10 ms·

I’m glad there’s finally some cases setting precedent for the GPL. I am personally not a fan of GPL family licenses BUT I am sick of fellow OSS developers who

by dagmx 3y ago

I’m glad there’s finally some cases setting precedent for the GPL. I am personally not a fan of GPL family licenses BUT I am sick of fellow OSS developers who keep telling me not to worry about the minutiae of the license. (Usually some form of “Oh don’t worry because we aren’t litigious right now, as long as you stick with our incorrect interpretation of the license”) My team is responsible for a lot of corporate contributions to open source (some GPL) and I have to pay extra attention to the license terms as a result. There’s a lot of GPL software that operates in the grey (and many OSS devs who don’t understand their license choices), and I very much like my licenses to be as black and white as possible so I can avoid any risk. Having legal precedence to point to will help make concerns concrete.

Semaphor 3y ago
> There’s a lot of GPL software that operates in the grey (and many OSS devs who don’t understand their license choices), Do you have examples? What kinds of misunderstanding are there? And what gets clarified by this case that wasn’t clear before?
- dagmx 3y ago
  I can’t give specific examples without calling out some projects. But usually it’s a misunderstanding of what derivative works are. E.g building an extension to a GPL app. Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL. Or things like what constitutes distribution. E.g employees vs contractors vs third party collaborators etc… But when I have to deal with said project owners, they bring up that the GPL is about the spirit of the license, not the exact words. They often say not to worry about litigation. This case doesn’t specifically clarify those terms but it does highlight that GPL violation is a serious issue that can’t just be treated as a suggestion. That any lawsuit has taken place and won means that 1. I can point to cases where the license choice is impactful when working with existing projects or when setting up new OSS projects in my industry 2. It also means that the license proponents may feel more empowered (as they should) to take action against infringement. Basically, very few people take software licenses as seriously as they should. Cases like these help make them a more serious matter. The more seriously people take it, the easier my job gets for multiple reasons. And since someone might ask, the license I advocate for the most is Apache 2.0. It covers the most ground, with the most clarity and the most protections for all parties involved.
  - pooper 3y ago
    On the other hand, some people freak out too much. All I did was use a ghostscript dll, which is LGPL if I recall correctly. :/
  - consp 3y ago
    > Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL Wasn't this the, "if the source is in your tree everything is GPL" and otherwise "if it's downloaded module as a package it is not"? Or was that LGPL? Asking to show clarification for everyone. edit: the question was stated as ignorant to get a few decent explanations. Thank you for the effort!
    - juliusdavies 3y ago
      Pipe/exec into GPL generally considered okay (not a derivative work) What you described only okay with LGPL
      - actionfromafar 3y ago
        And pipe/exec not because it's a magic boundary, but because that kind of interface is often so generic and simple it's not constituting a derivate work to use that boundary. But one could easily come up with an example where it is.
        mytailorisrich 3y ago
        It is a "magic" boundary in that it is an interface to another process, i.e. effectively another program altogether.
        lupusreal 3y ago
        Another process is not necessarily "another program altogether". What presents as "a program" to the user may be a collection of several processes using a variety of IPC methods to interface with each other. "Process" has a fairly concrete technical meaning but "program" is more loosely goosey. A shell script could be called "a program" even though it's executed by a shell process and invokes dozens of other processes, without which it is nothing.
- flanked-evergl 3y ago
  What constitutes linking, dynamic linking, and static linking, if you use python and plugins? Can the rights holder of proprietary software contribute to or distribute a GPL or LGPL plugin for that software?
  - dagmx 3y ago
    You don’t have to distribute the plugin as xGPL but you do need to make it compliant. The L/GPL would widely consider Python imports as dynamic linking. Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result. This too is somewhat of a grey area though that the GPL is vague on.
    - flanked-evergl 3y ago
      > You don’t have to distribute the plugin as xGPL but you do need to make it compliant. My reading of the GPL is that if you are the rights holder of some software, and there is a xGPL licensed plugin to said software, you can only distribute changes to the plugin if you also distribute your software as xGPL. In other words it is impractical for you to make changes to xGPL licensed plugins to your software. > Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result. I'm fairly sure this is not legal, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLWrapper https://www.gnu.org/licenses/gpl-faq.en.html#GPLWrapper The point is there is too much in the GPL that is open ended and can only be known for sure after litigation.
      - toyg 3y ago
        > this is not legal Unless the GPL was enshrined in some law I'm not aware of, it's likely to be a a breach of contract, not necessarily "illegal". If a court rules against you, in most cases the worst that can happen is having to pay some redress to the developer and stopping what you were doing.
- Culonavirus 3y ago
  FFMPEG. Look at the amount of legal horse fertilizer here: https://www.ffmpeg.org/legal.html https://www.ffmpeg.org/legal.html ... and every time I've seen people asking what they can and can't do, someone from the ffmpeg devs (once in a couple of years when they actually respond to someone) just says "talk to your lawyer". I mean, flip a few switches and suddenly you're under a different licence ... and all this you have to look up yourself. Many (especially smaller) devs just don't care and distribute ffmpeg together with their (often non-oss) tools. Given the amount of these in the wild, if someone really had an axe to grind, they could sue hundreds, maybe thousands of devs of all sizes. It's a total minefield. And one of the most popular (L)GPL packages in existence.
  - adev_ 3y ago
    It is currently pretty clearly describe. Compile it in LGPL mode and you are good for propriétaire use cases. There is nothing fundamentally dangerous with the LGPLv2.1. It is mainly annoying in case of static linking due to the obligation of providing object files but will not contaminate your codebase like the GPL does.
  - Semaphor 3y ago
    My experience with FFMPEG is that it’s usually not directly distributed for probably those reasons. The only times I remember getting it directly with software, was for GPL software.
    - Culonavirus 3y ago
      Eh, I'm just gonna point out that you can find ffmpeg code (proprietary decoders even) distributed with Electron. I'm not even going to think about how many proprietary apps built on top of Electron have no idea about that. Look at the answer here: https://stackoverflow.com/questions/67799370/legal-issues-in-shipping-apps-based-on-electron-framework-libffmpeg https://stackoverflow.com/questions/67799370/legal-issues-in...
- Thorrez 3y ago
  The Python websocket-client library switched from LGPL to BSD without realizing you need to get all contributors to sign off on that. https://github.com/websocket-client/websocket-client/issues/526 https://github.com/websocket-client/websocket-client/issues/... It looks like that did get rectified a few years later: https://github.com/websocket-client/websocket-client/issues/697 https://github.com/websocket-client/websocket-client/issues/...
account42 3y ago
> Usually some form of “Oh don’t worry because we aren’t litigious right now, as long as you stick with our incorrect interpretation of the license Where do you see that attitude in the OSS world? In my experience that's how the games industry operates wrt to mods but for open source projects you usually have a clear license IME.
- flanked-evergl 3y ago
  I worked for a Multinational US company that was doing business with a Scandinavian company. The Scandinavian company wrote a GPL plugin to our software and wanted us to make contributions to it. We didn't think we could do that and still be within the terms of the GPL, they insisted that we could because they would be fine with it.
  - _puk 3y ago
    As the author of the GPL code they have the authority to dual licence it, so surely the fact that they state they are fine with it (especially if in writing) would be enough? I'd worry the other way, if you're contributing to the GPL code, you'd need to relinquish your rights to any IP contributed to the third party.
    - flanked-evergl 3y ago
      Our concern was not that our contribution would be GPL licensed, our concern was that we didn't have permission under GPL to distribute the contributions even if we were fine with them being GPL licensed. For details as to why we were concerned, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins - for any company that should be a clear signal to stay away. An employee of a company saying it's fine in an email is also not issuing another licence. We did suggest they use another licence than GPL, which they eventually did after months of arguing with them that just saying "it's okay because we don't care" makes no material difference to us and that GPL does not unambiguously provide us permission to do what they want us to do.
jillesvangurp 3y ago
It's a good thing to point out that judges are notoriously indifferent about "he said that she said" type arguments. In the presence of anything that looks like a license text or contract that's usually what they take as the starting point for a decision. In so far that is enforcable of course. Most longer licenses usually have some language stating what happens when certain things aren't enforcable. With GPL, the version matters. I'm not aware of any GPL v1 licensed stuff, it probably was a bit short lived. But there's quite a few things licensed under GPLv2 and GPLv3. v3 tried to close a few loopholes v2 had that some companies working with e.g. Linux or Java see as a feature rather than a bug. Many corporate lawyers don't like GPL style licenses and particularly AGPL because these licenses have a lot of things to say about things like intellectual property, patents, servers, and uses that are/aren't allowed that probably isn't OK with most corporate lawyers worth their money. With GPLv2, this stuff has been through the courts a few times so the industry seems comfortable with it at this point. Whether those lawyers are right or not is not something engineers should be overruling based on vague notions of fairness, gut feelings, loose interpretations, etc. The whole "it's fine because we're all nice people" doesn't have much value in a court room. Licenses are for when people stop being nice to each other. I prefer the MIT license for my own projects. It's simple and clear and completely uncontroversial with corporate lawyers. It has decades of use, is well understood, and has very little ambiguity. Lots of OSS is licensed with it. It's fair for developers and users. Users being able to do what they want with the software is fully intentional on my part. That's a freedom I give them with that license and not something I actively want to restrict. Fully understood and intentional.
- gnuser 3y ago
  Of course the corporate lawyers and enterprise settings are going to take this position, but I find your flippant dismissal of GPLs core uses and purposes seem to belie you are just in a group that prefers the non-user friendly licensing. That’s ok, but you can’t hand wave away that GPL, especially v3+, is about protecting and defending the user (like tron), while MIT/BSD is not, by calling it “vague notions of fairness” as if GPL hasn’t already seen wins in the courts… on this point I think some research might be due for me though. I’m just so very tired of the “hey me and my banker/lawyer/insurance friends all hate this - that means it’s useless and dangerous for everybody” I say the GPL and copyleft and the four freedoms for the user are the tools we use to fight these types of corporations in the first place, and I truly believe not only is GPL not dead but that it will play a vital role in our near and long term future. Choose your weapons wisely.
nikanj 3y ago
The legal precedent seems to be "If you steal GPL code, 14 years later you have to pay $650k - assuming the developer didn't give up before that"
- bsza 3y ago
  One of the key advantages to a legal precedent is that the next time it won’t take 14 years.
  - lolinder 3y ago
    France has a civil law system [0] which doesn't place nearly as strong an emphasis on precedent as common law does, so this specific case probably won't help speed anything up. [0] https://en.m.wikipedia.org/wiki/Civil_law_(legal_system) https://en.m.wikipedia.org/wiki/Civil_law_(legal_system)
    - arlort 3y ago
      Precedent isn't binding in civil law systems, but that doesn't mean it is ignored. Especially when set by higher courts
throw0101a 3y ago
> I’m glad there’s finally some cases setting precedent for the GPL. Given that France uses Civil law and not Common law, does precedent / case law actually matter? (IANAL.) * https://en.wikipedia.org/wiki/Civil_law_(legal_system) https://en.wikipedia.org/wiki/Civil_law_(legal_system) * https://en.wikipedia.org/wiki/Common_law https://en.wikipedia.org/wiki/Common_law
- Conan_Kudo 3y ago
  It matters in an advisory sense (that is, other courts may use it to gain understanding), but not in a legally binding sense.
  - eru 3y ago
    In practice, precedence has about the same legal power in both common law and civil law jurisdictions. That is civil law courts tend to go with the precedent most of the time on the one hand. And on the other hand, a common law judge can always do a bit of nitpicking to argue why the case before her is special and thus different enough from the precedent (or she can pick from multiple different precedents, and then come up with a justification for why the one she picked matches the case before her the most).
    - timeon 3y ago
      > a common law judge can always do a bit of nitpicking This makes sense. Precedents ruled by mistake/etc. should not set the law.
      - eru 3y ago
        Well, that's why you have appeals and higher courts can overrule the precedence of the lower courts.
  - rtsil 3y ago
    Some, but not all, precedents are absolutely legally binding in the French system, they have the same force as the law (unless a later law contradicts them).
lutoma 3y ago
> I’m glad there’s finally some cases setting precedent for the GPL. There's been a few before: https://gpl-violations.org/news/ https://gpl-violations.org/news/
deleted 3y ago
[deleted]

by dagmx 3y ago

Semaphor 3y ago

> There’s a lot of GPL software that operates in the grey (and many OSS devs who don’t understand their license choices), Do you have examples? What kinds of misunderstanding are there? And what gets clarified by this case that wasn’t clear before?

dagmx 3y ago
I can’t give specific examples without calling out some projects. But usually it’s a misunderstanding of what derivative works are. E.g building an extension to a GPL app. Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL. Or things like what constitutes distribution. E.g employees vs contractors vs third party collaborators etc… But when I have to deal with said project owners, they bring up that the GPL is about the spirit of the license, not the exact words. They often say not to worry about litigation. This case doesn’t specifically clarify those terms but it does highlight that GPL violation is a serious issue that can’t just be treated as a suggestion. That any lawsuit has taken place and won means that 1. I can point to cases where the license choice is impactful when working with existing projects or when setting up new OSS projects in my industry 2. It also means that the license proponents may feel more empowered (as they should) to take action against infringement. Basically, very few people take software licenses as seriously as they should. Cases like these help make them a more serious matter. The more seriously people take it, the easier my job gets for multiple reasons. And since someone might ask, the license I advocate for the most is Apache 2.0. It covers the most ground, with the most clarity and the most protections for all parties involved.
- pooper 3y ago
  On the other hand, some people freak out too much. All I did was use a ghostscript dll, which is LGPL if I recall correctly. :/
- consp 3y ago
  > Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL Wasn't this the, "if the source is in your tree everything is GPL" and otherwise "if it's downloaded module as a package it is not"? Or was that LGPL? Asking to show clarification for everyone. edit: the question was stated as ignorant to get a few decent explanations. Thank you for the effort!
  - juliusdavies 3y ago
    Pipe/exec into GPL generally considered okay (not a derivative work) What you described only okay with LGPL
    - actionfromafar 3y ago
      And pipe/exec not because it's a magic boundary, but because that kind of interface is often so generic and simple it's not constituting a derivate work to use that boundary. But one could easily come up with an example where it is.
      - mytailorisrich 3y ago
        It is a "magic" boundary in that it is an interface to another process, i.e. effectively another program altogether.
        lupusreal 3y ago
        Another process is not necessarily "another program altogether". What presents as "a program" to the user may be a collection of several processes using a variety of IPC methods to interface with each other. "Process" has a fairly concrete technical meaning but "program" is more loosely goosey. A shell script could be called "a program" even though it's executed by a shell process and invokes dozens of other processes, without which it is nothing.
flanked-evergl 3y ago
What constitutes linking, dynamic linking, and static linking, if you use python and plugins? Can the rights holder of proprietary software contribute to or distribute a GPL or LGPL plugin for that software?
- dagmx 3y ago
  You don’t have to distribute the plugin as xGPL but you do need to make it compliant. The L/GPL would widely consider Python imports as dynamic linking. Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result. This too is somewhat of a grey area though that the GPL is vague on.
  - flanked-evergl 3y ago
    > You don’t have to distribute the plugin as xGPL but you do need to make it compliant. My reading of the GPL is that if you are the rights holder of some software, and there is a xGPL licensed plugin to said software, you can only distribute changes to the plugin if you also distribute your software as xGPL. In other words it is impractical for you to make changes to xGPL licensed plugins to your software. > Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result. I'm fairly sure this is not legal, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLWrapper https://www.gnu.org/licenses/gpl-faq.en.html#GPLWrapper The point is there is too much in the GPL that is open ended and can only be known for sure after litigation.
    - toyg 3y ago
      > this is not legal Unless the GPL was enshrined in some law I'm not aware of, it's likely to be a a breach of contract, not necessarily "illegal". If a court rules against you, in most cases the worst that can happen is having to pay some redress to the developer and stopping what you were doing.
Culonavirus 3y ago
FFMPEG. Look at the amount of legal horse fertilizer here: https://www.ffmpeg.org/legal.html https://www.ffmpeg.org/legal.html ... and every time I've seen people asking what they can and can't do, someone from the ffmpeg devs (once in a couple of years when they actually respond to someone) just says "talk to your lawyer". I mean, flip a few switches and suddenly you're under a different licence ... and all this you have to look up yourself. Many (especially smaller) devs just don't care and distribute ffmpeg together with their (often non-oss) tools. Given the amount of these in the wild, if someone really had an axe to grind, they could sue hundreds, maybe thousands of devs of all sizes. It's a total minefield. And one of the most popular (L)GPL packages in existence.
- adev_ 3y ago
  It is currently pretty clearly describe. Compile it in LGPL mode and you are good for propriétaire use cases. There is nothing fundamentally dangerous with the LGPLv2.1. It is mainly annoying in case of static linking due to the obligation of providing object files but will not contaminate your codebase like the GPL does.
- Semaphor 3y ago
  My experience with FFMPEG is that it’s usually not directly distributed for probably those reasons. The only times I remember getting it directly with software, was for GPL software.
  - Culonavirus 3y ago
    Eh, I'm just gonna point out that you can find ffmpeg code (proprietary decoders even) distributed with Electron. I'm not even going to think about how many proprietary apps built on top of Electron have no idea about that. Look at the answer here: https://stackoverflow.com/questions/67799370/legal-issues-in-shipping-apps-based-on-electron-framework-libffmpeg https://stackoverflow.com/questions/67799370/legal-issues-in...
Thorrez 3y ago
The Python websocket-client library switched from LGPL to BSD without realizing you need to get all contributors to sign off on that. https://github.com/websocket-client/websocket-client/issues/526 https://github.com/websocket-client/websocket-client/issues/... It looks like that did get rectified a few years later: https://github.com/websocket-client/websocket-client/issues/697 https://github.com/websocket-client/websocket-client/issues/...

account42 3y ago

> Usually some form of “Oh don’t worry because we aren’t litigious right now, as long as you stick with our incorrect interpretation of the license Where do you see that attitude in the OSS world? In my experience that's how the games industry operates wrt to mods but for open source projects you usually have a clear license IME.

flanked-evergl 3y ago
I worked for a Multinational US company that was doing business with a Scandinavian company. The Scandinavian company wrote a GPL plugin to our software and wanted us to make contributions to it. We didn't think we could do that and still be within the terms of the GPL, they insisted that we could because they would be fine with it.
- _puk 3y ago
  As the author of the GPL code they have the authority to dual licence it, so surely the fact that they state they are fine with it (especially if in writing) would be enough? I'd worry the other way, if you're contributing to the GPL code, you'd need to relinquish your rights to any IP contributed to the third party.
  - flanked-evergl 3y ago
    Our concern was not that our contribution would be GPL licensed, our concern was that we didn't have permission under GPL to distribute the contributions even if we were fine with them being GPL licensed. For details as to why we were concerned, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins - for any company that should be a clear signal to stay away. An employee of a company saying it's fine in an email is also not issuing another licence. We did suggest they use another licence than GPL, which they eventually did after months of arguing with them that just saying "it's okay because we don't care" makes no material difference to us and that GPL does not unambiguously provide us permission to do what they want us to do.

jillesvangurp 3y ago

It's a good thing to point out that judges are notoriously indifferent about "he said that she said" type arguments. In the presence of anything that looks like a license text or contract that's usually what they take as the starting point for a decision. In so far that is enforcable of course. Most longer licenses usually have some language stating what happens when certain things aren't enforcable. With GPL, the version matters. I'm not aware of any GPL v1 licensed stuff, it probably was a bit short lived. But there's quite a few things licensed under GPLv2 and GPLv3. v3 tried to close a few loopholes v2 had that some companies working with e.g. Linux or Java see as a feature rather than a bug. Many corporate lawyers don't like GPL style licenses and particularly AGPL because these licenses have a lot of things to say about things like intellectual property, patents, servers, and uses that are/aren't allowed that probably isn't OK with most corporate lawyers worth their money. With GPLv2, this stuff has been through the courts a few times so the industry seems comfortable with it at this point. Whether those lawyers are right or not is not something engineers should be overruling based on vague notions of fairness, gut feelings, loose interpretations, etc. The whole "it's fine because we're all nice people" doesn't have much value in a court room. Licenses are for when people stop being nice to each other. I prefer the MIT license for my own projects. It's simple and clear and completely uncontroversial with corporate lawyers. It has decades of use, is well understood, and has very little ambiguity. Lots of OSS is licensed with it. It's fair for developers and users. Users being able to do what they want with the software is fully intentional on my part. That's a freedom I give them with that license and not something I actively want to restrict. Fully understood and intentional.

gnuser 3y ago
Of course the corporate lawyers and enterprise settings are going to take this position, but I find your flippant dismissal of GPLs core uses and purposes seem to belie you are just in a group that prefers the non-user friendly licensing. That’s ok, but you can’t hand wave away that GPL, especially v3+, is about protecting and defending the user (like tron), while MIT/BSD is not, by calling it “vague notions of fairness” as if GPL hasn’t already seen wins in the courts… on this point I think some research might be due for me though. I’m just so very tired of the “hey me and my banker/lawyer/insurance friends all hate this - that means it’s useless and dangerous for everybody” I say the GPL and copyleft and the four freedoms for the user are the tools we use to fight these types of corporations in the first place, and I truly believe not only is GPL not dead but that it will play a vital role in our near and long term future. Choose your weapons wisely.

nikanj 3y ago

The legal precedent seems to be "If you steal GPL code, 14 years later you have to pay $650k - assuming the developer didn't give up before that"

bsza 3y ago
One of the key advantages to a legal precedent is that the next time it won’t take 14 years.
- lolinder 3y ago
  France has a civil law system [0] which doesn't place nearly as strong an emphasis on precedent as common law does, so this specific case probably won't help speed anything up. [0] https://en.m.wikipedia.org/wiki/Civil_law_(legal_system) https://en.m.wikipedia.org/wiki/Civil_law_(legal_system)
  - arlort 3y ago
    Precedent isn't binding in civil law systems, but that doesn't mean it is ignored. Especially when set by higher courts

throw0101a 3y ago

> I’m glad there’s finally some cases setting precedent for the GPL. Given that France uses Civil law and not Common law, does precedent / case law actually matter? (IANAL.) * https://en.wikipedia.org/wiki/Civil_law_(legal_system) https://en.wikipedia.org/wiki/Civil_law_(legal_system) * https://en.wikipedia.org/wiki/Common_law https://en.wikipedia.org/wiki/Common_law

Conan_Kudo 3y ago
It matters in an advisory sense (that is, other courts may use it to gain understanding), but not in a legally binding sense.
- eru 3y ago
  In practice, precedence has about the same legal power in both common law and civil law jurisdictions. That is civil law courts tend to go with the precedent most of the time on the one hand. And on the other hand, a common law judge can always do a bit of nitpicking to argue why the case before her is special and thus different enough from the precedent (or she can pick from multiple different precedents, and then come up with a justification for why the one she picked matches the case before her the most).
  - timeon 3y ago
    > a common law judge can always do a bit of nitpicking This makes sense. Precedents ruled by mistake/etc. should not set the law.
    - eru 3y ago
      Well, that's why you have appeals and higher courts can overrule the precedence of the lower courts.
- rtsil 3y ago
  Some, but not all, precedents are absolutely legally binding in the French system, they have the same force as the law (unless a later law contradicts them).

lutoma 3y ago

> I’m glad there’s finally some cases setting precedent for the GPL. There's been a few before: https://gpl-violations.org/news/ https://gpl-violations.org/news/

deleted 3y ago

[deleted]