5 ms·

Busybox strikes again. I worked for a company that was on a receiving end of a similar GPL legal action (though not busybox-based and not from SF Conservancy).

Busybox strikes again. I worked for a company that was on a receiving end of a similar GPL legal action (though not busybox-based and not from SF Conservancy). I'll tell you what will happen next. VMWare will (a) write a drop-in in-house replacement for busybox (b) they will show that busybox is not an principal part for ESXi and that it can be easily swapped for the in-house replacement. At this point they will release the busybox sources, potentially including the in-house version, but not under GPL. This will hinder the lawsuit, but it will keep dragging on until everyone gets tired of its pointlessness and then it will get quietly dismissed to the mutual satisfaction of both involved parties. The thing is that it's not that VMWare is evil or unethical. It's just that this GPL thing doesn't even register on their legal radar, so it never percolates down to engineering. Similarly any concerns raised by engineering are never taken seriously by the legal council. It's really as simple as that.

tie_ 12y ago
> It's just that this GPL thing doesn't even register on their legal radar... Any engineer competent enough to incorporate Busybox into another product would know what GPL is, and what are the most basic implications that it leads to. I find it much easier to believe that VMWare as a whole was explicitly aware of the licensing situation. It remains to be seen what was their plan B, if there ever was one.
AceJohnny2 12y ago
A non-GPL Busybox alternative like Toybox? http://www.landley.net/toybox/about.html http://www.landley.net/toybox/about.html
shmerl 12y ago
Or you know, they can stop being jerks and release sources for the code they derived from the GPLed one. > It's just that this GPL thing doesn't even register on their legal radar It should register. > Similarly any concerns raised by engineering are never taken seriously by the legal council. Not in any serious company to my experience. Being so lax on legal matters for such company shows very low level of their management's professionalism.
- the_af 12y ago
  Especially since the GPL is one of the most widely known copyleft licenses out there. I can expect a layman to not know about it, but the software engineers at VMWare?
  - shmerl 12y ago
    It sounds from the above comment that even if engineers raise this issue, their legal department dismisses it. I find it bizarre for any serious company.
    - charlesnw 12y ago
      Yes exactly. Most large organizations (with in house counsel) take feedback from software/systems engineering very seriously. For compliance (especially licenses) contract requirements etc. Legal exists to serve/protect the organization.
    - gnoway 12y ago
      That comment is just supposition. The author has not demonstrated any knowledge of VMware development or legal practices.
  - dogma1138 12y ago
    You assume that a software engineer knows any more about copyright law than a random person from the street? Cuz I'm pretty sure they don't also in virtually every company it will be "don't bother with this, let the lawyers deal with it". Companies violate patents licenses agreements and all other legal nonsense all the time, that's what they got lawyers for.
- huhtenberg 12y ago
  > Being so lax on legal matters for such company shows very low level of their management's professionalism. Actually, no, it doesn't. It merely means that the management views GPL violations as a low-probability calculated risk. As in "we know that we can be in compliance, but we won't be wasting any resources on it until it's justified". It has nothing to do with the professionalism.
deleted 12y ago
[deleted]
geofft 12y ago
It's not really about busybox. Conservancy started looking at the use of Busybox, and then realized that vmkernel was using the Linux kernel in ways that (in their eyes) violated the Linux kernel's license. The present lawsuit is about that, and Christoph Hellwig is suing as a Linux rightsholder. Swapping out Linux in vmkernel would be much harder. See their FAQ (or one of the other comment threads here) for more info: http://sfconservancy.org/linux-compliance/vmware-lawsuit-faq.html http://sfconservancy.org/linux-compliance/vmware-lawsuit-faq...
th0br0 12y ago
Was said lawsuit also taking place in Germany? IANAL, but my understanding of the German copyright law (being a citizen of said country) is that such a proof is not a possible solution.
anonemployee 12y ago
> It's just that this GPL thing doesn't even register on their legal radar, so it never percolates down to engineering. VMware engineer here. This should not be construed as commenting on an ongoing court case (and I've never worked on the vmkernel), but I would like to respond to: At least in my organization: Legal is definitely aware of the GPL. Engineers are definitely aware of the GPL. Adding a dependency on a GPL'd library requires an almost unbelievable amount of paperwork. Again, at least in my organization: We also take open source obligations very seriously. For each release, we publish a detailed list of all open source software we consumed and a bundle containing all of the source code for those components, even if the project's license is one of the more permissive ones which doesn't require it.
- tw04 12y ago
  Out of curiosity - if GPL is taken so seriously, why do customers have to jump through so many hoops to get copies of source. Last I checked you are required to send a letter via snailmail to legal counsel @vmware and if they deem you worthy, they send back physical media with copies of the source. I can't imagine a less open-source friendly system...
  - delinka 12y ago
    It's not required to be "friendly" nor is it required to be convenient for you. It's designed to be compliant, internally audit-able, and for free they get the ability to frustrate you into not requesting copies.
  - Igglyboo 12y ago
    It is taken as seriously as is has to be. They are required to provide the source, they are not required to make obtaining the source a pleasant experience.
  - travem 12y ago
    If you want a copy of the source you can get it via the Open Source tab on most VMware products download page. You'll find the open source distributed for ESXi under the VMware vSphere Open Source group on this page -> https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/5_5#open_source https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_... It doesn't require a snail mail letter as far as I can tell.
makeitsuckless 12y ago
I seem to be missing the part where this behavior of VMWare is not unethical. This is a software company, not a chocolate factory. "Doesn't even register" isn't an accident, it's a choice in the same way ignoring the speed limit is a choice.
s73v3r 12y ago
>The thing is that it's not that VMWare is evil or unethical. Evil? No, probably not. Unethical? I would say so.
thrillgore 12y ago
> It's just that this GPL thing doesn't even register on their legal radar Then everyone in their legal department needs to be fired yesterday.
- dredmorbius 12y ago
  I think it's far more likely that huhtenberg is speaks of what he knows not. There's no legal department of any note in Silicon Valley which isn't painfully aware of the GPL, nor has there been for the past 15 years, if not 25. They may have decided, as he somewhat more plausibly suggests, that the risks aren't significant. FSF have pursued GPL compliance cases in the past, and their goals are to increase the scope of Free Software -- getting either larger works released as open source or changes committed back. IIRC some major GCC enhancements came by way of this route. Odds of seeking a cash settlement or other punitive award are slight. There's similarly little risk of customers being sued, though other VMWare partners could conceivably be. This doesn't do much for corporate goodwill in at least some quarters, and a lot of early GNU / Free Software folks are now in senior positions within the industry.
mentat 12y ago
Any large company is very aware of GPL or else they're incompetent. Having worked at several companies I can assure you it's on their radar. If they're not compliant, it's a choice.
codys 12y ago
> At this point they will release the busybox sources, potentially including the in-house version, but not under GPL Do you mean they'll release the busybox sources potentially not under GPL, or the in-house version potentially not under GPL? The former is probably legally difficult, while the latter is expected. What isn't clear to me is how action regarding the use of copyrighted materials taken after a legal claim is made could have an effect on on-going proceedings. Perhaps someone with more legal knowledge could elaborate?

tie_ 12y ago

> It's just that this GPL thing doesn't even register on their legal radar... Any engineer competent enough to incorporate Busybox into another product would know what GPL is, and what are the most basic implications that it leads to. I find it much easier to believe that VMWare as a whole was explicitly aware of the licensing situation. It remains to be seen what was their plan B, if there ever was one.

AceJohnny2 12y ago

A non-GPL Busybox alternative like Toybox? http://www.landley.net/toybox/about.html http://www.landley.net/toybox/about.html

shmerl 12y ago

Or you know, they can stop being jerks and release sources for the code they derived from the GPLed one. > It's just that this GPL thing doesn't even register on their legal radar It should register. > Similarly any concerns raised by engineering are never taken seriously by the legal council. Not in any serious company to my experience. Being so lax on legal matters for such company shows very low level of their management's professionalism.

the_af 12y ago
Especially since the GPL is one of the most widely known copyleft licenses out there. I can expect a layman to not know about it, but the software engineers at VMWare?
- shmerl 12y ago
  It sounds from the above comment that even if engineers raise this issue, their legal department dismisses it. I find it bizarre for any serious company.
  - charlesnw 12y ago
    Yes exactly. Most large organizations (with in house counsel) take feedback from software/systems engineering very seriously. For compliance (especially licenses) contract requirements etc. Legal exists to serve/protect the organization.
  - gnoway 12y ago
    That comment is just supposition. The author has not demonstrated any knowledge of VMware development or legal practices.
- dogma1138 12y ago
  You assume that a software engineer knows any more about copyright law than a random person from the street? Cuz I'm pretty sure they don't also in virtually every company it will be "don't bother with this, let the lawyers deal with it". Companies violate patents licenses agreements and all other legal nonsense all the time, that's what they got lawyers for.
huhtenberg 12y ago
> Being so lax on legal matters for such company shows very low level of their management's professionalism. Actually, no, it doesn't. It merely means that the management views GPL violations as a low-probability calculated risk. As in "we know that we can be in compliance, but we won't be wasting any resources on it until it's justified". It has nothing to do with the professionalism.

deleted 12y ago

[deleted]

geofft 12y ago

It's not really about busybox. Conservancy started looking at the use of Busybox, and then realized that vmkernel was using the Linux kernel in ways that (in their eyes) violated the Linux kernel's license. The present lawsuit is about that, and Christoph Hellwig is suing as a Linux rightsholder. Swapping out Linux in vmkernel would be much harder. See their FAQ (or one of the other comment threads here) for more info: http://sfconservancy.org/linux-compliance/vmware-lawsuit-faq.html http://sfconservancy.org/linux-compliance/vmware-lawsuit-faq...

th0br0 12y ago

Was said lawsuit also taking place in Germany? IANAL, but my understanding of the German copyright law (being a citizen of said country) is that such a proof is not a possible solution.

anonemployee 12y ago

> It's just that this GPL thing doesn't even register on their legal radar, so it never percolates down to engineering. VMware engineer here. This should not be construed as commenting on an ongoing court case (and I've never worked on the vmkernel), but I would like to respond to: At least in my organization: Legal is definitely aware of the GPL. Engineers are definitely aware of the GPL. Adding a dependency on a GPL'd library requires an almost unbelievable amount of paperwork. Again, at least in my organization: We also take open source obligations very seriously. For each release, we publish a detailed list of all open source software we consumed and a bundle containing all of the source code for those components, even if the project's license is one of the more permissive ones which doesn't require it.

tw04 12y ago
Out of curiosity - if GPL is taken so seriously, why do customers have to jump through so many hoops to get copies of source. Last I checked you are required to send a letter via snailmail to legal counsel @vmware and if they deem you worthy, they send back physical media with copies of the source. I can't imagine a less open-source friendly system...
- delinka 12y ago
  It's not required to be "friendly" nor is it required to be convenient for you. It's designed to be compliant, internally audit-able, and for free they get the ability to frustrate you into not requesting copies.
- Igglyboo 12y ago
  It is taken as seriously as is has to be. They are required to provide the source, they are not required to make obtaining the source a pleasant experience.
- travem 12y ago
  If you want a copy of the source you can get it via the Open Source tab on most VMware products download page. You'll find the open source distributed for ESXi under the VMware vSphere Open Source group on this page -> https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/5_5#open_source https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_... It doesn't require a snail mail letter as far as I can tell.

makeitsuckless 12y ago

I seem to be missing the part where this behavior of VMWare is not unethical. This is a software company, not a chocolate factory. "Doesn't even register" isn't an accident, it's a choice in the same way ignoring the speed limit is a choice.

s73v3r 12y ago

>The thing is that it's not that VMWare is evil or unethical. Evil? No, probably not. Unethical? I would say so.

thrillgore 12y ago

> It's just that this GPL thing doesn't even register on their legal radar Then everyone in their legal department needs to be fired yesterday.

dredmorbius 12y ago
I think it's far more likely that huhtenberg is speaks of what he knows not. There's no legal department of any note in Silicon Valley which isn't painfully aware of the GPL, nor has there been for the past 15 years, if not 25. They may have decided, as he somewhat more plausibly suggests, that the risks aren't significant. FSF have pursued GPL compliance cases in the past, and their goals are to increase the scope of Free Software -- getting either larger works released as open source or changes committed back. IIRC some major GCC enhancements came by way of this route. Odds of seeking a cash settlement or other punitive award are slight. There's similarly little risk of customers being sued, though other VMWare partners could conceivably be. This doesn't do much for corporate goodwill in at least some quarters, and a lot of early GNU / Free Software folks are now in senior positions within the industry.

mentat 12y ago

Any large company is very aware of GPL or else they're incompetent. Having worked at several companies I can assure you it's on their radar. If they're not compliant, it's a choice.

codys 12y ago

> At this point they will release the busybox sources, potentially including the in-house version, but not under GPL Do you mean they'll release the busybox sources potentially not under GPL, or the in-house version potentially not under GPL? The former is probably legally difficult, while the latter is expected. What isn't clear to me is how action regarding the use of copyrighted materials taken after a legal claim is made could have an effect on on-going proceedings. Perhaps someone with more legal knowledge could elaborate?