6 ms·

>many GPL violations are resolved through non-legal means, such as negotiating a license agreement or reaching a settlement outside of court. And IMHO this is

>many GPL violations are resolved through non-legal means, such as negotiating a license agreement or reaching a settlement outside of court. And IMHO this is killing the license. Companies are doing the calculations and determining that by the time they get caught they can just negotiate at best and at worst just ignore it and drag things out until it realistically no longer matters. Without teeth no one will follow their obligations.

kube-system 4y ago
This is just the way the legal business works normally. 95% of civil cases settle before trial because lawyers know the law, don't need to go to court to know what is going to happen, and handle it more efficiently between themselves.
- scotty79 4y ago
  Only in US and UK and such. Anywhere else it would indicate a severe pathology of justice system.
  - vkou 4y ago
    Why? Settling out-of-court is a win-win for everyone. If it weren't a win for both sides, the side that feels like it got the short end of the stick would opt for court.
  - dmoy 4y ago
    On the other hand you have Brazil, where there's like 1 active lawsuit for every two people in the country.
  - kube-system 4y ago
    The fact that people are able to remediate disputes without resorting to escalation indicates a high level of maturity of the legal system and legal profession. Third party remediation is a result of a failure of both parties to work out a solution amongst themselves. A legal system where both parties know and agree on the law is a success, not a failure.
    - scotty79 4y ago
      By analogy if people manage their own illnesses without engaging health service should be a testament to the level of maturity of health services in USA.
      - kube-system 4y ago
        I think people in healthier countries in fact do consumer fewer healthcare services than those in the US.
  - Loic 4y ago
    In Germany most of the cases are settled outside of the court but with the help of a court judge.
toyg 4y ago
> IMHO this is killing the license. Some people say GPL is dying because nobody use it due to its terms. Some people say GPL is dying because everyone use it but nobody follows its terms. The truth is in somewhat in the middle. There is more GPL adoption out there than people think, but respecting terms is a nontrivial effort. Some infringements are done in good faith and resolved equitably once noted, but detection as a whole is undoubtedly difficult, and we only see the negative headlines when it happens. That doesn't mean the license is dying; in fact, it's doing the opposite: helping people out there building software in the open, and taking to task businesses that don't play fair. We just have to accept that success rate will just never be 100% compliance, because legal constructs never reach that.
- indymike 4y ago
  > respecting terms is a nontrivial effort. This is true of almost all contracts. If respecting terms was easy, we'd have no needs for lawyers and courts.
  - andrewxdiamond 4y ago
    It’s quite easy to comply with the MIT OS license
    - tpxl 4y ago
      You'd think so, but people fail to do so often.
  - toyg 4y ago
    I mean, it's much less trivial than other licenses. Let's look at the scenarios here: - John Dev takes a bit of MIT/BSD licensed code. He drops an acknowledgment in the About screen (which nobody will ever read), and that's it. (yes, many still fail to do it...) - Jane Dev takes a bit of (L)GPL licensed code. She has to add the license file to the installer, so the installer people start asking questions: "is this an eula? Should we display it on install?" Jane clarifies that we just need to ship it, but now Legal is in the loop. Legal goes "it says here that we have to provide stuff on request, does that mean all our private code?" Jane explains how she carefully used it in such a way to avoid that scenario; half of the explanation goes above the head of every lawyer in the room, so some of them trust her and some don't. Let's assume it gets greenlit, now we have to talk to the website folks to put a link somewhere - but Legal are still on the case: "ah, but we don't want to make it too easy, let's just have an email." Who's going to monitor that mailbox? Can you do it, Jane? Legal goes "no, Jane is technically not responsible for distributing, let's loop back in the release managers". Release managers don't want to hear it, they already have enough shit to shovel. By now half the people have gone on holiday one or more times, there are more urgent fires to put out, and the thread is forgotten. Product ships. Jane moves on to found her own startup. The product will likely be infringing for years, which may or may not ever be detected. I love the GPL and I wish everyone used it and respected it, but it's not easy to live with it.
throwwwaway69 4y ago
If I was a billionaire this is the sort of thing I'd fund. Like the EFF but specifically for open source developers and projects.
- a2800276 4y ago
  Luckily you can fund the EFF now, all without having to become a billionaire!
  - throwwwaway69 4y ago
    Already a member :)
- kube-system 4y ago
  A foundation, just for free software? https://www.fsf.org/ https://www.fsf.org/
  - bionade24 4y ago
    The FSF says they only care about the GNU project license violations. https://sfconservancy.org/ https://sfconservancy.org/ has an actual record of fighting against license violations.
    - seabass-labrax 4y ago
      GNU generally requires that contributors assign their copyright to the FSF, which is what allows the FSF to litigate; they can't do this for software that they don't hold copyright to. The Software Freedom Conservancy, on the other hand, holds partial copyright to each of their many member projects' software and chooses to actively enforce the GNU GPL on that code quite frequently. The SFC's ongoing case against Vizio in California[1] appears to show that violators of the GNU GPL can be sued by users, not just copyright holders. If this case sets precedent elsewhere in the USA and even in other countries, then organisations like the FSF and SFC will have far more options in what violations they choose to litigate. However, this also opens up the risk of 'GPL trolls' who might not be motivated by the same principles[2]. [1]: https://sfconservancy.org/press/vizio-coverage.html https://sfconservancy.org/press/vizio-coverage.html [2]: https://www.fsf.org/licensing/enforcement-principles https://www.fsf.org/licensing/enforcement-principles
frognumber 4y ago
My experience is that 95+% of businesses will follow GPL obligations, even without teeth. The <5% bad actors are a problem, but that doesn't negate that it mostly works.
- balefrost 4y ago
  My experience is, for businesses who pay attention to open-source licenses, they will avoid GPL libraries like the plague (GPL applications are usually fine, though there's sometimes some skepticism). But not all businesses pay close attention to open-source licenses. I have to assume that scale has something to do with it. Huge companies usually take that pretty seriously. Tiny companies... eh, they might not even be aware.
  - avitous 4y ago
    Concur on this about avoidance. From my own experience at a startup years ago, the corporate counsel was pretty much hostile to any GPL libraries being used in the companies product, and was especially hostile to the AGPL, categorically refusing to support use of anything using the latter.
its-summertime 4y ago
In both of those situations, don't the companies end up paying more (to lawyers) than if they open-sourced in the first place?
cptskippy 4y ago
> Companies are doing the calculations and determining that by the time they get caught they can just negotiate at best and at worst just ignore it and drag things out until it realistically no longer matters. You're giving companies way too much credit. Unless a company has been sued for something, they often have no insight into or awareness of it. Most companies do not have strict policies around using GPL or OSS. The legal, audit and compliance teams are only aware of things when it's brought to their attention. Our company is very good about accessibility and ease of use in our products, but only because someone used the ADA to sue the shit out of us a decade ago. I would wager that most GPL violations are made by folks who are consciously aware of what they're doing, and the companies they work for are completely unaware that such decisions are even being made. There's no actuary running the numbers and saying "yeah go ahead and violate it, litigation is cheaper than compliance", that's tinfoil hat level thinking IMO.
- pabs3 4y ago
  Conservancy have said in numerous talks that we are well past the age of unintentional violations and well into the deliberate violations era, where companies just stall and stall and stall.
  - cptskippy 4y ago
    > where companies just stall and stall and stall. That's a legal tactic regardless of initial intent or guilt. If you thinking waiting someone out is cheaper than losing or settling, then you stall. It puts a financial burden on them. I'm not saying it's right, and it's also not an indicator of guilt, malice, or forethought.
    - pabs3 4y ago
      Sure, but this is after they have shown to be violating.
      - cptskippy 4y ago
        And? Being shown evidence you committed a crime or breached an agreement doesn't prove malice or forethought. Additionally people seem to think of legal contracts and licenses as being set in stone or non negotiable. In the legal world they are simple the starting point for any negotiation.

kube-system 4y ago

This is just the way the legal business works normally. 95% of civil cases settle before trial because lawyers know the law, don't need to go to court to know what is going to happen, and handle it more efficiently between themselves.

scotty79 4y ago
Only in US and UK and such. Anywhere else it would indicate a severe pathology of justice system.
- vkou 4y ago
  Why? Settling out-of-court is a win-win for everyone. If it weren't a win for both sides, the side that feels like it got the short end of the stick would opt for court.
- dmoy 4y ago
  On the other hand you have Brazil, where there's like 1 active lawsuit for every two people in the country.
- kube-system 4y ago
  The fact that people are able to remediate disputes without resorting to escalation indicates a high level of maturity of the legal system and legal profession. Third party remediation is a result of a failure of both parties to work out a solution amongst themselves. A legal system where both parties know and agree on the law is a success, not a failure.
  - scotty79 4y ago
    By analogy if people manage their own illnesses without engaging health service should be a testament to the level of maturity of health services in USA.
    - kube-system 4y ago
      I think people in healthier countries in fact do consumer fewer healthcare services than those in the US.
- Loic 4y ago
  In Germany most of the cases are settled outside of the court but with the help of a court judge.

toyg 4y ago

> IMHO this is killing the license. Some people say GPL is dying because nobody use it due to its terms. Some people say GPL is dying because everyone use it but nobody follows its terms. The truth is in somewhat in the middle. There is more GPL adoption out there than people think, but respecting terms is a nontrivial effort. Some infringements are done in good faith and resolved equitably once noted, but detection as a whole is undoubtedly difficult, and we only see the negative headlines when it happens. That doesn't mean the license is dying; in fact, it's doing the opposite: helping people out there building software in the open, and taking to task businesses that don't play fair. We just have to accept that success rate will just never be 100% compliance, because legal constructs never reach that.

indymike 4y ago
> respecting terms is a nontrivial effort. This is true of almost all contracts. If respecting terms was easy, we'd have no needs for lawyers and courts.
- andrewxdiamond 4y ago
  It’s quite easy to comply with the MIT OS license
  - tpxl 4y ago
    You'd think so, but people fail to do so often.
- toyg 4y ago
  I mean, it's much less trivial than other licenses. Let's look at the scenarios here: - John Dev takes a bit of MIT/BSD licensed code. He drops an acknowledgment in the About screen (which nobody will ever read), and that's it. (yes, many still fail to do it...) - Jane Dev takes a bit of (L)GPL licensed code. She has to add the license file to the installer, so the installer people start asking questions: "is this an eula? Should we display it on install?" Jane clarifies that we just need to ship it, but now Legal is in the loop. Legal goes "it says here that we have to provide stuff on request, does that mean all our private code?" Jane explains how she carefully used it in such a way to avoid that scenario; half of the explanation goes above the head of every lawyer in the room, so some of them trust her and some don't. Let's assume it gets greenlit, now we have to talk to the website folks to put a link somewhere - but Legal are still on the case: "ah, but we don't want to make it too easy, let's just have an email." Who's going to monitor that mailbox? Can you do it, Jane? Legal goes "no, Jane is technically not responsible for distributing, let's loop back in the release managers". Release managers don't want to hear it, they already have enough shit to shovel. By now half the people have gone on holiday one or more times, there are more urgent fires to put out, and the thread is forgotten. Product ships. Jane moves on to found her own startup. The product will likely be infringing for years, which may or may not ever be detected. I love the GPL and I wish everyone used it and respected it, but it's not easy to live with it.

throwwwaway69 4y ago

If I was a billionaire this is the sort of thing I'd fund. Like the EFF but specifically for open source developers and projects.

a2800276 4y ago
Luckily you can fund the EFF now, all without having to become a billionaire!
- throwwwaway69 4y ago
  Already a member :)
kube-system 4y ago
A foundation, just for free software? https://www.fsf.org/ https://www.fsf.org/
- bionade24 4y ago
  The FSF says they only care about the GNU project license violations. https://sfconservancy.org/ https://sfconservancy.org/ has an actual record of fighting against license violations.
  - seabass-labrax 4y ago
    GNU generally requires that contributors assign their copyright to the FSF, which is what allows the FSF to litigate; they can't do this for software that they don't hold copyright to. The Software Freedom Conservancy, on the other hand, holds partial copyright to each of their many member projects' software and chooses to actively enforce the GNU GPL on that code quite frequently. The SFC's ongoing case against Vizio in California[1] appears to show that violators of the GNU GPL can be sued by users, not just copyright holders. If this case sets precedent elsewhere in the USA and even in other countries, then organisations like the FSF and SFC will have far more options in what violations they choose to litigate. However, this also opens up the risk of 'GPL trolls' who might not be motivated by the same principles[2]. [1]: https://sfconservancy.org/press/vizio-coverage.html https://sfconservancy.org/press/vizio-coverage.html [2]: https://www.fsf.org/licensing/enforcement-principles https://www.fsf.org/licensing/enforcement-principles

frognumber 4y ago

My experience is that 95+% of businesses will follow GPL obligations, even without teeth. The <5% bad actors are a problem, but that doesn't negate that it mostly works.

balefrost 4y ago
My experience is, for businesses who pay attention to open-source licenses, they will avoid GPL libraries like the plague (GPL applications are usually fine, though there's sometimes some skepticism). But not all businesses pay close attention to open-source licenses. I have to assume that scale has something to do with it. Huge companies usually take that pretty seriously. Tiny companies... eh, they might not even be aware.
- avitous 4y ago
  Concur on this about avoidance. From my own experience at a startup years ago, the corporate counsel was pretty much hostile to any GPL libraries being used in the companies product, and was especially hostile to the AGPL, categorically refusing to support use of anything using the latter.

its-summertime 4y ago

In both of those situations, don't the companies end up paying more (to lawyers) than if they open-sourced in the first place?

cptskippy 4y ago

> Companies are doing the calculations and determining that by the time they get caught they can just negotiate at best and at worst just ignore it and drag things out until it realistically no longer matters. You're giving companies way too much credit. Unless a company has been sued for something, they often have no insight into or awareness of it. Most companies do not have strict policies around using GPL or OSS. The legal, audit and compliance teams are only aware of things when it's brought to their attention. Our company is very good about accessibility and ease of use in our products, but only because someone used the ADA to sue the shit out of us a decade ago. I would wager that most GPL violations are made by folks who are consciously aware of what they're doing, and the companies they work for are completely unaware that such decisions are even being made. There's no actuary running the numbers and saying "yeah go ahead and violate it, litigation is cheaper than compliance", that's tinfoil hat level thinking IMO.

pabs3 4y ago
Conservancy have said in numerous talks that we are well past the age of unintentional violations and well into the deliberate violations era, where companies just stall and stall and stall.
- cptskippy 4y ago
  > where companies just stall and stall and stall. That's a legal tactic regardless of initial intent or guilt. If you thinking waiting someone out is cheaper than losing or settling, then you stall. It puts a financial burden on them. I'm not saying it's right, and it's also not an indicator of guilt, malice, or forethought.
  - pabs3 4y ago
    Sure, but this is after they have shown to be violating.
    - cptskippy 4y ago
      And? Being shown evidence you committed a crime or breached an agreement doesn't prove malice or forethought. Additionally people seem to think of legal contracts and licenses as being set in stone or non negotiable. In the legal world they are simple the starting point for any negotiation.