11 ms·

Will the new judicial ruling in the Vizio lawsuit strengthen the GPL?

233 points by sillystuff 3y ago

seabass-labrax 3y ago
I'm usually rather scathing of test cases, because they allow more affluent parties to exert undue influence on legal precedent. However, in this scenario I have nothing but congratulations to offer to the Software Freedom Conservancy: they took on a party several times their size, seeking resolution of a clear-cut GPL violation, and - most importantly - in a way that seems to me entirely compatible with the spirit of the GPL. If one reads the articles written by the progenital big cheeses of the early Free Software Foundation (such figures as Richard Stallman, Eben Moglen and even Bradley Kuhn of the SFC himself), it's clear both from the legalese and the marketing slogans that user empowerment was the intention. Those old articles don't give me the impression that enforcement the GPL was ever supposed to be a privilege limited to the software author, even if this was the most conventional situation for copyright infringement cases and thus the only legally viable action. I'd posit that the SFC are being lenient, even generous with their legal action against Vizio. Suing to enforce the GPL 3.0 rather than version 2.0 would have been slightly more so, considering the "cure within 30 days" provision introduced in the GPL 3.0 family. But that is all but irrelevant considering Vizio's long-standing disregard for copyleft license compliance.
- bonzini 3y ago
  They can't sue to enforce GPLv3, because Linux isn't under a "GPLv2 or later" license. However, Conservancy established "Principles of Community-oriented Enforcement" (https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...), and these include extending the 30 days provision to GPLv2-only works. This is a concession by Conservancy and not a requirement of the license, but it's a part of the Principles that has been widely lauded and adopted by others including Red Hat (https://www.redhat.com/en/about/gplv3-enforcement-statement https://www.redhat.com/en/about/gplv3-enforcement-statement).
  - richardfontana 3y ago
    The lawsuit does not ask for source code solely for the kernel, but also for several userspace components under GPLv2 and LGPLv2.1 (at least some of which are at least in large part under "or-later" licensing). They don't recite any noncompliance wrt any *GPLv3 components, perhaps (though I'm just guessing) because Vizio doesn't include any in their TVs.
    - bonzini 3y ago
      > also for several userspace components True, though from the filing it's clear that Linux is the most interesting to them (it's the only one that is described separately, in paragraphs 41-45 of the complaint).
dang 3y ago
See also https://social.coop/@luis_in_brief/111766701183578447 https://social.coop/@luis_in_brief/111766701183578447 (via https://news.ycombinator.com/item?id=39077286 https://news.ycombinator.com/item?id=39077286), but we merged that thread hither.
andy99 3y ago
So there have been discussions about how AI model weights may not be copyrightable because they are computer generated. Personally I disagree but there is not a clear court ruling yet and we'll have to see. Nevertheless, practically all weights of any significance get released under various software-like licenses, either open source like Apache 2.0 or other more restrictive ones. I wonder would this ruling be relevant to these AI weight licenses being enforceable as contracts, even if the weights cannot be copyrighted? If so, would it only work if the license actually conferred some benefit like with GPL? Any ideas?
- ronsor 3y ago
  A contract without consideration is no contract at all, and without the ability to offer a copyright license, what sort of consideration is left?
  - andy99 3y ago
    Isn't the consideration the use of the software (or model in my example)?
    - zarzavat 3y ago
      But you were already allowed to do that, if we suppose that model weights are not copyrightable.
alexchamberlain 3y ago
I'd like to preface this comment with the fact I support what the SFC is trying to do here: if you're using GPL software, you have to publish the modifications. It's pretty simple... That being said, and please correct me if this doesn't exist in the US/US-CA, have they risked a malicious intent argument here? Did they go out and buy the TV with the sole intent of baiting Visio into an argument?
- wmf 3y ago
  AFAIK people have bought stuff specifically to hang lawsuits on for decades. If that was somehow improper I'd think there would be precedent against it by now.
- gumby 3y ago
  > if you're using GPL software, you have to publish the modifications. It's pretty simple... If you redistribute GPLed binaries you have to be willing to provide the source that built that binary, whether it incorporated changes or not, to anyone who asks. “Provide” can include pointing someone at a public repo these days.
  - Lt_Riza_Hawkeye 3y ago
    I believe it only has to be provided to recipients of the binaries, so you can still charge money for linux modifications, such as grsec.
  - Someone 3y ago
    I don’t think it necessarily is “to anyone who asks”. https://www.gnu.org/licenses/gpl-3.0.html#license-text https://www.gnu.org/licenses/gpl-3.0.html#license-text, article 6a: “a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.” Assuming any “durable physical medium customarily used for software interchange” still exists, that means that, if you choose to ship your software on CD you have to give the source to whomever you distribute the binary, but need not make the source code available to others. If, instead, you go for the distribution method of article 6b, you do have to make the source code available to anyone who possesses the object code, but not indefinitely: “b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.” So, if you distribute the binary in a “physical distribution medium”, and then immediately claim to stop supporting that product, I think you’re off the hook if nobody asks for the source code for 3 years. Also, should that “(including a physical distribution medium)” have been there in that article in the license? It means you can sell a CD with your software, immediately stop supporting that CD, and get of the hook in 3years time.
hamilyon2 3y ago
I think it may matter in specifics of how Red Hat chose to implement GPL compliance recently. This means that even non-clients of Red Hat can ask for copy of source code as long as they have binaries. And you should definitely have right to give away binaries without asking Red Hat for permission.
- bonzini 3y ago
  > you should definitely have right to give away binaries without asking Red Hat for permission. You do, and you have to provide sources in that case. But, Red Hat can choose to stop doing business with you if you give away binaries for reasons that they judge to be against their interest. They aren't forced to accept your money.
  - AnthonyMouse 3y ago
    How would they even know who it is? Alice is a Red Hat customer, gives binaries and sources to Bob in private, now Bob publishes them on the internet for the world without telling anyone it was Alice he got them from. "Tell us who it was so we can retaliate against them for exercising their rights under the license" doesn't seem like a good faith request.
    - trimistermota 3y ago
      Nobody's going to use untrusted binaries/sources in this age of supply chain security..
      - AnthonyMouse 3y ago
        Anybody can diff the sources against upstream if they want to. But also, how does that even mean anything? Bob submitted a patch to the mainline Linux kernel which Red Hat forked which Alice downloaded which Bob uploaded and now you're trusting Bob that the code is safe, which you were already doing anyway unless you were comparing the changes to the code yourself, which you can still do.
      - 3y ago
pwarner 3y ago
What's the benefit to Vizio in withhold the source? Wouldn't all their interesting custom code be outside the scope of the GPL?
- bayindirh 3y ago
  Maybe they have written some kernel modules which claim to be GPL licensed to be able to access all kernel APIs unimpeded? So it’s their interesting code infringing GPL. Maybe they modified tools, kernel or some GPL licensed tool to work with their hardware, and don’t want to spill the beans? Possibilities are endless.
  - bornfreddy 3y ago
    Or drivers, possibly for devices / modules for which they are not at liberty to share the details (NDA). Either way, such hiding should stop. There is no reason I should not be able to repair / upgrade / change the TV I bought however I wish, as long as I'm not harming others (RF). Even then, this should be my responsability.
  - gary_0 3y ago
    Maybe their engineers were lazy or rushed by management, and didn't keep things organized, so GPL code, proprietary/internal code, potentially-patent-violating hardware documentation, and secret keys all got munged together, and they figured it would be cheaper to fight a lawsuit than to carefully untangle the terabytes of junk so they can hand over the relevant code without having their digital asses hanging out. The possibilities are indeed endless.
- bluGill 3y ago
  It would cost them millons to find and package everything. This is assuming they have everything in source control and have nothing to hide (that is no code that isn't public anyway) sure you can do a git to tar.gz easy, but GNU is likely to demand the hash everything was built from which means people need to figure that out. if they have a monorepo with non GPL code (which doesn't link to anything GPL) stripping it all out will cost a lot more.
kurts_mustache 3y ago
I know they don't rely on GPL much, but what does the ruling here suggest for OSS foundations like Apache and CNCF? Specifically this part: only the author can initiate the lawsuit. Does that mean failure to adhere to the terms of licenses like ASLv2 or MIT would could only be settled in court if the person who wrote the code actually bring suit and that OSS foundations basically become (more) toothless?
- 8note 3y ago
  The impacts of the case are only to keep the status quo, or to extend who can bring a case. Apache can have enforcement rights to a project if you as an author gift them the copyright over one of the commits
- GrilledChips 3y ago
  The reasoning of this case rests on the intentions of the FSF when they wrote the licence. If the person who wrote the licence didn't intend you to be able to get benefits, you can't.
  - NoZebra120vClip 3y ago
    > The reasoning of this case rests on the intentions of the FSF when they wrote the licence. If the person who wrote the licence didn't intend you to be able to get benefits, you can't. I contend that it does not. It doesn't matter who wrote a license, it only matters who adopted that license when they authored a work. The Conservancy is doing license enforcement on behalf of numerous authors and vendors of code, not authors of licenses such as the FSF or Creative Commons. When I create a distribution of code and copy a LICENSE file into it, I take responsibility for the wording of that license. I don't foist that onto the FSF or MIT or BSD. I take responsibility for the wording, whether it is boilerplate or if I modify it after the fact.
    - ufocia 3y ago
      The conservancy is not enforcing the license nor are they representing the copyright holders in this case. The conservancy is representing itself as a 3rd party beneficiary to an alleged contact. It does matter who wrote the document, but not in the way the poster suggested. One of the arguments made in the case so far was that the FSF's view of the document should be considered, but FSF is not a party in this suit most likely intentionally.
deleted 3y ago
[deleted]
Octokiddie 3y ago
> In October of 2021 the Software Freedom Conservancy (SFC) decided to launch what is believed to be the first significant open source lawsuit based in contract rather than in copyright. Critically, the SFC’s case argued that anyone who benefits from the General Public License (GPL), not just the authors of the software, should be able to bring a lawsuit to enforce the terms of the GPL. This seems to be the key issue. It's the first time I've heard of a case in which the party claiming harm was not the author of the software. It raises a lot of questions - for example around linking. My understanding of the issue with respect to Linux was that Linus won't enforce GPL against those who link, therefore, Linux is immune to the reciprocity requirement when just linking occurs. This new case seems to raise the issue of whether those other than authors of GPL software can bring suit under contract rather than copyright for linking to GPL-licensed software.
- dagmx 3y ago
  Afaik this case isn’t about linked libs. It’s that the Vizio devices ship with Linux but don’t provide sources. In theory they don’t need to provide sources to any of their libraries that link against Linux as Linux licenses glibc as LGPL. But they do need to provide the Linux core that they use along with any modifications.
  - cjbprime 3y ago
    AIUI: This case isn't about kernel modules, but it re-opens the question of what to do about closed-source kernel modules, because the status quo is "Linus doesn't want to sue people even though closed-source kernel modules might be illegal", and now you don't have to be Linus to sue people anymore.
- matheusmoreira 3y ago
  Linus Torvalds enjoys an incredibly good negotiating position relative to these corporations. Simply put, he's got massive leverage in the form of Linux's staggering development speed: he gets like a zillion patches an hour. He maximizes that leverage by purposefully keeping the kernel APIs and ABIs unstable so they can't reliably target it without mainlining their drivers as GPL code in the kernel tree. Corporations modifying Linux have the choice of playing ball and publishing source code or being forced to play catch up with the constantly changing kernel until the end of time which is obviously unsustainable and ends with them getting left behind and eating dust. This manifests as shitty products which run outdated tainted kernels and never get updated. That's what leads Linus to be "lenient" towards these corporations and their violations. He thinks their products are mere toys that don't matter in the grand scheme of things. I remember reading an email on LWN where he used that exact word to describe them. Toys. Obviously, as the users of these shitty products, we think differently. We'd very much enjoy it if some courts were to force these corporations to publish their source code under the GPL. Then we'd be able to have actual quality drivers instead of their proprietary nonsense, and we'd be able to run the latest mainline kernel on our devices.
torstenvl 3y ago
> This is because, under a doctrine known as preemption, state courts generally cannot rule on questions of federal law, like copyright. This is too broad and in need of slight correction. By default, state courts have jurisdiction to hear cases under federal law, unless indicated otherwise "by an explicit statutory directive, by unmistakable implication from legislative history, or by a clear incompatibility between state-court jurisdiction and federal interests." Gulf Shore Co. v. Mobil Oil Corp., 453 U.S. 473, 478 (1981). In this case, the author is correct, because copyright—like bankruptcy—is a matter of exclusive federal jurisdiction. However, extrapolating that "generally" to all "questions of federal law" is not accurate.
chris_wot 3y ago
It's funny - Vizio saves a ton of money by using all this GPL-licensed and free-as-in-money software, and yet they cannot even comply with the license requirements of the people who saved them all this money?
- wmf 3y ago
  Like every embedded vendor, they have a decade of technical debt so it will take them a person-year to untangle their build system just to get to the point where they even know what dependencies they have. Then they can start on the license audit.
  - deleted 3y ago
    [deleted]
  - chris_wot 3y ago
    Sucks to be them, I guess.
internetter 3y ago
I just want to reiterate the point in the article that this is very much a David vs Goliath situation. If you value free software, please consider donating to the SFC here: https://sfconservancy.org/donate/ https://sfconservancy.org/donate/
- filoeleven 3y ago
  Devil’s advocate: Isn’t the whole point of being bound by the Rule of Law to eliminate this kind of David and Goliath situation? If I’m mistaken in this assumption, please tell me why. If I’m correct in this assumption, where has the system been corrupted in this case? (End Devil’s advocate. Seriously interested in where things went wrong, because if this is being raised as a question instead of reported as a clear outcome, something’s gone wrong.)
  - tgsovlerkhgsel 3y ago
    The goal of the Rule of Law is to reduce this problem, but it hasn't succeeded at eliminating it (and never will). It's exceptionally hard to design a society so that someone with more resources doesn't have an advantage over someone with fewer resources, without massive restrictions on freedom.
  - internetter 3y ago
    In theory, sure, in practice, when you have hundreds or thousands of times more resources than someone else, you are at an advantage. That's one of the many reasons why minorities are incarcerated at high rates (and why nobody uses public defense if they can afford private), and why organizations like the ACLU & SPLC exist. That's why we see cases like Gary Bowser (nintendo mod chip seller) being fined 15 million dollars in egregious violations of justice. Sometimes, people cannot even afford to fight, like when apple brought a lawsuit against a coffee shop with an apple logo (actually, in this case the coffee shop did win, but you can see how many times when apple sues you you just decide to go huh ok you win apple). Indeed, it's a very common tactic: stall until the opponent runs out of funding. That's even before you begin to consider things like bail and bribes (e.g. Clarance Thomas). And sure, not much of this applies directly to this case, but you can clearly see how money helps win court cases, even if you just consider the hundreds more eyes searching for loopholes.
pnw 3y ago
The article claims "The limitations on financial claims will (probably) not make this a lucrative line of mass litigation." I wonder how true that is given how lawyers have leveraged laws like patent, ADA etc into lucrative mass litigation?
- trimistermota 3y ago
  GPL has implicit patent license.
tgsovlerkhgsel 3y ago
This will (if it goes the way the SFC wants) definitely make the GPL stronger. However, I'm worried whether this might make it so strong that companies start considering GPL-licensed content toxic. Historically, the risk of actual, serious consequences from accidentally or negligently (and perhaps even intentionally) violating the GPL was effectively zero. The range of people who could sue you was limited and outside of a few projects, most never did. With this, you'd have to dot your i's and cross your t's on GPL compliance, because if you got any detail wrong, random customers could start hitting you with lawsuits. (Which I'd expect to have some potentially catastrophic worst-case outcomes if they bundled third-party code under a closed license, i.e. which they cannot release under GPL, with GPL code.) In fact, it seems like something similar happened around GPL enforcement through BusyBox: https://lwn.net/Articles/478361/ https://lwn.net/Articles/478361/ Best case, since there is so much hard-to-avoid GPL code (including the Linux kernel), we'll see much better compliance and code availability, especially around embedded devices. Worst case, we get a new class of patent-troll style parasites that use the legal system to terrorize, extort and/or bankrupt anyone who distributes anything that touched GPL software.
- nagisa 3y ago
  > However, I'm worried whether this might make it so strong that companies start considering GPL-licensed content toxic. Why is that a problem? Many already do consider anything involving the three letters (even if there’s an A preceding them) toxic and its their problem to think through it. Nobody is forcing them to include GPL code into their products, so if they think choosing alternatives is more profitable then all the power to them.
  - tgsovlerkhgsel 3y ago
    > Why is that a problem? Because that has the risk to move the world away from open source and more towards closed source.
    - elteto 3y ago
      Without GPL enforcement you end up with closed source too: they take it, modify it, and don’t distribute their changes. Fuck them. If they want to get freebies then they have to share. If not they are welcome to write their own from scratch.
pjmlp 3y ago
If anything it will strengthen the opposition to GPL and push even more for non-copyleft licenses in big corps. See the OS FOSS for IoT, none of them is GPL, including ironically sponsored Linux Foundation's Zephyr.
- ufocia 3y ago
  Not sure about the effect on big corps. There are many variables to consider. In any case, the suit is very young and non-precedential at this point. How it will ultimately turn out is extremely speculative. GPL is more challenging in general in embedded and thus much of IoT.

233 points by sillystuff 3y ago

I'm usually rather scathing of test cases, because they allow more affluent parties to exert undue influence on legal precedent. However, in this scenario I have nothing but congratulations to offer to the Software Freedom Conservancy: they took on a party several times their size, seeking resolution of a clear-cut GPL violation, and - most importantly - in a way that seems to me entirely compatible with the spirit of the GPL. If one reads the articles written by the progenital big cheeses of the early Free Software Foundation (such figures as Richard Stallman, Eben Moglen and even Bradley Kuhn of the SFC himself), it's clear both from the legalese and the marketing slogans that user empowerment was the intention. Those old articles don't give me the impression that enforcement the GPL was ever supposed to be a privilege limited to the software author, even if this was the most conventional situation for copyright infringement cases and thus the only legally viable action. I'd posit that the SFC are being lenient, even generous with their legal action against Vizio. Suing to enforce the GPL 3.0 rather than version 2.0 would have been slightly more so, considering the "cure within 30 days" provision introduced in the GPL 3.0 family. But that is all but irrelevant considering Vizio's long-standing disregard for copyleft license compliance.

bonzini 3y ago
They can't sue to enforce GPLv3, because Linux isn't under a "GPLv2 or later" license. However, Conservancy established "Principles of Community-oriented Enforcement" (https://sfconservancy.org/copyleft-compliance/principles.html https://sfconservancy.org/copyleft-compliance/principles.htm...), and these include extending the 30 days provision to GPLv2-only works. This is a concession by Conservancy and not a requirement of the license, but it's a part of the Principles that has been widely lauded and adopted by others including Red Hat (https://www.redhat.com/en/about/gplv3-enforcement-statement https://www.redhat.com/en/about/gplv3-enforcement-statement).
- richardfontana 3y ago
  The lawsuit does not ask for source code solely for the kernel, but also for several userspace components under GPLv2 and LGPLv2.1 (at least some of which are at least in large part under "or-later" licensing). They don't recite any noncompliance wrt any *GPLv3 components, perhaps (though I'm just guessing) because Vizio doesn't include any in their TVs.
  - bonzini 3y ago
    > also for several userspace components True, though from the filing it's clear that Linux is the most interesting to them (it's the only one that is described separately, in paragraphs 41-45 of the complaint).

dang 3y ago

See also https://social.coop/@luis_in_brief/111766701183578447 https://social.coop/@luis_in_brief/111766701183578447 (via https://news.ycombinator.com/item?id=39077286 https://news.ycombinator.com/item?id=39077286), but we merged that thread hither.

andy99 3y ago

So there have been discussions about how AI model weights may not be copyrightable because they are computer generated. Personally I disagree but there is not a clear court ruling yet and we'll have to see. Nevertheless, practically all weights of any significance get released under various software-like licenses, either open source like Apache 2.0 or other more restrictive ones. I wonder would this ruling be relevant to these AI weight licenses being enforceable as contracts, even if the weights cannot be copyrighted? If so, would it only work if the license actually conferred some benefit like with GPL? Any ideas?

ronsor 3y ago
A contract without consideration is no contract at all, and without the ability to offer a copyright license, what sort of consideration is left?
- andy99 3y ago
  Isn't the consideration the use of the software (or model in my example)?
  - zarzavat 3y ago
    But you were already allowed to do that, if we suppose that model weights are not copyrightable.

alexchamberlain 3y ago

I'd like to preface this comment with the fact I support what the SFC is trying to do here: if you're using GPL software, you have to publish the modifications. It's pretty simple... That being said, and please correct me if this doesn't exist in the US/US-CA, have they risked a malicious intent argument here? Did they go out and buy the TV with the sole intent of baiting Visio into an argument?

wmf 3y ago
AFAIK people have bought stuff specifically to hang lawsuits on for decades. If that was somehow improper I'd think there would be precedent against it by now.
gumby 3y ago
> if you're using GPL software, you have to publish the modifications. It's pretty simple... If you redistribute GPLed binaries you have to be willing to provide the source that built that binary, whether it incorporated changes or not, to anyone who asks. “Provide” can include pointing someone at a public repo these days.
- Lt_Riza_Hawkeye 3y ago
  I believe it only has to be provided to recipients of the binaries, so you can still charge money for linux modifications, such as grsec.
- Someone 3y ago
  I don’t think it necessarily is “to anyone who asks”. https://www.gnu.org/licenses/gpl-3.0.html#license-text https://www.gnu.org/licenses/gpl-3.0.html#license-text, article 6a: “a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.” Assuming any “durable physical medium customarily used for software interchange” still exists, that means that, if you choose to ship your software on CD you have to give the source to whomever you distribute the binary, but need not make the source code available to others. If, instead, you go for the distribution method of article 6b, you do have to make the source code available to anyone who possesses the object code, but not indefinitely: “b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.” So, if you distribute the binary in a “physical distribution medium”, and then immediately claim to stop supporting that product, I think you’re off the hook if nobody asks for the source code for 3 years. Also, should that “(including a physical distribution medium)” have been there in that article in the license? It means you can sell a CD with your software, immediately stop supporting that CD, and get of the hook in 3years time.

hamilyon2 3y ago

I think it may matter in specifics of how Red Hat chose to implement GPL compliance recently. This means that even non-clients of Red Hat can ask for copy of source code as long as they have binaries. And you should definitely have right to give away binaries without asking Red Hat for permission.

bonzini 3y ago
> you should definitely have right to give away binaries without asking Red Hat for permission. You do, and you have to provide sources in that case. But, Red Hat can choose to stop doing business with you if you give away binaries for reasons that they judge to be against their interest. They aren't forced to accept your money.
- AnthonyMouse 3y ago
  How would they even know who it is? Alice is a Red Hat customer, gives binaries and sources to Bob in private, now Bob publishes them on the internet for the world without telling anyone it was Alice he got them from. "Tell us who it was so we can retaliate against them for exercising their rights under the license" doesn't seem like a good faith request.
  - trimistermota 3y ago
    Nobody's going to use untrusted binaries/sources in this age of supply chain security..
    - AnthonyMouse 3y ago
      Anybody can diff the sources against upstream if they want to. But also, how does that even mean anything? Bob submitted a patch to the mainline Linux kernel which Red Hat forked which Alice downloaded which Bob uploaded and now you're trusting Bob that the code is safe, which you were already doing anyway unless you were comparing the changes to the code yourself, which you can still do.
    - 3y ago

pwarner 3y ago

What's the benefit to Vizio in withhold the source? Wouldn't all their interesting custom code be outside the scope of the GPL?

bayindirh 3y ago
Maybe they have written some kernel modules which claim to be GPL licensed to be able to access all kernel APIs unimpeded? So it’s their interesting code infringing GPL. Maybe they modified tools, kernel or some GPL licensed tool to work with their hardware, and don’t want to spill the beans? Possibilities are endless.
- bornfreddy 3y ago
  Or drivers, possibly for devices / modules for which they are not at liberty to share the details (NDA). Either way, such hiding should stop. There is no reason I should not be able to repair / upgrade / change the TV I bought however I wish, as long as I'm not harming others (RF). Even then, this should be my responsability.
- gary_0 3y ago
  Maybe their engineers were lazy or rushed by management, and didn't keep things organized, so GPL code, proprietary/internal code, potentially-patent-violating hardware documentation, and secret keys all got munged together, and they figured it would be cheaper to fight a lawsuit than to carefully untangle the terabytes of junk so they can hand over the relevant code without having their digital asses hanging out. The possibilities are indeed endless.
bluGill 3y ago
It would cost them millons to find and package everything. This is assuming they have everything in source control and have nothing to hide (that is no code that isn't public anyway) sure you can do a git to tar.gz easy, but GNU is likely to demand the hash everything was built from which means people need to figure that out. if they have a monorepo with non GPL code (which doesn't link to anything GPL) stripping it all out will cost a lot more.

kurts_mustache 3y ago

I know they don't rely on GPL much, but what does the ruling here suggest for OSS foundations like Apache and CNCF? Specifically this part: only the author can initiate the lawsuit. Does that mean failure to adhere to the terms of licenses like ASLv2 or MIT would could only be settled in court if the person who wrote the code actually bring suit and that OSS foundations basically become (more) toothless?

8note 3y ago
The impacts of the case are only to keep the status quo, or to extend who can bring a case. Apache can have enforcement rights to a project if you as an author gift them the copyright over one of the commits
GrilledChips 3y ago
The reasoning of this case rests on the intentions of the FSF when they wrote the licence. If the person who wrote the licence didn't intend you to be able to get benefits, you can't.
- NoZebra120vClip 3y ago
  > The reasoning of this case rests on the intentions of the FSF when they wrote the licence. If the person who wrote the licence didn't intend you to be able to get benefits, you can't. I contend that it does not. It doesn't matter who wrote a license, it only matters who adopted that license when they authored a work. The Conservancy is doing license enforcement on behalf of numerous authors and vendors of code, not authors of licenses such as the FSF or Creative Commons. When I create a distribution of code and copy a LICENSE file into it, I take responsibility for the wording of that license. I don't foist that onto the FSF or MIT or BSD. I take responsibility for the wording, whether it is boilerplate or if I modify it after the fact.
  - ufocia 3y ago
    The conservancy is not enforcing the license nor are they representing the copyright holders in this case. The conservancy is representing itself as a 3rd party beneficiary to an alleged contact. It does matter who wrote the document, but not in the way the poster suggested. One of the arguments made in the case so far was that the FSF's view of the document should be considered, but FSF is not a party in this suit most likely intentionally.

deleted 3y ago

[deleted]

Octokiddie 3y ago

> In October of 2021 the Software Freedom Conservancy (SFC) decided to launch what is believed to be the first significant open source lawsuit based in contract rather than in copyright. Critically, the SFC’s case argued that anyone who benefits from the General Public License (GPL), not just the authors of the software, should be able to bring a lawsuit to enforce the terms of the GPL. This seems to be the key issue. It's the first time I've heard of a case in which the party claiming harm was not the author of the software. It raises a lot of questions - for example around linking. My understanding of the issue with respect to Linux was that Linus won't enforce GPL against those who link, therefore, Linux is immune to the reciprocity requirement when just linking occurs. This new case seems to raise the issue of whether those other than authors of GPL software can bring suit under contract rather than copyright for linking to GPL-licensed software.

dagmx 3y ago
Afaik this case isn’t about linked libs. It’s that the Vizio devices ship with Linux but don’t provide sources. In theory they don’t need to provide sources to any of their libraries that link against Linux as Linux licenses glibc as LGPL. But they do need to provide the Linux core that they use along with any modifications.
- cjbprime 3y ago
  AIUI: This case isn't about kernel modules, but it re-opens the question of what to do about closed-source kernel modules, because the status quo is "Linus doesn't want to sue people even though closed-source kernel modules might be illegal", and now you don't have to be Linus to sue people anymore.
matheusmoreira 3y ago
Linus Torvalds enjoys an incredibly good negotiating position relative to these corporations. Simply put, he's got massive leverage in the form of Linux's staggering development speed: he gets like a zillion patches an hour. He maximizes that leverage by purposefully keeping the kernel APIs and ABIs unstable so they can't reliably target it without mainlining their drivers as GPL code in the kernel tree. Corporations modifying Linux have the choice of playing ball and publishing source code or being forced to play catch up with the constantly changing kernel until the end of time which is obviously unsustainable and ends with them getting left behind and eating dust. This manifests as shitty products which run outdated tainted kernels and never get updated. That's what leads Linus to be "lenient" towards these corporations and their violations. He thinks their products are mere toys that don't matter in the grand scheme of things. I remember reading an email on LWN where he used that exact word to describe them. Toys. Obviously, as the users of these shitty products, we think differently. We'd very much enjoy it if some courts were to force these corporations to publish their source code under the GPL. Then we'd be able to have actual quality drivers instead of their proprietary nonsense, and we'd be able to run the latest mainline kernel on our devices.

torstenvl 3y ago

> This is because, under a doctrine known as preemption, state courts generally cannot rule on questions of federal law, like copyright. This is too broad and in need of slight correction. By default, state courts have jurisdiction to hear cases under federal law, unless indicated otherwise "by an explicit statutory directive, by unmistakable implication from legislative history, or by a clear incompatibility between state-court jurisdiction and federal interests." Gulf Shore Co. v. Mobil Oil Corp., 453 U.S. 473, 478 (1981). In this case, the author is correct, because copyright—like bankruptcy—is a matter of exclusive federal jurisdiction. However, extrapolating that "generally" to all "questions of federal law" is not accurate.

chris_wot 3y ago

It's funny - Vizio saves a ton of money by using all this GPL-licensed and free-as-in-money software, and yet they cannot even comply with the license requirements of the people who saved them all this money?

wmf 3y ago
Like every embedded vendor, they have a decade of technical debt so it will take them a person-year to untangle their build system just to get to the point where they even know what dependencies they have. Then they can start on the license audit.
- deleted 3y ago
  [deleted]
- chris_wot 3y ago
  Sucks to be them, I guess.

internetter 3y ago

I just want to reiterate the point in the article that this is very much a David vs Goliath situation. If you value free software, please consider donating to the SFC here: https://sfconservancy.org/donate/ https://sfconservancy.org/donate/

filoeleven 3y ago
Devil’s advocate: Isn’t the whole point of being bound by the Rule of Law to eliminate this kind of David and Goliath situation? If I’m mistaken in this assumption, please tell me why. If I’m correct in this assumption, where has the system been corrupted in this case? (End Devil’s advocate. Seriously interested in where things went wrong, because if this is being raised as a question instead of reported as a clear outcome, something’s gone wrong.)
- tgsovlerkhgsel 3y ago
  The goal of the Rule of Law is to reduce this problem, but it hasn't succeeded at eliminating it (and never will). It's exceptionally hard to design a society so that someone with more resources doesn't have an advantage over someone with fewer resources, without massive restrictions on freedom.
- internetter 3y ago
  In theory, sure, in practice, when you have hundreds or thousands of times more resources than someone else, you are at an advantage. That's one of the many reasons why minorities are incarcerated at high rates (and why nobody uses public defense if they can afford private), and why organizations like the ACLU & SPLC exist. That's why we see cases like Gary Bowser (nintendo mod chip seller) being fined 15 million dollars in egregious violations of justice. Sometimes, people cannot even afford to fight, like when apple brought a lawsuit against a coffee shop with an apple logo (actually, in this case the coffee shop did win, but you can see how many times when apple sues you you just decide to go huh ok you win apple). Indeed, it's a very common tactic: stall until the opponent runs out of funding. That's even before you begin to consider things like bail and bribes (e.g. Clarance Thomas). And sure, not much of this applies directly to this case, but you can clearly see how money helps win court cases, even if you just consider the hundreds more eyes searching for loopholes.

pnw 3y ago

The article claims "The limitations on financial claims will (probably) not make this a lucrative line of mass litigation." I wonder how true that is given how lawyers have leveraged laws like patent, ADA etc into lucrative mass litigation?

trimistermota 3y ago
GPL has implicit patent license.

tgsovlerkhgsel 3y ago

This will (if it goes the way the SFC wants) definitely make the GPL stronger. However, I'm worried whether this might make it so strong that companies start considering GPL-licensed content toxic. Historically, the risk of actual, serious consequences from accidentally or negligently (and perhaps even intentionally) violating the GPL was effectively zero. The range of people who could sue you was limited and outside of a few projects, most never did. With this, you'd have to dot your i's and cross your t's on GPL compliance, because if you got any detail wrong, random customers could start hitting you with lawsuits. (Which I'd expect to have some potentially catastrophic worst-case outcomes if they bundled third-party code under a closed license, i.e. which they cannot release under GPL, with GPL code.) In fact, it seems like something similar happened around GPL enforcement through BusyBox: https://lwn.net/Articles/478361/ https://lwn.net/Articles/478361/ Best case, since there is so much hard-to-avoid GPL code (including the Linux kernel), we'll see much better compliance and code availability, especially around embedded devices. Worst case, we get a new class of patent-troll style parasites that use the legal system to terrorize, extort and/or bankrupt anyone who distributes anything that touched GPL software.

nagisa 3y ago
> However, I'm worried whether this might make it so strong that companies start considering GPL-licensed content toxic. Why is that a problem? Many already do consider anything involving the three letters (even if there’s an A preceding them) toxic and its their problem to think through it. Nobody is forcing them to include GPL code into their products, so if they think choosing alternatives is more profitable then all the power to them.
- tgsovlerkhgsel 3y ago
  > Why is that a problem? Because that has the risk to move the world away from open source and more towards closed source.
  - elteto 3y ago
    Without GPL enforcement you end up with closed source too: they take it, modify it, and don’t distribute their changes. Fuck them. If they want to get freebies then they have to share. If not they are welcome to write their own from scratch.

pjmlp 3y ago

If anything it will strengthen the opposition to GPL and push even more for non-copyleft licenses in big corps. See the OS FOSS for IoT, none of them is GPL, including ironically sponsored Linux Foundation's Zephyr.

ufocia 3y ago
Not sure about the effect on big corps. There are many variables to consider. In any case, the suit is very young and non-precedential at this point. How it will ultimately turn out is extremely speculative. GPL is more challenging in general in embedded and thus much of IoT.