7 ms·

Contractor had included GPL code, so Microsoft decides to publish its own source

18 points by dctoedt 17y ago

jacquesm 17y ago
Weird how it gets spun as a 'danger of open source'. It's simply being careless. If they have a review process and it did not catch this it can't be much of a review. The really worrying thing here is not that a chunk of gpl'd code made it into the distribution but that apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight.
- Tangurena 17y ago
  Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. And that becomes a "danger" in a businessman's model of the world because it is a clear and present danger to the health and survivability of their company. > apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight Microsoft, like most companies, has been hiring too many contractors instead of FTE. While this gets spun as a "contractor out of control" it isn't a contractor out of control, it is a business model out of control.
  - DarkShikari 17y ago
    Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. How does this follow from anything? There's nothing about the GPL that says you can't sell your product. This has happened before; a Japanese game used Xvid a while back for its videos and included the GPL Xvid decoder in the binary (stupidly, since there are better LGPL equivalents anyways). They got called on it and released the source of the game--but did anyone care? I highly doubt that it hurt sales--everyone who was going to pay for it probably still paid for it, and everyone who was going to pirate it probably still pirated it.
    - antonovka 17y ago
      There's nothing about the GPL that says you can't sell your product. I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free. That -- without any shadow of a doubt -- hurts sales (even if you "highly doubt it"). RedHat sells services, not software. That's why they can afford for CentOS to keep doing what they do.
      - DarkShikari 17y ago
        I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free. My entire point is that this isn't true. The aforementioned game released its source code--and nobody cared. The GPL applies to code only--nothing else. If a game's source code is GPL, that doesn't give anyone permission to legally distribute the game--all the art and assets are still not GPL'd, only the binaries are. I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful. And companies vastly overvalue their source code. They assume that since they spent $1m developing something that the source is worth $1m, when in reality there's probably nobody in the world who would pay a cent for their crappy code.
        antonovka 17y ago
        I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful. Are you serious? It's a drop-in game engine. You could create a variation on Civilization 4 for the cost of your artists.
        Sandman 17y ago
        And you'd have to release it under that same license (or a GPL compliant license), which means that anybody can do the same thing to you. If you improved the engine in some way, there's nothing stopping the makers of the original game to take your improved version, bundle some resources with it (sound, graphics) and release a new and improved version of their game.
- lanstein 17y ago
  I would not say this is "spun." Furthermore, from his bio, "I am the General Counsel, pro bono, of the Open Source Initiative." My reaction to the HN title was "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)
  - jacquesm 17y ago
    > "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;) I solemnly promise that if that comes to pass you will be credited with planting the seed. Now, does anybody have a way to get me on the windows team as a developer ?
  - shpxnvz 17y ago
    Then they would simply remove the GPL code and push out an update. The GPL does not compel the release of source code - if they accidentally distribute a product that does not comply with the requirements of the included GPL software then they simply lose the right to distribute the GPL software at the copyright holder's discretion.
freetard 17y ago
> Microsoft decides to publish its own source "Decides"? The very gpl license forces them to do so, this headline basically says "Microsoft decides to respect the law". Nothing to see here.
- jdale27 17y ago
  Couldn't they have instead rewritten their code so that it didn't use the GPL-licensed code?
  - freetard 17y ago
    Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.
    - jmillikin 17y ago
      This is not correct; please stop upvoting mindless talking points. Nothing in the GPL or in copyright law compels infringers to divulge their source code.
      - eli 17y ago
        Huh? You mean other than the fact that if they don't they're violating their agreement with the copyright holder of the GPL'd code?
        jmillikin 17y ago
        They're violating the license, which means they no longer have the right to distribute the GPL'd code. In some cases, they may have to pay damages. However, in the US (laws may be different where you live), the violator can't be forced to divulge their source code; the author of the GPL'd code has no right to it. An analogy might help; say I distribute CDs, with 6 songs I wrote and 6 songs by the Beatles, without a license. A judge can place an injunction to stop me. The copyright owner might seek damages. The judge might put me in jail/prison, if I continue infringement or don't pay. But they can't force me to give up the copyright on my songs, merely because they're distributed together.
kevinpet 17y ago
Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. The contractor would be toast (probably had an indemnification clause), MS wouldn't have been on the hook for that much even if the copyright holders of the GPL code sued for infringement, as it wasn't willful. The GPL absolutely does not force them to do so. It cannot, as it is simply a copyright license. The GPL actually terminated as soon as MS distributed the code, since they weren't following it's rules. I don't know if they have a formal agreement with the copyright owner, or if they're just following what is an accepted practice in opening the source, but technically GPL v2 cannot be "reactivated" on its own.
- freetard 17y ago
  > Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary and asks for the source.
- eli 17y ago
  Hmm, so I can give away copies of MS Office so long as I stop when someone points out it's copyright violation?
  - jmillikin 17y ago
    You would probably have to pay damages; see the ongoing drama of RIAA v. The Public for an example.
jrockway 17y ago
Don't tell anyone, but I really want to try this technique on Android. Cut-n-paste some GPL3 code from somewhere, get it accepted, wait for the binary using the code to be released, and then you can get root on your phone simply by sending a nastygram (as the GPL3 prohibits devices from locking out the user without their consent). No more wasting time finding a security hole! (Perhaps this has already been done!)
- wmf 17y ago
  Such a trick only works if the code doesn't matter. For something as important as Android, Google would just remove the offending code. Also, all code coming into important projects like Android has to have someone to vouch for it, so perhaps Google could shift the blame to the submitter (who would have had to remove the GPLv3 notice before submitting the code).
  - jrockway 17y ago
    Doesn't matter who they blame. Once the GPL3 code is in your hand, on the phone, they are stuck. Removing the code is fine, just like how they fix security holes that let you get root.
- deleted 17y ago
  [deleted]
- jacquesm 17y ago
  So, your idea of telling nobody is to post something on a forum that catches 40K uniques on a good day and has employees from that specific company as it's members ? Something tells me you're not entirely serious ;)
  - jrockway 17y ago
    Looking out for one class of problem makes it easier to inject other classes of problems. Or they could just give me root on my fucking mp3 player.

18 points by dctoedt 17y ago

Weird how it gets spun as a 'danger of open source'. It's simply being careless. If they have a review process and it did not catch this it can't be much of a review. The really worrying thing here is not that a chunk of gpl'd code made it into the distribution but that apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight.

Tangurena 17y ago
Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. And that becomes a "danger" in a businessman's model of the world because it is a clear and present danger to the health and survivability of their company. > apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight Microsoft, like most companies, has been hiring too many contractors instead of FTE. While this gets spun as a "contractor out of control" it isn't a contractor out of control, it is a business model out of control.
- DarkShikari 17y ago
  Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. How does this follow from anything? There's nothing about the GPL that says you can't sell your product. This has happened before; a Japanese game used Xvid a while back for its videos and included the GPL Xvid decoder in the binary (stupidly, since there are better LGPL equivalents anyways). They got called on it and released the source of the game--but did anyone care? I highly doubt that it hurt sales--everyone who was going to pay for it probably still paid for it, and everyone who was going to pirate it probably still pirated it.
  - antonovka 17y ago
    There's nothing about the GPL that says you can't sell your product. I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free. That -- without any shadow of a doubt -- hurts sales (even if you "highly doubt it"). RedHat sells services, not software. That's why they can afford for CentOS to keep doing what they do.
    - DarkShikari 17y ago
      I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free. My entire point is that this isn't true. The aforementioned game released its source code--and nobody cared. The GPL applies to code only--nothing else. If a game's source code is GPL, that doesn't give anyone permission to legally distribute the game--all the art and assets are still not GPL'd, only the binaries are. I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful. And companies vastly overvalue their source code. They assume that since they spent $1m developing something that the source is worth $1m, when in reality there's probably nobody in the world who would pay a cent for their crappy code.
      - antonovka 17y ago
        I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful. Are you serious? It's a drop-in game engine. You could create a variation on Civilization 4 for the cost of your artists.
        Sandman 17y ago
        And you'd have to release it under that same license (or a GPL compliant license), which means that anybody can do the same thing to you. If you improved the engine in some way, there's nothing stopping the makers of the original game to take your improved version, bundle some resources with it (sound, graphics) and release a new and improved version of their game.
lanstein 17y ago
I would not say this is "spun." Furthermore, from his bio, "I am the General Counsel, pro bono, of the Open Source Initiative." My reaction to the HN title was "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)
- jacquesm 17y ago
  > "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;) I solemnly promise that if that comes to pass you will be credited with planting the seed. Now, does anybody have a way to get me on the windows team as a developer ?
- shpxnvz 17y ago
  Then they would simply remove the GPL code and push out an update. The GPL does not compel the release of source code - if they accidentally distribute a product that does not comply with the requirements of the included GPL software then they simply lose the right to distribute the GPL software at the copyright holder's discretion.

freetard 17y ago

> Microsoft decides to publish its own source "Decides"? The very gpl license forces them to do so, this headline basically says "Microsoft decides to respect the law". Nothing to see here.

jdale27 17y ago
Couldn't they have instead rewritten their code so that it didn't use the GPL-licensed code?
- freetard 17y ago
  Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.
  - jmillikin 17y ago
    This is not correct; please stop upvoting mindless talking points. Nothing in the GPL or in copyright law compels infringers to divulge their source code.
    - eli 17y ago
      Huh? You mean other than the fact that if they don't they're violating their agreement with the copyright holder of the GPL'd code?
      - jmillikin 17y ago
        They're violating the license, which means they no longer have the right to distribute the GPL'd code. In some cases, they may have to pay damages. However, in the US (laws may be different where you live), the violator can't be forced to divulge their source code; the author of the GPL'd code has no right to it. An analogy might help; say I distribute CDs, with 6 songs I wrote and 6 songs by the Beatles, without a license. A judge can place an injunction to stop me. The copyright owner might seek damages. The judge might put me in jail/prison, if I continue infringement or don't pay. But they can't force me to give up the copyright on my songs, merely because they're distributed together.

kevinpet 17y ago

Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. The contractor would be toast (probably had an indemnification clause), MS wouldn't have been on the hook for that much even if the copyright holders of the GPL code sued for infringement, as it wasn't willful. The GPL absolutely does not force them to do so. It cannot, as it is simply a copyright license. The GPL actually terminated as soon as MS distributed the code, since they weren't following it's rules. I don't know if they have a formal agreement with the copyright owner, or if they're just following what is an accepted practice in opening the source, but technically GPL v2 cannot be "reactivated" on its own.

freetard 17y ago
> Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary and asks for the source.
eli 17y ago
Hmm, so I can give away copies of MS Office so long as I stop when someone points out it's copyright violation?
- jmillikin 17y ago
  You would probably have to pay damages; see the ongoing drama of RIAA v. The Public for an example.

jrockway 17y ago

Don't tell anyone, but I really want to try this technique on Android. Cut-n-paste some GPL3 code from somewhere, get it accepted, wait for the binary using the code to be released, and then you can get root on your phone simply by sending a nastygram (as the GPL3 prohibits devices from locking out the user without their consent). No more wasting time finding a security hole! (Perhaps this has already been done!)

wmf 17y ago
Such a trick only works if the code doesn't matter. For something as important as Android, Google would just remove the offending code. Also, all code coming into important projects like Android has to have someone to vouch for it, so perhaps Google could shift the blame to the submitter (who would have had to remove the GPLv3 notice before submitting the code).
- jrockway 17y ago
  Doesn't matter who they blame. Once the GPL3 code is in your hand, on the phone, they are stuck. Removing the code is fine, just like how they fix security holes that let you get root.
deleted 17y ago
[deleted]
jacquesm 17y ago
So, your idea of telling nobody is to post something on a forum that catches 40K uniques on a good day and has employees from that specific company as it's members ? Something tells me you're not entirely serious ;)
- jrockway 17y ago
  Looking out for one class of problem makes it easier to inject other classes of problems. Or they could just give me root on my fucking mp3 player.