Slashdot Log In
GPL Violations On Windows Go Unnoticed?
Posted by
kdawson
on Thu Aug 30, 2007 08:29 AM
from the not-in-my-back-yard dept.
from the not-in-my-back-yard dept.
Scott_F writes "I recently reviewed several commercial, closed-source slideshow authoring packages for Windows and came across an alarming trend. Several of the packages I installed included GPL and LGPL software without any mention of the GPL, much less source code. For example, DVD Photo Slideshow (www.dvd-photo-slideshow.com) included mkisofs, cdrdao, dvdauthor, spumux, id3lib, lame, mpeg2enc, and mplex (all of which are GPL or LGPL). The company tried to hide this by wrapping them all in DLLs. There are other violations in other packages as well. Based on my testing of other software, it seems that use of GPL software in commercial Windows applications is on the rise. My question is how much are GPL violations in the Windows world being pursued? Does the FSF or EFF follow up on these if the platform is not GPL? How aware is the community of this trend?" This new method of detecting GPL violations could help here.
Related Stories
[+]
News: New Method To Detect and Prove GPL Violations 218 comments
qwerty writes "A paper to be presented at the upcoming academic conference Automated Software Engineering describes a new method to detect code theft and could be used to detect GPL violations in particular. While the co-called birthmarking method is demonstrated for Java, it is general enough to work for other languages as well. The API Benchmark observes the interaction between an application and (dynamic) libraries that are part of the runtime system. This captures the observable behavior of the program and cannot be easily foiled using code obfuscation techniques, as shown in the paper (PDF). Once such a birthmark is captured, it can be searched for in other programs. By capturing the birthmarks from popular open-source frameworks, GPL-violating applications could be identified."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Richard Stallman... (Score:3, Funny)
Re:Richard Stallman... (Score:4, Funny)
I can just imagine him like that and saying "They may take our lives, but they can't take our free software!"
Parent
Well.. (Score:5, Insightful)
Re:Well.. (Score:5, Informative)
Parent
Re:Well.. (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Re:Well.. (Score:5, Insightful)
Parent
Re:Well.. (Score:4, Informative)
The violation comes in stripping the GPL off the code....definitely illegal.
Parent
Re:Well.. (Score:4, Funny)
Parent
Legal vs Legitimate (Score:5, Insightful)
However, another point you may have missed is the distinction between illegal and illegitimate - or, conversely, the distinction between legal and legitimate. This is for me a critical aspect of the debate whether it is worse to copy mp3s from someone else or to ignore GPL requirements when redistributing software.
Personally, I think that copying mp3s is often a victimless crime (if I didn't have buy the mp3 at full price because I thought it was overpriced, but then download it later from a friend because he has it results in a zero loss for all involved parties), though can screw over people in particular circumstances. As a result, downloading mp3s is for me a crime on the scale of jaywalking. It might therefore be legal to sue someone for $100000 per infringement, but it doesn't seem legitimate to me. On the other hand, ignoring the GPL when distributing software is taking someone's effort to improve the world, reapproprating it and selling it as your own. Monetary gain or not, it's a shit thing to do.
Again, I challenge you to find me posts that say downloading mp3s is not illegal. I'll show you a post arguing about pre-set levies on blank media or a crackpot. Not only that, but on the more subtle point of whether it is the same thing to download MP3s or to break the GPL license, I completely disagree with you. Breaking the GPL license is to me like stealing candy from a baby - you're a complete jack-ass if you do it. Downloading mp3s.... meh, just make sure to not get caught.
Parent
Re:Clarifying copyrights (Score:4, Interesting)
Then I think you see a different intent than most people. What you are describing is much closer to BSD - here's the code, do what you like with it but just don't claim it's yours. The GPL makes use of copyright to ensure that you can only do certain things with the code - most notably that you must share the source of any modifications you make. Note that if copyright law didn't exist I could still quite happily give you a binary but keep the source to myself, which is now what the GPL wants.
Parent
Re:Clarifying copyrights (Score:4, Informative)
And without the contract, you're infringing copyrights by distributing the material.
By the way, I never got an EULA with any CD/DVD I own.
Here's the EFF's take: http://www.eff.org/deeplinks/archives/004145.php [eff.org]
Notice that none of the various legal uses of the CD include DISTRIBUTING the content. That's why it's called a "COPY - RIGHT". (copyright) Licenses give you rights to material you otherwise do not own or have rights to.
By the way, bootleg automatically implies breaking the law ("illicitly sold")
According to Dictionary.com, something, as a recording, made, reproduced, or sold illegally or without authorization [reference.com] (emphasis mine)
Fair Use still applies if I download an MP3 of a song I already have in a CD I bought, right?
Good question. But if the answer is yes, then you wouldn't be "bootlegging" it, thus the point is made either way.
Parent
Re:Clarifying copyrights (Score:4, Informative)
The rulling specifically says:In other words, breaking the contract didn't automatically revoke the license to use the copyright.
Show me another ruling that says otherwise or for all legal purposes, all you will find is people saying shit that have no grounds in a court. You can believe anything you want. Just don't cry to me when you goto court and find the copyright violations didn't exist. You will find out that in a court, it isn't like the Internet where the loudest most obnoxious person wins. You actually have to, you know, have you claim based in law and tort.
The copyright part is the payment for the contract. You cannot get the benefit of the contract which is the ability to do things copyright hold exclusive to the copyright owner unless you follow the terms of the contract.
You should really read the article you linked to. It mentions "I don't have to promise anything further to go fishing after I pay for my license or sign up for it or whatever the town requires. Once I have my license, I'm free to fish, as long as I abide by the terms." in relation to licenses. Of course a fishing license isn't the same thing as a copyright license. They are specifically defined by different sections of the laws. To compare the two is literally comparing apples and oranges. They share a common thing, Fruit but are both extremely different in appearance as well as taste. The GPL meets all the legally required parts of a contract. It uses copyright as an element but as we saw with the ruling I already linked to (which a ruling matter more then some website), violations of the contract aren't necessarily infringements on the copyright.
Now, I bet you cannot even explain how the copyright and the GPL work without describing a contract. Try it, I dare you to. I'm interested in seeing you walk all over yourself. But before you embark on this endeavor, look up the legal definition of a contract [thefreedictionary.com]. This is a free version of a legal dictionary and it is materially the same as the pay versions I have.
Parent
Re:Well.. (Score:5, Informative)
It needs to be accompanied by a written offer for the source if it isn't accompanied by source.
Parent
Re: (Score:3, Funny)
1. Read "free" license.txt. (Some are surprising, eg: SQLite's original "prayer" or FractInt's "Got money - want admiration")
2. Cut & paste the "free" license.txt into the appendix of your license.txt
3. ???
4. Profit!
There are companies and individuals who are willfully ignorant of steps 1&2 particularly when talking about shrink-wrapped software but IMHO most corporate shops treat copyright issues with "due dilligence".
Re: (Score:3, Informative)
The GPL is usually the only thing giving you permission to make copies of someone else's copyrighted work (unless your use constitutes Fair Dealing or you have separately-negotiated permission from the copyright holder or their authorised agent)
Re: (Score:3, Insightful)
Right on. Using code that is available under GPL does not even always mean that there is a violation. It's possible that the copyright hold allowed them to use it under a different license. (Given the number of packages that are included in this DVD authoring application, this seems unlikely, though.)
new method of detecting GPL violations (Score:5, Informative)
Misleading summary (Score:5, Interesting)
Re: (Score:3, Insightful)
Re:Misleading summary (Score:4, Insightful)
Parent
Re:Misleading summary (Score:4, Insightful)
- They must include a copy of the license.
- They must provide a written offer with the package to provide the source on request.
- They cannot strip attributions in what they provide
I don't know that they've done the last one, but it makes sense along with the other violationsParent
Probably common (Score:5, Informative)
Question to your Question: (Score:3, Insightful)
Who's going to follow up on it and why?
Who's going to pay for the lawyers to do so?
Is there *any* money to be made? Even enough to pay for those lawyers?
Are you just penalizing the "spirit" of the GPL by making it a legal battle rather than letting the code proliferate?
Be sure to report it. (Score:5, Informative)
The normal course of action is that the authors of the GPL code will send friendly "please comply with the license" messages. Usually the infringing party will comply with the GPL before threat of lawsuits are mentioned.
It's definitely unfortunate that consistent policing of proprietary vendors is necessary (they, of all people, should know better!)... but ultimately I think most projects can be made to comply with the GPL without too much trouble, once they are uncovered.
So, in short, document your findings and notify the appropriate people!
Re:Be sure to report it. (Score:5, Informative)
"How can I help gpl-violations.org ?
Firstly by not reacting to a technical GPL violation in an extreme fashion. Secondly by checking the violation is indeed a violation.
Join the mailing lists, discuss issues there first. Be polite but firm when dealing with companies and remember that the goal is to ensure a company stops violating the GPL and does not violate it again, rather than to leave a smoking crater at the location of their HQ... at least not on the first offence.
Keep records of conversations with companies. Co-ordinate with others. A company faced with eight different stories will find it hard to deal with. A company faced with a single accurate information source can respond better.
Beware the "public shaming" bomb. It's easy to let off, but very hard to defuse if you made a mistake or the issue turned out to be minor and is rapidly resolved. In addition companies may become very defensive in such cases and decide to "tough it out". We want to build bridges and giving a company no way to avoid losing face hinders that, especially in certain cultures."
Parent
FSF pursues all violations (Score:5, Informative)
The FSF investigates and pursues GPL violations on its software on all platforms. I've handled violations on Windows, MacOS X, GNU/Linux, and embedded devices. We provide complete instructions for reporting violations [fsf.org] on our web site; if you're finding any kind of violation on FSF-copyrighted software, please don't hesitate to contact us.
-- Brett Smith, FSF Licensing Compliance Engineer
On its software (Score:4, Insightful)
Your code, your responsibility to look after it, not some third party organization's responsibility. (yes, I know submitter isn't complaining about HIS code being used)
Parent
Re: (Score:3, Insightful)
The FSF investigates and pursues GPL violations on its software on all platforms.
Its software - software owned by the FSF, such as the GNU project. The article is incorrectly tagged 'gnu' but this is not a GNU issue. Just because someone used the GPL for their software, doesn't make it part of the GNU project or owned by the FSF and the FSF have no obligation to do anything about this. (dsclaimer: I havent checked to see whether any of the software listed actually is part of the GNU project but it
fsf is a fair weather friend (Score:5, Informative)
The FSF will only work to enforce the GPL if the GPL code in question is signed over to the FSF. While I can understand that legal logic, I have a hard time with the concept of creating something, keeping a copyright in force, and then signing the copyright away for no benefit to myself. The only benefit would be that the FSF would then fight when someone uses it in an "unauthorized" manner. If I'm not going to hold my own copyright, why not just specifically disavow copyright and let it enrich everybody via the public domain?
This is the root of my problem with GNU in general: why show everybody how you achieved and developed a certain technological capability, without letting people actually use that method? If you only want certain people to be able to use that method, then only show those certain people how it's done. I think it's just a bit petty to show the code but not authorize its use. The "unauthorized" user can't steal it because you will always have it. The "unauthorized" user can extend it and keep those extensions hidden, but I fail to see how that really hurts me: I can extend my copy too. If I give an ice cream cone to my brother, I can't dictate to him how he eats it.
Re: (Score:3, Insightful)
Re:fsf is a fair weather friend (Score:5, Insightful)
You appear not to care about the "guaranteed to remain so" part. That's fine. But understand that many among us find closing the source of code that was freely distributed to be rather unfriendly... and we're using copyright law as a tool to help guarantee that the code remains free. This guarantee helps encourage more people to create and to release (because many people would not release their code if they knew that others would commercialize/extend it without giving back). That is, copyright law is achieving, in this case, its stated goal: to encourage the production and dissemination of content.
That, in my mind, is the brilliance of the GPL: it co-opts copyright law, uses it in an unconventional way, and thereby achieves the fundamental purpose of copyright law: to give an incentive for creation and free distribution of creative works.
Parent
Re: (Score:3, Interesting)
Works for SQLite.
The GPL (conceptually); lets people use the software freely, but requires that they "pay" you if the change and distribute the software. Now, they don't pay in money, they
Windows devs don't know much about GPL (Score:5, Interesting)
I personaly don't care much for the GPL, but I do care for complying with licenses and copyright, so I mentionned it to them. Their answer was "GPwhat? No, its free code people give away on the net!". My reply was a long explaination of the difference between "free to do whatever" and the GPL, and even repeating several time, I'd literaly get the same answer: "But...its free! What conditions could there be?".
Eventually I got through by explaining to a project manager, who essentially said that the day someone asks for the source, we'll give it, and that will be that. I still don't think they realised what it meant considering the amount of trade secrets that were in the code, but...
Rentacoder & others (Score:4, Interesting)
On a few occasions when I used to freelance, I've warned people that in order to deliver something on time they'd need to buy-in external components, and to deliver something on budget they'd need to use existing GPL/LGPL or BSD licensed components along with some suggestions and a full rundown of the licensing requirements.
In response to atleast one of these I was just told to strip the copyright from a GPL component and hide it in the application.
The problem isn't really in the violations themselfs, but in the commercial commodity software ecosystem (mostly Windows) where people build up software portfolios as fast as possible for the lowest cost just to try and get market share (and profit). In this desparate effort to get products to market most are just a re-branded combination of existing software, which usually end up violating source code licenses.
Basically when consumers start caring about ethical software the industry will start changing. Until then we still have a problem
patent and GPL? (Score:4, Interesting)
Or they're just careless.
Addressing a few comments... (Score:5, Informative)
- Selling GPL and LGPL software is fine ("nominal fee" clause). The issue is that some of the packages that they are using are GPL'd and the company is LINKING against them. When you link to a GPL package when compiling your software, even if it is a DLL (same address space, symbols resolved in memory), the work becomes one as a whole and the whole package must be GPL. If the package is not GPL'd, it is a violation, even if you provide a license file (which they don't). When you link to a LGPL package, you do NOT need to LGPL your software BUT you need to provide a copy of the LGPL, a way for them to download the source to the LGPL package, and the object files used to link the software as a whole (this last one is heavily overlooked).
- It doesn't matter how popular a software package is. They are still violating the terms of the GPL and LGPL at $60 per sale. "But the code is free!"
- I did not contact the company because I am not a copyright holder in any of the packages whose licenses are being ignored. I contacted all of the projects to let them know of the violations. I have also contacted the FSF for ANOTHER software package (Wondershare DVD Slideshow Builder) who is using vcdimager in addition to most of the above named packages (ffmpeg, dvdauthor, mplex, spumux, mencoder). There are still a few others who I've found just in this category of software who are using GPL/LGPL software.
- The spirit of the GPL isn't just to let code proliferate (not that I am a spokesman for the GPL.. I don't know how it wants to be remembered...
This company and a couple others I'd seen make no mention of the GPL, LGPL, or any other licensing terms and provide no means to download the source code for the LGPL packages.
The reason this came up is because almost every package I installed seemed to contain these exact packages. The companies are profiting from GPL / LGPL software without respecting the licenses.
-Scott
Re: (Score:3, Informative)
libtorrent is BSD licensed (Score:3, Informative)
Re: (Score:3)
Re:Bill's response (Score:5, Funny)
Though... it would explain the speed of the average Windows executable...
Parent
Re:Bill's response (Score:5, Interesting)
It sounds to me like the company isn't trying to hide anything. They're just clueless.
Parent
Re:Bill's response (Score:4, Funny)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Re:What's the issue here? (Score:5, Insightful)
No, we are saying that you have to include a copy of the GPL & an address/url where they can get the source of mkfsiso. Your code is your code, but msfsiso isn't yours so you have to follow the rules it's authors established on how it can be used.
Now assuming that the violation is only with the lack of a copy of the GPL & the URL, it's a 2 minute fix to add those to the liscense.txt file that nobody reads for the next run of CDs. I don't think that anyone would argue that that type of fix is an excessive request by the copyright holders in exchange for the volumes of work put into creating mkfsiso.
Funny doesn't seem like that at all to me. Charge for the work he put into building the distro vs require that he follow the licenses on the works he included in the distro. Two very distinct issues at hand. Seeing as I am almost certain I have seen that software & I believe it comes with a copyright notice on it declairing copyright belongs to the company selling it, I do feel this is a touch different than selling a distro with notices that the copyright belongs to the individual owners.
Parent
Re: (Score:3, Informative)
Stop trolling.
Re:Are you sure these are violations? YES! (Score:3, Insightful)
's are GPL'ed and the source of the added code MUST be made available. (Where is RMS on thi
GPL plug-ins (Score:4, Informative)
Parent
Re:welcome! (Score:5, Funny)
I for one welcome our Auto-Joke Creation Overlords, but imagine a Beowolf cluster of them. In Soviet Russia, the auto-joke creates you!!!
Parent