7 ms·

This got buried on HN a few days ago which is a shame: https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ

This got buried on HN a few days ago which is a shame: https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community. Which brings us to the question: what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? Of which there are likely none. Try and run custom software on his medical device which can likely kill him? More than likely. The judge's comments on the Vizio case are such that should this guy get his hands on the code, he has no right to modify/reinstall it AND expect it will continue to operate as an insulin pump. This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system.

ryandrake 10mo ago
Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.
- schmuckonwheels 10mo ago
  It's a medical device that requires a prescription. You can't buy it off the shelf. They're not distributing software to you either. You must go through a medical equipment supplier who transfers the device to you after insurance has paid for some or all of it. For the same reason you can't find an airplane entertainment system in the trash and call up the company and demand source code.
  - kevin_thibedeau 10mo ago
    It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable." The GPL here doesn't extend beyond the kernel boundary. Userland is isolated unless they have GPL code linked in there as well. If they were careless about the linkage boundaries then that's on them.
    - schmuckonwheels 10mo ago
      The recipient of that object code is the medical device supplier, not the end-user. It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code. In other words, assume you are the second owner in all cases when it comes to certified medical equipment. AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received the offer of source during a purchase transaction. You know that little slip of paper you toss as soon as you open some new electronics that says "Open Source Software Notice".
      - RHSeeger 10mo ago
        > In other words, assume you are the second owner in all cases when it comes to certified medical equipment. By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it. It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.
        RichardLake 10mo ago
        Would you disagree with this logic? You distribute GPL code to me on a dvd. I give that dvd to someone else. I have not made a copy of the source code, so copyright does not come into this. If instead I copied the dvd and emailed the iso to someone else I would be distributing and copyright comes into it.
        RHSeeger 10mo ago
        The GPL binds _everyone_ who distributes GPL-covered work, including resellers. It doesn't matter if you made a copy of it, you are distributing it.
        10mo ago
- teddyh 10mo ago
  Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The lack of a written offer is in itself a clear violation.
  - schmuckonwheels 10mo ago
    > But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines. In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source. If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.
    - teddyh 10mo ago
      > If that was true, anyone reselling an Android phone could open themselves up to legal liability. That’s only an appeal to ridicule. If those are valid, here’s an opposing one: If this is not true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.
      - gpm 10mo ago
        Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales. That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.
jacquesm 10mo ago
There are a lot of people hacking on insulin pumps and they are lightyears ahead of commerce. If you want a very interesting rabbit hole to dive into try 'artificial pancreas hacking' as google feed. One interesting link: https://www.drugtopics.com/view/hacking-diabetes-the-diy-bionic-pancreas-is-here-to-stay https://www.drugtopics.com/view/hacking-diabetes-the-diy-bio... I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up, it's the equivalent of flying a plane you built yourself.
- bitmasher9 10mo ago
  > it's the equivalent of flying a plane you built yourself A great analogy because people die that way. I personally would never push code to another person’s insulin pump (or advertise code as being used for an insulin pump) because I couldn’t live with the guilt if my bug got someone else killed.
  - jacquesm 10mo ago
    I know people die that way (GA). But someone is working for the companies that make insulin pumps and they are not as a rule equally motivated so I would expect them to do worse, not better. And to the best of my knowledge none of the closed-loop people have died as a result of their work and they are very good at peer reviewing each others work to make sure it stays that way. And I'd trust my life to open source in such a setting long before I'd do it to closed source. At least I'd have a chance to see what the quality of the code is, which in the embedded space ranges from 'wow' all the way to 'no way they did that'.
    - chii 10mo ago
      > I would expect them to do worse, not better. which is why lots of systems and processes (sometimes called red tape) exist to try and prevent the undesired outcome, and dont rely on the competency of a single person as the weak link!
      - 10mo ago
JoshTriplett 10mo ago
> Linus rants Linus is arguing against a strawman that Conservancy never actually argued. See https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelevant-ruling/ https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelev... for details. > Which brings us to the question: what is this guy going to do with (presumably) the kernel source? https://openaps.org/ https://openaps.org/
- schmuckonwheels 10mo ago
  If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Separately, do you think it's remotely a good idea?
  - iinnPP 10mo ago
    Not that person, but yes. You have entirely missed the ability to simply view and understand what's inside your own body. Where your interpretation means someone else needs to follow your whim for their own problem, despite the legalese stating otherwise. I think that is an absurd position and I am sorry to feel the need to have to be blunt about it.
  - brendyn 10mo ago
    Obviously yes to the first question. How could you possibly not have the right to operating your own heart. Naturally it would generally not be a good idea.
  - JoshTriplett 10mo ago
    > If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Yes, of course. It is abhorrent that people have devices implanted into their bodies and are in any way prevented from obtaining every last detail about how those devices operate. > Separately, do you think it's remotely a good idea? In rare circumstances, yes. See, by way of example, Karen Sandler's talk on her implanted pacemaker and its bugs, for specific details on why one might want to do so.
isodev 10mo ago
> what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? As the original Reddit comment explains, Insulet is an American company.
jonway 10mo ago
Big disagree, if they distribute the code they’re on the hook for the gpl source, too! That’s about as ridiculous as buying a plane and knowing you’re entitled to the gpl sources used.
cxr 10mo ago
> The spirit of the GPLv2 was about contributing software improvements back to the community. It may be the case that when all is settled, the courts determine that the letter of the license means others' obligations are limited to what the judge in the Vizio case wrote. And Linus can speak authoritatively about his intent when he agreed to license kernel under GPL. But I think that it's pretty clear—including and especially the very wordy Preamble—not to mention the motivating circumstances that led to the establishment of GNU and the FSF, the type of advocacy they engage in that led up to the drafting/publication of the license, and everything since, that the spirit of the GPL is very much in line with exactly the sort of activism the SFC has undertaken against vendors restricting the owners of their devices from using them how they want.
f1shy 10mo ago
>> Try and run custom software on his medical device which can likely kill him? More than likely I think this sentence is very sad. Not only this is a hard accusation, it is also the primary argument of the anti right to repair movement. An argument that I think is extremely bogus and ill intentioned, and I particularly (like Mr. Rossman) viscerally dislike. Maybe the primary motivation is a) curiosity, and b) just for kicks to know if they honor the license.
RobotToaster 10mo ago
> Linus rants That happens every Tuesday, hardly newsworthy.
wizzwizz4 10mo ago
> Try and run custom software on his medical device which can likely kill him? More than likely. It's not like the OEM software also won't kill you: https://sfconservancy.org/blog/2025/dec/23/seven-abbott-freestyle-libre-cgm-patients-dead/ https://sfconservancy.org/blog/2025/dec/23/seven-abbott-free...
fsckboy 10mo ago
>Which brings us to the question: what is this guy going to do with (presumably) the kernel source? it doesn't bring us to the question, but the answer to the question is, run a diff between the software that has this guys life in its hands, and the version it was derived from, to see if they inserted back doors, stray pointers, etc.
qmr 9mo ago
> This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system. Broken take. You are entitled to the source code.

ryandrake 10mo ago

Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.

schmuckonwheels 10mo ago
It's a medical device that requires a prescription. You can't buy it off the shelf. They're not distributing software to you either. You must go through a medical equipment supplier who transfers the device to you after insurance has paid for some or all of it. For the same reason you can't find an airplane entertainment system in the trash and call up the company and demand source code.
- kevin_thibedeau 10mo ago
  It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable." The GPL here doesn't extend beyond the kernel boundary. Userland is isolated unless they have GPL code linked in there as well. If they were careless about the linkage boundaries then that's on them.
  - schmuckonwheels 10mo ago
    The recipient of that object code is the medical device supplier, not the end-user. It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code. In other words, assume you are the second owner in all cases when it comes to certified medical equipment. AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received the offer of source during a purchase transaction. You know that little slip of paper you toss as soon as you open some new electronics that says "Open Source Software Notice".
    - RHSeeger 10mo ago
      > In other words, assume you are the second owner in all cases when it comes to certified medical equipment. By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it. It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.
      - RichardLake 10mo ago
        Would you disagree with this logic? You distribute GPL code to me on a dvd. I give that dvd to someone else. I have not made a copy of the source code, so copyright does not come into this. If instead I copied the dvd and emailed the iso to someone else I would be distributing and copyright comes into it.
        RHSeeger 10mo ago
        The GPL binds _everyone_ who distributes GPL-covered work, including resellers. It doesn't matter if you made a copy of it, you are distributing it.
        10mo ago
teddyh 10mo ago
Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The lack of a written offer is in itself a clear violation.
- schmuckonwheels 10mo ago
  > But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines. In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source. If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.
  - teddyh 10mo ago
    > If that was true, anyone reselling an Android phone could open themselves up to legal liability. That’s only an appeal to ridicule. If those are valid, here’s an opposing one: If this is not true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.
    - gpm 10mo ago
      Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales. That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.

jacquesm 10mo ago

There are a lot of people hacking on insulin pumps and they are lightyears ahead of commerce. If you want a very interesting rabbit hole to dive into try 'artificial pancreas hacking' as google feed. One interesting link: https://www.drugtopics.com/view/hacking-diabetes-the-diy-bionic-pancreas-is-here-to-stay https://www.drugtopics.com/view/hacking-diabetes-the-diy-bio... I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up, it's the equivalent of flying a plane you built yourself.

bitmasher9 10mo ago
> it's the equivalent of flying a plane you built yourself A great analogy because people die that way. I personally would never push code to another person’s insulin pump (or advertise code as being used for an insulin pump) because I couldn’t live with the guilt if my bug got someone else killed.
- jacquesm 10mo ago
  I know people die that way (GA). But someone is working for the companies that make insulin pumps and they are not as a rule equally motivated so I would expect them to do worse, not better. And to the best of my knowledge none of the closed-loop people have died as a result of their work and they are very good at peer reviewing each others work to make sure it stays that way. And I'd trust my life to open source in such a setting long before I'd do it to closed source. At least I'd have a chance to see what the quality of the code is, which in the embedded space ranges from 'wow' all the way to 'no way they did that'.
  - chii 10mo ago
    > I would expect them to do worse, not better. which is why lots of systems and processes (sometimes called red tape) exist to try and prevent the undesired outcome, and dont rely on the competency of a single person as the weak link!
    - 10mo ago

JoshTriplett 10mo ago

> Linus rants Linus is arguing against a strawman that Conservancy never actually argued. See https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelevant-ruling/ https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelev... for details. > Which brings us to the question: what is this guy going to do with (presumably) the kernel source? https://openaps.org/ https://openaps.org/

schmuckonwheels 10mo ago
If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Separately, do you think it's remotely a good idea?
- iinnPP 10mo ago
  Not that person, but yes. You have entirely missed the ability to simply view and understand what's inside your own body. Where your interpretation means someone else needs to follow your whim for their own problem, despite the legalese stating otherwise. I think that is an absurd position and I am sorry to feel the need to have to be blunt about it.
- brendyn 10mo ago
  Obviously yes to the first question. How could you possibly not have the right to operating your own heart. Naturally it would generally not be a good idea.
- JoshTriplett 10mo ago
  > If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Yes, of course. It is abhorrent that people have devices implanted into their bodies and are in any way prevented from obtaining every last detail about how those devices operate. > Separately, do you think it's remotely a good idea? In rare circumstances, yes. See, by way of example, Karen Sandler's talk on her implanted pacemaker and its bugs, for specific details on why one might want to do so.

isodev 10mo ago

> what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? As the original Reddit comment explains, Insulet is an American company.

jonway 10mo ago

Big disagree, if they distribute the code they’re on the hook for the gpl source, too! That’s about as ridiculous as buying a plane and knowing you’re entitled to the gpl sources used.

cxr 10mo ago

> The spirit of the GPLv2 was about contributing software improvements back to the community. It may be the case that when all is settled, the courts determine that the letter of the license means others' obligations are limited to what the judge in the Vizio case wrote. And Linus can speak authoritatively about his intent when he agreed to license kernel under GPL. But I think that it's pretty clear—including and especially the very wordy Preamble—not to mention the motivating circumstances that led to the establishment of GNU and the FSF, the type of advocacy they engage in that led up to the drafting/publication of the license, and everything since, that the spirit of the GPL is very much in line with exactly the sort of activism the SFC has undertaken against vendors restricting the owners of their devices from using them how they want.

f1shy 10mo ago

>> Try and run custom software on his medical device which can likely kill him? More than likely I think this sentence is very sad. Not only this is a hard accusation, it is also the primary argument of the anti right to repair movement. An argument that I think is extremely bogus and ill intentioned, and I particularly (like Mr. Rossman) viscerally dislike. Maybe the primary motivation is a) curiosity, and b) just for kicks to know if they honor the license.

RobotToaster 10mo ago

> Linus rants That happens every Tuesday, hardly newsworthy.

wizzwizz4 10mo ago

> Try and run custom software on his medical device which can likely kill him? More than likely. It's not like the OEM software also won't kill you: https://sfconservancy.org/blog/2025/dec/23/seven-abbott-freestyle-libre-cgm-patients-dead/ https://sfconservancy.org/blog/2025/dec/23/seven-abbott-free...

fsckboy 10mo ago

>Which brings us to the question: what is this guy going to do with (presumably) the kernel source? it doesn't bring us to the question, but the answer to the question is, run a diff between the software that has this guys life in its hands, and the version it was derived from, to see if they inserted back doors, stray pointers, etc.

qmr 9mo ago

> This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system. Broken take. You are entitled to the source code.