13 ms·

RedHat found a way to get around the GPLv2 license intention with contract law

167 points by andy99 3y ago

mike_hock 3y ago
Hopefully the GPLv4 will plug this loophole.
- robertlagrant 3y ago
  GPLv4 will be fought with sticks and stones.
  - mike_hock 3y ago
    Sticks and stones may break my bones but Redhat will never paywall the source again.
- linuxftw 3y ago
  There's no loophole. If you distribute software covered by the GPL, you have to release the source to any person that you distributed the software to, and you have to release it under the same GPL. The real loophole is enforcement. There's no case law that allows an end user to get standing for GPL software, only the copyright holder can enforce the license.
  - mike_hock 3y ago
    > you have to release the source to any person that you distributed the software to, and you have to release it under the same GPL. And this same GPL allows them to further distribute the software to third parties. If you're threatening and intimidating people not to do so, you're subverting the terms of the license.
    - linuxftw 3y ago
      Exactly right, which is why I said it's not a loophole. The loophole is who has legal standing in court. The recipient so far has been found to not have standing. So Red Hat can distribute the software, not even tell you about the GPL, and that's that. Unless the original copyright holder wants to sue them. Which in the famous VMware case, at least in Germany IIRC, the bar to prove infringement or derivative work is impossibly high. So, the GPL is mostly worth nothing.
    - jzb 3y ago
      It isn't a threat or intimidation - it's simply a potential that Red Hat will stop doing business with you. Imagine for a moment that you're an indie developer and you contract with a company to supply support for a GPL'ed program under the idea that they're using it internally. Next thing you know, they're taking the code you're providing and offering a subscriber service and undermining your livelihood contracting with other companies. OK - the GPL says they can do that. The GPL, however, does not require you to keep doing business with them. So, next contract opportunity you refuse to do business with them. The GPL does not obligate you to re-up with them. Nor should the GPL force Red Hat to supply future updates to customers that threaten its business. Just because people have become accustomed to Red Hat doing more than it has to do doesn't mean they're perpetually obligated to live up to those expectations.
      - mike_hock 3y ago
        It absolute is a threat and intimidation. The situation with the indie developer is not comparable. The massive power asymmetry matters. It just shows that the correct fix isn't some dumb clause that just says "this thing that Redhat did is now forbidden." A cleverer fix might be to require that the source code be made publicly available.
        jzb 3y ago
        "The massive power asymmetry matters." Rules for thee but not for me? What's the boundary for company size that forces public release of code vs. allowing a small company to choose its customers? If Red Hat's customers find the situation intolerable, they can and will stop paying Red Hat and do business elsewhere. It's not, by and large, Red Hat's customers that are squawking about this - it's people who have decided they're entitled to the clones and are actively undermining Red Hat.
        hyperhopper 3y ago
        Yes, that's kind of how intimidation works. The mafia doesn't get to claim the shopkeeper is intimidating them.
        3y ago
  - Alupis 3y ago
    It has to be said over and over, unfortunately. A license or contract is only as good as your ability to enforce it.
  - dragonwriter 3y ago
    > There's no case law that allows an end user to get standing for GPL software There's case law establishing clearly the doctrine that intended third-party beneficiaries can enforce contract provisions, and that the GPL operates as a contract and not just a bare copyright license. There is not yet case law on third-party beneficiaries under the GPL (though there is plenty of rrason to believe that end users are such under the broader case law on the topic), AFAIK, though SFC v. Vizio, currently proceeding under that theory last I saw status, may well provide it.
  - chasil 3y ago
    Red Hat offers free developer accounts with available downloads of the install ISOs. I have never seen the source ISOs from this perspective. However, would it not be trivial for Rocky, Alma, and Oracle to simply use "burner" developer accounts to pull the source ?
    - linuxftw 3y ago
      It's interesting that the new agreement terms don't mention distributing 'source code' only 'software.' And the bit about supporting non-Red Hat software, reads as if, you promise you're not going to use Red Hat binary patches to patch Oracle Linux or some other distro, unless you're paying a subscription per instance of said distro. There's really no restriction in this article about distributing the source itself. Red Hat may be happy for this confusion to remain.
  - flaptrap 3y ago
    Again the fallacy. GPLv2 allow (1) giving the source code along with the binaries or (2) promise to allow any third-party to obtain those sources for the cost of copying. The Software Freedom Conservancy post shows that Red Hat considers GPL licensing to be a serious matter. Correct, an end user could not enforce a copyright violation, but the copyright owner can assign those rights. I also think Red Hat is complying with GPL and other licenses, just it is closer to the edge than last month.
  - hyperhopper 3y ago
    The whole purpose of gpl is if you want to be a user of software, you should get freedoms. This effectively eliminates those freedoms by saying that if you use those freedoms, you will no longer be a user. Defeats the whole purpose, definitely a loophole.
    - beanjuiceII 3y ago
      you just made 0 sense, you get the freedoms the GPL gives you, the GPL says nothing about you having to continue being a customer of some company
      - hyperhopper 3y ago
        In a practical sense (but not a legal sense), being a user of the software, and being a customer of the company providing the software that you entered into a contract with and paid, are the same thing.
  - pabs3 3y ago
    Software Freedom Conservancy have a legal theory that the GPL functions as both a license and contract and that recipients of GPLed binaries are third-party beneficiaries of the GPL contract. They are also suing Vizio under that theory. Their next court dates are in California in September IIRC. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html
- redox99 3y ago
  The current problem arises from the fact that you have to ask for the source code. So companies can retaliate (if you ask us for the source code, we terminate this other contract). The solution would be to mandate either including the source code when you distribute the software, or a link to something like IPFS that hosts the source code.
  - circuit10 3y ago
    > mandate either including the source code This could cause problems by making the size of binary packages/executables a lot larger because they’d also need the source
    - redox99 3y ago
      Thus the two options
      - circuit10 3y ago
        The second option seems a little better but tying it to specific technology like that seems like it might not a great idea There’s probably a better way to achieve the same effect
- deleted 3y ago
  [deleted]
m463 3y ago
Isn't some of the code that redhat distributes under GPLv3 or AGPL? Are the terms there stricter?
- jzb 3y ago
  AGPL provisions kick in for services delivered over a network, basically the SaaS models. With RHEL some of the code may be under the AGPL (I haven't checked if any of the RHEL packages are actually AGPL), but it's not being offered as a service in a way that should trigger AGPL requirements AFAIK. GPLv3 doesn't contain any provisions that address this as far as I am aware. It was concerned with things like "Tivoization" and embedded software. None of the terms in those licenses require the things that everybody seems to want them to require: verbatim publishing of exact source code to everyone everywhere that allows "bug for bug" clones of RHEL and/or continuing a business relationship that forces Red Hat to convey the GPL rights for all RHEL releases no matter what a customer does with those rights.
- bragr 3y ago
  Not really in regards to this particular issue. GPLv3 has the same issue in that it only people who receive the binaries are entitled to the source, and 3rd parties technically have no right to demand the source. AGPL is a little broader, but if I don't allow anyone else access to my modified AGPL app, again technically no 3rd parties could demand the source from me. It'll be interesting to see if there is some new generation of licenses that require derivatives in source form to be publicly available, but enforcement seems almost impossible.
  - quectophoton 3y ago
    > [...] licenses that require derivatives in source form to be publicly available Note, this fails the "desert island test" from Debian's Free Software Guidelines[1]. If someone wants their software to be accepted in the Debian package repositories, they should be aware that using this license might prevent them from doing so. I'm not opining on whether that's a good policy or a bad policy, only mentioning that that's a thing. [1]: https://en.wikipedia.org/wiki/Debian_Free_Software_Guidelines https://en.wikipedia.org/wiki/Debian_Free_Software_Guideline...
jzb 3y ago
"It violates the spirit of the open source software movement" Says a person promoting open core. I have little interest in hearing lectures about the spirit of open source from open core proponents. None, actually. There are definitely folks who have standing to talk about Red Hat's decisions around distributing GPL'ed code, but if you're out there promoting open core or primarily make your money with proprietary code, you're not in that group.
- TylerE 3y ago
  Live by the sword, die by the sword.
- jancsika 3y ago
  > I have little interest in hearing lectures about the spirit of open source from open core proponents. None, actually. I maintain an open source project. I'd like to lecture you on how Red Hat is violating the spirit of the open source software movement. How's Tuesday work for you?
  - jzb 3y ago
    If you wanna swing round and buy the beer, go for it. Or Scotch. I'm partial to a good Scotch.
  - dralley 3y ago
    Reread that sentence again. Particularly the words "from open core proponents"
- zeruch 3y ago
  Even broken clocks are right twice a day (once if on 24 hour time)
yellow_lead 3y ago
> RockyLinux has a work-around that doesn’t violate any subscription agreements and AlmaLinux is adjusting its development model to pull from CentOS Stream. A bit out of the loop here - what is the workaround?
- sleepytimetea 3y ago
  They run a cloud VM with a paid RHEL AMI and use it to pull the sources. :-).
  - Alupis 3y ago
    How long until this work-around is "patched" by RH/IBM? This is a big part of the reason there's so much uncertainty in the RHEL community right now...
    - adr1an 3y ago
      They would need to stop providing sources to all of their clients using rhel in cloud.. doesn't seem possible
      - Alupis 3y ago
        Could they not change their contract/license and forbid "exporting" or something? IBM is big enough to make an example out of a few unlucky individuals, and compel everyone else to play their way.
        pg_1234 3y ago
        RH/IBM is bound by a contract where the moment someone spins up one of their VMs, they MUST provide all sources and the recipient is free to redistribute them. If they forbid this they lose the right to use Linux.
        Alupis 3y ago
not_your_vase 3y ago
It's not like they are the first ones. Anyone remember GRSecurity, especially after their beef with a person called L. Torvalds? They "pulled a red hat" before it was cool. Would be surprised if they were the first ones.
EGreg 3y ago
You know, they could use utility tokens as a way to monetize open source software. Have they looked into it? In order to do that, they would have to use a strong network effect to lock in their audience and make it more costly to fork the whole ecosystem than just keep paying for the utility. What is the alternative? Everyone who is silently downvoting — I would LOVE to hear a viable alternative.
- wmf 3y ago
  You're name-dropping utility tokens as if we know what those are but we don't. Somebody needs to explain exactly how these utility tokens would work before we'll take them seriously.
  - EGreg 3y ago
    A utility token is a decentralized token you pay to a provider in order to do a service for you. Maybe it's hosting. Maybe it's manual work. Maybe it's AI credits. Maybe -- like in the case of RHEL - it's licensing fees. Think about it like the API credits and quotas that you are given by an API provider, except more decentralized. You can use trustlines to make it a lot more scalable, meaning the provider only closes out the trustline and posts it to the blockchain to collect the tokens, once in a while, not on every micropayment. Here is an example: https://qbix.com/ecosystem https://qbix.com/ecosystem
- tonyarkles 3y ago
  (Note: I am engaging in good faith. I'm not arguing against utility tokens, I'm just not sure I get how they're applicable) I read your sibling comment and I'm still not sure I get this: > they could use utility tokens as a way to monetize open source software First, who is "they" in this context? RedHat? > use a strong network effect to lock in their audience and make it more costly to fork the whole ecosystem than just keep paying for the utility > Maybe -- like in the case of RHEL - it's licensing fees. I'm trying to parse this and I'm just not following. What's the "monetize open source" business model here with utility tokens? RedHat's current business model is: "Set up a contract where businesses pay money every month, in exchange for access to RHEL builds and technical support, whether or not they use that tech support in a given month." I think I conceptually get what a "utility token" is from having a skim through the QBUX site, but... I don't really get how it would change things in this case, other than likely making it more difficult for people to pay for RHEL subscriptions? > What is the alternative? Everyone who is silently downvoting — I would LOVE to hear a viable alternative. I think the trick is that the viable alternative is the status quo. You haven't really explained how this would lead to RedHat making more money every month than how they're doing business currently.
doctorpangloss 3y ago
IP protection is driven by $$$ and norms. Non-S&P500 corporations routinely violate open source licenses a myriad of ways. If you license something as AGPLv3, Amazon, Microsoft and Google, among other S&P500s, will not integrate it into their service offerings. Sherlocking happens to everyone big and small. If I work at Microsoft and see AppGet and make WinGet, what can the author do? Microsoft will pay someone to reimplement X in C#, Google in GoLang, Apple in Swift, etc. etc. These aren't clean room implementations, but this is how they can consume code that is valuable to them. If you have a speculative meeting with Google about working together, they may engage the quota-driven attorney to patent your work anyway (https://patentpandas.org/stories/company-patented-my-idea https://patentpandas.org/stories/company-patented-my-idea). Let's say you contract to do work for Microsoft as a vendor, but you have "background technologies." That's fine, so you own the copyright to the code. If you make something innovative, your partner at Microsoft - some engineer or PM or whatever - will engage their quota-driven attorney to patent it. So even if contract X says you own the copyright to the code, they lie (by omission) and patent anything interesting anyway. End users reading HN routinely violate copyright, EULAs, etc. I mean they believe in the rights of the author for AI generated art sometimes, do-not-train robots.txts, and then immediately use a paywall bypass or archive.lol to read an article written by a real human being. They complain about giant corporations violating these GPL provisions and then they go and pirate a video game, a movie, an anime, etc. What is the cultural norm for stuff you put out there for the public on the Internet? It seems to be, tough cookie! If you purposefully put your stuff on the Internet (as opposed to someone buying something off X and pirating it), you've conceded: "If you have more money than me and if you never want to work with me again, I guess you can do whatever the hell you want." There's an IP law crisis. We've totally abrogated IP law to capitalism. HN is part of the problem, people talking about laws, contracts, etc. that they themselves were routinely violate from Napster to What.cd, ad blockers, paywall bypassing like Archive.lol, etc. HN users excuse themselves just because the law says one thing, but is unenforceable unless you have a ton of money or something the counterparty has to lose, so you're going to do the norm, you're going to do the thing that you like that makes sense to you. Nobody forces you to use RHEL or Rocky Linux. You can simply ignore this whole drama in this particular product category. But eventually, the giant corporations will simply copy your code and use it, and even if you have an open and shut case, you won't be able to afford a lawyer, you'll have to go beg. You'll get represented by the Berkman center for free, and you'll still lose. Something's gotta change.
linuxftw 3y ago
Red Hat always planned to do this. They were huge proponents of the GPL Cooperation Commitment [1], and persuaded lots of gullible developers to irrevocably sign over their rights. 1: https://gplcc.github.io/gplcc/ https://gplcc.github.io/gplcc/
- bragr 3y ago
  That really has no bearing here because regardless of who holds the copyright, what they are doing is permissible under the GPL.
- jzb 3y ago
  AFAIK this does not sign over any rights. It simply says that the signees support a "cure" period for GPL violations like the GPLv3 has. This wouldn't help Red Hat much if a rights holder decided that Red Hat was violating the GPL. At worst, or best, it would give Red Hat a little more time to "cure" its violation. It's not a permanent shield against being sued or having rights rescinded for GPL violation. So - if somebody signed this and decided to talk to Red Hat and Red Hat didn't want to change its EULA or whatever, then they can go ahead and sue or formally rescind Red Hat's GPL rights. (As I understand it. Standard disclaimer that I am not a lawyer, etc.)
  - linuxftw 3y ago
    Creating additional barriers to rights holders to bring suit can only benefit the entity infringing. Why should the rights holder need to promise anything? Release the software under the rights or face termination of the license as they see fit? If you want back in, bring your checkbook.
- ilc 3y ago
  This is not the worst of what Red Hat has done. https://openinventionnetwork.com/ https://openinventionnetwork.com/ is #1 on my list. ... Why? Because instead of supporting all FOSS systems. It is Linux only. Thus locking the whole patent protection eco-system they created onto Linux, the platform they created.
klyrs 3y ago
> The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.” The community may be large enough to end-run this. Every month, a new subscriber gets the source code, publishes it, and yeets their subscription. Or, if I'm reading this right, they cancel their subscription so they are no longer under its T&C, and then publish the code.
- phpisthebest 3y ago
  I think Rocky's Linux propose solution of using AWS Instances is probably the best path. Unless RHEL wants to stop allowing RHEL Licensed Instances from being spun up by AWS Customers and instead having to have people "bring their own license" to AWS which would likely hurt their revenue far more than anything Rock or Alma would have
- fragmede 3y ago
  Hell, someone publish a script up on GitHub to automate the whole process.
nocoiner 3y ago
In at least a couple places, the article says what Red Hat is doing is “technically legal” or “technically in compliance” with the GPL. I don’t find it very useful or enlightening when people start talking about “intention” in this context. If you intend for some particular outcome to happen, you really need to make sure that it’s written into the license! That’s what licenses and contracts and every annoying legal-type thing that exists are for! On a related topic: Taking a quick scan of GPLv2, this doesn’t even seem to grossly offend the principles or intent of the license - am I reading it wrong, or, when it comes to appropriately distributed software (i.e., bearing notice, license terms, copyright, disclaimer, etc.), it seems to say pretty clearly that source only need to be provided to recipients of the modified program? I guess there’s some ambiguity about what 2(b) could mean?
- jzb 3y ago
  You're not reading it wrong. The popular understanding of the GPL vs. the actual text of the GPL are two extremely different things. Red Hat is far from alone in this. If I'm not mistaken, there's a whole cottage industry of WordPress plugin and theme developers who use basically this model. The plugin or theme is GPL'ed because it depends on WordPress, which is GPLed. But they gate the software and require payment to get it. They may also have an agreement that sets out a limit on redistribution for access - if you buy the theme or plugin from them and then set about redistributing it, they're not going to take your money in the future. I can't think of any good way to close the "loophole" here in a GPL-type license that doesn't essentially force a developer to distribute to anybody they've ever done business with, forever. Any language that would force Red Hat to keep its subscription with an "offending" customer would also tie their hands for cutting off access for other reasons -- because who wouldn't claim that the reason Red Hat cut the subscription was over distribution?
  - madeofpalk 3y ago
    What's the loophole? This is working exactly as intended, no? GPL is to grant the user of software freedoms. Free as in freedoms, not beer. It's origin was from the user of a printer driver being frustrated they couldn't debug and fix an issue.
throwaway5752 3y ago
IBM is shitting the bed so badly here. It was always going to happen. The value of RHEL and goodwill associated with it doesn't clearly flow through to the bottom line, so they were always going kill that golden goose because that is who IBM is. It's sad to watch, though.
Havoc 3y ago
Just add a redhat clause to it :p Bit like Facebook just did with Llama >Meta will open source LLaMa 2, enabling developers to access it freely, with a license requirement for companies with 700 million MAUs.
dmitrygr 3y ago
Wait till you hear about Qualcomm. “Yes it is gpl but your contract with us states that you agree to never ask for source”
- circuit10 3y ago
  Is that legal?
  - wmf 3y ago
    No, but the entire Android ecosystem will collapse if it's challenged, so...
josho 3y ago
I can't imagine this holding up in court. By analogy, it sounds like I give you the right to walk across a line, but I also have the right to shoot anyone that crosses the line. This has the net effect that you effectively are not allowed to cross the line.
- jzb 3y ago
  No. The analogy here is this: Every time I hand you your monthly subscription of software, you can do anything allowed by the GPL. However, if you threaten my business, I can stop your monthly subscription. You have the GPL rights for everything I've given you. I don't have to continue to convey the rights to new things to you if I don't like how you use them. If Red Hat were selling GPL'ed software for navigation systems to a supplier in Country A and it turned out that they were re-distributing that software to Country B to bomb Country C, nobody would blink if Red Hat refused to stop doing business with that supplier. The imaginary obligations that people have invented around the GPL wouldn't allow Red Hat to discontinue that relationship.
  - Y_Y 3y ago
    No.
    - dralley 3y ago
      Yes?
      - Y_Y 3y ago
        My intention was to object to the parent post replying with "No" to something that wasn't a question or a falsehood. I find it annoying and inflammatory and not conducive to good discussion. Since brevity is wit, I thought that would be a good way to get my point across without having to write an explanation like this one.
        pessimizer 3y ago
indigodaddy 3y ago
“The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.” End-users are allowed to exercise their right to redistribute the code but if they do, they face the consequence of Red Hat canceling their subscription and being cut off from future versions of the software and Red Hat services.” —- This is the key issue imo. How can you be in compliance with “..if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have.” … if you make non-redistribution a requirement to even get access to begin with..? I’m sure I’m misunderstanding though at some level
- soneil 3y ago
  The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide you future binaries is your contract with them - and exercising those rights jeopardises that contract. Which technically works because the GPL only concerns the software you've received - it does not concern nor compel the software you've yet you receive.
  - indigodaddy 3y ago
    So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..
    - spullara 3y ago
      You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
    - Semaphor 3y ago
      I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.
CrLf 3y ago
Honestly, the more reactions I see from certain parts of the community, the more I agree with Red Hat’s decision. And I started from thinking it was a bad move. Also, see Jon “maddog” Hall’s take from a few days ago: https://www.lpi.org/blog/2023/07/30/ibm-red-hat-and-free-software-an-old-maddogs-view/ https://www.lpi.org/blog/2023/07/30/ibm-red-hat-and-free-sof...
- pjmlp 3y ago
  I agreed with it since the beginning, as Jon “maddog” Hall states, there are plenty of distributions out there. Thanks for pointing out his take.
deleted 3y ago
[deleted]
saltcured 3y ago
I think many of us have taken for granted a very broad idea of "the spirit of free software" because of overlapping practices over the past few decades. But I'm not sure these are actually the "intent" of GPLv2, which I think would mean what Stallman et. al were advocating back then. The GPLv2 is pretty clear about allowing for "hostile" forks, and not about mandating communal behavior from everyone. That is particularly clear in how it offers multiple methods to satisfy obligations to redistribute sources. A vendor like Red Hat can choose whether to make sources generally available to the public or to only respond to requests for sources from their own licensed users. They are moving from the first method to the second. The GPLv2 also doesn't say anything about obligations to receive patches nor offer maintenance or future versions of anything. I think we've all enjoyed a luxury of people acting beyond the actual license obligations. The voluntary effort to contribute to a communal codebase and broadly share a stream of maintenance releases is very nice. But licensing does not compel all this voluntary effort. I think it is in Red Hat's rights to try to capture some of this business value that has been left on the table, even though I selfishly hope that they will either stub their toes and reverse course, or get out-competed by a new benevolent vendor who sees an opportunity in taking over such a communal role.
- mistrial9 3y ago
  > I think we've all enjoyed a luxury of people acting beyond the actual license obligations and, the largest and most-profitable companies on Earth today have also enjoyed a luxury beyond the actual license obligations. To "pile on" .. it is not that "the well is running dry".. rather it is an explicit business objective to restrict the distribution of SECURITY UPDATES and in a parallel move, require those security updates to continue to operate with money doing X-y-z. Its not secret.
  - freedomben 3y ago
    The GPL is very clear that the software does not come with a warranty or any guarantees of fitness for any purpose. The customer has the code, they are free to fix any bugs or security holes that affect them, but they are not entitled to have other people do that work for them for free.
brnt 3y ago
Please stop reinforcing the Red Hat ecosystem by using Red Hat derived distros.
- mistrial9 3y ago
  the people reading this are not the people making those decisions. Management uses this product as a required element in business contracts, those requirements include security updates. The security updates are not going to be available the day management stops paying. It is explicit.
  - brnt 3y ago
    Maybe. I still see way too much enthusiasm for all these new CentOS replacements in these circles. Those projects are all phenomenally bad ideas and everyone should understand that. People who're convinced in board rooms are getting RHEL anyway, they've little interest in the 'CentOS community'.
  - infamouscow 3y ago
    I work at a stealth mode database startup. We are not prioritizing RHEL support because of their business decision.
JohnFen 3y ago
All of this nonsense is excellent reason to avoid using Red Hat, at least outside of a business context. They are the Microsoft of the Linux world.
Animats 3y ago
This might be handled via a secondary market in abandoned Red Hat licenses. Offer a nominal amount every few months for a Red Hat customer that's leaving Red Hat. Have them obtain the source, release it, and let their license expire. Talk to someone who liquidates the IP of failed startups. "Localliquidators.com" is in that business. They probably have some license rights available. Somebody should do this at least once.
insanitybit 3y ago
This is nothing new and it's perfectly compliant with GPLv2.
taylodl 3y ago
IBM just doing what IBM does - sleaze.
stcroixx 3y ago
s/RedHat/IBM - Red Hat the name is just a smoke screen now.
lightlyused 3y ago
I hope this makes the RedHat based distros less popular in the long term. We need to get out from under their shadow (and IBMs).
ataylor284_ 3y ago
This is part of an emerging trend that's a threat to the current symbiosis between open source communities their commercial sponsors. Many of these companies have nurtured a lot of goodwill with the community and built successful businesses around enterprise customers. Once they're entrenched in the enterprise software business, there is value to be had by cashing in that goodwill and maximizing shareholder value. Even if their current leadership is unwilling to move in this direction, there are plenty of existing enterprise computing companies (e.g. IBM) and private equity firms who will.
mindslight 3y ago
This idea isn't new. Does nobody remember Sveasoft? They tried this with regards to alternative WRT54G firmware, back when that was a thing. They ended up failing in the market, to the point that seemingly nobody even remembers the attempt. Redhat seems to be betting on their size for their staying power. But that size also means there is much more demand for third parties to route around their attempt at creating an inefficient market speedbump. For example, that proposed solution of subscribing to Redhat through a cloud provider, then distributing the source code seems quite straightforward. If they tighten up on that, it would only seem to take a handful of small subscribers comparing the source code they receive to make sure there is no steganographic watermark, and then distributing source through an unrelated entity without fear of reprisal. I'm sure they will succeed at creating some level of speed bump for companies that want things to just work, but I'd say that ultimately this is just going to lead to another cycle of users moving to the new libre thing, and then Redhat needing to pay to reacquire those customers later.
fatfingerd 3y ago
How does one adjust an open source license to make RedHat's redistribution illegal without interfering with distributions that follow the GPL intent?
fragmede 3y ago
Where is Oracle in all this? Oracle Linux is a RedHat clone and they sell support contacts and everything that businesses like.
dsr_ 3y ago
GPL v2 part 6: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. I think it can be reasonably argued that a contract designed to defeat the intent of the license is "a further restriction". The correct remedy is not to require Red Hat to restore their former client's contract. The correct remedy is that Red Hat, and thus IBM, is no longer licensed to use GPL v2 software.
- nocoiner 3y ago
  OK. Let’s say Red Hat Linux Distributors Inc. is the software licensor. And Red Hat Support LLC is the support provider. RHLDI distributes software (and source) in compliance with GPLv2. RHSLLC has a provision in its contract that a support customer may not re-distribute any source that it receives from RHLDI. Where’s the breach of the GPL? The reference to “You” in that instance, about not being able to impose additional restrictions, would have to be give additional words and meaning not present in the contract for that line to mean what you say it means. If that’s what the license is supposed to prevent, it really needs to be written in a way that clearly addresses this fact pattern.
  - dsr_ 3y ago
    No, you're missing the point. The Linux Kernel is the big GPL v2 fish. It's not a Red Hat licensing to Red Hat situation.
kazinator 3y ago
There is no circumvention of the GPL going on, or any loophole in the license being exploited. It's basically "I'm only going to be your friend and provide you with free software with my cool and useful modifications if you don't redistribute it to your other friends. (Which you're allowed to do, but I just won't be your if I catch you doing that, and won't give you any more)." There isn't anything the GPL can do about that, without becoming a crazy non-free license. It's entirely out of its scope. The behavior doesn't step on any user rights, because: 1. It doesn't remove their rights to what they already have (software they have downloaded under the Subscription Agreement). 2. Users do not have a right to enter into or remain in a Subscription Agreement with Red Hat; there is no such right. 3. People have a right to refuse to redistribute something. If you have some GPLed program I want, and I ask for it, you can say no. If you say yes to giving me binaries, then you can't say no to giving the source (for just that specific version of those binaries and nothing more). 4. People have access to the original software; they can make their own distribution from scratch to compete with Red Hat. There is no intent in the GPL whatsoever to prevent Red Hat's behavior; there is no wording that could even remotely have that interpretation. The person who came up with the license probably disagrees with the behavior, but he didn't put anything in the license to prevent it and probably wouldn't find it a good idea to try to use a copyright license to try to do that.

167 points by andy99 3y ago

mike_hock 3y ago

Hopefully the GPLv4 will plug this loophole.

robertlagrant 3y ago
GPLv4 will be fought with sticks and stones.
- mike_hock 3y ago
  Sticks and stones may break my bones but Redhat will never paywall the source again.
linuxftw 3y ago
There's no loophole. If you distribute software covered by the GPL, you have to release the source to any person that you distributed the software to, and you have to release it under the same GPL. The real loophole is enforcement. There's no case law that allows an end user to get standing for GPL software, only the copyright holder can enforce the license.
- mike_hock 3y ago
  > you have to release the source to any person that you distributed the software to, and you have to release it under the same GPL. And this same GPL allows them to further distribute the software to third parties. If you're threatening and intimidating people not to do so, you're subverting the terms of the license.
  - linuxftw 3y ago
    Exactly right, which is why I said it's not a loophole. The loophole is who has legal standing in court. The recipient so far has been found to not have standing. So Red Hat can distribute the software, not even tell you about the GPL, and that's that. Unless the original copyright holder wants to sue them. Which in the famous VMware case, at least in Germany IIRC, the bar to prove infringement or derivative work is impossibly high. So, the GPL is mostly worth nothing.
  - jzb 3y ago
    It isn't a threat or intimidation - it's simply a potential that Red Hat will stop doing business with you. Imagine for a moment that you're an indie developer and you contract with a company to supply support for a GPL'ed program under the idea that they're using it internally. Next thing you know, they're taking the code you're providing and offering a subscriber service and undermining your livelihood contracting with other companies. OK - the GPL says they can do that. The GPL, however, does not require you to keep doing business with them. So, next contract opportunity you refuse to do business with them. The GPL does not obligate you to re-up with them. Nor should the GPL force Red Hat to supply future updates to customers that threaten its business. Just because people have become accustomed to Red Hat doing more than it has to do doesn't mean they're perpetually obligated to live up to those expectations.
    - mike_hock 3y ago
      It absolute is a threat and intimidation. The situation with the indie developer is not comparable. The massive power asymmetry matters. It just shows that the correct fix isn't some dumb clause that just says "this thing that Redhat did is now forbidden." A cleverer fix might be to require that the source code be made publicly available.
      - jzb 3y ago
        "The massive power asymmetry matters." Rules for thee but not for me? What's the boundary for company size that forces public release of code vs. allowing a small company to choose its customers? If Red Hat's customers find the situation intolerable, they can and will stop paying Red Hat and do business elsewhere. It's not, by and large, Red Hat's customers that are squawking about this - it's people who have decided they're entitled to the clones and are actively undermining Red Hat.
        hyperhopper 3y ago
        Yes, that's kind of how intimidation works. The mafia doesn't get to claim the shopkeeper is intimidating them.
      - 3y ago
- Alupis 3y ago
  It has to be said over and over, unfortunately. A license or contract is only as good as your ability to enforce it.
- dragonwriter 3y ago
  > There's no case law that allows an end user to get standing for GPL software There's case law establishing clearly the doctrine that intended third-party beneficiaries can enforce contract provisions, and that the GPL operates as a contract and not just a bare copyright license. There is not yet case law on third-party beneficiaries under the GPL (though there is plenty of rrason to believe that end users are such under the broader case law on the topic), AFAIK, though SFC v. Vizio, currently proceeding under that theory last I saw status, may well provide it.
- chasil 3y ago
  Red Hat offers free developer accounts with available downloads of the install ISOs. I have never seen the source ISOs from this perspective. However, would it not be trivial for Rocky, Alma, and Oracle to simply use "burner" developer accounts to pull the source ?
  - linuxftw 3y ago
    It's interesting that the new agreement terms don't mention distributing 'source code' only 'software.' And the bit about supporting non-Red Hat software, reads as if, you promise you're not going to use Red Hat binary patches to patch Oracle Linux or some other distro, unless you're paying a subscription per instance of said distro. There's really no restriction in this article about distributing the source itself. Red Hat may be happy for this confusion to remain.
- flaptrap 3y ago
  Again the fallacy. GPLv2 allow (1) giving the source code along with the binaries or (2) promise to allow any third-party to obtain those sources for the cost of copying. The Software Freedom Conservancy post shows that Red Hat considers GPL licensing to be a serious matter. Correct, an end user could not enforce a copyright violation, but the copyright owner can assign those rights. I also think Red Hat is complying with GPL and other licenses, just it is closer to the edge than last month.
- hyperhopper 3y ago
  The whole purpose of gpl is if you want to be a user of software, you should get freedoms. This effectively eliminates those freedoms by saying that if you use those freedoms, you will no longer be a user. Defeats the whole purpose, definitely a loophole.
  - beanjuiceII 3y ago
    you just made 0 sense, you get the freedoms the GPL gives you, the GPL says nothing about you having to continue being a customer of some company
    - hyperhopper 3y ago
      In a practical sense (but not a legal sense), being a user of the software, and being a customer of the company providing the software that you entered into a contract with and paid, are the same thing.
- pabs3 3y ago
  Software Freedom Conservancy have a legal theory that the GPL functions as both a license and contract and that recipients of GPLed binaries are third-party beneficiaries of the GPL contract. They are also suing Vizio under that theory. Their next court dates are in California in September IIRC. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html
redox99 3y ago
The current problem arises from the fact that you have to ask for the source code. So companies can retaliate (if you ask us for the source code, we terminate this other contract). The solution would be to mandate either including the source code when you distribute the software, or a link to something like IPFS that hosts the source code.
- circuit10 3y ago
  > mandate either including the source code This could cause problems by making the size of binary packages/executables a lot larger because they’d also need the source
  - redox99 3y ago
    Thus the two options
    - circuit10 3y ago
      The second option seems a little better but tying it to specific technology like that seems like it might not a great idea There’s probably a better way to achieve the same effect
deleted 3y ago
[deleted]

m463 3y ago

Isn't some of the code that redhat distributes under GPLv3 or AGPL? Are the terms there stricter?

jzb 3y ago
AGPL provisions kick in for services delivered over a network, basically the SaaS models. With RHEL some of the code may be under the AGPL (I haven't checked if any of the RHEL packages are actually AGPL), but it's not being offered as a service in a way that should trigger AGPL requirements AFAIK. GPLv3 doesn't contain any provisions that address this as far as I am aware. It was concerned with things like "Tivoization" and embedded software. None of the terms in those licenses require the things that everybody seems to want them to require: verbatim publishing of exact source code to everyone everywhere that allows "bug for bug" clones of RHEL and/or continuing a business relationship that forces Red Hat to convey the GPL rights for all RHEL releases no matter what a customer does with those rights.
bragr 3y ago
Not really in regards to this particular issue. GPLv3 has the same issue in that it only people who receive the binaries are entitled to the source, and 3rd parties technically have no right to demand the source. AGPL is a little broader, but if I don't allow anyone else access to my modified AGPL app, again technically no 3rd parties could demand the source from me. It'll be interesting to see if there is some new generation of licenses that require derivatives in source form to be publicly available, but enforcement seems almost impossible.
- quectophoton 3y ago
  > [...] licenses that require derivatives in source form to be publicly available Note, this fails the "desert island test" from Debian's Free Software Guidelines[1]. If someone wants their software to be accepted in the Debian package repositories, they should be aware that using this license might prevent them from doing so. I'm not opining on whether that's a good policy or a bad policy, only mentioning that that's a thing. [1]: https://en.wikipedia.org/wiki/Debian_Free_Software_Guidelines https://en.wikipedia.org/wiki/Debian_Free_Software_Guideline...

jzb 3y ago

"It violates the spirit of the open source software movement" Says a person promoting open core. I have little interest in hearing lectures about the spirit of open source from open core proponents. None, actually. There are definitely folks who have standing to talk about Red Hat's decisions around distributing GPL'ed code, but if you're out there promoting open core or primarily make your money with proprietary code, you're not in that group.

TylerE 3y ago
Live by the sword, die by the sword.
jancsika 3y ago
> I have little interest in hearing lectures about the spirit of open source from open core proponents. None, actually. I maintain an open source project. I'd like to lecture you on how Red Hat is violating the spirit of the open source software movement. How's Tuesday work for you?
- jzb 3y ago
  If you wanna swing round and buy the beer, go for it. Or Scotch. I'm partial to a good Scotch.
- dralley 3y ago
  Reread that sentence again. Particularly the words "from open core proponents"
zeruch 3y ago
Even broken clocks are right twice a day (once if on 24 hour time)

yellow_lead 3y ago

> RockyLinux has a work-around that doesn’t violate any subscription agreements and AlmaLinux is adjusting its development model to pull from CentOS Stream. A bit out of the loop here - what is the workaround?

sleepytimetea 3y ago
They run a cloud VM with a paid RHEL AMI and use it to pull the sources. :-).
- Alupis 3y ago
  How long until this work-around is "patched" by RH/IBM? This is a big part of the reason there's so much uncertainty in the RHEL community right now...
  - adr1an 3y ago
    They would need to stop providing sources to all of their clients using rhel in cloud.. doesn't seem possible
    - Alupis 3y ago
      Could they not change their contract/license and forbid "exporting" or something? IBM is big enough to make an example out of a few unlucky individuals, and compel everyone else to play their way.
      - pg_1234 3y ago
        RH/IBM is bound by a contract where the moment someone spins up one of their VMs, they MUST provide all sources and the recipient is free to redistribute them. If they forbid this they lose the right to use Linux.
        Alupis 3y ago

not_your_vase 3y ago

It's not like they are the first ones. Anyone remember GRSecurity, especially after their beef with a person called L. Torvalds? They "pulled a red hat" before it was cool. Would be surprised if they were the first ones.

EGreg 3y ago

You know, they could use utility tokens as a way to monetize open source software. Have they looked into it? In order to do that, they would have to use a strong network effect to lock in their audience and make it more costly to fork the whole ecosystem than just keep paying for the utility. What is the alternative? Everyone who is silently downvoting — I would LOVE to hear a viable alternative.

wmf 3y ago
You're name-dropping utility tokens as if we know what those are but we don't. Somebody needs to explain exactly how these utility tokens would work before we'll take them seriously.
- EGreg 3y ago
  A utility token is a decentralized token you pay to a provider in order to do a service for you. Maybe it's hosting. Maybe it's manual work. Maybe it's AI credits. Maybe -- like in the case of RHEL - it's licensing fees. Think about it like the API credits and quotas that you are given by an API provider, except more decentralized. You can use trustlines to make it a lot more scalable, meaning the provider only closes out the trustline and posts it to the blockchain to collect the tokens, once in a while, not on every micropayment. Here is an example: https://qbix.com/ecosystem https://qbix.com/ecosystem
tonyarkles 3y ago
(Note: I am engaging in good faith. I'm not arguing against utility tokens, I'm just not sure I get how they're applicable) I read your sibling comment and I'm still not sure I get this: > they could use utility tokens as a way to monetize open source software First, who is "they" in this context? RedHat? > use a strong network effect to lock in their audience and make it more costly to fork the whole ecosystem than just keep paying for the utility > Maybe -- like in the case of RHEL - it's licensing fees. I'm trying to parse this and I'm just not following. What's the "monetize open source" business model here with utility tokens? RedHat's current business model is: "Set up a contract where businesses pay money every month, in exchange for access to RHEL builds and technical support, whether or not they use that tech support in a given month." I think I conceptually get what a "utility token" is from having a skim through the QBUX site, but... I don't really get how it would change things in this case, other than likely making it more difficult for people to pay for RHEL subscriptions? > What is the alternative? Everyone who is silently downvoting — I would LOVE to hear a viable alternative. I think the trick is that the viable alternative is the status quo. You haven't really explained how this would lead to RedHat making more money every month than how they're doing business currently.

doctorpangloss 3y ago

IP protection is driven by $$$ and norms. Non-S&P500 corporations routinely violate open source licenses a myriad of ways. If you license something as AGPLv3, Amazon, Microsoft and Google, among other S&P500s, will not integrate it into their service offerings. Sherlocking happens to everyone big and small. If I work at Microsoft and see AppGet and make WinGet, what can the author do? Microsoft will pay someone to reimplement X in C#, Google in GoLang, Apple in Swift, etc. etc. These aren't clean room implementations, but this is how they can consume code that is valuable to them. If you have a speculative meeting with Google about working together, they may engage the quota-driven attorney to patent your work anyway (https://patentpandas.org/stories/company-patented-my-idea https://patentpandas.org/stories/company-patented-my-idea). Let's say you contract to do work for Microsoft as a vendor, but you have "background technologies." That's fine, so you own the copyright to the code. If you make something innovative, your partner at Microsoft - some engineer or PM or whatever - will engage their quota-driven attorney to patent it. So even if contract X says you own the copyright to the code, they lie (by omission) and patent anything interesting anyway. End users reading HN routinely violate copyright, EULAs, etc. I mean they believe in the rights of the author for AI generated art sometimes, do-not-train robots.txts, and then immediately use a paywall bypass or archive.lol to read an article written by a real human being. They complain about giant corporations violating these GPL provisions and then they go and pirate a video game, a movie, an anime, etc. What is the cultural norm for stuff you put out there for the public on the Internet? It seems to be, tough cookie! If you purposefully put your stuff on the Internet (as opposed to someone buying something off X and pirating it), you've conceded: "If you have more money than me and if you never want to work with me again, I guess you can do whatever the hell you want." There's an IP law crisis. We've totally abrogated IP law to capitalism. HN is part of the problem, people talking about laws, contracts, etc. that they themselves were routinely violate from Napster to What.cd, ad blockers, paywall bypassing like Archive.lol, etc. HN users excuse themselves just because the law says one thing, but is unenforceable unless you have a ton of money or something the counterparty has to lose, so you're going to do the norm, you're going to do the thing that you like that makes sense to you. Nobody forces you to use RHEL or Rocky Linux. You can simply ignore this whole drama in this particular product category. But eventually, the giant corporations will simply copy your code and use it, and even if you have an open and shut case, you won't be able to afford a lawyer, you'll have to go beg. You'll get represented by the Berkman center for free, and you'll still lose. Something's gotta change.

linuxftw 3y ago

Red Hat always planned to do this. They were huge proponents of the GPL Cooperation Commitment [1], and persuaded lots of gullible developers to irrevocably sign over their rights. 1: https://gplcc.github.io/gplcc/ https://gplcc.github.io/gplcc/

bragr 3y ago
That really has no bearing here because regardless of who holds the copyright, what they are doing is permissible under the GPL.
jzb 3y ago
AFAIK this does not sign over any rights. It simply says that the signees support a "cure" period for GPL violations like the GPLv3 has. This wouldn't help Red Hat much if a rights holder decided that Red Hat was violating the GPL. At worst, or best, it would give Red Hat a little more time to "cure" its violation. It's not a permanent shield against being sued or having rights rescinded for GPL violation. So - if somebody signed this and decided to talk to Red Hat and Red Hat didn't want to change its EULA or whatever, then they can go ahead and sue or formally rescind Red Hat's GPL rights. (As I understand it. Standard disclaimer that I am not a lawyer, etc.)
- linuxftw 3y ago
  Creating additional barriers to rights holders to bring suit can only benefit the entity infringing. Why should the rights holder need to promise anything? Release the software under the rights or face termination of the license as they see fit? If you want back in, bring your checkbook.
ilc 3y ago
This is not the worst of what Red Hat has done. https://openinventionnetwork.com/ https://openinventionnetwork.com/ is #1 on my list. ... Why? Because instead of supporting all FOSS systems. It is Linux only. Thus locking the whole patent protection eco-system they created onto Linux, the platform they created.

klyrs 3y ago

> The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.” The community may be large enough to end-run this. Every month, a new subscriber gets the source code, publishes it, and yeets their subscription. Or, if I'm reading this right, they cancel their subscription so they are no longer under its T&C, and then publish the code.

phpisthebest 3y ago
I think Rocky's Linux propose solution of using AWS Instances is probably the best path. Unless RHEL wants to stop allowing RHEL Licensed Instances from being spun up by AWS Customers and instead having to have people "bring their own license" to AWS which would likely hurt their revenue far more than anything Rock or Alma would have
fragmede 3y ago
Hell, someone publish a script up on GitHub to automate the whole process.

nocoiner 3y ago

In at least a couple places, the article says what Red Hat is doing is “technically legal” or “technically in compliance” with the GPL. I don’t find it very useful or enlightening when people start talking about “intention” in this context. If you intend for some particular outcome to happen, you really need to make sure that it’s written into the license! That’s what licenses and contracts and every annoying legal-type thing that exists are for! On a related topic: Taking a quick scan of GPLv2, this doesn’t even seem to grossly offend the principles or intent of the license - am I reading it wrong, or, when it comes to appropriately distributed software (i.e., bearing notice, license terms, copyright, disclaimer, etc.), it seems to say pretty clearly that source only need to be provided to recipients of the modified program? I guess there’s some ambiguity about what 2(b) could mean?

jzb 3y ago
You're not reading it wrong. The popular understanding of the GPL vs. the actual text of the GPL are two extremely different things. Red Hat is far from alone in this. If I'm not mistaken, there's a whole cottage industry of WordPress plugin and theme developers who use basically this model. The plugin or theme is GPL'ed because it depends on WordPress, which is GPLed. But they gate the software and require payment to get it. They may also have an agreement that sets out a limit on redistribution for access - if you buy the theme or plugin from them and then set about redistributing it, they're not going to take your money in the future. I can't think of any good way to close the "loophole" here in a GPL-type license that doesn't essentially force a developer to distribute to anybody they've ever done business with, forever. Any language that would force Red Hat to keep its subscription with an "offending" customer would also tie their hands for cutting off access for other reasons -- because who wouldn't claim that the reason Red Hat cut the subscription was over distribution?
- madeofpalk 3y ago
  What's the loophole? This is working exactly as intended, no? GPL is to grant the user of software freedoms. Free as in freedoms, not beer. It's origin was from the user of a printer driver being frustrated they couldn't debug and fix an issue.

throwaway5752 3y ago

IBM is shitting the bed so badly here. It was always going to happen. The value of RHEL and goodwill associated with it doesn't clearly flow through to the bottom line, so they were always going kill that golden goose because that is who IBM is. It's sad to watch, though.

Havoc 3y ago

Just add a redhat clause to it :p Bit like Facebook just did with Llama >Meta will open source LLaMa 2, enabling developers to access it freely, with a license requirement for companies with 700 million MAUs.

dmitrygr 3y ago

Wait till you hear about Qualcomm. “Yes it is gpl but your contract with us states that you agree to never ask for source”

circuit10 3y ago
Is that legal?
- wmf 3y ago
  No, but the entire Android ecosystem will collapse if it's challenged, so...

josho 3y ago

I can't imagine this holding up in court. By analogy, it sounds like I give you the right to walk across a line, but I also have the right to shoot anyone that crosses the line. This has the net effect that you effectively are not allowed to cross the line.

jzb 3y ago
No. The analogy here is this: Every time I hand you your monthly subscription of software, you can do anything allowed by the GPL. However, if you threaten my business, I can stop your monthly subscription. You have the GPL rights for everything I've given you. I don't have to continue to convey the rights to new things to you if I don't like how you use them. If Red Hat were selling GPL'ed software for navigation systems to a supplier in Country A and it turned out that they were re-distributing that software to Country B to bomb Country C, nobody would blink if Red Hat refused to stop doing business with that supplier. The imaginary obligations that people have invented around the GPL wouldn't allow Red Hat to discontinue that relationship.
- Y_Y 3y ago
  No.
  - dralley 3y ago
    Yes?
    - Y_Y 3y ago
      My intention was to object to the parent post replying with "No" to something that wasn't a question or a falsehood. I find it annoying and inflammatory and not conducive to good discussion. Since brevity is wit, I thought that would be a good way to get my point across without having to write an explanation like this one.
      - pessimizer 3y ago

indigodaddy 3y ago

“The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.” End-users are allowed to exercise their right to redistribute the code but if they do, they face the consequence of Red Hat canceling their subscription and being cut off from future versions of the software and Red Hat services.” —- This is the key issue imo. How can you be in compliance with “..if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have.” … if you make non-redistribution a requirement to even get access to begin with..? I’m sure I’m misunderstanding though at some level

soneil 3y ago
The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide you future binaries is your contract with them - and exercising those rights jeopardises that contract. Which technically works because the GPL only concerns the software you've received - it does not concern nor compel the software you've yet you receive.
- indigodaddy 3y ago
  So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..
  - spullara 3y ago
    You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
  - Semaphor 3y ago
    I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.

CrLf 3y ago

Honestly, the more reactions I see from certain parts of the community, the more I agree with Red Hat’s decision. And I started from thinking it was a bad move. Also, see Jon “maddog” Hall’s take from a few days ago: https://www.lpi.org/blog/2023/07/30/ibm-red-hat-and-free-software-an-old-maddogs-view/ https://www.lpi.org/blog/2023/07/30/ibm-red-hat-and-free-sof...

pjmlp 3y ago
I agreed with it since the beginning, as Jon “maddog” Hall states, there are plenty of distributions out there. Thanks for pointing out his take.

deleted 3y ago

[deleted]

saltcured 3y ago

I think many of us have taken for granted a very broad idea of "the spirit of free software" because of overlapping practices over the past few decades. But I'm not sure these are actually the "intent" of GPLv2, which I think would mean what Stallman et. al were advocating back then. The GPLv2 is pretty clear about allowing for "hostile" forks, and not about mandating communal behavior from everyone. That is particularly clear in how it offers multiple methods to satisfy obligations to redistribute sources. A vendor like Red Hat can choose whether to make sources generally available to the public or to only respond to requests for sources from their own licensed users. They are moving from the first method to the second. The GPLv2 also doesn't say anything about obligations to receive patches nor offer maintenance or future versions of anything. I think we've all enjoyed a luxury of people acting beyond the actual license obligations. The voluntary effort to contribute to a communal codebase and broadly share a stream of maintenance releases is very nice. But licensing does not compel all this voluntary effort. I think it is in Red Hat's rights to try to capture some of this business value that has been left on the table, even though I selfishly hope that they will either stub their toes and reverse course, or get out-competed by a new benevolent vendor who sees an opportunity in taking over such a communal role.

mistrial9 3y ago
> I think we've all enjoyed a luxury of people acting beyond the actual license obligations and, the largest and most-profitable companies on Earth today have also enjoyed a luxury beyond the actual license obligations. To "pile on" .. it is not that "the well is running dry".. rather it is an explicit business objective to restrict the distribution of SECURITY UPDATES and in a parallel move, require those security updates to continue to operate with money doing X-y-z. Its not secret.
- freedomben 3y ago
  The GPL is very clear that the software does not come with a warranty or any guarantees of fitness for any purpose. The customer has the code, they are free to fix any bugs or security holes that affect them, but they are not entitled to have other people do that work for them for free.

brnt 3y ago

Please stop reinforcing the Red Hat ecosystem by using Red Hat derived distros.

mistrial9 3y ago
the people reading this are not the people making those decisions. Management uses this product as a required element in business contracts, those requirements include security updates. The security updates are not going to be available the day management stops paying. It is explicit.
- brnt 3y ago
  Maybe. I still see way too much enthusiasm for all these new CentOS replacements in these circles. Those projects are all phenomenally bad ideas and everyone should understand that. People who're convinced in board rooms are getting RHEL anyway, they've little interest in the 'CentOS community'.
- infamouscow 3y ago
  I work at a stealth mode database startup. We are not prioritizing RHEL support because of their business decision.

JohnFen 3y ago

All of this nonsense is excellent reason to avoid using Red Hat, at least outside of a business context. They are the Microsoft of the Linux world.

Animats 3y ago

This might be handled via a secondary market in abandoned Red Hat licenses. Offer a nominal amount every few months for a Red Hat customer that's leaving Red Hat. Have them obtain the source, release it, and let their license expire. Talk to someone who liquidates the IP of failed startups. "Localliquidators.com" is in that business. They probably have some license rights available. Somebody should do this at least once.

insanitybit 3y ago

This is nothing new and it's perfectly compliant with GPLv2.

taylodl 3y ago

IBM just doing what IBM does - sleaze.

stcroixx 3y ago

s/RedHat/IBM - Red Hat the name is just a smoke screen now.

lightlyused 3y ago

I hope this makes the RedHat based distros less popular in the long term. We need to get out from under their shadow (and IBMs).

ataylor284_ 3y ago

This is part of an emerging trend that's a threat to the current symbiosis between open source communities their commercial sponsors. Many of these companies have nurtured a lot of goodwill with the community and built successful businesses around enterprise customers. Once they're entrenched in the enterprise software business, there is value to be had by cashing in that goodwill and maximizing shareholder value. Even if their current leadership is unwilling to move in this direction, there are plenty of existing enterprise computing companies (e.g. IBM) and private equity firms who will.

mindslight 3y ago

This idea isn't new. Does nobody remember Sveasoft? They tried this with regards to alternative WRT54G firmware, back when that was a thing. They ended up failing in the market, to the point that seemingly nobody even remembers the attempt. Redhat seems to be betting on their size for their staying power. But that size also means there is much more demand for third parties to route around their attempt at creating an inefficient market speedbump. For example, that proposed solution of subscribing to Redhat through a cloud provider, then distributing the source code seems quite straightforward. If they tighten up on that, it would only seem to take a handful of small subscribers comparing the source code they receive to make sure there is no steganographic watermark, and then distributing source through an unrelated entity without fear of reprisal. I'm sure they will succeed at creating some level of speed bump for companies that want things to just work, but I'd say that ultimately this is just going to lead to another cycle of users moving to the new libre thing, and then Redhat needing to pay to reacquire those customers later.

fatfingerd 3y ago

How does one adjust an open source license to make RedHat's redistribution illegal without interfering with distributions that follow the GPL intent?

fragmede 3y ago

Where is Oracle in all this? Oracle Linux is a RedHat clone and they sell support contacts and everything that businesses like.

dsr_ 3y ago

GPL v2 part 6: > You may not impose any further restrictions on the recipients' exercise of the rights granted herein. I think it can be reasonably argued that a contract designed to defeat the intent of the license is "a further restriction". The correct remedy is not to require Red Hat to restore their former client's contract. The correct remedy is that Red Hat, and thus IBM, is no longer licensed to use GPL v2 software.

nocoiner 3y ago
OK. Let’s say Red Hat Linux Distributors Inc. is the software licensor. And Red Hat Support LLC is the support provider. RHLDI distributes software (and source) in compliance with GPLv2. RHSLLC has a provision in its contract that a support customer may not re-distribute any source that it receives from RHLDI. Where’s the breach of the GPL? The reference to “You” in that instance, about not being able to impose additional restrictions, would have to be give additional words and meaning not present in the contract for that line to mean what you say it means. If that’s what the license is supposed to prevent, it really needs to be written in a way that clearly addresses this fact pattern.
- dsr_ 3y ago
  No, you're missing the point. The Linux Kernel is the big GPL v2 fish. It's not a Red Hat licensing to Red Hat situation.

kazinator 3y ago

There is no circumvention of the GPL going on, or any loophole in the license being exploited. It's basically "I'm only going to be your friend and provide you with free software with my cool and useful modifications if you don't redistribute it to your other friends. (Which you're allowed to do, but I just won't be your if I catch you doing that, and won't give you any more)." There isn't anything the GPL can do about that, without becoming a crazy non-free license. It's entirely out of its scope. The behavior doesn't step on any user rights, because: 1. It doesn't remove their rights to what they already have (software they have downloaded under the Subscription Agreement). 2. Users do not have a right to enter into or remain in a Subscription Agreement with Red Hat; there is no such right. 3. People have a right to refuse to redistribute something. If you have some GPLed program I want, and I ask for it, you can say no. If you say yes to giving me binaries, then you can't say no to giving the source (for just that specific version of those binaries and nothing more). 4. People have access to the original software; they can make their own distribution from scratch to compete with Red Hat. There is no intent in the GPL whatsoever to prevent Red Hat's behavior; there is no wording that could even remotely have that interpretation. The person who came up with the license probably disagrees with the behavior, but he didn't put anything in the license to prevent it and probably wouldn't find it a good idea to try to use a copyright license to try to do that.