4 ms·

> “In violation of GPL” is a stretch. The originally envisioned distribution method, in fact, was "Send FSF a blank 9-track tape and they'll fill it and mail i

by ajross 2mo ago

> “In violation of GPL” is a stretch. The originally envisioned distribution method, in fact, was "Send FSF a blank 9-track tape and they'll fill it and mail it back". Nor, obviously, does anything prevent someone who downloads this from Drive from mirroring it on GitHub or wherever. This is arguably bad stewardship of a historically open source project. It's certainly not a license violation.

Brian_K_White 2mo ago
It's paying a bill in pennies.
- ajross 2mo ago
  It's not even that. Downstream projects host their own mirrors already, this is an annoying hoop to jump through for the maintainers (basically suck down a bunch of tarballs for every release, analogous to grabbing stuff from FTP sites back in the day), but not exactly a terrible hardship compared to the really very significant work of maintaining a large project.
  - simoncion 2mo ago
    There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days, but, yeah, it's definitely not paying a thousand+ cent bill in pennies, and I'm skeptical that it's a violation of the letter of the GPL. It is definitely a dick move by Google.
    - jraph 2mo ago
      > There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared, so indeed, not a violation of the letter of the GPL I think. It's like what we had in France and the Hadopi, which requested ISPs to share the IP addresses of people torrenting a defined set of files. One of them sent them printed on paper... (But the malicious compliance was cool in this case).
      - simoncion 2mo ago
        > I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared... With the greatest of respect, you've forgotten what the licenses say. GPLv2: [0] 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, ... GPLv3: [1] 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer [to convey the source code upon request]... on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. ... d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. ... e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. This unambiguously speaks about the form in which the source code is shared. If the licenses didn't specify this, folks would be compliant with the letter of the license by shipping you a printout of the source code and everything you need to build it and charging you for both the labor to generate that enormous, heavy-ass printout and shipping and handling to get it to you. [2] [0] <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html> [1] <https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html> [2] To downvoters: Don't forget that OCR was decent even back in the 1990s... certainly good enough for a good-quality printout in a fixed-width font to be -strictly speaking- machine-readable, and it has only gotten better as time has wobbled on. If you don't believe my account of the history, go look up how Zimmerman exported copies of PGP back when it was considered an export-controlled munition.
    - leni536 2mo ago
      While I don't find any requirements on how timely the source distribution must be upon request, one can reasonably say that there must be a line between 1 nanosecond and 1 century.
      - shevy-java 2mo ago
        Courts would most definitely make a distinction here. For instance, one century would mean "refusing to release the source code". We should test how long it takes Google to release source code upon request. And whether it is 100%. I think we should test whether Google fulfils the GPL here. That's now a challenge.
      - grapheneos 2mo ago
        Google can trivially provide it nearly instantly with no hardship. In fact, it's much harder for them to implement manual handling than automation. They have no justification for it beyond deliberately making it harder. It does have to be provided in a reasonable time or the license wouldn't work. What amount of time is reasonable is up to a court. Google being incapable of timely handling of these requests is not believable. They're one of the largest tech companies in the world. They deliberately moved from a system without any need for manual handling of requests to requiring it with the clear goal of creating a hassle. By failing to provide it for long enough periods of time to cause tangible harm to people relying on it, they're failing to comply with the license.
  - grapheneos 2mo ago
    We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
- aleph_minus_one 2mo ago
  > It's paying a bill in pennies. This is actually a problem that is solved in German law: § 3 Münzgesetz (MünzG), Absatz 1 [§ 3 Coins Act, article 1] "§ 3 Annahme- und Umtauschpflicht (1) Niemand ist verpflichtet, deutsche Euro-Gedenkmünzen im Betrag von mehr als 200 Euro bei einer einzelnen Zahlung anzunehmen. Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." https://www.gesetze-im-internet.de/m_nzg_2002/__3.html https://www.gesetze-im-internet.de/m_nzg_2002/__3.html Translation based on the one created by DeepL: "§ 3 Obligation to Accept and Exchange (1) No one is obliged to accept German commemorative euro coins totalling more than 200 euros in a single payment. If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros."
  - ajross 2mo ago
    To clarify given the subject at hand: German courts are 100% not going to find a Google Drive link to be disallowed by the GPLv2. That's literally about physical coins.
  - g6taa 2mo ago
    This is explicitly about commemorative coins, not regular ones.
    - aleph_minus_one 2mo ago
      > This is explicitly about commemorative coins, not regular ones. The formulation is not so easy to read (very common for German laws), but it includes also the regulations for normal coins: "Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." "If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros." So, there exist two cases in which the vendor is not obliged to take more than 50 coins: - The payment consists of both normal Euro coins and German commemorative euro coins - The payment is less than EUR 200. -- Independently, there does exist another source of law by which the vendor is not obliged to take more than 50 coins: Artikel 11 der EG-Verordnung Nr. 974/98 des Rates über die Einführung des Euro, EU-Amtsblatt L139 vom 11. Mai 1998: > https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELE... (German) > https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... (English) "As from 1 January 2002, the participating Member States shall issue coins denominated in euro or in cent and complying with the denominations and technical specifications which the Council may lay down in accordance with the second sentence of Article 105a(2) of the Treaty. Without prejudice to Article 15, these coins shall be the only coins which have the status of legal tender in all these Member States. Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment." Relevant part of this article: "Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment."
grapheneos 2mo ago
We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
- ajross 2mo ago
  Well to be fair you didn't say that in the linked tweet. Delay is bad too, but again the original spirit of the license was absolutely OK with the idea of weeks-long delays. Our modern world of instant github access has spoiled us, but courts are not going to see damages from just "we had to ship a month late" unless you can show something more specific.
  - grapheneos 2mo ago
    It's required for providing timely security patches. It's not hard to show why that's important and Google engineers have written plenty about it for us to cite. We've managed to avoid delays for security patches so far through reverse engineering and other workarounds. Having to invest time from developers paid to work on GrapheneOS in reverse engineering compiled GPLv2 code shows Google is violating the GPLv2.
    - gsquaredxc 2mo ago
      Delay is frustrating, but not a violation. Just because you reverse engineered GPLv2 code doesn’t make that in violation of GPLv2, many people have done that for reasons that rhyme with yours over the decades. GPLv2 also doesn’t have any clause about security patches or if you have a requirement for a certain timeline. GPLv2 isn’t a “you agree to not be an asshole” license.

by ajross 2mo ago

Brian_K_White 2mo ago

It's paying a bill in pennies.

ajross 2mo ago
It's not even that. Downstream projects host their own mirrors already, this is an annoying hoop to jump through for the maintainers (basically suck down a bunch of tarballs for every release, analogous to grabbing stuff from FTP sites back in the day), but not exactly a terrible hardship compared to the really very significant work of maintaining a large project.
- simoncion 2mo ago
  There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days, but, yeah, it's definitely not paying a thousand+ cent bill in pennies, and I'm skeptical that it's a violation of the letter of the GPL. It is definitely a dick move by Google.
  - jraph 2mo ago
    > There might be some merit to a claim that Google Drive isn't a medium customarily used for software distribution these days I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared, so indeed, not a violation of the letter of the GPL I think. It's like what we had in France and the Hadopi, which requested ISPs to share the IP addresses of people torrenting a defined set of files. One of them sent them printed on paper... (But the malicious compliance was cool in this case).
    - simoncion 2mo ago
      > I suppose forcing a means to share the source code could have been too restrictive, but the GPL only speaks about the shape of the source code itself (it should be "the preferred form of the work for making modifications to it"), not how it is shared... With the greatest of respect, you've forgotten what the licenses say. GPLv2: [0] 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, ... GPLv3: [1] 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer [to convey the source code upon request]... on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. ... d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. ... e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. This unambiguously speaks about the form in which the source code is shared. If the licenses didn't specify this, folks would be compliant with the letter of the license by shipping you a printout of the source code and everything you need to build it and charging you for both the labor to generate that enormous, heavy-ass printout and shipping and handling to get it to you. [2] [0] <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html> [1] <https://www.gnu.org/licenses/gpl-3.0.html https://www.gnu.org/licenses/gpl-3.0.html> [2] To downvoters: Don't forget that OCR was decent even back in the 1990s... certainly good enough for a good-quality printout in a fixed-width font to be -strictly speaking- machine-readable, and it has only gotten better as time has wobbled on. If you don't believe my account of the history, go look up how Zimmerman exported copies of PGP back when it was considered an export-controlled munition.
  - leni536 2mo ago
    While I don't find any requirements on how timely the source distribution must be upon request, one can reasonably say that there must be a line between 1 nanosecond and 1 century.
    - shevy-java 2mo ago
      Courts would most definitely make a distinction here. For instance, one century would mean "refusing to release the source code". We should test how long it takes Google to release source code upon request. And whether it is 100%. I think we should test whether Google fulfils the GPL here. That's now a challenge.
    - grapheneos 2mo ago
      Google can trivially provide it nearly instantly with no hardship. In fact, it's much harder for them to implement manual handling than automation. They have no justification for it beyond deliberately making it harder. It does have to be provided in a reasonable time or the license wouldn't work. What amount of time is reasonable is up to a court. Google being incapable of timely handling of these requests is not believable. They're one of the largest tech companies in the world. They deliberately moved from a system without any need for manual handling of requests to requiring it with the clear goal of creating a hassle. By failing to provide it for long enough periods of time to cause tangible harm to people relying on it, they're failing to comply with the license.
- grapheneos 2mo ago
  We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.
aleph_minus_one 2mo ago
> It's paying a bill in pennies. This is actually a problem that is solved in German law: § 3 Münzgesetz (MünzG), Absatz 1 [§ 3 Coins Act, article 1] "§ 3 Annahme- und Umtauschpflicht (1) Niemand ist verpflichtet, deutsche Euro-Gedenkmünzen im Betrag von mehr als 200 Euro bei einer einzelnen Zahlung anzunehmen. Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." https://www.gesetze-im-internet.de/m_nzg_2002/__3.html https://www.gesetze-im-internet.de/m_nzg_2002/__3.html Translation based on the one created by DeepL: "§ 3 Obligation to Accept and Exchange (1) No one is obliged to accept German commemorative euro coins totalling more than 200 euros in a single payment. If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros."
- ajross 2mo ago
  To clarify given the subject at hand: German courts are 100% not going to find a Google Drive link to be disallowed by the GPLv2. That's literally about physical coins.
- g6taa 2mo ago
  This is explicitly about commemorative coins, not regular ones.
  - aleph_minus_one 2mo ago
    > This is explicitly about commemorative coins, not regular ones. The formulation is not so easy to read (very common for German laws), but it includes also the regulations for normal coins: "Erfolgt eine einzelne Zahlung sowohl in Euro-Münzen als auch in deutschen Euro-Gedenkmünzen, ist niemand verpflichtet, mehr als 50 Münzen anzunehmen; dies gilt auch dann, wenn der Gesamtbetrag 200 Euro unterschreitet." "If a single payment is made using both euro coins and German commemorative euro coins, no one is obliged to accept more than 50 coins; this also applies if the total amount is less than 200 euros." So, there exist two cases in which the vendor is not obliged to take more than 50 coins: - The payment consists of both normal Euro coins and German commemorative euro coins - The payment is less than EUR 200. -- Independently, there does exist another source of law by which the vendor is not obliged to take more than 50 coins: Artikel 11 der EG-Verordnung Nr. 974/98 des Rates über die Einführung des Euro, EU-Amtsblatt L139 vom 11. Mai 1998: > https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/DE/TXT/PDF/?uri=CELE... (German) > https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31998R0974 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... (English) "As from 1 January 2002, the participating Member States shall issue coins denominated in euro or in cent and complying with the denominations and technical specifications which the Council may lay down in accordance with the second sentence of Article 105a(2) of the Treaty. Without prejudice to Article 15, these coins shall be the only coins which have the status of legal tender in all these Member States. Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment." Relevant part of this article: "Except for the issuing authority and for those persons specifically designated by the national legislation of the issuing Member State, no party shall be obliged to accept more than 50 coins in any single payment."

grapheneos 2mo ago

We said artificially delaying it for weeks or more is how they're violating it, not using Google Drive. It's also not provided in the preferred form for modification. It isn't in the form expected by the build system and causes it to not function in the way it did for their own builds.

ajross 2mo ago
Well to be fair you didn't say that in the linked tweet. Delay is bad too, but again the original spirit of the license was absolutely OK with the idea of weeks-long delays. Our modern world of instant github access has spoiled us, but courts are not going to see damages from just "we had to ship a month late" unless you can show something more specific.
- grapheneos 2mo ago
  It's required for providing timely security patches. It's not hard to show why that's important and Google engineers have written plenty about it for us to cite. We've managed to avoid delays for security patches so far through reverse engineering and other workarounds. Having to invest time from developers paid to work on GrapheneOS in reverse engineering compiled GPLv2 code shows Google is violating the GPLv2.
  - gsquaredxc 2mo ago
    Delay is frustrating, but not a violation. Just because you reverse engineered GPLv2 code doesn’t make that in violation of GPLv2, many people have done that for reasons that rhyme with yours over the decades. GPLv2 also doesn’t have any clause about security patches or if you have a requirement for a certain timeline. GPLv2 isn’t a “you agree to not be an asshole” license.