Re: GPL violation by Renault (R-Link system)

[Marc Dietrich]

Hi again,

Am Donnerstag, 10. April 2014, 16:46:22 schrieb Marc Dietrich:
> Hi,
> 
> the Renault R-Link system
> (http://www.renault.com/en/pages/legalinformation.aspx) is a
> navigation/entertainment solution installed in many newer Renault cars. It
> is original developed by TomTom (www.tomtom.com) but distributed by
> Renault. The System is based on Android 2.2 and runs a linux kernel. I
> haven't analysed the bootloader yet, but other tomtom products use uboot.

I just want to inform you that things moved a bit in the mean time. I checked 
yesterday the TomTom site (www.tomtom.com/gpl) and found a source code release 
named version tt146818! AFAICT, it contains all (L)GPL'd programs.

Some issues still persist: 
 * The released version tt146818 is dated from January, this year. Since then, 
several new versions have been released. Also there is no source for the older 
released versions (more than 10 or so). While not all versions may contain 
changed the GPL'd software, I know that at least the kernel was updated 
several times. I know this might be a problem for many applications, not only 
R-Link/TomTom/Renault.
 * Since this a an omap embedded board, there should be some first stage 
bootloader (the 2nd stage is uboot). The first stage bootloader is usually 
also uboot, in a very stripped down version, but there is no source for it 
released. While it's possible that there is something else (or maybe the 2nd 
stage contains the 1st stage), I doubt this. On the other hand I also cannot 
prove it, because I have no binaries for the bootloader(s) yet.

Ok, that's all I found so far. I like to express my thanks to all people who 
helped in this case. It also shows that with some public pressure, certain 
companies can be convinced to release the source code of the GPL'd software 
they make money with.

Marc

> 
> You can download  a copy of their filesystem from
> http://download.tomtom.com/sweet/navcore/system-update_1467818_all.ttpkg
> which can be converted to a regular tar archive by this small bash script
> (you need a recent dd version for this)
> 
> #!/bin/bash
> 
> while :; do
>dd conv=notrunc bs=102400 iflag=skip_bytes,fullblock \
>oflag=append skip=20 count=1 2>&1 >&3 | grep 0+1 && break
> done < <(tail -c +9 system-update_1467818_all.ttpkg) 3>&1 | tail -c +55 >
> system-update_1467818_all.tar
> 
> I ask tomtom first because the "copyright" app shows an offer by tomtom to
> deliver the source, but they said that Renault is responsible (which is ok I
> think because they distribute it).
> 
> So I ask Renault Deutschland (where I got the car from) and they refused
> saying they can't do it. Translated response:
> 
> "Dear Mr. Dietrich,
> 
> after internal review of your request we can tell you that we as Renault
> Deutschland AG can't help you, that means we can neither correct the license
> text, nor we can supply the source code."
> 
> [...]
> 
>Renault Deutschland AG
> 
> [...]
> "
> 
> I wrote a letter to the FSF explaining the situation and I'm waiting now for
> an answer. Is there anything more I can do?
> 
> 
> Regards,
> 
> Marc


signature.asc
Description: This is a digitally signed message part.

Re: GPL violation by Renault (R-Link system)

[Marc Dietrich]

Hi,

Am Donnerstag, 10. April 2014, 16:46:22 schrieb Marc Dietrich:
> Hi,
> 
> the Renault R-Link system
> (http://www.renault.com/en/pages/legalinformation.aspx) is a
> navigation/entertainment solution installed in many newer Renault cars. It
> is original developed by TomTom (www.tomtom.com) but distributed by
> Renault. The System is based on Android 2.2 and runs a linux kernel. I
> haven't analysed the bootloader yet, but other tomtom products use uboot.

I just want to inform you that things moved a bit in the mean time. I checked 
yesterday the TomTom site (www.tomtom.com/gpl) and found a source code release 
named version tt146818! AFAICT, it contains all (L)GPL'd programs.

Some issues still persist: 
 * The released version tt146818 is dated from January, this year. Since then, 
several new versions have been released. Also there is no source for the older 
released versions (more than 10 or so). While not all versions may contain 
changed the GPL'd software, I know that at least the kernel was updated 
several times. I know this might be a problem for many applications, not only 
R-Link/TomTom/Renault.
 * Since this a an omap embedded board, there should be some first stage 
bootloader (the 2nd stage is uboot). The first stage bootloader is usually 
also uboot, in a very stripped down version, but there is no source for it 
released. While it's possible that there is something else (or maybe the 2nd 
stage contains the 1st stage), I doubt this. On the other hand I also cannot 
prove it, because I have no binaries for the bootloader(s) yet.

Ok, that's all I found so far. I like to express my thanks to all people who 
helped in this case. It also shows that with some public pressure, certain 
companies can be convinced to release the source code of the GPL'd software 
they make money with.

Marc


> You can download  a copy of their filesystem from
> http://download.tomtom.com/sweet/navcore/system-update_1467818_all.ttpkg
> which can be converted to a regular tar archive by this small bash script
> (you need a recent dd version for this)
> 
> #!/bin/bash
> 
> while :; do
>dd conv=notrunc bs=102400 iflag=skip_bytes,fullblock \
>oflag=append skip=20 count=1 2>&1 >&3 | grep 0+1 && break
> done < <(tail -c +9 system-update_1467818_all.ttpkg) 3>&1 | tail -c +55 >
> system-update_1467818_all.tar
> 
> I ask tomtom first because the "copyright" app shows an offer by tomtom to
> deliver the source, but they said that Renault is responsible (which is ok I
> think because they distribute it).
> 
> So I ask Renault Deutschland (where I got the car from) and they refused
> saying they can't do it. Translated response:
> 
> "Dear Mr. Dietrich,
> 
> after internal review of your request we can tell you that we as Renault
> Deutschland AG can't help you, that means we can neither correct the license
> text, nor we can supply the source code."
> 
> [...]
> 
>Renault Deutschland AG
> 
> [...]
> "
> 
> I wrote a letter to the FSF explaining the situation and I'm waiting now for
> an answer. Is there anything more I can do?
> 
> 
> Regards,
> 
> Marc


signature.asc
Description: This is a digitally signed message part.

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Kern Sibbald]

On 04/27/2014 05:12 AM, Richard Fontana wrote:
> On Fri, Apr 25, 2014 at 12:02:26PM +0200, Kern Sibbald wrote:
>> Since I have worked with the FSFE since 2006, I am quite
>> familiar with the GPLv2 and AGPLv3 but am very far from being an expert.
>>
>> It would also be very useful to have information for developers.  In
>> particular, where I personally am unsure (please excuse me if these
>> topics are already covered):
>>
>> 1. Exactly who has the right to bring a lawsuit for copyright violation?
> Given that you seem to be asking about this specifically in the
> context of Bacula, I find your uncertainty about this interesting. Out
> of curiosity, is it your view that the AGPLv3 license on Bacula is
> coming from you, or coming from FSFE?

Please keep in mind that I am a free software developer since 1998 and
not a lawyer ...

More detail on my original question:

- What I understand is that only a copyright holder can initiate a
lawsuit, but the law is much more complicated than at first view.  You
don't need to answer, but here is an idea of where I was going, which to
me from a legal point of view gets very interesting ...

- What happens if there are multiple copyright holders?  (I believe any
can file a lawsuit but only for code for which they have a copyright). 

- If some copyright holders have an exclusive copyright and some have a
non-exclusive copyright, who can initiate a lawsuit? (I believe that
only exclusive copyright holders can initiate a lawsuit).

In response to your question:

My view about Bacula is that the Free Software Foundation has exclusive
copyright on "all" the Bacula community source code, and it is marked so
in the LICENSE file that comes with the source code. The exceptions are:
there are files used in Bacula that are licensed under less restrictive
licenses such as the 3 clause BSD, but these are the minority, and one
file contains a Bacula Systems copyright (inadvertently and now fixed)
but is licensed under the AGPLv3 so there is no issue with this file.

I also believe that I (Kern Sibbald) hold a non-exclusive copyright on
"all" the Bacula community source code.  I cannot speak for the Free
Software Foundation Europe, but my understanding based on the Fiduciary
License Agreement I signed with them in 2006 and the agreement they
signed with myself and Bacula Systems, is that they also agree that I
have a non-exclusive copyright on the Bacula community source code.  It
is very important to me what the Free Software Foundation Europe thinks,
because for me they are the "main copyright holder" for the Bacula
community source code.  However I refer you to what they have written:

   http://fsfe.org/activities/ftf/bacula-agreement.en.html

and the agreement itself, which is mentioned and linked to in the above
document:

   http://fsfe.org/activities/ftf/bacula-agreement-2013.pdf

Hopefully this answers your question.

Best regards,
Kern
  

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Richard Fontana]

On Fri, Apr 25, 2014 at 12:02:26PM +0200, Kern Sibbald wrote:
> Since I have worked with the FSFE since 2006, I am quite
> familiar with the GPLv2 and AGPLv3 but am very far from being an expert.
>
> It would also be very useful to have information for developers.  In
> particular, where I personally am unsure (please excuse me if these
> topics are already covered):
> 
> 1. Exactly who has the right to bring a lawsuit for copyright violation?

Given that you seem to be asking about this specifically in the
context of Bacula, I find your uncertainty about this interesting. Out
of curiosity, is it your view that the AGPLv3 license on Bacula is
coming from you, or coming from FSFE?

- RF

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Kern Sibbald]

On 04/26/2014 05:09 PM, Luke Kenneth Casson Leighton wrote:
> On Sat, Apr 26, 2014 at 9:44 AM, Kern Sibbald  wrote:
>> For the curious:
>> APCUPSD  (a free software project to integrate APC (American Power
>> Company) UPSes (Unterruptible Power Supplies) as a Linux Daemon
>> (service)).  In short a free software project.
>  ... not to be confused with CUPSD which is a *printing* service.
>  which is what i thought you were talking about :)
>
>> FLA (Fiduciary License Agreement) project of the Free Software
>> Foundation where they maintain the copyright for free software projects.
>  a link to a page on the FSFs web site would clarify further and save
>  you the effort as well.
Agreed.  Below is the link to the Free Software Foundation Europe's
Fiduciary License Agreement (FLA) program.

  http://fsfe.org/activities/ftf/fla.en.html

The following link provides information about Bacula (my free software
backup program) and the FLA that the Bacula project is using. It also
discusses an agreement with the open-core company, Bacula Systems SA
(founded by myself and other free software believers).

  http://fsfe.org/activities/ftf/bacula-agreement.en.html

I understand that some of you may "hate" open-core companies. 
Nevertheless, the above agreement, which is certainly unusual and maybe
unique, in my opinion situates Bacula Systems SA somewhere between a
free software company and a "normal" open-core company and thus is
positive for the free software movement.

Best regards,
Kern

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Neil Brown]

On 26 Apr 2014, at 08:44, Kern Sibbald  wrote:
> 
> APCUPSD  (a free software project to integrate APC (American Power
> Company) UPSes (Unterruptible Power Supplies) as a Linux Daemon
> (service)).  In short a free software project.

And very good it is too!


Neil


Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Kern Sibbald]

Hello,

Please find my comments in-line below ...

On 04/26/2014 12:46 AM, Luke Kenneth Casson Leighton wrote:
> On Fri, Apr 25, 2014 at 12:02 PM, Kern Sibbald  wrote:
>> Hello,
>>
>> I have downloaded your pdf and find it very interesting.  I have looked
>> at the table of contents but not yet read it, which I will do in
>> detail.  Since I have worked with the FSFE since 2006, I am quite
>> familiar with the GPLv2 and AGPLv3 but am very far from being an expert.
>  Kern: i won´t repeat the entire set of paragraphs here but i am
> concerned that you are using a huge number of acronyms without any
> kind of reference or context that allows people to understand what
> you´re saying.  without that ´reference guide´ is it actually
> impossible even to deduce the meaning or intent of *entire
> paragraphs*, thus throwing - and i am really not messing about here -
> the *entire message* that you´ve written - into total confusion and
> doubt.
>
>  and this was achieved - quite accidentally - because you assumed that
> people would know what these are:
>
>  * APCUPSD
>  * Bacula
>  * FLA
>  * FSFE
>
>  now, as it is your mistake, i am not going to do the work for you of
> looking those up: it is your responsibility (now and in future) to
> make your communications clear.  

Thanks for pointing this out, it certainly made my email
incomprehensible.  Yes, I assumed that everyone on this list understands
those acronyms.  I am sorry, I will make every effort not to do it
again.  In light of what you have said I must totally rethink and
rewrite my email, so until I do so, there is no need to spend any time
on it. Of course, if someone does want to respond on-list of off, I will
be happy to continue the discussion.

For the curious:
APCUPSD  (a free software project to integrate APC (American Power
Company) UPSes (Unterruptible Power Supplies) as a Linux Daemon
(service)).  In short a free software project.

Bacula (a free software backup and restore program)

FLA (Fiduciary License Agreement) project of the Free Software
Foundation where they maintain the copyright for free software projects.

FSFE (Free Software Foundation Europe)

> you will, however, need to make a
> decision in this one-off instance, as to how to best continue what
> will turn out to be a divided conversation, in at least *three*
> separate ways. 1) this meta-conversation 2) an acronym clarification
> conversation 3) the original conversation you *wanted* to have, which
> can only truly be properly contributed to by those people who, by some
> incredible coincidence, luck, or extreme effort on their part, so
> desperately wish to follow the conversation or have some other motive
> that they go to all the trouble of duplicating the effort of looking
> up the above acronyms [now multiply that by 20,000 subscribers, bear
> in mind that a *single* google search, due to the distributed nature
> of the google search system, results in enough power being consumed
> (world-wide) to *boil a kettle*, and you start to appreciate the
> enormity of the mistake that you made by *not* including a glossary
> that everyone can refer to]
Yes thanks for pointing out my BIG error (said with sincerity).
>
> so, respectfully, i have some suggestions for people:
>
> if you are tempted to reply in category (1) DO NOT DO IT.  DO NOT HIT
> SEND.  if you are tempted to hit send, return to the beginning of this
> sentence and read it again.  at least then you will die of old age or
> world war three will start and the internet will be disconnected.
>
> if you are tempted to reply in category (2) and your name is not ¨Kern
> Sibbald¨ DO NOT DO IT.  DO NOT HIT SEND.
>
> any other advice i cannot give, because it is dependent on too many
> variables.  also, it ain´t my mess, and it ain´t my responsibility.
>
>  basically, kern, in future, please assume that nobody knows the
> acronyms, use [*1] [*2] after the first occurrence then put a list at
> the bottom of the message, with either a short sentence or a URL.
> references, basically.  just like in scientific articles, as well as
> wikipedia.
>
> this is actually extremely common practice on technical mailing lists,
> which makes it even more surprising that it´s not on any mailing list
> FAQs that i´ve seen.
OK, thanks I "get it" now.
>
>
>> This is actuality, if it is not a topic for discussion on this list,
>> please tell me as I do not wish to create useless chatter on your list.
>  even if it is quotes Bradley´s List quotes - i doubt very much
> whether he could legally claim ownership or copyright over the several
> thousand email addresses that are on this list: if he tried i for one
> would be Having Words with him, i would also definitely like to know
> other people´s advice (and experience) on this topic, and as a) you
> have raised the matter here b) it would be a significantly reduced
> readership on any *other* mailing list *including* ironically one set
> up specifically to discuss this and only this issue that 

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Kern Sibbald]

Hello,

I have downloaded your pdf and find it very interesting.  I have looked
at the table of contents but not yet read it, which I will do in
detail.  Since I have worked with the FSFE since 2006, I am quite
familiar with the GPLv2 and AGPLv3 but am very far from being an expert.

I write to you as an open source software developer (originally APCUPSD,
and now since 2000 Bacula -- currently AGPLv3).  I suspect that your
tutorial might be mostly directed at companies wanting to use GPL code.
It would also be very useful to have information for developers.  In
particular, where I personally am unsure (please excuse me if these
topics are already covered):

1. Exactly who has the right to bring a lawsuit for copyright violation?

2. What happens when a developer (holding copyright assignments from all
contributors) signs an FLA with say the FSFE (as was my case in 2006)?

3. What happens if this developer subsequently requests and obtains FLAs
from all the contributors who signed an FLA with the FSFE?  Does he then
have a dual license?

4. What is required to cancel or "annul" an FLA?  Can it be done by a
simple letter or must it be done through a court of law providing the
FLA holder does not agree to cancel or annul the FLA?

For me these are interesting questions because they touch me
personally.  To be transparent the above scenario has happened to me
with the Bacula project due to the fact that I created a open source
company named Bacula Systems to provide professions services for Bacula,
but later (when it was failing) converted the company into an open-core
company with parts of the code proprietary justified by the fact that I
believe that I hold a dual license.

This is actuality, if it is not a topic for discussion on this list,
please tell me as I do not wish to create useless chatter on your list.

Best regards,
Kern Sibbald
Lausanne, Switzerland

On 04/24/2014 09:59 PM, Bradley M. Kuhn wrote:
>> On Wed, Apr 23, 2014 at 7:19 AM, Bradley M. Kuhn  wrote:
>>> Here's a brief list of the main things I ask for on a new enforcement
>>> matter:
>>> Some of this is already in the tutorial book I've been putting together
>>> (see: https://www.gitorious.org/gpl-compliance-tools/tutorial/ )
> Robinson Tryon wrote:
>> Is there a place where builds of the compliance book are uploaded? It could
>> be very helpful to be able to point directly at this type of basic
>> checklist, e.g. when someone new shows up to this list with a potential GPL
>> violation and asks for our help.
> First, it's more than just a compliance book.  There's only two sections on
> compliance.  Most of it is a detailed walk-through of GPL.  I've titled it:
> "Copyleft and the GNU General Public License: A Comprehensive Tutorial", and
> thus it has to cover compliance and enforcement (after all), but not
> exclusively those topics.
>
> Second, there's no auto build process for the LaTeX sources (patches welcome
> ;), but I've been keeping a current PDF [0] version on a URL of my personal
> website: http://ebb.org/bkuhn/articles/copyleft-book.pdf
>
> I will make sure that URL is permanently stable and redirects to the "right
> place" if there ever is a "right place" in the future. :)
>
> Finally, the compliance section is written as "advice to would-be violators".
> I wrote it originally as a document to help me prepare when I started giving
> public talks on the issues of GPL compliance back in the mid-2000s, and it's
> been edited heavily by both me and Aaron Williamson since then, but ultimately
> it's still just a summary of what I talk about in one-hour presentation
> on compliance.
>
> Thus, the info isn't presented in the best possible way for the average poster
> on this list (who are mostly violation reporters/discoverers, not violators).
>
> I'd thus love a chapter that discussed "advice to violation reporters and
> investigators", and as I said, patches/merge-requests welcome under
> CC-By-SA-4.0. :)
>
>
> Long term, I want to write a CCS tutorial chapter too.
>
> When there are major updates, I'll post notice to this list.
>
>
> [0] The HTML build of from LaTeX sources is broken at the moment.  tex4ht has
> changed a lot since I set it up, and since the LaTeX sources were taken
> from nearly a dozen different historical documents that I and others had
> written, there isn't consistent use of tex4ht-isms to properly generate
> HTML.
>
> (Man, this thing needs an issue tracker as well now, huh?  I'll file a
> bug that I need a bug tracker ...  ;)
>
>-- bkuhn
>

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Robinson Tryon]

On Wed, Apr 23, 2014 at 7:19 AM, Bradley M. Kuhn  wrote:
> Here's a brief list of the main things I ask for on a new enforcement
> matter:
>
>   * a copy of the manual (to check to see if an offer for source is
> present)
>   * transcripts of online chats for source requests and/or emails of the
> same.
> ...
>   * If not, a camera phone picture or something else from the device's
> screen that shows clearly it's running GPL'd software.  (e.g., a
> good shot of Linux booting is helpful).
> ..
> Some of this is already in the tutorial book I've been putting together
> (see: https://www.gitorious.org/gpl-compliance-tools/tutorial/ )

Is there a place where builds of the compliance book are uploaded? It
could be very helpful to be able to point directly at this type of
basic checklist, e.g. when someone new shows up to this list with a
potential GPL violation and asks for our help.

Thanks,
--R


-- 
Robinson Tryon
LibreOffice Community Outreach Herald
Senior QA Bug Wrangler
The Document Foundation
qu...@libreoffice.org

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Neil Brown]

On 23 Apr 2014, at 15:19, Bradley M. Kuhn  wrote:

Evening, Bradley

> Some of this is already in the tutorial book I've been putting together
> (see: https://www.gitorious.org/gpl-compliance-tools/tutorial/ )
> 
> However, more about reporting and documenting violations is needed in
> that.  Patches welcome!


I shall add it to my list of things to look at — thanks for sharing!


All the best,

Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk







signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

> On Wed, Apr 23, 2014 at 7:19 AM, Bradley M. Kuhn  wrote:
> > Here's a brief list of the main things I ask for on a new enforcement
> > matter:
> > Some of this is already in the tutorial book I've been putting together
> > (see: https://www.gitorious.org/gpl-compliance-tools/tutorial/ )

Robinson Tryon wrote:
> Is there a place where builds of the compliance book are uploaded? It could
> be very helpful to be able to point directly at this type of basic
> checklist, e.g. when someone new shows up to this list with a potential GPL
> violation and asks for our help.

First, it's more than just a compliance book.  There's only two sections on
compliance.  Most of it is a detailed walk-through of GPL.  I've titled it:
"Copyleft and the GNU General Public License: A Comprehensive Tutorial", and
thus it has to cover compliance and enforcement (after all), but not
exclusively those topics.

Second, there's no auto build process for the LaTeX sources (patches welcome
;), but I've been keeping a current PDF [0] version on a URL of my personal
website: http://ebb.org/bkuhn/articles/copyleft-book.pdf

I will make sure that URL is permanently stable and redirects to the "right
place" if there ever is a "right place" in the future. :)

Finally, the compliance section is written as "advice to would-be violators".
I wrote it originally as a document to help me prepare when I started giving
public talks on the issues of GPL compliance back in the mid-2000s, and it's
been edited heavily by both me and Aaron Williamson since then, but ultimately
it's still just a summary of what I talk about in one-hour presentation
on compliance.

Thus, the info isn't presented in the best possible way for the average poster
on this list (who are mostly violation reporters/discoverers, not violators).

I'd thus love a chapter that discussed "advice to violation reporters and
investigators", and as I said, patches/merge-requests welcome under
CC-By-SA-4.0. :)


Long term, I want to write a CCS tutorial chapter too.

When there are major updates, I'll post notice to this list.


[0] The HTML build of from LaTeX sources is broken at the moment.  tex4ht has
changed a lot since I set it up, and since the LaTeX sources were taken
from nearly a dozen different historical documents that I and others had
written, there isn't consistent use of tex4ht-isms to properly generate
HTML.

(Man, this thing needs an issue tracker as well now, huh?  I'll file a
bug that I need a bug tracker ...  ;)

   -- bkuhn

initial violation information collecting (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Neil Brown wrote on Wednesday, 16 April:
> Do you have standard list of questions / pieces of evidence you tend
> to collate in your triage process, which could be used as a framework
> here?

Josh alread posted some of FSF's thoughts on this.

Here's a brief list of the main things I ask for on a new enforcement
matter:

  * a copy of the manual (to check to see if an offer for source is
present)

  * transcripts of online chats for source requests and/or emails of the
same.

  * A URL of the firmware being distributed publicly (if it is).

  * If not, a camera phone picture or something else from the device's
screen that shows clearly it's running GPL'd software.  (e.g., a
good shot of Linux booting is helpful).


Basically, since GPL violators so often stonewall and refuse to act
until legal action is taken, I don't even open any GPL violation matter
where the evidence that a violation has occurred wouldn't pass Rule 11
of the USA's Federal Rules of Civil Procedure.  Frankly, so many
violators say "fine, sue us" that you have to assume every violation
matter you open will have to eventually go to litigation to get
resolved.

> We discussed - ooh, a few years ago now - the idea of some kind of
> "first steps on handling violations" guide, but never developed it
> further. If there is a good basis out there, it would be great not to
> re-invent the wheel!

Some of this is already in the tutorial book I've been putting together
(see: https://www.gitorious.org/gpl-compliance-tools/tutorial/ )

However, more about reporting and documenting violations is needed in
that.  Patches welcome!
-- 
   -- bkuhn

Re: GPL enforcement in practice (was Re: GPL violation by Renault(R-Link system))

[Bradley M. Kuhn]

Richard Fontana wrote a few days ago:
> (As for whether the Installation Information requirements also exist in
> some sense for GPLv2, I do understand the basis for that argument, but I've
> always assumed it was and remains a minority view, rejected by the
> author/steward of the license itself.)

Be very careful what specific view you're implying when you say "is the
minority view, rejected by the author/steward of the license [meaning FSF]".

AFAIK, the only related item that RMS has said specifically isn't covered by
GPLv2 is cryptographic lock-down -- i.e., a system that does not allow the
user to install modified versions of GPLv2'd software due to cryptography.
RMS has said such crypto-lock-down is permitted on GPLv2 but not by GPLv3.
I, Alan Cox, Jeremy Allison, and others do hold the minority view that GPLv2
*does* require disclosure of a method to install modified versions even in
this situation.

However, I realize that RMS made a problem for that minority interpretation
by saying what he's said.  I was even deposed on this point in Conservancy
& Andersen v. Best Buy, et al.  The violators brought my whole blog into
evidence just to ask me about about this blog post:
http://ebb.org/bkuhn/blog/2010/07/15/motorola-admits.html ).  Here's the
relevant porition of the deposition transcript (Q is the violator's attorney,
A is me):
  Q.  Do you see that the second sentence is:  "In
  fact, in my reading of GPL Version 2, in comparison to
  GPL Version 3, the only affected [sic] difference between the
  two on this point relates to cryptographic device
  lockdown.  I do admit that under GPL Version 2, if you
  give all the required installation scripts, you could
  still use cryptography to prevent those scripts from
  functioning without an authorization key."
  Did I read those two sentences correctly?

  A.  Yes.

  Q.  Do you have any reason to disagree with those two sentences?

  A.  I believe that we're stuck in that interpretation of GPL V 2,
  much to my chagrin.

I think it's kind of funny that some first year associates had to read my
entire blog going back to the 1990s just to find that quote so their
boss could ask me about it in deposition. :)

Anyway, there is no indication of any other difference in what
must be included with GPLv2's "scripts used to control compilation and
installation of the executable" and what GPLv3 requires in its (more 
long-winded)
equivalent provision.  The only difference in GPLv2-compliant build/install
instructions and GPLv3-compliant build/install instructions would be "the
GPLv2 ones don't tell you how to cryptographically sign the binary as part of
the install process".  Nothing FSF has ever said contradicts that
interpretation, and AFAIK it's the interpretation that both FSF and
Conservancy use in their GPL enforcement matters.

I've said frequently on my talks in GPL enforcement: the people that try
to say there's more to the difference between v2's and v3's requirements
in this regard (beyond cryptographic key issue) are likely going to end up
violating GPLv2.  And I'll come knocking.

   -- bkuhn

Re: Volume of GPL enforcement (was Re: GPL violation by Renault (R-Link system))

[Daniel Berlin]

On Wed, Apr 16, 2014 at 5:50 PM, Bradley M. Kuhn  wrote:

> Daniel Berlin wrote:
> > Enforcing compliance with laws is expensive in every case.
>
> I agree with that.
>
> > IMHO, even if bradley had an entire 300 person law firm dealing with
> > violations, you wouldn't see much difference in behavior  :)
>
> Actually, I somewhat disagree with that.  While the number of GPL
> violations
> has certainly gone up huge amounts over the last 15 years, I suspect the
> *percentage* of "number of copies of a GPL'd program distributed out of
> compliance" is about the same as what we found in the 1990s.
>
> Meanwhile, the amount of enforcement hasn't really increased to match.
>  There
> was a (short) period when Harald, FSF *and* Conservancy were all very
> active
> in enforcement -- at that moment, things were clearly getting much better.
> Many of those improvements have survived.
>
> Now, gpl-violations.org isn't active (but thankfully they keep the list
> running for us :), I personally took a break from doing any enforcement
> for a
> bit immediately after the big Conservancy lawsuit, and while both
> Conservancy
> and FSF are active in enforcement right now, we're probably in aggregate
> doing less enforcement than it was at its best.
>
> If we as a community could scale up just a bit, I think compliance behavior
> would improve.


I think we don't really disagree except in what we believe the impact would
be.
I guess i'm infinitely more cynical than you :)

I would actually go so far as to say "behavior of mid-to-to-large companies
in the US and Europe would improve", but I think it will slowly improve
anyway.
I don't think there is much hope for the rest anytime soon.  Happy to see
you prove me wrong though.
The honest truth is that the more work you do, the less work i have to do
later when we acquire them :)

Re: GPL enforcement in practice (was Re: GPL violation by Renault(R-Link system))

[Richard Fontana]

On Fri, Apr 18, 2014 at 07:44:28PM +, Smith, McCoy wrote:
> So Richard does that put you in the camp that says the installation 
> information requirement also exists in GPLv2?
> That's one area where I could see v2 & v3 having different enforcement 
> options.

I understood Marc's issue to be about 'who can enforce'. I don't think
the Installation Information provisions of v3 change the situation
(but I admit I'm now poring over the text to see whether I've missed
anything).

(As for whether the Installation Information requirements also exist
in some sense for GPLv2, I do understand the basis for that argument,
but I've always assumed it was and remains a minority view, rejected
by the author/steward of the license itself.)

 - Richard




> 
> Sent from my iPhone
> 
> > On Apr 18, 2014, at 1:36 PM, "Richard Fontana"  wrote:
> > 
> >> On Thu, Apr 17, 2014 at 10:18:48PM +0200, Marc Dietrich wrote:
> >> Am Mittwoch 16 April 2014, 19:08:18 schrieb Bradley M. Kuhn:
> > 
> >>> I'm sorry that this thread has been so distracting on this issue.  The 
> >>> goal
> >>> of the GPL is to give certain freedoms to end-users, indeed.  However, the
> >>> primary legal mechanism it uses underneath is copyright, and as such the
> >>> most traditional way and more or less the only successful way so far the
> >>> license has been enforced has been through copyright holders acting on
> >>> their rights. Take a look at GPLv2 Section 4 for the central provision on
> >>> how this works. You also might want to read the book I wrote much of it 
> >>> and
> >>> am the primary editor of:
> >>> http://www.ebb.org/bkuhn/articles/comprehensive-gpl-guide.pdf
> >> 
> >> I'm sorry that I'm likely not motivated enough to read through all this. 
> >> But 
> >> maybe just a small question you may have an answer to (sorry, I'm again 
> >> too 
> >> lazy to google it myself). Does the GPLv3 helps with with problem?
> > 
> > You mean does GPLv3 address the issue I believe you are raising, which
> > is the presumed reservation of an enforcement remedy for a GPLv2
> > violation in the copyright holder? No, it doesn't. The interpretation
> > of GPLv2 and GPLv3 should be in harmony in this respect. Thus if
> > there's some theory under which one could argue that a downstream
> > licensee has a legal remedy against a GPL-violating distributor, it
> > should apply equally to GPLv2 and GPLv3. If there's some theory why
> > this should *not* be possible, it should apply equally to GPLv2 and
> > GPLv3. 
> > 
> > Also, don't misunderstand me -- this is not *inherent* to the GPL as
> > some sort of abstract thing. I can envision various ways in which a
> > hypothetical GNU GPLv4 could be drafted to make weak or strong
> > attempts to ensure that downstream users have legal remedies to
> > enforce the source code requirements of the GPL. These might come at a
> > cost which might be seen as undesirable. But that's for the FSF of the
> > future to decide.
> > 
> > 
> > - Richard
> > 
> > 

Re: GPL enforcement in practice (was Re: GPL violation by Renault(R-Link system))

[Smith, McCoy]

So Richard does that put you in the camp that says the installation information 
requirement also exists in GPLv2?
That's one area where I could see v2 & v3 having different enforcement options.

Sent from my iPhone

> On Apr 18, 2014, at 1:36 PM, "Richard Fontana"  wrote:
> 
>> On Thu, Apr 17, 2014 at 10:18:48PM +0200, Marc Dietrich wrote:
>> Am Mittwoch 16 April 2014, 19:08:18 schrieb Bradley M. Kuhn:
> 
>>> I'm sorry that this thread has been so distracting on this issue.  The goal
>>> of the GPL is to give certain freedoms to end-users, indeed.  However, the
>>> primary legal mechanism it uses underneath is copyright, and as such the
>>> most traditional way and more or less the only successful way so far the
>>> license has been enforced has been through copyright holders acting on
>>> their rights. Take a look at GPLv2 Section 4 for the central provision on
>>> how this works. You also might want to read the book I wrote much of it and
>>> am the primary editor of:
>>> http://www.ebb.org/bkuhn/articles/comprehensive-gpl-guide.pdf
>> 
>> I'm sorry that I'm likely not motivated enough to read through all this. But 
>> maybe just a small question you may have an answer to (sorry, I'm again too 
>> lazy to google it myself). Does the GPLv3 helps with with problem?
> 
> You mean does GPLv3 address the issue I believe you are raising, which
> is the presumed reservation of an enforcement remedy for a GPLv2
> violation in the copyright holder? No, it doesn't. The interpretation
> of GPLv2 and GPLv3 should be in harmony in this respect. Thus if
> there's some theory under which one could argue that a downstream
> licensee has a legal remedy against a GPL-violating distributor, it
> should apply equally to GPLv2 and GPLv3. If there's some theory why
> this should *not* be possible, it should apply equally to GPLv2 and
> GPLv3. 
> 
> Also, don't misunderstand me -- this is not *inherent* to the GPL as
> some sort of abstract thing. I can envision various ways in which a
> hypothetical GNU GPLv4 could be drafted to make weak or strong
> attempts to ensure that downstream users have legal remedies to
> enforce the source code requirements of the GPL. These might come at a
> cost which might be seen as undesirable. But that's for the FSF of the
> future to decide.
> 
> 
> - Richard
> 
> 

Re: GPL enforcement in practice (was Re: GPL violation by Renault(R-Link system))

[Richard Fontana]

On Thu, Apr 17, 2014 at 10:18:48PM +0200, Marc Dietrich wrote:
> Am Mittwoch 16 April 2014, 19:08:18 schrieb Bradley M. Kuhn:

> > I'm sorry that this thread has been so distracting on this issue.  The goal
> > of the GPL is to give certain freedoms to end-users, indeed.  However, the
> > primary legal mechanism it uses underneath is copyright, and as such the
> > most traditional way and more or less the only successful way so far the
> > license has been enforced has been through copyright holders acting on
> > their rights. Take a look at GPLv2 Section 4 for the central provision on
> > how this works. You also might want to read the book I wrote much of it and
> > am the primary editor of:
> > http://www.ebb.org/bkuhn/articles/comprehensive-gpl-guide.pdf
> 
> I'm sorry that I'm likely not motivated enough to read through all this. But 
> maybe just a small question you may have an answer to (sorry, I'm again too 
> lazy to google it myself). Does the GPLv3 helps with with problem?

You mean does GPLv3 address the issue I believe you are raising, which
is the presumed reservation of an enforcement remedy for a GPLv2
violation in the copyright holder? No, it doesn't. The interpretation
of GPLv2 and GPLv3 should be in harmony in this respect. Thus if
there's some theory under which one could argue that a downstream
licensee has a legal remedy against a GPL-violating distributor, it
should apply equally to GPLv2 and GPLv3. If there's some theory why
this should *not* be possible, it should apply equally to GPLv2 and
GPLv3. 

Also, don't misunderstand me -- this is not *inherent* to the GPL as
some sort of abstract thing. I can envision various ways in which a
hypothetical GNU GPLv4 could be drafted to make weak or strong
attempts to ensure that downstream users have legal remedies to
enforce the source code requirements of the GPL. These might come at a
cost which might be seen as undesirable. But that's for the FSF of the
future to decide.


 - Richard

Re: the backchannel politics of GPL enforcement (was Re: GPL violation by Renault (R-Link system))

[Robinson Tryon]

On Wed, Apr 16, 2014 at 5:35 PM, Bradley M. Kuhn  wrote:
>
> That said, there is definitely a chilling effect: developers are afraid of
> losing their jobs or facing trouble at work if they even state their opinions
> in support of GPL enforcement, let alone doing enforcement.

I'm sure there are situations in which a developer's non-work
activities enforcing the GPL could interfere with their work
obligations (e.g. if the developer works at a law firm engaged in
defending against the same kind of Linux/GPL cases that they bring in
their spare time as a former kernel dev), but in the general case, I
hope that employers would not be able to quash an employee's personal,
non-work-time hobby of GPL enforcement.

Is there anything specific that could be done to reduce the
possibility of reprisal from an employer? I assume that in the process
of bringing suit against a company, the names of all copyright holders
would be made public, so masking identity to avoid harassment wouldn't
work.

> I think most people on this list would be surprised to learn and will
> probably doubt me when I say there is a not-really-coordinated, but nearly
> universal, effort by many "Linux"-related companies, working very hard to
> squelch anyone who attempts to enforce the GPL, and doubly so against anyone
> who coordinates many people together to enforce GPL (like I do).

I can certainly imagine that many such "Linux"-related companies would
be annoyed with the work you do regarding GPL enforcement, as they'd
much rather pretend that the kernel Linux and other pieces of software
may be used willy-nilly. They see you and your colleagues as an
impediment to their desire to ship a proprietary product, and the GPL
as a mechanism that might allow others to reuse their work.

But though some may wish to peel the GPL badge off the kernel and
replace it with an "Apache" or "BSD" one, I am a bit surprised to hear
that companies are working so hard to squelch your work. I'd expect
them to be frustrated, perhaps, but not to redouble their efforts when
you/your non-profit steps up to coordinate enforcement of copyleft.

Do the companies not understand the GPL, or are they willfully
violating it because they don't think anyone will bother to enforce
it? To what extent would further education at the developer/engineer
level help?

Cheers,
--R

Re: GPL enforcement in practice (was Re: GPL violation by Renault(R-Link system))

[Marc Dietrich]

Am Mittwoch 16 April 2014, 19:08:18 schrieb Bradley M. Kuhn:
> Marc Dietrich wrote:
> > Thanks for your help. I replied to your private mail which asked for
> > evidence on the GPL violation. I think it would be better to discuss these
> > things openly on this list so others may profit from the documentation of
> > the process in the future.
> 
> I don't have a serious objection to discussing the evidence of the violation
> publicly, but I hope you understand that since any given GPL violation
> could turn into a possible later litigation, I usually try to avoid talking
> about the details of what evidence exists for a specific enforcement matter
> on any public lists.

ok, that's understandable. I was more refering to the process in general, not 
the details of the evidence.

> > What's still looks strange to me is that the GPL gives all the rights to
> > endusers, but they are now allowed to file a suit?
> 
> I'm sorry that this thread has been so distracting on this issue.  The goal
> of the GPL is to give certain freedoms to end-users, indeed.  However, the
> primary legal mechanism it uses underneath is copyright, and as such the
> most traditional way and more or less the only successful way so far the
> license has been enforced has been through copyright holders acting on
> their rights. Take a look at GPLv2 Section 4 for the central provision on
> how this works. You also might want to read the book I wrote much of it and
> am the primary editor of:
> http://www.ebb.org/bkuhn/articles/comprehensive-gpl-guide.pdf

I'm sorry that I'm likely not motivated enough to read through all this. But 
maybe just a small question you may have an answer to (sorry, I'm again too 
lazy to google it myself). Does the GPLv3 helps with with problem?

Marc

RE: GPL violation by Renault (R-Link system)

[Andrew Katz]

Richard




 
> You brought up Red Hat; I know of some cases where Red Hat employees have
> attempted on their own to get device vendors or software distributors to
> provide source code in compliance with the GPL. They were not typically doing
> that as personal copyright holders, and they were not typically acting as 
> agents
> (even agents on spec, if you will) of Red Hat. So, taking your question 
> again: no,
> Red Hat employment agreements do not prohibit that sort of activity. I'd be
> really surprised to see an employment agreement address such a thing.
> 
This is interesting - I've never seen such a restriction either. I do see other 
problematic clauses in employment contracts, though.

I frequently advise employers that their employment agreements should 
explicitly state that they are not intended, and shall not be construed so as 
to conflict with the rights that an employee has in their own right under free 
and open source licences, particularly GPL. For example, a restriction on 
dealing with the employer's IP may be construed as a GPL 'further restriction' 
if it impinges on code that the employer otherwise distributes under the GPL. 
This is a particular problem post termination. 

Incidentally, these unintended further restrictions can appear in other areas 
as well, such as post-deal lockout clauses in corporate M&A transactions. 

- Andrew

Re: GPL violation by Renault (R-Link system)

[TJ]

In my earlier reply on this issue somehow my email client didn't add the correct thread 
ID and it ended up as the new thread "R-Link Source-code request".

That is a CC of a request I've made in the U.K. for the source-code to Renault 
U.K. via the company secretary (the senior legal affairs officer) and the 
published R-Link support help-desk.

I've received an out-of-office until April 22 reply from the Secretary, and a 
case reference (Case 500D00bUEjP / CS-026292) from the help-line. I'll 
update the list with responses.

beyond-copyright GPL enforcement mechanisms (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Richard Fontana wrote:
> the dominant assumption has been that the GPL is enforceable only by
> copyright holders. At one time I think this was even thought to have a
> policy justification, though I think that may have been rooted in
> confusion.

I don't think there's a policy justification either.  But I also don't
know of a way of an end-user to have a cause of action to enforce GPL that's
likely to work other than the fraud stuff in Australia that I mentioned
before.

The AFPA enforcement by FSF France is worth mentioning as well:
   http://fsffrance.org/news/article2009-09-22.en.html

that was novel because, IIUC, AFPA was able to show that Edu4 violated
their separate agreement by failing to comply with GPL, by one of those
"you agree to abide by all relevant legal terms" catch-all
boilerplate clauses, and the court held the GPL was included by
reference (even though AFPA didn't know the GPL was involved).  (I don't
read French so I may have the details wrong there; I'm summarizing based
on a summary that Loic gave me years ago :)

This is really really useful, but sadly is not necessarily useful
on consumer devices since consumers rarely get to negotiate such
wording into contracts before buying.

However, maybe there is some consumer law or something else like that
which would work.  If someone can find one and we can start filing class
action suits, great!  I'm open minded about these strategies but no
one has ever come to me with a proposal that seems like it has a chance,
at least in the USA.

> In the typical case of a GPL violation -- Bradley, if he reads this, can
> correct me if I am mistaken -- you have, in principle, infringement of
> thousands of copyrights.

Depends on how you count a "single copyright".  I don't know what it means to
say "infringement of thousands of copyrights", unless you mean "a thousand
copyright registrations", but I know you don't mean that.

>  What I'm getting at is that the employer, even *if* it is a copyright
> holder, is not necessarily best situated to pursue the violation if it
> advances beyond the initial stage. Depends on the employer and who the
> alleged violator is, really.

The best thing to bring is a coalition of copyright holders, which is why
Conservancy builds those coalitions for the Linux, BusyBox and Samba projects.

   -- bkuhn

Volume of GPL enforcement (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Daniel Berlin wrote:
> Enforcing compliance with laws is expensive in every case.

I agree with that.

> IMHO, even if bradley had an entire 300 person law firm dealing with
> violations, you wouldn't see much difference in behavior  :)

Actually, I somewhat disagree with that.  While the number of GPL violations
has certainly gone up huge amounts over the last 15 years, I suspect the
*percentage* of "number of copies of a GPL'd program distributed out of
compliance" is about the same as what we found in the 1990s.

Meanwhile, the amount of enforcement hasn't really increased to match.  There
was a (short) period when Harald, FSF *and* Conservancy were all very active
in enforcement -- at that moment, things were clearly getting much better.
Many of those improvements have survived.

Now, gpl-violations.org isn't active (but thankfully they keep the list
running for us :), I personally took a break from doing any enforcement for a
bit immediately after the big Conservancy lawsuit, and while both Conservancy
and FSF are active in enforcement right now, we're probably in aggregate
doing less enforcement than it was at its best.

If we as a community could scale up just a bit, I think compliance behavior
would improve.  (There are a few big "nuts to crack" there related to
upstream problems, but those are solvable with volume.)  Anyway, I'm doing my
best but it's tough work to fund (as you mention), and both Conservancy and
FSF have a lot of other work to do that isn't enforcement that's also very
important for software freedom.

I'd like to see another entity ramp up, but the problem is it has to be
structured well.  It's easy for enforcement work to become corrupt (see
Oracle's MySQL enforcement for details :).

> I'm not sure the right balance exists now, but it's not that simple.

I agree with this too.

   -- bkuhn

the backchannel politics of GPL enforcement (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Ralph Corderoy wrote:
> Perhaps the employment contracts from Red Hat, MontaVista, etc., prohibit
> the employee getting involved with copyright violation in a private
> capacity?

Fontana already raised the question about whether you mean someone's own
copyrights or copyrights their employers hold under "work for hire" or
similar doctrines.   The rest of my post assumes we're talking about
"copyrights we're sure the developers hold themselves in their own name":

I somewhat doubt *any* company restricts by formal agreement what a given
employee can do regarding the Free Software they've contributed on their own
with their own copyrights -- up to and including filing their own lawsuits.

That said, there is definitely a chilling effect: developers are afraid of
losing their jobs or facing trouble at work if they even state their opinions
in support of GPL enforcement, let alone doing enforcement.

I think most people on this list would be surprised to learn and will
probably doubt me when I say there is a not-really-coordinated, but nearly
universal, effort by many "Linux"-related companies, working very hard to
squelch anyone who attempts to enforce the GPL, and doubly so against anyone
who coordinates many people together to enforce GPL (like I do).

(Of course, I'm talking only about enforcement whose primary goal is full GPL
compliance.  Enforcement for profit by companies like Oracle does with MySQL
is something different entirely, and I guess the business world lauds that.)

   -- bkuhn

Re: GPL violation by Renault (R-Link system)

[Daniel Berlin]

On Wed, Apr 16, 2014 at 1:28 AM, Ralph Corderoy  wrote:
> Hi Bradley,
>
>> the list-regulars have derailed this thread into pontificating about
>> unrelated stuff.
>
> Sorry.  It's because I feel the current methods of compliance
> enforcement are failing:  they don't cope with the volume of violations;
In what what, exactly?
IE is your complaint that there is a huge number of major violations
that aren't getting dealt with?
Or do you mean "they don't handle them the way i would like them handled"?



> no enforcement ever seems to act as an incentive for others to comply,
> instead it's better for a bottom line if they don't bother to comply and
> just hope the SFC, etc., don't come calling.

You must realize at some level this is probably an unsolvable problem
with current laws.
Enforcing compliance with laws is expensive in every case.
IMHO, even if bradley had an entire 300 person law firm dealing with
violations, you wouldn't see much difference in behavior  :)

>
> For a copyright holder to enforce takes a lot of time and maybe money.

Which is both good and bad.
It means open source projects get the benefit of people not trying to
sue them over what are likely trivial copyright violations from
copy/paste all the time, for example.
However, it also makes it expensive for them to assert their rights.
I'm not sure the right balance exists now, but it's not that simple.

> Life's short.  It's the purchaser of the hardware that wants the source
> and is prepared to put some effort to get it.  Means of enabling them to
> do something seem worth considering.  Manufacturers care about mass
> sales and can ignore an annoying individual that buzzes around them like
> a gnat.  They would take notice of large retailers.

GPL enforcement in practice (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Marc Dietrich wrote:
> Thanks for your help. I replied to your private mail which asked for
> evidence on the GPL violation. I think it would be better to discuss these
> things openly on this list so others may profit from the documentation of
> the process in the future.

I don't have a serious objection to discussing the evidence of the violation
publicly, but I hope you understand that since any given GPL violation could
turn into a possible later litigation, I usually try to avoid talking about
the details of what evidence exists for a specific enforcement matter on any
public lists.

> What's still looks strange to me is that the GPL gives all the rights to
> endusers, but they are now allowed to file a suit?

I'm sorry that this thread has been so distracting on this issue.  The goal
of the GPL is to give certain freedoms to end-users, indeed.  However, the
primary legal mechanism it uses underneath is copyright, and as such the most
traditional way and more or less the only successful way so far the license
has been enforced has been through copyright holders acting on their rights.
Take a look at GPLv2 Section 4 for the central provision on how this works.
You also might want to read the book I wrote much of it and am the primary
editor of: http://www.ebb.org/bkuhn/articles/comprehensive-gpl-guide.pdf

the source of which is here:
   https://www.gitorious.org/gpl-compliance-tools/tutorial

(I guess this my official announcement to this list of that book project.  I
welcome merge requests.  The work is CC-By-SA.)

> Instead they have to find an involved developer willing to do it for them?

I've dedicated most of my life to making sure that there are good coalitions
of such copyright holders to take action in these cases.  I look forward to
collaborating with you and we always welcome volunteer help.

> If this is true, it heavily weakens the GPL.

While the system isn't perfect, the Free Software infrastructure work with
the legal systems we have: that was the "hack" that RMS discovered to make
copyleft work at all.

I have nevertheless been very supportive of novel ways to build Free Software
licensing structure, but I have yet to hear one that is known to work as well
as this one -- even for its flaws.  We have the worst system, AFAICT, except
for all the other possible ones.

I'm also very supportive of pro-bono lawyers (like Brendan Scott in
Australia) who have successfully used other legal systems (such as fraud law,
in that case) to force action by a GPL violator without copyright holders
involved.

   -- bkuhn

Re: GPL violation by Renault (R-Link system)

[Joshua Gay]

Hello Neil and everyone else on this list!

I really should have been subscribed to this list since my first day as 
starting as the new licensing & compliance manager of the FSF over a 
year ago.


>

help that person collect the evidence they need and get set
up properly to do the usual easy things that might yield compliance?


Do you have standard list of questions / pieces of evidence you tend to collate 
in your triage process, which could be used as a framework here?


I can share with you all a little of what we do in our triage process.

Please note that this does not address all of the kinds of compliance 
work the FSF does. How we approach GPL violations happening on free 
software projects or from members of the free software community will 
often be different, at least in terms of the kinds of information we 
collect.


 free software projects or community
These are all of the steps we take before we contact the company 
suspected of violating the terms of the GPL on FSF suspected of 
violating FSF copyright. Please note that when the party suspected of 
violating


## Step 1

I often ask the person submitting a report to help me fill in as much of 
the information as they can on this page:


* 

I usually check to see if we have had any past correspondence with the 
organization suspected of violating.


If it is clear that the FSF is not a copyright holder on the software in 
question, then I will encourage them to collect the information in the 
above and to contact the appropriate copyright holder(s).



## Step 2: Confirm suspected violation

The next step is to try to do an initial confirmation.

When all we can find is a binary or installation file, you sometimes 
need to do a little digging. Some of the tools that can be helpful include:


* 
* file, tree, find, less, strings, grep, dtrx, wine, mount, unsquashfs, 
cramfsswap, cpio, gzrecover, dd, ld, and several other programs are all 
in my rotation.


And of course, sometimes the violation report isn't on a failure to 
provide source. It could relate to not providing the corresponding 
source, installation information, etc. Or, other times it is a failure 
to provide a copy of the license or make appropriate notifications, etc.


## Step 3: Gather additional info

Once I've done a basic confirmation, I will then open a compliance case. 
I will inform the person who submitted it that I am doing so, explain to 
them our approach and that we will let them know of any outcome, and ask 
them to let us know of any response or future correspondence they have 
with the company,  and I often ask if the current compliance case is 
being discussed publicly or with other parties.



I then gather some more info on the company suspected of violating the 
GPL. This includes:


* corporate structure and jurisdictions of operation
* upstream distributor/manufacturer of device/system in question
* existing policies or publications (blog posts, etc) w.r.t to FLOSS
* and I'll do a quick search of the web for discussions about the 
company and the product/software in question and for any info relating 
to past compliance enforcement work done against the company.



In general, I try to document everything I am doing, files I've saved 
(which sometimes includes relevant web pages, manuals, etc), the amount 
of time I work on the report, and of course any correspondences I have. 
Often a violation report will come in on a particular version of 
software, and if there are newer or older versions, I will sometimes try 
to capture information on these or save some of them as I go.



Anyhow, that is basically my triage process. I hope that this is a 
helpful answer, even if it is a little verbose. :-)


Josh

--
Joshua Gay
Licensing & Compliance Manager
Free Software Foundation
http://www.fsf.org/licensing

Re: GPL violation by Renault (R-Link system)

[Richard Fontana]

On Wed, Apr 16, 2014 at 09:13:13AM -0400, Richard Fontana wrote:
> On Wed, Apr 16, 2014 at 09:16:56AM +0100, Ralph Corderoy wrote:
> > Perhaps the employment contracts from Red Hat,
> > MontaVista, etc., prohibit the employee getting involved with copyright
> > violation in a private capacity?  
> 
> You mean a prohibition on the employee pursuing or getting involved in
> the pursuit of legal remedies for infringement of the *employee's*
> copyright, or the *employer's* copyright? Or both?
> 
> I can't speak for MontaVista, but as to Red Hat, the answer is
> certainly not for the *employee's* copyright, and obviously not for
> the *employer's* copyright.

Actually I wonder if I am confused by what you mean by "private
capacity". I think now you mean "without getting the employer involved
even though the employer is probably the copyright holder".

As you've been recognizing to your understandable disappointment, the
dominant assumption has been that the GPL is enforceable only by
copyright holders. At one time I think this was even thought to have a
policy justification, though I think that may have been rooted in
confusion. Arguments have been advanced (mainly many years ago when
the obsession of some lawyers with the GPL as a topic of inquiry and
discussion was at a *far* more intense level than you see today) for
there being bases of legal enforceability by the downstream recipient
of the GPL-violating software. You can find some of this if you search
a bit.

Anyway, under the orthodox theory of GPL enforcement, if we're talking
about employer-held copyrights, there's a limit to what an employee
could do "privately" in the sense above. Sure, the employee can do
some initial investigation on his or her own, requesting source code,
etc. But it's somewhat irrelevant in such cases who the copyright
holder is, except in the sense that some copyright holders are more
active in enforcing the GPL than others. In the typical case of a GPL
violation -- Bradley, if he reads this, can correct me if I am
mistaken -- you have, in principle, infringement of thousands of
copyrights. What I'm getting at is that the employer, even *if* it is
a copyright holder, is not necessarily best situated to pursue the
violation if it advances beyond the initial stage. Depends on the
employer and who the alleged violator is, really.

You brought up Red Hat; I know of some cases where Red Hat employees
have attempted on their own to get device vendors or software
distributors to provide source code in compliance with the GPL. They
were not typically doing that as personal copyright holders, and they
were not typically acting as agents (even agents on spec, if you will)
of Red Hat. So, taking your question again: no, Red Hat employment
agreements do not prohibit that sort of activity. I'd be really
surprised to see an employment agreement address such a thing.

 - RF

Re: GPL violation by Renault (R-Link system)

[Joshua Gay]

On 04/16/2014 11:27 AM, Joshua Gay wrote:

  free software projects or community
These are all of the steps we take before we contact the company
suspected of violating the terms of the GPL on FSF suspected of
violating FSF copyright. Please note that when the party suspected of
violating



Oops. I had saved a draft of this email but it appears my final draft 
was not saved before editing again. You can ignore the above paragraph 
as the point I was going to make was made in the previous paragraph.

Re: GPL violation by Renault (R-Link system)

[Richard Fontana]

On Wed, Apr 16, 2014 at 09:16:56AM +0100, Ralph Corderoy wrote:
> Perhaps the employment contracts from Red Hat,
> MontaVista, etc., prohibit the employee getting involved with copyright
> violation in a private capacity?  

You mean a prohibition on the employee pursuing or getting involved in
the pursuit of legal remedies for infringement of the *employee's*
copyright, or the *employer's* copyright? Or both?

I can't speak for MontaVista, but as to Red Hat, the answer is
certainly not for the *employee's* copyright, and obviously not for
the *employer's* copyright. Indeed, regarding the latter, it is if
anything common generally in employment agreements to have provisions
that are intended in part to facilitate aiding the *employer* in its
pursuit of remedies for copyright infringement.

- RF

Other methods of GPL enforcement (was Re: GPL violation by Renault (R-Link system))

[Bradley M. Kuhn]

Ralph Corderoy wrote:
> It's because I feel the current methods of compliance enforcement are
> failing:

"Failing" isn't the right word.  Resolving GPL violations takes as much
effort and time as it always, and it's very typical that from when we
identify and open a violation, it's 18 months before we achieve compliance.

I've never seen a method that in general gets compliance faster.  If you know
one, please tell me about it!

Ralph Corderoy wrote:
> they don't cope with the volume of violations;

This I agree with.  Volunteers to help are welcome.  Email me off-list.

> no enforcement ever seems to act as an incentive for others to comply,

> instead it's better for
> a bottom line if they don't bother to comply and just hope the SFC, etc.,
> don't come calling.

> For a copyright holder to enforce takes a lot of time and maybe money.
> Life's short.

More resources would help.  Please donate:
http://sfconservancy.org/linux-compliance/  Please volunteer.

> It's the purchaser of the hardware that wants the source and is prepared to
> put some effort to get it.  Means of enabling them to do something seem
> worth considering.

I'm very much for this.  I think it's on-topic to this list.  But AFAIK we
have no formula for how to do this -- other than in Australia, we can put
people in touch with Brendan Scott.

Telling a new violation reporter speculative stuff that might help someday
but can't help them now isn't that useful.  My main concern is context of the
content, not the content itself.


> Manufacturers care about mass sales and can ignore an annoying individual
> that buzzes around them like a gnat.  They would take notice of large
> retailers.

This part I just don't understand what you're saying.

   -- bkuhn

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Bradley,

> the list-regulars have derailed this thread into pontificating about
> unrelated stuff.

Sorry.  It's because I feel the current methods of compliance
enforcement are failing:  they don't cope with the volume of violations;
no enforcement ever seems to act as an incentive for others to comply,
instead it's better for a bottom line if they don't bother to comply and
just hope the SFC, etc., don't come calling.

For a copyright holder to enforce takes a lot of time and maybe money.
Life's short.  It's the purchaser of the hardware that wants the source
and is prepared to put some effort to get it.  Means of enabling them to
do something seem worth considering.  Manufacturers care about mass
sales and can ignore an annoying individual that buzzes around them like
a gnat.  They would take notice of large retailers.

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Marc,

> What's still looks strange to me is that the GPL gives all the rights
> to endusers, but they are [not] allowed to file a suit? Instead they
> have to find an involved developer willing to do it for them?

And it often seems to need a developer in the relevant country?

I had trouble in the UK years ago, especially when a prominent Red Hat
kernel developer publically poo-poohed the whole thing by saying it was
probably just an oversight and the hardware manufacturer will catch up,
etc.  (They never did.)  Perhaps the employment contracts from Red Hat,
MontaVista, etc., prohibit the employee getting involved with copyright
violation in a private capacity?  (I realise contributions made as an
employee may be copyrighted by the employer but a developer typically
has years of private contributions preceeding the employment.)

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 16 Apr 2014, at 01:18, "Bradley M. Kuhn"  wrote:

Morning, Bradley

> help that person collect the evidence they need and get set
> up properly to do the usual easy things that might yield compliance?

Do you have standard list of questions / pieces of evidence you tend to collate 
in your triage process, which could be used as a framework here?

I ask since, whilst all of us here obviously have an interest in the legal 
aspects of the GPL, the vast majority will lack anything approaching your 
experience in enforcing it. We discussed - ooh, a few years ago now - the idea 
of some kind of "first steps on handling violations" guide, but never developed 
it further. If there is a good basis out there, it would be great not to 
re-invent the wheel!


Best wishes

Neil


Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk

Re: GPL violation by Renault (R-Link system)

[Marc Dietrich]

On Tue, 15 Apr 2014 20:18:25 -0400
"Bradley M. Kuhn"  wrote:

> Obviously this list will have some of of that sort of discussion,
> but can we please focus when someone reports a potential violation
> to help that person collect the evidence they need and get set
> up properly to do the usual easy things that might yield compliance?
> 
> Anyway, I've written to Marc privately on that front.

Thanks for your help. I replied to your private mail which asked for
evidence on the GPL violation. I think it would be better to discuss
these things openly on this list so others may profit from
the documentation of the process in the future.

The evidence is clear in this case: The car's android firmware is
updated by an sd card. The sd card gets loaded from a PC application,
which internet traffic I traced and got the URL of the firmware. Also
the downloaded firmware is put in the data dir of the application and
also (in exctracted form) on the sd card. As already mentioned in
another posting, the filesystem contains a file NOTICE.html.gz which
includes all the 3rd party software (in its licenses).

I don't have directy access to the embedded system yet, but I plan to
get it. It's a new car and I hessitate to dismantle it unless it is
really needed.

Regarding GPL enforcement, here in Germany, the GPL was enforced in
court several times already. gpl-violations.org lists some examples.

What's still looks strange to me is that the GPL gives all the rights
to endusers, but they are now allowed to file a suit? Instead they have
to find an involved developer willing to do it for them? If this is
true, it heavily weakens the GPL. 

Marc

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Neil,

> > The list seems to concentrate on getting the manufacturers to
> > comply.  IIRC Harald had success in the German courts against a
> > retailer, stopping them selling a violating product.  Would that be
> > an easier method to apply pressure on the manufacturers. 
> 
> If the rightsholder could demonstrate that the retailer had performed
> an act restricted by copyright then, yes, going against the retailer
> could well be an option.

Good so far...

> If, for example, the retailer was the first one to import the work in
> question into Europe, or copied the software onto the device itself.

...but then these conditions.  If a retailer buys a palette of
merchandise in good faith and is then later told they are manufactured
and sold to them without the copyright holder's permission, I don't
think them having to be the first importer into Europe is a condition of
having them stop sales?

Amazon release FLOSS software.  Some of those coders will understand the
GNU GPL enough to perhaps want to help out with internal contacts?
Discussion could then start on whether Amazon would consider refusing to
stock items where copyright holders, e.g. Busybox, show a likely
infringement and the shipper to Amazon, typically the manufacturer,
doesn't provide a good response.

Yes, there's a cost to Amazon.  If they thought that ultimately a court
might tell them to stop selling, then they could see an internal
compliance handler as a cheaper option.  Get one big international
retailer publically doing this and smaller ones can be pointed to it
with the suggestion they follow suit.

The manufacturer might churn out product after product but they often
all infringe and hampering sales across models might hit them in the
pocket more than a direct court case over infringement and be quicker
acting.

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Bradley M. Kuhn]

I've been busy and I just caught up on this thread, but I'm again
sad to see that, instead of list-regulars advising Marc about the
obvious steps that are most likely to help him toward a mundane
compliance resolution here, the list-regulars have derailed this
thread into pontificating about unrelated stuff.

Obviously this list will have some of of that sort of discussion,
but can we please focus when someone reports a potential violation
to help that person collect the evidence they need and get set
up properly to do the usual easy things that might yield compliance?

Anyway, I've written to Marc privately on that front.

   -- bkuhn

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 14 Apr 2014, at 10:15, Joseph Heenan  wrote:

> I'd be happy to throw some money and time into a venture to enforce the GPL 
> in the UK

I am not permitted / would not be able to give "legal advice” to such an 
endeavour, but I would be happy to help out where I could.

Best wishes

Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk







signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: GPL violation by Renault (R-Link system)

[Joseph Heenan]

On 14/04/2014 09:42, Neil Brown wrote:


On 14 Apr 2014, at 09:11, Andrew Katz > wrote:


I've spoken to the division at HM Revenue and Customs which deals 
with the seizure of infringing items, and they see no reason in 
principle why they may not use their powers against items containing 
infringing GPL code. However, the applicant does have to give various 
undertakings as to costs and damages etc. if the allegation turns out 
to be incorrect (which means, potentially, that they may be forced to 
the expense of proving their case in a court of law), so this is a 
fairly major disincentive to use this process.


*Very* interesting, indemnities / undertakings notwithstanding…


Agreed, thanks Andrew.

I'd be happy to throw some money and time into a venture to enforce the 
GPL in the UK; I have no idea how we'd really get such a venture off the 
ground - we'd need an (ideally UK based) linux kernel contributor, a 
lawyer (I guess there's a few of those around ;-) ) and some form of 
legal status (I wonder if it could qualify as a charity, albeit that'd 
be a quite a bit of work too).


Joseph

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 14 Apr 2014, at 09:11, Andrew Katz  wrote:

> I've spoken to the division at HM Revenue and Customs which deals with the 
> seizure of infringing items, and they see no reason in principle why they may 
> not use their powers against items containing infringing GPL code. However, 
> the applicant does have to give various undertakings as to costs and damages 
> etc. if the allegation turns out to be incorrect (which means, potentially, 
> that they may be forced to the expense of proving their case in a court of 
> law), so this is a fairly major disincentive to use this process.

*Very* interesting, indemnities / undertakings notwithstanding…


Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk







signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: GPL violation by Renault (R-Link system)

[Marc Dietrich]

Hi Daniel,

On Sun, 13 Apr 2014 20:47:45 -0700
Daniel Berlin  wrote:

> Actually, we (Google) did that , since that is probably the
> auto-generated android notice list that gets generated at build time
> automatically.

ah cool. Good to know and thanks for doing this. You could make it a
bit more userfriendly though by grouping files with equal license
texts. E.g. 

path/to/file1 1), or 2)
path/to/file2 3)

path/to/file3
path/to/file4 1)


and at the end of the file

1) GPL v2
2) BSD 3-clause
3) Android License

Marc

> 
> On Sat, Apr 12, 2014 at 4:46 AM, Marc Dietrich  wrote:
> > On Fri, 11 Apr 2014 15:29:42 -0700
> > Cole Johnson  wrote:
> >
> >> > I wrote a letter to the FSF explaining the situation and I'm waiting now
> >> for
> >> an answer. Is there anything more I can do?
> >>
> >> Unless you have a copyright on the kernel (you've made a contribution that
> >> has been accepted into mainstream and is present in the version that that
> >> device is running (`uname -r` is very helpful), you can't do anything.
> >
> > well, I don't own copyright on the related kernel or software. That's
> > why I contacted the FSF. In the meantime, I checked the filesystem for
> > other GPLed software. Fortunately, TomTom made the work for me already
> > and added a list of GPLed software in /etc/NOTICE.html.gz:
> >
> > /system/lib/libexifgnu.a (LGPL)
> > /system/lib/libusb-compat.so (GPL)
> > /system/lib/libusb.so (GPL)
> > /kernel (v2.6.32, omap3, GPL v2)
> >
> > /system/bin/dbus-daemon and
> > /system/lib/libdbus.so (Academic Free License v2.1 and v2, GPL v2)
> >
> > /system/bin/ip
> > /system/bin/rtmon
> > /system/bin/tc
> > /system/lib/libiprouteutil.so
> > /system/lib/libnetlink.so  (GPL v2)
> >
> > /system/bin/iptables
> > /system/lib/libext4.a
> > /system/lib/libip4tc.a
> > /system/lib/libxtables.a (GPL v2)
> >
> > /system/bin/gsm0710muxd (GPL v2)
> >
> > /system/lib/libwpa_client.so (GPL v2)
> >
> > /system/lib/libasound.so (LGPL v2.1)
> >
> > /system/lib/bluetoothd
> > /system/lib/libbluetoothd.so
> > /system/lib/libbluetooth.so
> > /system/lib/libbluez-common-static.a (LGPL v2.1)
> >
> > /system/lib/libwebcore.a
> > /system/lib/libwebcore.so (BSD, GPL v2, LGPL v2.1)
> >
> > /system/bin/e2fsck
> > /system/bin/mke2fs
> > /system/lib/libext2_profile.so (GPL v2)
> >
> > /busybox (GPL v2)
> >
> > /system/bin/mkdosfs (GPL v2)
> >
> > /system/lib/libfdt.a (GPL v2)
> >
> > /system/lib/libdevmapper.so
> > /system/xbin/usb_modeswitch (GPL v2)
> >
> > /uboot (GPL v2)
> >
> > /system/bin/dnsmasq (GPL v2)
> >
> > which also includes busybox and netfilter stuff.
> >
> > Marc
> >
> >>
> >>
> >> Cole Johnson
> >> -- E-mail: coleharrisjohn...@gmail.com
> >> -- Twitter: @5urd
> >>
> >> Hexware, LLC
> >> -- Twitter: @HexwareLLC
> >
> >
> > --
> > Marc Dietrich 
> >
> 


-- 
Marc Dietrich 

RE: GPL violation by Renault (R-Link system)

[Andrew Katz]

Hi Ralph

> -Original Message-
> From: legal-boun...@lists.gpl-violations.org [mailto:legal-boun...@lists.gpl-
> violations.org] On Behalf Of Ralph Corderoy
> Sent: 13 April 2014 10:09
> To: legal@lists.gpl-violations.org
> Subject: Re: GPL violation by Renault (R-Link system)
> 
> Hi Joseph,
> 
> > I'm wondering if there is some parallel with counterfeit software/
> > movie dvds?
> >
> > Consider if I buy a copy of MS Office, and it turns out not to have a
> > valid license code - there must be some recourse under the Sales of
> > Goods Act. In the GPL cases we normally discuss, the main difference I
> > see is that the GPL software only forms a component of the product
> > rather than the entire product, but it is still unlicensed software.
> >
> > Potentially trading standards could also take an interest, but this
> > would require finding a trading standards officer that understood the
> > issue and wasn't busy dealing with easier to prosecute cases.
> 
> http://www.tradingstandards.gov.uk/policy/leadofficerspecialistsubject.cfm
> says the institute has lead officers, including one for Intellectual Property.
> Their contact page tries to ward off the unwashed masses but it might be
> possible to broach if they're aware of the issue.  Steve Baker, MP, is a 
> former
> programmer who still dabbles, e.g.
> https://twitter.com/SteveBakerMP/status/440133081887170560.  Perhaps he'd
> be willing to offer advice as to how to get Government bodies understanding
> the issue?
> 
FYI, I've spoken to the division at HM Revenue and Customs which deals with the 
seizure of infringing items, and they see no reason in principle why they may 
not use their powers against items containing infringing GPL code. However, the 
applicant does have to give various undertakings as to costs and damages etc. 
if the allegation turns out to be incorrect (which means, potentially, that 
they may be forced to the expense of proving their case in a court of law), so 
this is a fairly major disincentive to use this process.

Best

- Andrew

RE: GPL violation by Renault (R-Link system)

[Andrew Katz]

Hi Neil


 
> It sounds as if we have similar in the UK (although, of course, it means
> interpreting the GPL as a contract, and persuading a court to this effect) - 
> it's
> the Contracts (Rights of Third Parties) Act 1999
> (http://www.legislation.gov.uk/ukpga/1999/31/contents).
> 
> Here's perhaps the key part (s1):
> 
> 
> (1)Subject to the provisions of this Act, a person who is not a party to a 
> contract
> (a "third party") may in his own right enforce a term of the contract if-
> 
> (a)the contract expressly provides that he may, or
> 
> (b)subject to subsection (2), the term purports to confer a benefit on him.
> 
> (2)Subsection (1)(b) does not apply if on a proper construction of the 
> contract it
> appears that the parties did not intend the term to be enforceable by the 
> third
> party.
> 
> (3)The third party must be expressly identified in the contract by name, as a
> member of a class or as answering a particular description but need not be in
> existence when the contract is entered into.
> 
> 
> Could the class be "any third party", who was entitled to require the source 
> to
> be provided in response to a written offer?

I see no reason why the class cannot be 'any third party'. However, the problem 
is that to impose an obligation to release the source, you need to interpret 
that requirement as an contractual obligation, as opposed to a condition 
imposed on the right to distribute. The other problem is that there are 3 ways 
of fulfilling the condition: even if you can interpret the condition as an 
obligation, which one should the court choose to enforce? My understanding is 
the FSF does not believe there is (ever) an enforceable obligation to release 
the source, but that if the source is not released (or the offer made), there 
is a failure to comply with the condition, and the remedies of copyright apply. 
This is one of their complaints against people who spread FUD about the GPL, 
claiming that inadvertent use may require them to release all of their source 
code. 

This is one reason why, under English law, I'm more comfortable with 
interpreting the GPL as a bare licence, and not a contract. 

Best

Andrew

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 13 Apr 2014, at 10:28, u...@vibe.ac wrote:

Morning, Udo.

> On the other hand, from an end user's perspective, he/she is crippled
> the right to get the sources, which - eventually - is one of the core
> things of the GPL, or am I wrong?

I agree entirely that freedom of the user is core to the GPL. I am less sure 
that there is a simple mechanism for user to obtain these in the event of an 
allegation of non-compliance.

At least, I am not aware of any circumstance in which an end user has 
successfully taken action, but I would love to hear otherwise

> Having some legal (albeit quite rusty) background from Austria, we have
> those contracts for the benefit of a third party ("Vertrag mit
> Schutzwirkung zugunsten Dritter"), allowing the third party to intervene
> according to the terms of the contract as well. In the case of the OP,
> that would come very handy ...


It sounds as if we have similar in the UK (although, of course, it means 
interpreting the GPL as a contract, and persuading a court to this effect) — 
it's the Contracts (Rights of Third Parties) Act 1999 
(http://www.legislation.gov.uk/ukpga/1999/31/contents).

Here's perhaps the key part (s1):


(1)Subject to the provisions of this Act, a person who is not a party to a 
contract (a “third party”) may in his own right enforce a term of the contract 
if—

(a)the contract expressly provides that he may, or

(b)subject to subsection (2), the term purports to confer a benefit on him.

(2)Subsection (1)(b) does not apply if on a proper construction of the contract 
it appears that the parties did not intend the term to be enforceable by the 
third party.

(3)The third party must be expressly identified in the contract by name, as a 
member of a class or as answering a particular description but need not be in 
existence when the contract is entered into.


Could the class be "any third party", who was entitled to require the source to 
be provided in response to a written offer?


Best wishes

Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk





signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 13 Apr 2014, at 10:08, Ralph Corderoy  wrote:

> The list seems to concentrate on getting the manufacturers to comply.
> IIRC Harald had success in the German courts against a retailer,
> stopping them selling a violating product.  Would that be an easier
> method to apply pressure on the manufacturers. 

If the rightsholder could demonstrate that the retailer had performed an act 
restricted by copyright then, yes, going against the retailer could well be an 
option.

If, for example, the retailer was the first one to import the work in question 
into Europe, or copied the software onto the device itself.


Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk





signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: GPL violation by Renault (R-Link system)

[udo]

On 04/12/2014 04:52 PM, Neil Brown wrote:
> On 12 Apr 2014, at 09:08, u...@vibe.ac wrote:
>>
>> Why should only the originator of a contribution resp. "a piece of
>> software" be entitled to enforce disclosure of sources?
> 
> 
> It likely depends on the laws of your country, but establishing a basis for a 
> claim might be challenging if not under copyright law.
> 
> Some kind of action for breach of contract, if you could prove (would that be 
> in the interests of the community anyway?) that the GPL was a contract and 
> not a licence.

Thanks, Neil.

I understand, that interpreting the GPL as a contract or as a part of a
contract might lead to unwalked paths :)

On the other hand, from an end user's perspective, he/she is crippled
the right to get the sources, which - eventually - is one of the core
things of the GPL, or am I wrong?

Sources = ability to modify = ability to distribute and so on.

Having some legal (albeit quite rusty) background from Austria, we have
those contracts for the benefit of a third party ("Vertrag mit
Schutzwirkung zugunsten Dritter"), allowing the third party to intervene
according to the terms of the contract as well. In the case of the OP,
that would come very handy ...

So, as per the OP question, TomTom contracted GPL licensed software to
Renault, opening a path for "third parties" (like the OP) to intervene
on their own behalf as well.

Udo

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Joseph,

> I'm wondering if there is some parallel with counterfeit software/
> movie dvds?
> 
> Consider if I buy a copy of MS Office, and it turns out not to have a
> valid license code - there must be some recourse under the Sales of
> Goods Act. In the GPL cases we normally discuss, the main difference I
> see is that the GPL software only forms a component of the product
> rather than the entire product, but it is still unlicensed software.
> 
> Potentially trading standards could also take an interest, but this
> would require finding a trading standards officer that understood the
> issue and wasn't busy dealing with easier to prosecute cases.

http://www.tradingstandards.gov.uk/policy/leadofficerspecialistsubject.cfm
says the institute has lead officers, including one for Intellectual
Property.  Their contact page tries to ward off the unwashed masses but
it might be possible to broach if they're aware of the issue.  Steve
Baker, MP, is a former programmer who still dabbles, e.g.
https://twitter.com/SteveBakerMP/status/440133081887170560.  Perhaps
he'd be willing to offer advice as to how to get Government bodies
understanding the issue?

The list seems to concentrate on getting the manufacturers to comply.
IIRC Harald had success in the German courts against a retailer,
stopping them selling a violating product.  Would that be an easier
method to apply pressure on the manufacturers.  Get Amazon understanding
the issue and a private-ish contact point for informing them of
violations.  When they ask the manufacturer about a violation claim,
their loud voice will be heard and responded too.

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Neil,

> > > Some kind of false advertising, perhaps?
> > 
> > If I buy a tome from my corner bookshop, thinking it to be printed
> > by the publisher, and with a pittance going to the author, only to
> > realise once home that it's been knocked up behind the counter
> > without permission of the copyright holder, what recourse do I have
> > in England?
> 
> Interesting question.
> 
> You might be able to argue that there is a Sale of Goods Act issue
> here, in that the product is not of satisfactory quality but, if, to
> all intents and purposes, the only difference between the official
> copy and the unofficial copy was the lack of a licence to the
> publisher / printer, I have a feeling that this might be a difficult
> case to bring.

It's not inferior quality for the errata are reproduced faithfully.
What irks me is that the author hasn't been given due acknowledgement
with my duff copy.  Perhaps that's a slice of my outlay, passed on by
the publisher, or maybe he received financial reward in advance for
writing it but my purchase should still count as a +1 in the
best-sellers' list.

If I buy hardware with Linux on board, I have the expectation that the
authors have been credited following the rules they signed up to in
allowing their work to be distributed.

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Joseph Heenan]

Hi Neil, Ralph,

On 12/04/2014 16:52, Neil Brown wrote:

On 12 Apr 2014, at 16:32, Ralph Corderoy  wrote:


If I buy a tome from my corner bookshop, thinking it to be printed by
the publisher, and with a pittance going to the author, only to realise
once home that it's been knocked up behind the counter without
permission of the copyright holder, what recourse do I have in England?

Interesting question.

You might be able to argue that there is a Sale of Goods Act issue here, in 
that the product is not of satisfactory quality but, if, to all intents and 
purposes, the only difference between the official copy and the unofficial copy 
was the lack of a licence to the publisher / printer, I have a feeling that 
this might be a difficult case to bring. I'm not aware of any authority on this 
point, but it is interesting.

It feels slightly different to the situation in which someone buys a book 
bearing an autograph, and is told that the autograph is that of famous person x 
when, in fact, it has been applied by the store owner out the back — aside from 
advertising issues, I would suspect that this could be pursued criminally as 
fraud. However, the similarity which is coming to mind is that, in both cases, 
the purchaser derives value from the authenticity of the text / autograph, as 
much if not more so than the physical pages, binding etc.

I'm wondering if there is some parallel with counterfeit software/ movie 
dvds?


Consider if I buy a copy of MS Office, and it turns out not to have a 
valid license code - there must be some recourse under the Sales of 
Goods Act. In the GPL cases we normally discuss, the main difference I 
see is that the GPL software only forms a component of the product 
rather than the entire product, but it is still unlicensed software.


Potentially trading standards could also take an interest, but this 
would require finding a trading standards officer that understood the 
issue and wasn't busy dealing with easier to prosecute cases.


Joseph

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 12 Apr 2014, at 16:32, Ralph Corderoy  wrote:

Afternoon, Ralph

>> Some kind of action for breach of contract, if you could prove (would
>> that be in the interests of the community anyway?) that the GPL was a
>> contract and not a licence.
> 
> The FSF have said in the past they don't want it to be judged as a
> contract?

I'm not sure — possibly so? It would seem logical if that were the FSF's 
position, given that GNU GPL 2.0 section 5 — at least, my reading of it — hints 
at the intention to keep the document as a licence and not a contract.

I am not sure it would be at all desirable for it to be interpreted as a 
contract, and, if it were to be construed as a contract, one would get into 
needing to prove that there was an "acceptance", that there was consideration, 
that the recipient intended to create a legal relationship and so on. It would 
also likely need to comply with various statutory regime around consumer 
protection and contractual fairness (which might pose no problem at all; it's 
not something I have thought about).

Personally, I tend to treat GNU GPL 2.0 and 3.0 as conditional grants of 
licence, which would require a remedy to come from copyright law.

> 
>> Some kind of false advertising, perhaps?
> 
> If I buy a tome from my corner bookshop, thinking it to be printed by
> the publisher, and with a pittance going to the author, only to realise
> once home that it's been knocked up behind the counter without
> permission of the copyright holder, what recourse do I have in England?

Interesting question.

You might be able to argue that there is a Sale of Goods Act issue here, in 
that the product is not of satisfactory quality but, if, to all intents and 
purposes, the only difference between the official copy and the unofficial copy 
was the lack of a licence to the publisher / printer, I have a feeling that 
this might be a difficult case to bring. I'm not aware of any authority on this 
point, but it is interesting.

It feels slightly different to the situation in which someone buys a book 
bearing an autograph, and is told that the autograph is that of famous person x 
when, in fact, it has been applied by the store owner out the back — aside from 
advertising issues, I would suspect that this could be pursued criminally as 
fraud. However, the similarity which is coming to mind is that, in both cases, 
the purchaser derives value from the authenticity of the text / autograph, as 
much if not more so than the physical pages, binding etc.



Best wishes


Neil

__

Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk





signature.asc
Description: Message signed with OpenPGP using GPGMail

Re: GPL violation by Renault (R-Link system)

[Ralph Corderoy]

Hi Neil,

> > Why should only the originator of a contribution resp. "a piece of
> > software" be entitled to enforce disclosure of sources?
> 
> It likely depends on the laws of your country, but establishing a
> basis for a claim might be challenging if not under copyright law.
> 
> Some kind of action for breach of contract, if you could prove (would
> that be in the interests of the community anyway?) that the GPL was a
> contract and not a licence.

The FSF have said in the past they don't want it to be judged as a
contract?

> Some kind of false advertising, perhaps?

If I buy a tome from my corner bookshop, thinking it to be printed by
the publisher, and with a pittance going to the author, only to realise
once home that it's been knocked up behind the counter without
permission of the copyright holder, what recourse do I have in England?

Do I not have the same if I buy a shiny bit of electronics where the
embedded software doesn't have all the copyright holders' permissions to
distribute?

Cheers, Ralph.

Re: GPL violation by Renault (R-Link system)

[Neil Brown]

On 12 Apr 2014, at 09:08, u...@vibe.ac wrote:
> 
> Why should only the originator of a contribution resp. "a piece of
> software" be entitled to enforce disclosure of sources?


It likely depends on the laws of your country, but establishing a basis for a 
claim might be challenging if not under copyright law.

Some kind of action for breach of contract, if you could prove (would that be 
in the interests of the community anyway?) that the GPL was a contract and not 
a licence.

Some kind of false advertising, perhaps?


Best wishes

Neil


Neil Brown
n...@neilzone.co.uk | http://neilzone.co.uk

Re: GPL violation by Renault (R-Link system)

[Solomon Peachy]

On Fri, Apr 11, 2014 at 03:29:42PM -0700, Cole Johnson wrote:
> Unless you have a copyright on the kernel (you've made a contribution that
> has been accepted into mainstream and is present in the version that that
> device is running (`uname -r` is very helpful), you can't do anything.

Folks,

I'm responsible for a large portion of the cw1200 WLAN driver that was 
finally mainlined in the 3.11 kernel, but used well before that 
(especially via compat-wireless/backports) That chipset/driver wasn't 
widely used in phones outside of Sony's, but if that driver turns out to 
be in any of the phones supported by the Anthrax kernels (or some other 
Linux distribution where no source is being provided) I'll lend my 
weight to any GPL enforcement efforts.

Cheers,

 - Solomon
-- 
Solomon Peachy pizza at shaftnet dot org
Delray Beach, FL  ^^ (email/xmpp) ^^
Quidquid latine dictum sit, altum viditur.


pgpRliSHD4pFO.pgp
Description: PGP signature

Re: GPL violation by Renault (R-Link system)

[Marc Dietrich]

On Fri, 11 Apr 2014 15:29:42 -0700
Cole Johnson  wrote:

> > I wrote a letter to the FSF explaining the situation and I'm waiting now
> for
> an answer. Is there anything more I can do?
> 
> Unless you have a copyright on the kernel (you've made a contribution that
> has been accepted into mainstream and is present in the version that that
> device is running (`uname -r` is very helpful), you can't do anything.

well, I don't own copyright on the related kernel or software. That's
why I contacted the FSF. In the meantime, I checked the filesystem for
other GPLed software. Fortunately, TomTom made the work for me already
and added a list of GPLed software in /etc/NOTICE.html.gz:

/system/lib/libexifgnu.a (LGPL)
/system/lib/libusb-compat.so (GPL)
/system/lib/libusb.so (GPL)
/kernel (v2.6.32, omap3, GPL v2)

/system/bin/dbus-daemon and
/system/lib/libdbus.so (Academic Free License v2.1 and v2, GPL v2)

/system/bin/ip
/system/bin/rtmon
/system/bin/tc
/system/lib/libiprouteutil.so
/system/lib/libnetlink.so  (GPL v2)

/system/bin/iptables
/system/lib/libext4.a
/system/lib/libip4tc.a
/system/lib/libxtables.a (GPL v2)

/system/bin/gsm0710muxd (GPL v2)

/system/lib/libwpa_client.so (GPL v2)

/system/lib/libasound.so (LGPL v2.1)

/system/lib/bluetoothd
/system/lib/libbluetoothd.so
/system/lib/libbluetooth.so
/system/lib/libbluez-common-static.a (LGPL v2.1)

/system/lib/libwebcore.a
/system/lib/libwebcore.so (BSD, GPL v2, LGPL v2.1)

/system/bin/e2fsck
/system/bin/mke2fs
/system/lib/libext2_profile.so (GPL v2)

/busybox (GPL v2)

/system/bin/mkdosfs (GPL v2)

/system/lib/libfdt.a (GPL v2)

/system/lib/libdevmapper.so
/system/xbin/usb_modeswitch (GPL v2)

/uboot (GPL v2)

/system/bin/dnsmasq (GPL v2)

which also includes busybox and netfilter stuff.

Marc

> 
> 
> Cole Johnson
> -- E-mail: coleharrisjohn...@gmail.com
> -- Twitter: @5urd
> 
> Hexware, LLC
> -- Twitter: @HexwareLLC


-- 
Marc Dietrich 

Re: GPL violation by Renault (R-Link system)

[udo]

On 04/12/2014 12:29 AM, Cole Johnson wrote:
>> I wrote a letter to the FSF explaining the situation and I'm waiting
> now for
> an answer. Is there anything more I can do?
> 
> Unless you have a copyright on the kernel (you've made a contribution
> that has been accepted into mainstream and is present in the version
> that that device is running (`uname -r` is very helpful), you can't do
> anything.

Why is that requirement? Even as a mere "user" of any software
distributed under the terms of the GPL, I have the right to have access
the sources and to redistribute, modify, ... them

Why should only the originator of a contribution resp. "a piece of
software" be entitled to enforce disclosure of sources?

Re: GPL violation by Renault (R-Link system)

[Cole Johnson]

> I wrote a letter to the FSF explaining the situation and I'm waiting now
for
an answer. Is there anything more I can do?

Unless you have a copyright on the kernel (you've made a contribution that
has been accepted into mainstream and is present in the version that that
device is running (`uname -r` is very helpful), you can't do anything.


Cole Johnson
-- E-mail: coleharrisjohn...@gmail.com
-- Twitter: @5urd

Hexware, LLC
-- Twitter: @HexwareLLC

GPL violation by Renault (R-Link system)

[Marc Dietrich]

Hi,

the Renault R-Link system 
(http://www.renault.com/en/pages/legalinformation.aspx) is a 
navigation/entertainment solution installed in many newer Renault cars. It is 
original developed by TomTom (www.tomtom.com) but distributed by Renault. The 
System is based on Android 2.2 and runs a linux kernel. I haven't analysed the 
bootloader yet, but other tomtom products use uboot.

You can download  a copy of their filesystem from 
http://download.tomtom.com/sweet/navcore/system-update_1467818_all.ttpkg which 
can be converted to a regular tar archive by this small bash script (you need 
a recent dd version for this)

#!/bin/bash

while :; do
   dd conv=notrunc bs=102400 iflag=skip_bytes,fullblock \
   oflag=append skip=20 count=1 2>&1 >&3 | grep 0+1 && break
done < <(tail -c +9 system-update_1467818_all.ttpkg) 3>&1 | tail -c +55 > 
system-update_1467818_all.tar

I ask tomtom first because the "copyright" app shows an offer by tomtom to 
deliver the source, but they said that Renault is responsible (which is ok I 
think because they distribute it).

So I ask Renault Deutschland (where I got the car from) and they refused 
saying they can't do it. Translated response:

"Dear Mr. Dietrich,

after internal review of your request we can tell you that we as Renault 
Deutschland AG can't help you, that means we can neither correct the license 
text, nor we can supply the source code."

[...]

   Renault Deutschland AG

[...]
"

I wrote a letter to the FSF explaining the situation and I'm waiting now for 
an answer. Is there anything more I can do?


Regards,

Marc