioned, accepted by the proper group, placed in a priority queue based on severity of end-user impact, and assessed along with all of the other work they are doing. At least this is how it is at the large company I work for. Sure he has a lot of 'laurels' for his post, but a two day old post of one person not being able to compile their Nook sourcecode is probably not high on the list of things which must be addressed immediately. Chill out and give it some time to be addressed.
- drewcrawford 15y ago
  This isn't a support request. Large companies don't get a special pass for license compliance because they move slowly. The solution is simple--don't release binaries without source. That's what the GPL requires, and what they signed up for when they used GPLed code.
  - res0nat0r 15y ago
    I'm not saying at all that they should get a pass. I'm saying this is a complaint via a single user from their forums which will be triaged and addressed, just not this immediate second.
mjg59 15y ago
I added this as a comment in a related thread on XDA, but it seems relevant here: Brief background - my name is Matthew Garrett. I'm a Linux kernel developer working for Red Hat. I bought an original Nook back in 2009 and was responsible for getting Barnes and Noble to release the full kernel source code. When the Nook Color was released I did the same. I've been active in enforcement of the GPL and have a keen interest in helping (or making) companies comply with their obigaitons. Having said that. One of the significant differences between GPLv2 and GPLv3 is that GPLv3 makes explicit the requirement that signing keys be shipped. It has been argued that the GPLv2 implicitly requires the same, in the form of the requirement for the scripts required for installation. I'm sympathetic to that claim, and I will not personally distribute any code that requires a private signing key. But I'm not a lawyer and I'm certainly not a judge. Many people who are active in GPL enforcement will agree that vendors should provide the signing keys - but I don't think you'll find any who will actually make that the basis of a case. B&N are not the only company to require signed kernel images. Many Android devices have locked bootloaders. I think this is a despicable anti-consumer design choice, but nobody's taking action against it. B&N have provided you with the kernel source code. They've done better than many by also providing you with the configuration file. They have a strong argument that by doing so they've complied with the requirements of GPLv2, and while you (and I) may disagree, that's almost certainly going to be as much as they'll be required to do. Consensus at the moment is that they don't need to do any more. If it went to court then you may end up finding a judge who would rule that they're in violation, but I wouldn't put money on it. I think it's far too extreme to claim that they're actively violating.
- mjg59 15y ago
  As a bit of further clarification, I've downloaded the source tarball and checked it out. The kernel source appears as complete as I'd expect it to be. I don't have a Nook Tablet to check the filesystem, but the userspace code at least roughly matches what ought to be there. The bootloader source seems to match the hardware. As far as I can tell the only argument is that the NT will only boot with a signed bootloader and kernel, and the signing keys aren't included. There's no broad consensus that GPLv2 requires those keys.
  - 15y ago
dreww 15y ago
it's too bad that the discussion around this, both as given in the title of the post here on HN, and the description of the problem, are needlessly inflammatory and obscure the real interesting thing that is going on: the source code release is essentially moot & probably sufficient under the terms of the gpl v2 because the keys that make the kernel valid to the device's bootloader were not released.
jwildeboer 15y ago
So B&N publishes the source code as mentioned by the original poster. How can that lead to this headline that claims refusal to do that? Fail. The original poster has not figured out how to build and run the source he got from B&N and asks for a solution without giving any information? Fail. So net result: (at least) a misleading headline and PEBCAK all over the place. Nuff said.
paulhauggis 15y ago
This is exactly why I steer clear of GNU software in any of my commercial apps.

138 points by recoiledsnake 15y ago

projectileboy 15y ago

What options does the community have to compel Barnes and Noble to satisfy their obligations?

RexRollman 15y ago
A copyright lawsuit requesting damages and a cease and desist, I would imagine.
aquayellow 15y ago
Technically, anyone who has contributed to the Linux kernel can drag them to court. Probably not something an average developer will jump into :) That said, Harald Welte has a dedicated site for this : http://gpl-violations.org/ http://gpl-violations.org/ and he is pretty active chasing violators. Personally, I believe if there is straightforward evidence that the sources they are providing is incomplete, spreading the word around is a good start!
- nknight 15y ago
  > I believe if there is straightforward evidence As far as I could tell from that thread, there isn't, just a lot of ignorance. B&N has no legal obligation to tell them how to get a custom kernel to boot on the Nook.
  - rbanffy 15y ago
    > B&N has no legal obligation to tell them how to get a custom kernel to boot on the Nook Nor the obligation to make it possible. Signed boots are OK.
rbanffy 15y ago
First of all, make sure B&N is violating the GPL. GPLv2 does not require them to make it possible to flash a new OS into the device and boot off it. As long as you can compile the sources into an executable that can possibly run, they are compliant. I too would like Linux to be licensed under GPLv3, but a lot of companies wouldn't. I seriously doubt my TV manufacturer would be OK with me running my own code on it. Or my cable box.
- burgerbrain 15y ago
  I suppose I can see cable box manufacturer, but why would the maker of your TV care in the slightest?
  - robin_reala 15y ago
    Warranty claims, and upselling. Samsung use (used?) Linux as the base OS for a large number of their TVs so of course replacement firmware projects sprang up (e.g. SamyGo [1]). The project added additional functionality to their TVs like playing movies from a USB stick - features that Samsung had restricted to their higher-end TVs. Within a few months Samsung had released an ‘official’ firmware upgrade that removed the ability to load unofficial (unsigned I guess?) updates. [1] http://forum.samygo.tv/ http://forum.samygo.tv/

alain94040 15y ago

Contrary to the title, it looks like Barnes & Nobles did release some sort of source code. The fact that the author wasn't able to compile them into something doesn't mean BN is violating the GPL. I'd cool down before making such accusations.

duskwuff 15y ago
Based on some of the screenshots, it might just be the case that the author doesn't know how to upload the kernel to the Nook correctly. Moreover -- correct me if I'm wrong -- GPLv2 doesn't require that the device manufacturer support software upgrades anyway. It's only v3 that introduced the "anti-TiVoization" clause, and the kernel isn't GPLv3.
- ktsmith 15y ago
  AdamOutler is not one that would have trouble uploading source code to the device. He's saying that it's not compilable. There are other threads and statements saying there are missing components from the source release.
  - nknight 15y ago
    You should read past the first post in the thread. It apparently compiled just fine. They just can't get it to boot. http://forum.xda-developers.com/showpost.php?p=21113848&postcount=6 http://forum.xda-developers.com/showpost.php?p=21113848&...

ChuckMcM 15y ago

I suspect that the author of this piece is taking a very optimistic interpretation of the GPL and Barnes and Noble a very conservative interpretation. They only GPL'd code on the Nook as far as I can tell is the Android kernel. So if they distribute the patches they made to the kernel to support their tablet then they are done. They have no obligation whatsoever to distribute source to their book display application, their UI, or their other 'user land' applications. Its the same with Google, the 'Google Experience' applications (mail, maps, Etc) are neither GPL'd nor 'free' for manufacturers to put on their boxes.

ktsmith 15y ago
He's asking for them to release the Kernel source in compilable/working form which it doesn't currently appear to be in. He's not asking for the userland apps, or even binary kernel modules to be released.
JohnTHaller 15y ago
He's not asking for that. He's an experienced Android kernel hacker. He knows the difference between kernel and userland. He's informing B&N that their kernel source is incomplete. B&N is required by the GPL to release the full source of the kernel, build instructions and everything they compile directly into it (read: not 'apps') in order for another developer to be able to compile the full kernel. All of that is required by the GPL. If you don't follow it, you're not permitted to redistribute works under the license.

drinian 15y ago

I applaud his efforts, but he's aggressively misspelling Barnes and Noble's name in that post, and that lack of attention to detail makes him much harder to take seriously.

Joakal 15y ago
Please do not attack based on what could be company name typos. The content is presently clearly enough to discuss.
- drinian 15y ago
  It's not an attack, I'm just pointing out that it's unprofessional and makes the author look like he pays no attention to detail. When dealing with legal issues, detail is of course paramount.
  - Joakal 15y ago
    The legal discussion is about the content, not the author.

tzs 15y ago

B&N was right to delete his worthless request/complaint. It contained no information that would actually help them resolve the problem. All it said in his post on their forums was that: 1. He could not get the source they released to compile. 2. Quoted a GPL violations FAQ. 3. Told them they are doing a bad thing. 4. Told them to fix the problem. How about actually giving them DETAILS about what failed to compile. From his complaint they have no idea if the problem is because they made a mistake in the source release, or if there is something wrong with his environment, or whatever.

JohnTHaller 15y ago
He's an experienced Android kernel hacker, so he's no amateur. He's saying it won't compile using what they've given. He's also stated it fails under the common Android build setups he's used for other Android kernels. One of the requirements of the GPL is to provide the build/make instructions to allow other developers to build it themselves. It would appear B&N isn't quite doing this.
- burgerbrain 15y ago
  Exactly: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."
- nknight 15y ago
  No, he's saying it won't boot. Big, huge, enormous difference. He can clearly get it to compile, since he apparently produced some image that he thought (apparently wrongly) that the Nook would be willing to boot.
lotu 15y ago

res0nat0r 15y ago

Not to be a jerk here, but has the bug submitter ever worked for a large company before? From the screenshots and the timestamp of the xda post, it looks like this issue he's submitted is roughly only two days old. Forum posts such as these have to get triaged by their forum managers, TT's cut to the appropriate groups responsible for the issue mentioned, accepted by the proper group, placed in a priority queue based on severity of end-user impact, and assessed along with all of the other work they are doing. At least this is how it is at the large company I work for. Sure he has a lot of 'laurels' for his post, but a two day old post of one person not being able to compile their Nook sourcecode is probably not high on the list of things which must be addressed immediately. Chill out and give it some time to be addressed.

drewcrawford 15y ago
This isn't a support request. Large companies don't get a special pass for license compliance because they move slowly. The solution is simple--don't release binaries without source. That's what the GPL requires, and what they signed up for when they used GPLed code.
- res0nat0r 15y ago
  I'm not saying at all that they should get a pass. I'm saying this is a complaint via a single user from their forums which will be triaged and addressed, just not this immediate second.

mjg59 15y ago

I added this as a comment in a related thread on XDA, but it seems relevant here: Brief background - my name is Matthew Garrett. I'm a Linux kernel developer working for Red Hat. I bought an original Nook back in 2009 and was responsible for getting Barnes and Noble to release the full kernel source code. When the Nook Color was released I did the same. I've been active in enforcement of the GPL and have a keen interest in helping (or making) companies comply with their obigaitons. Having said that. One of the significant differences between GPLv2 and GPLv3 is that GPLv3 makes explicit the requirement that signing keys be shipped. It has been argued that the GPLv2 implicitly requires the same, in the form of the requirement for the scripts required for installation. I'm sympathetic to that claim, and I will not personally distribute any code that requires a private signing key. But I'm not a lawyer and I'm certainly not a judge. Many people who are active in GPL enforcement will agree that vendors should provide the signing keys - but I don't think you'll find any who will actually make that the basis of a case. B&N are not the only company to require signed kernel images. Many Android devices have locked bootloaders. I think this is a despicable anti-consumer design choice, but nobody's taking action against it. B&N have provided you with the kernel source code. They've done better than many by also providing you with the configuration file. They have a strong argument that by doing so they've complied with the requirements of GPLv2, and while you (and I) may disagree, that's almost certainly going to be as much as they'll be required to do. Consensus at the moment is that they don't need to do any more. If it went to court then you may end up finding a judge who would rule that they're in violation, but I wouldn't put money on it. I think it's far too extreme to claim that they're actively violating.

mjg59 15y ago
As a bit of further clarification, I've downloaded the source tarball and checked it out. The kernel source appears as complete as I'd expect it to be. I don't have a Nook Tablet to check the filesystem, but the userspace code at least roughly matches what ought to be there. The bootloader source seems to match the hardware. As far as I can tell the only argument is that the NT will only boot with a signed bootloader and kernel, and the signing keys aren't included. There's no broad consensus that GPLv2 requires those keys.
- 15y ago

dreww 15y ago

it's too bad that the discussion around this, both as given in the title of the post here on HN, and the description of the problem, are needlessly inflammatory and obscure the real interesting thing that is going on: the source code release is essentially moot & probably sufficient under the terms of the gpl v2 because the keys that make the kernel valid to the device's bootloader were not released.

jwildeboer 15y ago

So B&N publishes the source code as mentioned by the original poster. How can that lead to this headline that claims refusal to do that? Fail. The original poster has not figured out how to build and run the source he got from B&N and asks for a solution without giving any information? Fail. So net result: (at least) a misleading headline and PEBCAK all over the place. Nuff said.

paulhauggis 15y ago

This is exactly why I steer clear of GNU software in any of my commercial apps.