Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Court Ruling shows the GPL is both copyright license and contractual agreement (sfconservancy.org)
259 points by pabs3 on May 16, 2022 | hide | past | favorite | 114 comments


The specific difference here seems to be about who is allowed to sue for GPL violations: "[Sandler] explains that in past litigation, the plaintiffs have always been copyright holders of the specific GPL code. In this case, Software Freedom Conservancy hopes to demonstrate that it's not just the copyright holders, but also the receivers of the licensed code who are entitled to rights." Stating a contractual claim seems to be the first step towards proving this (but not sufficient in and of itself).


If so, those receivers probably have to pay for something. You can't have a contract without exchange of value, right?

So that is to say, if I sell you some hardware-software package where the software is based on GPL code, then I paid for that software too, and so we are in a contract, part and parcel of which is the content of the GPL.

Suppose I sell you just the hardware, and you download and install the GPLed software separately from that. My sales agreement doesn't mention the existence of that software at all. Then there can be no contract there; that's just some free stuff you got somewhere. Perhaps that somewhere was my own server, where I prepared the images, but that is neither here nor there.


> You can't have a contract without exchange of value, right?

Yes. But, generally speaking, that thing of value doesn't have to be money. You could have a perfectly good contract where I get to use your software in exchange for agreeing to your terms, since both (the use of the software, and the commitment to comply with the terms) are valuable.

[Hopefully I'm stating the obvious here but, this is not legal advice. It's a general observations about U.S. law, and does not necessarily apply to any particular situation.]


That hasn't really held up in court in the past. T&C sections on installs of software and click-through "I agree" buttons have routinely been struck down.


That’s a different issue. The problem there (to generalize wildly) is whether both parties actually had an intent to enter into an agreement. That’s a distinct legal requirement from the need for consideration. But I agree that GP’s scenario may suffer from the same kind of problem.


You’re making a distinct legal point


> You can't have a contract without exchange of value, right?

IANAL, but I believe a contract is binding once a party has made some undertaking in relation to it (eg if you order bespoke goods from me, the contract is enforceable once I start working on them, or when you pay for them).

Training staff in the use of some software could be ruled a relevant undertaking.


OK, but in these cases, the contract itself spells out the this-for-that. The actual exchange of this for that doesn't have to commence for the contract to be binding; but without it being spelled out in the contract, it's not a contract.

E.g. we can't sign a document which says I will mow your lawn every Wednesday, April to October and call it a contract. It's missing the compensation clauses, so it's saying the mowing will be free of charge. The GPL is one-sided in that it spells out that some receiving user's rights are to be upheld in such and such a ways, without requiring that user to lift a finger. It's like the free lawn-mowing document in that sense.

But, obviously, that part of it will come from some larger umbrella contract whereby the user is sold the software. Those parts of the GPL which resemble contract clauses should be effectively absorbed into that sales contract. According to the larger contract, the user paid for the software, and so the counterparty is bound by the GPL clauses contractually. (Or so it would seem is the court decision here.)

I doubt that the court decision means that if you give someone a Debian DVD-ROM at a party (let's pretend for a second people still do that) you are now obliged to do additional things for them by a contract.


> I doubt that the court decision means that if you give someone a Debian DVD-ROM at a party (let's pretend for a second people still do that) you are now obliged to do additional things for them by a contract.

Civil law is meaningless without a willingness to engage in litigation; you aren't obliged to do additional things because nobody would spend money that way. As a result, I think this example muddies the waters rather than clarifying anything.


The claim here is that SFC is a third-party beneficiary of the alleged contract between the software creator and Visio. A third-party beneficiary can sue even though it is a non-party to the contract. (e.g., if Alice pays Bob to paint Charlie's house, then Charlie can sue Bob if Bob doesn't paint the house.)


If Software Freedom Conservancy - which isn't seeking monetary damages as "receiver of the licensed code" - succeeds in this litigation, does this mean other end-users could sue for monetary damages?


I'm not a lawyer, nor am I very familiar with contract law, so take this with a grain of salt.

I think technically yes, practically it is a separate up hill battle. Monetary damages have to be not-speculative, something like "because of defendant not complying with the contract I ended up spending <this> money on <these> software licenses" would probably work, but something like "because of defendant not complying with the contract I ended up making an inferior product (since I had to rewrite this code from scratch)" probably wouldn't.

I doubt that leaves many big lawsuits, it's hard to think of concrete damages that result from people improperly modifying and distributing linux (unfortunately common). Maybe customers of ChessBase who purchased Fat Fritz 2 or Houdini 6 (context: [1]) would have a claim for the return of their license fees, since if ChessBase was properly distributing it as GPL software they almost certainly would have been able to acquire it for free - that's like $50/person though - not a huge money maker.

[1] https://stockfishchess.org/blog/2021/our-lawsuit-against-che...


Is the contract of interest between the author of the GPL code and the buyer of the Vizio TV, so that the buyer would have a claim of tortious interference against Vizio?


It's not tortious interference but rather "3rd party / intended beneficiary" coming into play here. The idea is that the contract between the author and Vizio was for the benefit of a 3rd party (the end user) and so that party has the right to sue.

For another example, think of someone who is hired to handle disbursing an estate by someone who is dying. Their kids/heirs can sue the executor for contractual issues if the executor does anything shady because even though they weren't party to the contract because they stood to explicitly benefit.

https://www.upcounsel.com/intended-beneficiary-example


(1) This ruling does not show that the GPL is, in general or as applicable to the specific case, a contract, it found that the SFC’s contract claims in the case are distinct, legally cognizable claims that are not preempted by federal Copyright law, so the case can be litigated in state court. It is there that the contract claims, including the threshold issue of the existence of a contract, will be addressed.

(2) Ruling that the GPL is (at least in the context of specific facts between particular parties) a valid contract isn't new [0], so (even if this ruling did find that), it would be odd to paint this ruling as a watershed for finding that:

[0] https://qz.com/981029/a-federal-court-has-ruled-that-an-open...


I've learned, rightly or wrongly, to basically ignore the significance of court rulings unless they're the outcome of a protracted Jarndyce-v-Jarndyce-esque process litigated by huge companies with huge legal defense budgets, with all appeals except maybe SCOTUS exhausted.

These decisions otherwise seem to get overturned in the future when you have a party with sufficient motivation+resources which is incidentally when they would matter the most.


A local stand-up comedian once quipped, "Why do we even have <lowest-level court>? They're always wrong!"

It stuck with me because then I read the news and realised they were right! The lowest level court rulings very often get overturned when challenged in higher level courts.

Of course, even later, I realised it's just selection bias. Cases are not brought before higher level courts unless in those specific case someone is fairly sure they can get the verdict overturned.


> “The ruling is a watershed moment in the history of copyleft licensing. This ruling shows that the GPL agreements function both as copyright licenses and as contractual agreements,” says Karen M. Sandler, executive director of Software Freedom Conservancy. Sandler noted that many in the Free and Open Source Software (FOSS) legal community argue incorrectly that the GPL and other copyleft licenses only function as copyright licenses.

If the GPL is a contractual agreement, does that mean that a court can require that an entity to release the closed source portion of infringing software that uses the GPL?

If that is the case, the legal jeopardy involved with using GPL software just got a lot higher.


>> The funding bodies want us to detail all expenses and justify all the changes in the plan, because they don't want people to say that the public funds are mismanaged. This is just an example. We also write tons of useless papers, to justify that we are productive with this money.

That has always been the case. The alternative would be to disclaim the GPL and face straight copyright infringement, which in the US can be as high as $150K per copy. No company making wide use of GPL and infringing it would want to go the copyright route.

The GPL is not really dangerous except to someone with no legal clue who is deliberately ripping off free software.


> The alternative would be to disclaim the GPL and face straight copyright infringement, which in the US can be as high as $150K per copy.

Per work, not per copy.


Oh my bad. The wording is per infringement, which does seem to mean per work rather than per copy. That makes it perfect for going after individuals but not corporations - because it's peanuts to them.


It might be peanuts if it was a one-time thing, but if they kept infringing I would expect they could be sued again for the additional infringements.

Statutory damages in the US start out in the $750-30000 range, and can be raised up to $150000 in the case of willful infringement. The burden of proving willfulness is on the plaintiff, but that shouldn't be too hard if the defendant already lost once and is continuing to infringe.

I'd expect courts to start going higher and higher up the range for damages the more times they see the same defendant losing for continued infringement of the same work.

I'd expect that this would get the defendants to start complying with the license and release the source.


Companies should be more worried about injections than infringement. Sure they might pay court fines, but courts can also order them to stop infringing immediately. Continuing to infringe after a court order is a very different issue, and isn't about copyright law it anymore.


You pay for all the software you use, unless you are in a country with public domain and the software is clearly cast into it.

Some software you pay for in dollars. Some in postcards. Some by exchanging patent rights, or promising not to sue. Some by accepting contracts to contribute back changes you make, under certain circumstances.

There is no legal jeopardy involved in using GPL software that is different from buying a math library: you read the contract, you pay the price, you use the software in accordance with the contract.

Violate the contract, penalties attach, starting with enforcement of the contract.


> the legal jeopardy involved with using GPL software just got a lot higher

Not at all. If you are a developer, this only protects you from patent trolls or any confused company that might sue the wrong person.

Same if you are a user.

The only "legal jeopardy" is for those who repeatedly violate developers and users right. And that's a good thing.


That was always the case. This simply alters who can enforce it.


The requirements were there, but yes, now you go from a relatively friendly group of developers eager to see code shared around to the SFC, which has very strong views on things like unlocks on hardware - I think it is potentially a pretty major change here.


I believe both of these statements are correct.

One of the interesting effect of finally litigating the GPL is that the 'theoretical' implications become a matter of fact. And with that comes a bunch of clarity around what the risks are of using GPL software in your products.

It will be interesting if GPL "wins" and a bunch of companies immediately tells their employees to strip every bit of GPL code out of the system and rewrite from first principles any function that is required for the product to operate. There will be a market for programmers who do systems programming (which is currently not a big market, but it will get bigger.)


> what the risks are of using GPL software in your products

"Risk" is a weird way to phrase it. It's a cost for taking advantage of someone else's work, just the same as if you paid for a library. If you're not willing to pay the cost, don't use the software, just like companies would tell their employees not to use a pirated version of Photoshop.

> It will be interesting if GPL "wins" and a bunch of companies immediately tells their employees to strip every bit of GPL code out of the system and rewrite from first principles any function that is required for the product to operate.

This seems unlikely. Is it really that common for companies to violate the GPL today?


I'm interested in what makes you think the term 'risk' is weird. In my experience most, if not the majority, of business decisions a company made were composed at the management level as a trade-off between risk and reward. The decision process included a list of things that could go wrong, or take longer than expected, Etc and those things were in the risk category, and things like time to market, operational efficiency, better margins, Etc. were in the reward category.

From that perspective the choice to use open source software in their product seemed to often include two risks, one was how would you respond if it broke and the other was what would you have to do to replace it if it became unavailable for some reason. To use a pretty well known example, the Android system from Google, which you could compile and run on your phone for "free" but the risk was that Microsoft would (and did) come after you for patent infringement if you used it in a phone [1].

The risk here was to margins, where a manager might assume the cost of shipping this software was $0 (no license cost) and have it end up costing $Y because of patent fees.

When Blekko was acquired by IBM we had to "blue wash" our code, which was to go through and identify every copyright, every comment that might imply ownership, and figure out if it was "okay", "not okay", or "needs more research." That entire exercise was described as "Minimizing the risk that the IBM company will be sued because they are using the code for your product."

So that is where I'm coming from here.

[1] https://finance.yahoo.com/news/microsoft-may-relinquishing-b...


> Is it really that common for companies to violate the GPL today?

Every company I've worked at is careful about GPL. Some are more careful than others, but they all put at least some effort into ensuring nobody brings in GPL libraries.

As a lawyer explained to me, they understand at some point GPL code will be shipped - it is too tempting. The real goal is to ensure that when it happens they can convince the courts it is a rouge employee doing something he wasn't supposed to, as then the penalty is a slap on the wrist and a bunch of developers emergency switched to rid our stuff of GPL. If the courts decide the company didn't do enough to prevent infringement then the court will decide that it was company policy to make their product open source and the courts will force the release of source code. This is why all developers I work with have to take open source training, we have someone assigned to audit all our code, and we have bought tools that look for potential open source code, it all builds a case before the court. To my knowledge the above as kept us from infringing in the first place, which is the real goal, but since all tools have holes eventually we can assume it won't.


> There will be a market for programmers who do systems programming (which is currently not a big market, but it will get bigger.)

What‽ The market for systems programmers is enormous! You think "smart" things program themselves? What about cars or industrial systems or traffic lights or well, literally everything that isn't running on a full blown computer?

Systems programmers don't get much play on open source sites like Github but they're probably the majority of software developers world-wide because there's vastly more embedded systems than there are desktop and servers.


Wow - to say this is a major major result in an understatement. This is going to turn GPL litigation on its head, and allow more activist type folks to pursue cases aggressively. On the developer side I can see a move away from GPL - as adding third parties into this is going to be pretty unappealing for some developers.

I think historically distribution of source code was seen as a condition of the copyright license (which meant copyright holders enforced), not as a separate contract right available to third parties (which would mean users and other can go after a variety of claims).


On the contrary, as a developer, this makes GPL even more appealing to me.

I don't have time, money or energy to sue someone for using my code and not giving back.

But if downstream users can, and the math changes.


True. As a original developer of code, it protects the original author and the real user. However the middlemen (companies who make money using others code) may not like this.


Someone could "use your code and not give back" while staying perfectly within the limits of the GPL, though. For example, they could use and modify your software in an internal package.


Yes, and that's good. Internal use is different from redistribution.

The important point is to prevent freeloaders from taking credit from your work [and sometime even competing against you].


This is something that's always been slightly unclear to me. I think you should be able to do whatever with any copyrighted code that's been published (by someone who has the right to do so) for your own personal use, regardless of license. Clearly publishing this copyrighted is not possible without some kind of license.

However where 'personal use' ends and 'publishing copyrighted code' begins is not entirely clear to me. Does an internal tool in a company still count?


> Does an internal tool in a company still count?

I would think so, yes. If I take a piece of information and do something to it inside my house, that's my business. If I show it to my friend, it's between him and me. If it let my coworkers see it so that they can only see it within the office, it's between them and me. And so on. The only issue would arise if an employee asked to see the source of such an internal tool and was denied.


The FSF FAQ explicitly states that internal use within a corporation does not count as distribution. It's one legal entity and can't violate copyleft on its own. A gray area would be a subsidiary or joint venture sharing with a parent.


That's really interesting, because if a corporation bought a physical book, scanned it, and distributed it internally that would be a clear violation of copyright law.


GPL is copyleft (copies authorized by default) until you violate the terms. Then normal copyright law applies and it's the same as an unauthorized book copy.


> The FSF FAQ explicitly states that internal use within a corporation does not count as distribution.

It's probably a good thing on balance since it's one less barrier to companies using code under the license, but considering companies and their assets (including their internal tools) can be bought and sold, I'd personally consider that distribution enough.


Your reasoning suggests the terms of the copyright license do apply when used as an internal tool (you'd be free to keep the code hidden otherwise) in which case preventing anyone from publishing any work derived from code under a copyleft license seems impossible. At the very least the GPL doesn't seem to allow you to create a derived work and require people to keep it secret even if it's just internal to the office (though I guess they could keep it secret willingly, I just see no way to legally compel them).

This seems different from something that's purely personal use. I don't think it makes much sense to force a program to show a notice its GPL licensed if you're the only one using it for instance. In fact that seems to run counter to the intent of free software.

It's possible that legal systems treat this situation differently, but I think it makes far more sense if you don't need an additional license to use stuff that's already published by the copyright holder until what you're doing starts to go beyond just personal use.


Of course; those are freedoms 0 and 1 guaranteed by the license. It seems like "use" sometimes means "include in a downstream software package and redistribute modified versions of".


My point is that just having the GPL doesn't guarantee that modifications will be contributed back or published, even without violating the license.


Right, GPL only requires contributing forward, to the downstream users. It is only through creating a culture of working upstream and or reaching out to downstream redistributors that a project gets any contributions back, including financial contributions.


In the old model in that case you could assign or work with any of the litigation groups already doing the work needed to allow them to sue on your behalf.

Downstream users can also of course sue you if you work on a project with a few other people under the GPL even if they didn't write any code or contribute.


On the developer side I see the opposite: End users that are complaining can now deal with problem themselves without having to pester (or even find) the developer.

Anything that amounts to less pestering of developers is (probably) a good thing


I'm unsure of how the burden of proof would work if the developer is not involved. The end user may have a hard time even guessing whether a piece of GPL software is embedded in the defendant's software.


Someone with enough knowledge to provide the proof would still need to be involved, but it doesn't have to be the original developer(s).


This just makes me more confident in choosing GPL licenses for my projects in order to ensure user freedom.


Exactly. The choice of GPL is an explicit choice to protect end user freedom over reducing intermediate developer & corporation hassle. If you want to ensure end-user freedom, BSD, MIT, Apache style permissive licenses don't cut it. If you want to become a developer celebrity and have your open source project used in projects everywhere, or if you are a company and you want to hook other devs on your freemium open core product, then those licenses are for you. The decision about whether to use the GPL or not is far more nuanced and there is no one-size-fits-all license out there. If there was I suspect we'd all use it...

Interestingly in this case, this ruling also reduces intermediate developer hassle for devs who are already used to working with GPL code. So that's a nice win (=


> protect end user freedom over reducing intermediate developer & corporation hassle

Actually it also reduces intermediate developer hassle: it's better if I don't have to rely on closed source firmware, firmware updaters, drivers, SDKs, proprietary tools.

It create openness in the whole software stack.


Agreed.

Will be interesting to see where development / contributions by various players go in the future.


Then this will be a good result.

You of course may be sued yourself if you have a project using GPL'ed code that doesn't comply with the the current view of GPL (ie, release of encryption keys) or if you infringe your own GPL copyright in some proprietary project (ie, GPL code where user was promised access is in something that you don't want available broadly).

This is all good for users for sure for things like open core projects and projects that used to be open but moved away etc


You could only infringe the GPL copyright if you change the GPL license wording itself. The GPL license is a license that allows software using your copyright code to be used by others under certain conditions but at no point does it violate the law and remove your copyright in your own work, so there is no way someone could sue you (and win) for using your copyrighted work as you see fit, including licensing it under a separate distribution license to some third party.


That's the change here. Historically the GPL distribution language was a condition of the copyright license, so exactly as you said, no one could sue you because there was no separate contract element to end users binding them into a contract with anyone.

That is what is so exciting / different about this. When you make available software under the GPL, you have now entered into a CONTRACT (not copyright anymore) with all users that binds you to the terms of the GPL and gives them a right to sue for violations of THEIR independent rights.

This is the power of this new ruling, they can then sue you or anyone for breaking this agreement with them. Obviously will take some experience to see how far this can be taken. My understanding is the conservancy may want to try to leverage this to try to get GPLv3 effects into GPLv2 and a few other things the developers of for example Linux are not so hot on.


> When you make available software under the GPL, you have now entered into a CONTRACT (not copyright anymore) with all users that binds you to the terms of the GPL and gives them a right to sue for violations of THEIR independent rights.

Sure, anyone can sue you for anything. However nothing in this removes the copyright holders' ability to issue non-GPL licenses. A user of a product that uses a non-GPL license for that code would still have no standing for that suit.


Correct.

Historically one could contribute to a GPL project (potentially on a significant level for a corp) but wouldn't worry too much about using it in your own product that was potentially locked down - ie, DRM / motor duty cycle control, rev limits etc.

Linus / Linux have a long history of being pretty relaxed about your use cases, with the one key provision that you share your code.

Now, the group of people who can sue you is much larger. And some of them (conservancy in particular) may have views that don't align with your GPLv2 interpretation (particularly around tivoization / lock down issues for hardware devices). So if you are contributing too and shipping GPLv2 code - yes, you as the distributor of a larger body of code probably have a higher risk now of being sued.


Some links on the topic of GPLv2, installation, tivo and GPLv3. The Conservancy position seems to be that GPLv2 requires allowing installation but that what Tivo did (breaking proprietary software when you modify GPL software) is allowed by both GPLv2 and GPLv3. The main reason the GPL exists is to give downstream users the right to run modified versions, so their interpretation of GPLv2 seems reasonable to me.

https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017...


That is the SFC's position.

The main reason the GPL exists was to insure changes to code (forks) were available to original developers of the code so they could include those changes if they wanted (this was a result of issues with earlier unix systems that had fragmentation from forks). Additional, Linus, author of Linux, has been clear that his focus is getting code back, what happens to hardware was not covered in his mind by GPLv2.

So there is a dispute as to what GPLv2 requires with respect to hardware. It's clear that the code must be shared, and that's what a lot of GPLv2 devs have focused on. That the source code be shared, including scripts used for compilation and installation.

But (one view) is that is separate from mandating behavior of hardware, and that hardware can still check if its running approved code and refuse to run if approved code is not loaded.

That's why this case is so huge. The actual developers of Linux are not likely to try to enforce a term they don't think exists, the SFC very well may.


Nothing in the GPL requires giving back, only giving forward to downstream users, who may or may not give back or even publish what they received.

So what Linus wants from the GPL isn't even mentioned in the GPL.

It is only through a culture of contributing upstream and through upstreams reaching out to downstream redistributors and asking them to contribute upstream that anything gets upstream at all.

I suggest you read Conservancy's posts and the GPL, it does mention that installation is required to be possible and this requirement has always been present and enforced by copyright holders for GPL software, including for Linux itself.


> You could only infringe the GPL copyright if you change the GPL license wording itself.

Only if you had a time machine. Once you’ve distributed the code the horse has left the barn.

You can impose a new license on new versions of the software though.


You seem to have the concepts of copyright and license confused.

> you infringe your own GPL copyright in some proprietary project

You can't infringe your own copyright. If you own the copyright to the code, you can't violate GPL by using it, even if that code is licensed under GPL. This is because a copyright holder releasing only their code under one license, can also release that code under another, proprietary license.


That's what's so new about this. There is now a contract (not copyright) element - which binds you and the recipients of your code.

If you contribute to an open source project, then use that code in for example a locked down device, a user / conservancy who views that as a violation of GPL can sue you. That's important because historically developers on linux kernel have not agreed with conservancy views on things like encryption keys, and so have not pursued these types of claims and were somewhat unlikely to fully litigate claims against other contributors especially beyond just sharing code back.

As the conservancy notes, the universe of potential claimants (even with bogus claims) is now much much larger.


> If you contribute to an open source project, then use that code in for example a locked down device, a user / conservancy who views that as a violation of GPL can sue you.

If it is only code you wrote and you haven't transfered your copyright to the project, then No, this creates no standing.

> That's what's so new about this. There is now a contract (not copyright) element - which binds you and the recipients of your code.

Incorrect, there is a contract that binds you and recipients of the code under a GPL license.

If you receive that code under a different license, that contract doesn't exist.

Edit: Let me put it this way. Let's say you create a library and make it available under GPL. Any company that uses your code under that GPL license, has entered a contract with you that allows users of their software to sue them for GPL violations. However, you can also simultaneously offer a non-GPL, proprietary license for that library to paying customers. Those paying customers would not be part of any GPL contract, they would instead have whatever contract they signed with you when buying the proprietary license. The users of that paying customer would have no grounds to sue that paying customer, because that paying customer never agreed to the GPL contract. (OFC if you use other people's code in your library under a GPL license, then you don't have the legal right to offer a propriety license for that code.)


You are missing a large value to GPL code, it's often developed collaboratively.

Consider carefully your example, you've contributed to some GPLv2 body of code. Now you ship that code on your device (making available corresponding source code, but not decryption keys). You are not the only copyright holder, this is a collective effort.

Can you avoid the GPL'ed requirements? No. More critically, this allows new requirements to be asserted (under the GPL) that GPLv2 developers might not have considered something they want to enforce (hardware unlock) but users and activists might want to try and enforce.

All good for the users. Glad to hear this is welcomed by developers and those hiring open source contributors. This is still going to be a change from past GPLv2 experience I think for some / many.


I'm missing something here. Are you saying that people should be able to (or were previously able to) violate the GPL with software that they contributed to, but didn't completely write? What about the rights of the other contributors?

edit: if not, maybe you're trying to say that the people who control the license to the project (and have the contributors' agreements to prove it) can't relicense the code however they want (and however is allowed in the agreement) for whoever they want? Because I don't think that's true.


In the past if you were a contributor and violated the GPL in terms of your product (that used yours and others code) it was only other contributors who could sue you (ie, you broke your deal with them, and they had the copyright that was violated).

There are different views on the GPLv2. Most of the contributors / developers on GPLv2 just wanted you to share back your code, so most litigation in this space followed that approach. Even there, it was at times pretty cooperative.

The SFC has a MUCH more aggressive view. They have views around DRM / unlocks on hardware and much more that are very user rights focused, but pose complications to developers. In the past though, they really couldn't pursue these claims because despite lots of contributors to projects, many didn't support their approach and so wouldn't work with them to make copyright claims. To give you a sense of some developers views:

"lawyering has become a nasty festering disease, and the SFC [Software Freedom Conservancy] and Bradley Kuhn has been the Typhoid Mary spreading the disease." - Linus Torvalds (key player in the Linux kernel development).

They and the EFF created Affero GPLv3 and GPLv3 to try and solve for some of the issues they felt were important, but developers didn't really get on board.

The key is SFC can now sue folks making and distributing devices with OSS software WITHOUT any permission or input from the creators and copyright holders of the software, that is what is so huge. And this is particularly important because many authors and copyright holders have different views on these issues compared to the SFC.

We went though this once with GPLv3 already. SAMBA for example moved pretty aggressively to GPLv3. I'm not sure apple kept contributing to it or updating it in their software once that happened.


> The key is SFC can now sue folks making and distributing devices with OSS software WITHOUT any permission or input from the creators and copyright holders of the software, that is what is so huge. And this is particularly important because many authors and copyright holders have different views on these issues compared to the SFC.

Sure, its easier to get standing to enforce GPL, but the legal requirements of abiding by GPL have not changed due to this decision. The only change is that GPL violations that were hard to pursue are now easier and people that have been violating GPL will be more likely to face consequences.

If this that GPL projects have lower adoption rates then that is because fewer people who would have violated the license will bow avoid it. Similarly, if fewer projects areadr available as under GPL, it is because they are adopting licenses that have fewer restrictions.

I don't personally see the advantage of having a more difficult to enforce license. Either your license accurately matches your intent in a court of law and should be enforced rigorously, or it doesn't match your intent and you should use a different license.

Selectively enforced licenses seems like selectively enforced laws: ripe for corruption.


Its interesting to note that the GPLv2 doesn't say anything about sharing back your code, only sharing forward your code to downstream users (who might or might not then share that code back upstream). So downstream users have the same access to software as upstream authors; that makes the SFC position seem much more consistent with the GPL than what Linus says.


> as adding third parties into this is going to be pretty unappealing for some developers

On the contrary: the GPL is meant to PROTECT developers from patent trolls and freeloaders who what to turn FOSS into unpaid labor.

It also protect users, and all developers are also users.


Nothing in the GPL does anything about freeloading; I'm using lots of GPL projects without contributing back funding, bug reports or patches, for eg glibc, GCC and so on.

The only thing the GPL does is give the same access copyright holders have to software to downstream users.


No. I wrote "freeloaders who what to turn FOSS into unpaid labor".

Simply using or modifying for internal use is OK.

We cross the line into unpaid labor when I release an application or a game, and somebody changes the name, maybe makes minor improvements, then sells it and takes all the money, takes all the credit, and even competes against my own software.


That sounds like a description of what literally every Linux distro does. Take your code, potentially make a (minor) fork of it, sells access to it, sells support for it, maybe sells hosting for it (Amazon), takes all the money, maybe gives back patches or maybe not and competes with your own builds of the software.

I think that what you want (no competition from forks or downstream redistributors) would not comply with the Open Source Definition (or DFSG) nor the Free Software Definition.

https://opensource.org/osd https://www.gnu.org/philosophy/free-sw.html


> The only thing the GPL does is give the same access copyright holders have to software to downstream users.

I think that's what GP meant by preventing freeloading. Anything you do with the source code to GPL software needs to itself be distributed freely. Ie, a company can't freeload off of your work to build and then sell a proprietary project.


Right, but they can freeload off your work and sell a GPL project (or even sell just setting up the project), distributing source to users, but those users not publishing or doing anything with the code and you not getting modifications back nor any kind of financial support.


Great. I'm even more likely to use GPL now (which is a complete 180 from my early days where I would only consider BSD or MIT).


So pretty much every line of code I've written in my professional career has been GPL licensed (I work for an open source software company), but I understand why some people - even those that are strong supporters of free software - take issue with the GPL and similar licenses.

For me, the biggest problems are:

1) Strong copyleft licenses often end up being incompatible with other free software licenses, especially other strong copyleft licenses. GPLv2(not +) and GPLv3 are incompatible, GPLv2 is incompatible with Apache 2.0, etc. Proliferation of strong copyleft licenses can therefore create serious interoperability challenges even within the free/libre software ecosystem.

2) LGPL is deeply tied to the technical specifics of how libraries and executables are linked together. This might have been reasonable when 90% of software on Linux was written in C and most developers could be expected to deeply understand those concepts, but it is no longer a reasonable expectation. Understanding how to comply with LGPL when it comes to C++ with templates, or Rust, or Go, or C with LTO techniques and inlining, is now an incredible headache when compared to licenses like MPLv2 that are approximately similar in scope but much simpler to understand.

3) The definition of "derivative work" is too broad. The FSF considers that re-implementing a library in an entirely different language would be a "derivative work" [0] Perhaps that's fair enough - if the translation is basically identical. But what if it's not? Where does the line between derivative and non-derivative work lie? If I was a very active contributor to some GPL project, and years later I decide to write a vaguely-similar-but-different program in some entirely different language, is that a derivative work? Do I need to walk a lawyer through every line of code?

These incompatibilities and chilling effects do come with a cost to free software as a whole. I still think GPL can be good for many types of software but in some respects it really can get in the way of proliferating free software.

[0] https://www.gnu.org/licenses/gpl-faq.html#TranslateCode


I'm not wed to GPL specifically but I feel better if the license is tested rather than theoretical so cases like this are a step forward. Without getting into details, I've released BSD-licensed software that has been used in commercial products and integrated into the surveillance apparatus (without my knowledge or consent). A copyleft license would have made that more difficult so the stronger the better IMO.


This reminded me of the French case in 2020 (same conclusion): https://news.ycombinator.com/item?id=24478769


Unlike common law systems, in the continental European civil law systems there is no concept of a "copyright license" separate from a contract. The only way private parties can put obligations on each other is by contract.

If someone creates derivative works of GPL software, they could of course claim that they have not accepted the GPL contract, but in that case they would plainly have committed copyright infringement.


This decision does not establish that the GPL is a contract. This decision of the federal court only says that SFC made contract claims that are not preempted by the Copyright Act, and therefore the case belongs in state court where SFC had originally filed.

So, now it's back to state court where that court will decide whether there is any merit to SFC's claims.


Hard to assess with regard to right-to-repair, but many companies have gotten in trouble by assuming that open source licenses of one kind or another are just some hippie/commie psychodrama.

That's all true until the process servers turn up.


Total tangent, but now I'm curious...

If a U.S. corporation has a registered mail address for legal service, is there ever a need to get a process server involved?


Really don't know but this page, for California corporations, seem to say that's one way.

https://www.sos.ca.gov/business-programs/business-entities/s...


In California.

EDIT: I’m wrong and need to pay more attention. See comments below.


No, that's the whole point. The lawsuit started in California, but Vizio tried to move it to federal court claiming that since it was a copyright claim it belonged in Federal court and not in state court.

The federal court said that because this was a contract issue, not just a copyright concern, that copyright law could not be used to bypass the contract law to move the case to federal court.

>The May 13 ruling by the Honorable Josephine L. Staton stated that the claim from Software Freedom Conservancy succeeded in the “extra element test” and was not preempted by copyright claims, and the court finds “that the enforcement of ‘an additional contractual promise separate and distinct from any rights provided by the copyright laws’ amounts to an ‘extra element,’ and therefore, SFC's claims are not preempted.“

This isn't California specific at all.


> This isn't California specific at all.

It's a District court. This is specific to California by nature of the jurisdiction. The finding of the Honorable Josephine L. Staton is, an element of that case, not the ruling. This will end up in the Appellate.

It's a good first step, but don't overstate the facts.


> This will end up in the Appellate.

Maybe, but that isn't clear. They will try to appeal, but it isn't clear if the appeals court will accept the appeal. If the court doesn't accept the appeal, then all courts will be informed about this for future cases as lawyers try to build their case before whatever court they are in front of. If it is appealed, then whatever the final appeal result is will win (final appeal can be different in different courts so there could be conflicts until the supreme court takes this.).

My guess is the appeals court won't take this. Just a guess though.


Read more carefully. The decision to send the case back to California on the argument that it wasn't solely a copyright matter was made by a federal court. It wasn't a California court decision.


Even if the claimant wins the case "just" in California, it impacts all companies doing business in California. And since almost every large (US/World) business operates in California, this ruling will help all consumers/customers of those companies.

(Late addition): In fact, it seems that SFConservancy _wants_ the case to be tried "just" in California, hence the fought in Federal court and brought the case back in a State court. Perhaps the advantage is that it's easier to win the case at State level, but the ramifications of a win will be US-wide, or even Worldwide, as explained above.


Parent is right, sort of - it's only in US for now. It would be interesting to see this tested in other courts of law and included in trade agreements.


Judges in Europe have ruled that software licenses are contractual agreements. So we already have some case law in some countries establishing this.

The tricky bit in common-law countries like the USA and UK is that normally, a contract requires three things: an offer, acceptance, and consideration -- something of value exchanged for the offer in the contract. No consideration means no contract, and the license reverts to a bare license -- one that can be revoked at any time for any reason. If we now have case law establishing that the GPL fulfills the requirements of a contract, that will make software under the GPL safer, as it will not be at risk of having the copyright holders revoke permission to use or distribute it once it's out there under the GPL.


A state with a population of 40M people. If CA were a country it would be 37th in the world. Importantly software available in the US will ultimately be available to CA citizens.


Different things are available in different states all the time.


[flagged]


This isn't as clear as you imagine.


It's always seemed to me that IP laws state you can not copy copyright material and use it (outside of a few specific fair use cases), unless you have permission from the person who owns the copyright.

I don't see why the Linux kernel is any more or less covered by that than say the Windows kernel or Avengers Endgame

Now I can see arguments about whether loading such code into memory is "copying" it or "using" it, but I think everyone agrees that you can't take 30 minutes of avengers, or half the windows or linux code, and incorporate it into your product, unless you have permission of the person who owns the copyright.

The GPL is an offer to allow you to do things with the copyrighted code if you maintain certain specific. You don't have to accept that, you're then just covered under copyright (no copying, reproducing small amounts for review or critique is fine, selling it to someone else is fine, etc)

Arguably you could use it even if that involves transitory copying of the code into memory, arguably you can modify that code to yourself as long as you don't copy it (presumably that means you have to accept that "to copy" doesn't mean loading it into memory, or even moving it from one disk sector to another, etc)

But the principles of copyright law and how various microsoft, gnu, linux, and disney licenses can apply to give you more rights has always been clear to me.

However what's interesting in this case, and what I would agree isn't clear, is the person bringing the case isn't the copyright owner though. If someone sells you stolen goods, can you sue them?

> In this case, Software Freedom Conservancy hopes to demonstrate that it's not just the copyright holders, but also the receivers of the licensed code who are entitled to rights.


> However what's interesting in this case, and what I would agree isn't clear, is the person bringing the case isn't the copyright owner though.

You're right, which is why SFC's case is entirely a contract law case. SFC argues (1) the GPL is a contract between the software creator and Vizio, (2) Vizio has a contractual obligation to publish their modified source code, and (3) SFC has the right to sue because they are a third-party beneficiary of that contract.

Here, this decision only states that SFC's contract claims aren't preempted by the Copyright Act and therefore the case belongs in state court. The case was originally brought in state court, but Visio successfully argued that SFC was essentially making a copyright law claim disguised as a contract claim, and therefore the case belonged in federal court. (Edit: I was wrong about the procedure. See reply by dragonwriter.)

So, now it's back to state court where the court will decide whether there is any merit to the contract claims.


> The case was originally brought in state court, but Visio successfully argued that SFC was essentially making a copyright law claim disguised as a contract claim, and therefore the case belonged in federal court.

Vizio unsuccessfully argued that: this is the decision on Vizio’s attempt to remove the case to federal court, which SFC opposed.

(The nature of removal is such that it always “succeeds” in the limited sense that the removal itself is a federal question resolved in federal court, but Vizio never succeeded in convincing any court that the case should be removed.)


Ah, you're right. The initial filing by Visio was a notice of removal. There is no argument or decision by the court on the notice. SFC responds by filing a motion to remand, which is what this decision relates to.


could a YNews moderator or other knowledgable person here please explain why my opinion above is now marked 'flagged' ?


If your question is about what the flagged label is about : https://news.ycombinator.com/newsfaq.html


Mechanically any user with sufficient karma can click "flag" on comments, enough people clicking that and it get's flagged and people without show dead on it don't see it.

I didn't flag your comment, but I came very close to doing so.

Personally I couldn't figure out what you were trying to say. What am I supposed to be deciding for myself? Are the organized groups you're referring to companies trying to use GPL code without a license? Groups trying to use the GPL as a tool to get access to other companies closed source code? IP lawyers trying to make a profit? Something else?

Flagging nonsense (as in literally not-understandable comments) seems like the right thing to do to me. I would have flagged it over that, but for michaelmrose's reply that indicated that they at least managed to parse your comment.

I'm also generally very wary of the phrase "decide for yourself", it's not objectively incorrect, but it comes across as asking people to ignore better informed people's opinions, which is the exact opposite of what you should do when reading comment sections on the internet.

I think another commenters point that you're making fairly baseless accusations against people who like the GPL might be correct, but that didn't weigh in to my decision to flag it or not because I honestly didn't (and still don't) understand your comment. If I agreed with them that that is what your comment was doing, I would have been more likely to flag it - because insulting groups of people rarely leads to fruitful discussion.

Hopefully that helps...


It’s not up to the moderators. It’s likely because you made a fairly baseless accusation about people who prefer GPL.


Possibly because punctuation, capitalization, and miscellaneous mistakes make the comment really hard to parse. Some people may just give up and regard the comment as what it "smells" like: The type of troll comment you often see on HN.

Even allowing for that it is worded rather... inciteful.

I parsed your comment as: "Some organized people will take advantage of GPL software, very few care and are willing to defend it, while the vast majority are indifferent. I do not intend to elaborate."


I thought it was provocative to choose a side, yes, as in "anti-indifferent" ... I did not intend or even see it as 'troll' ..


Get enough downvotes fast enough and it gets flagged


No, flags and downvotes are independent. [flagged] means users clicked 'flag'.

Sometimes moderators also add [flagged] to a post, but much less often, and we didn't do that here.


thx dang, perhaps it was lazy of me but I did not intend to break guidelines here


I didn't consider it flag worthy personally I thought it was merely unclear and needed clarification as to what you were asserting.


yeah - it was lazy and sort of political.. that's true and in hindsight maybe not helpful (downvotes) but to be 'flagged' means it broke some guidelines, which I doubt. It does need clarification, agree.


flagged just means enough users flagged it. Most tossed-off one-liners are eminently flaggable because they break the hn prime directive of 'curious conversation'.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: