[go: up one dir, main page]
|
|
Log in / Subscribe / Register

How not to handle a licensing violation

[Posted April 11, 2007 by corbet]

For a long time, Broadcom 43xx wireless interfaces had no free Linux driver. Happily, a dedicated group of developers reverse engineered the device, and, over time, were able to create the missing driver. In the process, they implemented some features which were not available in Broadcom's proprietary driver. Not wanting their code to become part of the proprietary version, the Linux bcm43xx developers chose the GPL for their code - a choice that most other Linux driver developers make as well.

More recently, the bcm43xx developers noticed that the OpenBSD "bcw" driver looked very much like their code. It would appear that the developer of this driver looked to the Linux code for inspiration and took a bit more than just ideas. GPL-licensed code is meant to be shared and reused, but it is not meant to be relicensed unilaterally by third parties. So the bcm43xx hackers decided to talk to the OpenBSD developer about the apparent copying which had taken place.

Unfortunately, their message was copied to a rather large number of people, along with a few mailing lists. The response from the OpenBSD side took two forms, neither of which will be at all surprising to those who have watched how that community operates:

  • The OpenBSD developers do honestly care about the provenance and legitimacy of their code. So the claims were taken seriously; OpenBSD leader Theo de Raadt remarked "This is a major problem in our code base" and said that the issue would be resolved.

  • Those developers immediately launched a counterattack as if they were a beehive which had just been hit by a rock. They complained about the wide distribution of the mail, tore into the bcm43xx developers (example: "You are a very poor example of humankind"), repeatedly put down the "precious GPL," and, inevitably, dragged their maintenance of OpenSSH into the discussion. To many, it looked like an overt attempt to attack the messenger and take attention away from the real problem.

In theory, this situation should be simple to resolve. The OpenBSD developer, Marcus Glocker, has acknowledged the problem and stated that he was aware of it before the discussion began. He says:

I wanted to make some quick progress (maybe too quick), and rewrite the functions in question after seeing some first success, e.g. receivment of first frames, which isn't the case right now.

The bcm43xx developers have said from the outset that they would be willing to relicense at least some of the affected code. The two groups should be able to sit down, talk things through, and end up with everybody being happy.

That has not happened. Instead, we got a nasty flame war, the outright deletion of the OpenBSD bcw driver, and the bizarre sight of Theo de Raadt claiming that he is the person with "at least some fucking empathy in my soul." That is not how things should have gone. There need be no enmity between the Linux and BSD communities; when something like this happens it's worth looking at why in the hope of avoiding a recurrence in the future.

The initial contact from the Linux side was clearly mishandled. When licensing issues come up, the generally-accepted first step is a quiet, polite, private message seeking a solution. People rarely respond well when the first communication about a problem is broadcast to the world. Had the bcm43xx developers conducted a private chat with the OpenBSD bcw developer, chances are that the issues would have been worked out with relatively little fuss. Most developers are interested in solving problems, after all.

The OpenBSD crowd also missed its chance for a quiet solution when it went on the attack. Attempts to divert the discussion through ad hominem attacks, profanity, and general bluster will never lead to a civil conversation or a peaceful resolution of a problem. Deleting the bcw driver (and blaming the Linux community for its loss) seems childish at best. The use of OpenSSH as a sort of trump card is just strange, and a little worrying.

Needless to say, it would also have been better if the code had not been used contrary to its license in the first place. But code licensing issues are complex. In a world where vast amounts of code are floating around under mutually-incompatible licenses, the occasional problem is certain to turn up. That's why the "open source licensing compliance" companies are able to make a living. But licensing disagreements between free software projects are rarely so intractable that they cannot be solved by rational discussion. The next time a situation like this comes up - something which is certain to happen, sooner or later, and the Linux community might just find itself on the other side of the table - we can only hope that all of the people involved will approach a solution in a way which allows that rational discussion to take place.

Index entries for this article
KernelBroadcom 43xx
KernelCopyright issues

to post comments

How not to handle a licensing violation

Posted Apr 11, 2007 20:13 UTC (Wed) by jengelh (subscriber, #33263) [Link] (1 responses)

It is "bcw" not "bcm" on the OpenBSD side. http://beranger.org/index.php?article=2779

Somebody flipped my "w"

Posted Apr 11, 2007 20:22 UTC (Wed) by corbet (editor, #1) [Link]

Oops, silly mistake. Fixed now.

How not to handle a licensing violation

Posted Apr 11, 2007 20:19 UTC (Wed) by drag (guest, #31333) [Link] (11 responses)

Sometimes you just can't deal rationally with some people.

The problem faced with the BCM43xx people is that the offending code is already out there. That the copyrights are wrong, that the licensing is wrong, and that third parties are already starting to look at it and maybe even are trying to use it.

So it's something that needed to be done publicly. There is no way around it. You can't do it privately since there are third parties that _need_ to know.

Although it would of been better to go talk to the BSD developer BEFORE going public with the issue. So that was the first mistake.

The second mistake was letting Theo change the discussion to center around email etiquette.

They should of just ignored him. It's obvious that it's pointless to discuss anything with him.

How not to handle a licensing violation

Posted Apr 11, 2007 20:34 UTC (Wed) by madscientist (subscriber, #16861) [Link] (10 responses)

The right thing to do was to contact the BSD developer and let HIM go public asking people to remove the old version with incorrect copyrights and start using the new version where the copyright issues had been resolved, along with an explanation.

As Our Editor says, clearly this was handled badly by all concerned. This kind of thing is exactly why the FSF always starts with private conversations whenever a GPL violation is discovered: you can get so much more accomplished so much more rapidly if you don't make the other person feel like they're being attacked.

How not to handle a licensing violation

Posted Apr 11, 2007 21:03 UTC (Wed) by drag (guest, #31333) [Link] (9 responses)

Well as long as somebody ended up going public without much delay. It doesn't realy matter a whole lot who does it.

The way I look at it it seems that it should off been handled in a manner similar to how you deal with security disclosures. You go to them first, in private, then you let the end users know what happenned after it's been resolved.

It's a bit different from your normal GPL violation because generally your trying to prevent people from closing off access to code. In this case your trying to prevent third party mostly anonymous people from using tainted code from the OpenBSD project.

How not to handle a licensing violation

Posted Apr 11, 2007 22:04 UTC (Wed) by dlang (guest, #313) [Link]

not completely, you are also trying to prevent people from takeing the code that's apparently released under the BSD license and putting it in their private codebase. without publicity there is no way for these third parties to know that they shouldn't do this.

How not to handle a licensing violation

Posted Apr 11, 2007 22:24 UTC (Wed) by dmarti (subscriber, #11625) [Link] (5 responses)

The security scene balanced full disclusure vs. privately giving people a chance to fix things: RFPolicy. Maybe we need something similar for attribution or copyright issues.

How not to handle a licensing violation

Posted Apr 11, 2007 22:44 UTC (Wed) by ajross (guest, #4563) [Link] (4 responses)

Absolutely not. The purpose behind the limited disclosure rules for security vulnerabilities is to limit exposure of public systems until a solution is found. It's a public safety concern.

This whole brouhaha, as far as I can tell, is about hurt feelings, decorum, and email etiquette. In what possible way can that be considered morally or practically equivalent? Remember that the real issue here was a copyright and license violation, and that issue was resolved successfully and quickly. Your suggestion is just a band-aid for avoiding the resulting flame war.

Developers are, as a rule, socially insensitive jerks and flame wars happen all the time. Why does this one deserve special treatment? My guess is that it's because one of the biggest bomb throwers was the leader of a high profile project, and as a result lots of high profile people were embarrassed. I'm sorry, but "don't embarrass important people" seems like a pretty obscure and special case requirement for a development process.

And, by way of full disclosure: these flame wars aren't exactly without value. I'll come right out and admit that this was one of the most entertaining I've read in years. It's right up there with Tannenbaum vs. Torvalds, or Tridgell vs. McVoy in my book. I mean, let's just admit it: this kind of train wreck can make for a pretty great afternoon's reading for those of us not directly involved.

How not to handle a licensing violation

Posted Apr 12, 2007 0:05 UTC (Thu) by dmarti (subscriber, #11625) [Link]

People who want to jump into flame wars can easily find them.

Ability and willingness to participate in unnecessary flame wars shouldn't be a prerequisite for participating in a project, though. Raise the standard of discourse, and you make a project attractive to people who aren't "socially insensitive jerks", bring in useful contributors who won't bother with flame-infested projects, and you win.

How not to handle a licensing violation

Posted Apr 12, 2007 8:59 UTC (Thu) by sdalley (subscriber, #18550) [Link] (2 responses)

Am I permitted to wonder whether "socially insensitive jerk" attitudes like this are one big reason why there are so few women in FOSS ??

How not to handle a licensing violation

Posted Apr 12, 2007 9:59 UTC (Thu) by aigarius (subscriber, #7329) [Link] (1 responses)

Oh, please. Women can be just as insensitive as men if they try :)

How not to handle a licensing violation

Posted Apr 12, 2007 21:41 UTC (Thu) by amikins (guest, #451) [Link]

Or if they don't try. Being, you know, insensitive and all. Sensitivity requires effort. :D
<-- Insensitive

How not to handle a licensing violation

Posted Apr 11, 2007 22:34 UTC (Wed) by ekj (guest, #1524) [Link]

It matters a lot to the person guilty of infringing the copyrigth.

There's a rather large difference between having "this person is an asshole who stole my code" posted very publicly one the one hand, and on the other hand to get a private message about it, being able to relicence some of the code, rewrite or otherwise fix the remaining issues and then be able to yourself post a message of the type;

I was recently contacted by the developers of X about my recent contributions to Y. In an attempt to get the driver working quickly, I improperly copied some functions from their similar Linux-driver, planning to replace them as the driver started working. The developers of X have however agreed to relicence parts of their driver under the BSD-license, and I have rewritten other parts -- the driver in current CVS is clean. Everybody should stay away from the driver in CVS rev X to rev Z, as that code contains GPLed parts not distributable under the BSD-licence.

How not to handle a licensing violation

Posted Apr 11, 2007 22:46 UTC (Wed) by k8to (guest, #15413) [Link]

If the license problem is limited to the developer being contacted yes. In this case the license problem was being inflicted upon any users who acquired CVS HEAD (ie. the public). See my comment below for more detail.

How not to handle a licensing violation

Posted Apr 11, 2007 20:32 UTC (Wed) by jengelh (subscriber, #33263) [Link] (37 responses)

Well, since we can give comments, here's my standpoint as an observer. (I am not involved in bcm43xx or bcw.) The arguments I find most strong (as in value) are:

And, you are going to do this using the GPL, even. You did not privately mail that developer. No, you basically went public with it.

The bcw developers went public with it. This code was submitted to a public CVS. With multiple commits.[ref]

and

A mistake several times in a row? Isn't that unlikely to be a mistake them?[ref]

How not to handle a licensing violation

Posted Apr 11, 2007 20:50 UTC (Wed) by madscientist (subscriber, #16861) [Link] (36 responses)

What you find valuable depends on what your ultimate goal is.

Is the goal to resolve the issue as quickly and harmoniously as possible? If so then going public with the problem to a huge recipients list without any attempt to resolve the matter privately first is absolutely NOT the right way to proceed, regardless of whether the other party is wrong, really wrong, or even unforgivably wrong, or how much proof of this exists.

If you don't care about quick, harmonious resolution and the goal is to make an example or to prove a point, then publicity is definitely the way to go. However, the only outcome that you can reasonably expect from the public method that the authors chose is the one they got: bad feelings, acrimony, and even more fuel for those who hate Linux and the GPL to feed on.

I agree that the BSD folks behaved quite badly as well (probably just embarrassment, underneath--they don't like to think they need or want anything from Linux)... but the sad thing is all of this was easily avoidable. As with many other things, when it comes to handling license violations we should just follow RMS's example :-)

How not to handle a licensing violation

Posted Apr 11, 2007 21:02 UTC (Wed) by ajross (guest, #4563) [Link] (25 responses)

Is the goal to resolve the issue as quickly and harmoniously as possible? If so then going public with the problem to a huge recipients list without any attempt to resolve the matter privately first is absolutely NOT the right way to proceed

What about the case where a third party downloaded and shipped code from OpenBSD's CVS while the infringing code was present? How does one resolve the matter "privately" when the code had already been distributed?

And I'm not even sure that your statement is correct for all values of "resolve". Note that the infringing code was pulled from CVS within hours of the flame war and the public notified (via slashdot, of course) within two days. I have a hard time believing that that speed would have been achievable via private email. One might event argue that "quickness" and "harmony" are anti-correlated here.

This whole canard just seems like a weak argument to me. I mean, even if one grants the whole "Linux developers are jerks" issue: it's still a copyright and license violation, it still needs to be corrected, and the public still needs to be notified. None of those goals are assisted by the OpenBSD team throwing counter-flames and etiquette ad-hominems in response.

How not to handle a licensing violation

Posted Apr 11, 2007 21:16 UTC (Wed) by drag (guest, #31333) [Link] (24 responses)

It's nice to be nice. It's a 'You catch more Flies with honey, then you do with Vinegar' type thing.

Realy the developer should be given the benifit of the doubt. All effort should be given to being cordial and respectfull of the other people involved.

Let the other person be the asshole first.

Given the attitude of OBSD users and OBSD developers torward Linux and toward the GPL there is NO WAY this would of ended nicely.

NO way. It's just not going to happen.

But it's much more adventagous to make the other guy look like the asshole first. The moral high ground and all that.

This is why Theo should just be mostly ignored. How would of this turned out if nobody responded to his attacks and challenges and just worked to make sure that the problem was resolved? What was won by debating him on weither or not your 'inhuman' or whatever?

Absolutely _nothing_.

It realy does take 2 people to flamewar. Theo purposely drove the discussion away from the copyright violations and made it a discussion about email morality.

If the BCM43xx folks ignored his bait, and ignored his flames then I doubt any of this crap would of made it to Slashdot.

Also if they handled themselves more courteous fasion in the first place PLUS ignord the attempts to divert attention away from the copyright violations then it would of been even better!

Going public was nessicary, but this was still a disaster that made both sides like like jerks.

How not to handle a licensing violation

Posted Apr 11, 2007 22:00 UTC (Wed) by cventers (guest, #31465) [Link] (22 responses)

I didn't really see any jerks except for Theo. All the concerns about
going public are really valid -- OpenBSD CVS cannot be an anonymizing
proxy through which GPL code can be incorporated (intentionally or
accidentally) into proprietary software.

The Linux devs started out with a peaceful message, even offering to
relicense parts of the code.

Theo responded by calling the code's inclusion a "mistake" (as if copying
code from one driver into yours, knowing full well that it violates
copyright, could ever be considered an "accident"). All of these
incidents where Linux code was being checked into the OpenBSD,
BSD-licensed CVS tree were all accidents. The accidents continued to
happen over the course of more than a month.

Theo erected a straw man: "What, you want my driver developer to stop his
work?"

Theo engaged in ad hominem attacks against the Linux driver developer.

Theo implied that copyright might not apply because the bcw driver
doesn't yet work properly. (What?)

Theo implied that the only copyrighted material was spacing and comments.

By blowing up and making outrageous claims, Theo *caused* the issue to
get Slashdotted. You regret it being public? Your tantrum made it more
public.

At the end of the day, the OpenBSD project deleted the driver and spun
off into rants about OpenSSH and how evil the GPL is. All of that because
an OpenBSD developer blatantly violated a GPL copyright and got called on
it?

For the record... I don't have it out for OpenBSD. When Theo made his
call for OpenSSH contributions, I answered with a donation out of my
personal pocket for $40.

But was it wrong for the Linux developers to go public, even before going
private? Don't think so. There was even discussion in the commentary that
implied that when Linux asked for some BSD code (which they don't have to
do, except for the fact that Linus won't merge BSD code without
permission out of respect), they were told to piss off.

I agree with some of the others in the list... I think Theo was just
trying to distract attention away from the copyright infringement by
being as loud and obnoxious as possible.

How not to handle a licensing violation

Posted Apr 11, 2007 22:58 UTC (Wed) by drag (guest, #31333) [Link]

It's just a matter of decorum and perception. That's all.

There is no question in my mind that going public was required. To much potential for people using OpenBSD code.

The lessons learned are:

1. Talk to the developer first BEFORE (not instead of) going public in future if this problem happens again with OpenBSD folks.

2. Ingore Theo completely.

How not to handle a licensing violation

Posted Apr 12, 2007 4:30 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (20 responses)

Initially, upon seeing this donnybrook (or at least, the portion of it that was on various mailing lists), I was mystified about what sequence of events could possibly allow the described outcome to occur through a "mistake". I was actually tempted to find some maximally diplomatic way of asking "Excuse me, but I honestly am curious about how someone else's code can be copied into one's own by accident, and hope someone wouldn't mind describing the scenario that Marcus says applied in this case, or at least one that could occur. Thanks."

I'm pretty sure I've figured it out: Marcus was temporarily using Michael et al.'s code in what was supposed to be a private development instance of bcw, while figuring out how to reimplement bcm43xx's algorithms independently. (To answer ajross's question, no, that would not necessarily cause the resulting driver to remain permanently a derivative work of bcm43xx. "Derivative work" is a legal term of art from copyright law, and can be loosely described as a work reusing a substantive amount of the copyright-eligible expressive elements of the original. Please see "Derivative Works" and related entries in my knowledgebase.) Private reuse does not infringe copyright. Marcus no doubt intended to ensure that all substantive traces of bcm43xx were expunged from his local copy, before checking it into CVS, and failed to do so.

So, the protestations of "mistake" actually are credible.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 5:23 UTC (Thu) by bronson (guest, #4806) [Link] (19 responses)

But how did that private development tree get checked into a public CVS server? I'm happy to give the BSD developers the benefit of the doubt and call it an honest mistake but, wow... That's a pretty huge mistake! Have there been other mistakes that haven't been caught yet? If so, I hope the very capable OpenBSD team finds them before any greedy SCO-type companies.

How not to handle a licensing violation

Posted Apr 12, 2007 5:39 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (18 responses)

bronson wrote:

That's a pretty huge mistake!

Yes, indeed.

I now see that, per "ncm" (Nathan Myers, whom I always heed closely), elsewhere on this thread, Marcus simply didn't realise that checking into an outside-accessible CVS server constituted "distribution". Note Nathan's shrewd point about the key misunderstanding that resulting from people having assumed different things were what Marcus referred to as his "mistake".

Either way, it's copyright violation and needed to be fixed, but avoidable unpleasantness resulted from that misunderstanding: Michael, like me, had the understandable reaction of "Huh? How can copying someone else's work to that degree possibly be a mistake?"

In how many other code locations has this sort of mishap occurred? Probably innumerably many -- in both open source and proprietary code. (Businesses, as a point of comparison, find themselves inadvertantly committing torts against each other all the time, sometimes being forced to choose between greater and lesser ones. Almost all get dealt with quietly, if noticed.)

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 6:23 UTC (Thu) by bronson (guest, #4806) [Link]

Great answer. It's too bad about the heat that both sides generated but I'm glad it eventually produced a little illumination too.

How not to handle a licensing violation

Posted Apr 12, 2007 7:01 UTC (Thu) by cventers (guest, #31465) [Link] (7 responses)

I must admit I never looked at the code myself to verify. But what struck
me was that the check-ins of GPL code apparently happened over a period of
time of greater than a month.

I could see the mistake scenario you describe happening, but if it was
happening over a longer term... isn't it a little harder to justify?

How not to handle a licensing violation

Posted Apr 12, 2007 7:42 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (6 responses)

cventers wrote:

I could see the mistake scenario you describe happening, but if it was happening over a longer term... isn't it a little harder to justify?

It's so difficult that neither I, nor Marcus, nor anyone else to my knowledge has attempted to do so. (I hope you noticed my sentence "Either way, it's copyright violation, and needed to be fixed....)

Anyway, if you're asking if I think it credible for third-party borrowings to be checked into CVS multiple times without the committer quite noticing his failure to replace them, I 'd say yes.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 8:52 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (5 responses)

The thread showed the OpenBSD developper didn't take GPL code, commited it in CVS and forgot about it, but that he replaced some OpenBSD-rewritten code with new GPL code later, and then commited the result.

So the infrigement occured several times in a row and he really couldn't pretend he was working on replacing an initial GPL cut & paste

(also taking some outside code and replacing it peacemeal while having the original code under the eyes is probably not legit legal-wise, and he didn't even had the "excuse" there was no hardware docs because the Linux people had set up a separate documentation project for the hardware)

How not to handle a licensing violation

Posted Apr 12, 2007 16:13 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (4 responses)

"nim-nim" wrote:

So the infrigement occured several times in a row and he really couldn't pretend he was working on replacing an initial GPL cut & paste

That conclusion strikes me as non-sequitur: Nothing prevents Marcus having borrowed bcm43xx code several times and intending to rewrite it each time. Failing to do so is negligent, of course.

(also taking some outside code and replacing it peacemeal while having the original code under the eyes is probably not legit legal-wise

This opinion strikes me as ill-informed about copyright law. You might wish to read some caselaw on the meaning of "derivative work" as applied by the courts to software.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 17:21 UTC (Thu) by ajross (guest, #4563) [Link] (3 responses)

You might wish to read some caselaw on the meaning of "derivative work" as applied by the courts to software.

I think you might be overstepping here. At best, "derived work" in software is a nebulous concept. Wikipedia comes up with the following two links (by Larry Rosen and Dan Ravicher -- real lawyers, even!) which are considerably more circumspect in their pronouncements:

http://www.rosenlaw.com/lj19.htm
http://community.linux.com/article.pl?sid=02/11/13/117247

Certainly to me, a very clear common sense argument can be made that "piecewise replacement" is the software equivalent of, say, art forgery. The resulting work represents the efforts of its author, but is so tainted by the design of the original that it can't be viewed as a separate work.

At the same time, one could reasonably argue that only the final work generated from such a replacement regime should be judged on its own as a single entity -- that the "derived" property is of the work as it is, and not a function of its history. If it can be shown to be clearly distinct and different, then it should be legal. This is the theory supported by the AT&T/Berkeley lawsuit, for example (although it should be pointed out that this was a settlement, not a judgement, and one driven largely by Novell's lack of interest in pursuing the case for a comparatively minor product, not necessarily by weakness of the case itself).

The difference on both ends of the spectrum seem to be ones of degree; there is no "bright line" test here. So as a practical matter, I'd strongly argue that the kind of "copy and replace" development methodology used by OpenBSD here is inherently risky, and a generally bad idea. Its legality isn't nearly as obvious to me as it seems to be to you.

How not to handle a licensing violation

Posted Apr 12, 2007 17:49 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (2 responses)

ajross wrote:

I think you might be overstepping here.

I think you might need to read and understand the leading caselaw (e.g., Micro Star v. Formgen, Lewis Galoob Toys, Inc. v. Nintendo of America, etc.). I have done so (for USA jurisdictions); I'm pretty sure you have not.

...tainted by the design of the original...

See, "design" would have to be a patent encumbrance, if at all. Copyrights are abstract properties concerning expressive elements of creative works (in areas of endeavour defined by statute). Patents are abstract properties concerning (useful) ideas and methods.

Designs per se are not eligible for copyright, which is why typefaces ("fonts") do not have copyright ownership (though their hinting programs do). Particular expressions of a design, if put into fixed form and judged to have sufficient creative content, do give rise to copyright ownership. See the difference?

(By the way, the legal term is "derivative work", e.g., in 17 U.S.C. 103. This alternate form "derived work" appears to have recently caught on primarily among open source free-software people, I notice.)

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 18:10 UTC (Thu) by ajross (guest, #4563) [Link] (1 responses)

See, "design" would have to be a patent encumbrance, if at all.

No, that's just wrong. Or rather, it's true only for definitions of "design" that don't match the clear context of what I wrote. You're picking on the vocabulary in my post, not the meaning: that's just bad form. Yes, there are area of patent law that treat "design" as jargon. That doesn't prevent one from using the word in contexts where it has its more traditional meaning. I'll try once more, and then leave you to your flames:

Taking a C file and changing all the symbol names constitutes infringement, agreed? Doing the same, but re-ordering them constitutes infringement, yes? Inlining one into another is still infringing, yes? Changing the calling order of two statements is still infringing, yes? Likewise, the addition of new code doesn't change the infringing status.

And yet, after enough of those changes, the work stops being derived (last I checked, that was a synonym for "derivative", by the way -- y'know, even legal arguments get to use English, too!) and starts being a unique, copyrighted work. My point is that the distinction between these states is not a bright line (ooh! a legal term!), but in fact a squishy mess. And that it is therefore best avoided by concientious developers.

So please stop with the amateur legalese. The abundantly evident truth is that real lawyers and real courts don't think this is a clear area of law, and don't have unambiguous advice for us. The world isn't as simple as you believe, and continuing to act as if it is can only lead to precicely the mistakes seen by the OpenBSD team here.

How not to handle a licensing violation

Posted Apr 12, 2007 18:59 UTC (Thu) by rickmoen (subscriber, #6943) [Link]

ajross wrote:

You're picking on the vocabulary in my post, not the meaning: that's just bad form.

I'm honestly sorry if I misunderstood what you meant by the word "design", but I really was doing my best to read in proper context. You seemed to be saying that, even after all the borrowed bcm43xx code was replaced by from-scratch replacement code, some Platonic essence of the original, the "design", inevitably would remain. And, sorry, that's just not how copyright caselaw has developed.

But let's discuss how it would be applied. I think we turn out to be in substantive agreement on that. The court (again, assuming US jurisdiction) would look for both literal and non-literal copying. For the latter, it would apply the "abstraction, filteration, comparison" test developed in CAI v. Altai, looking for expressive elements copied in a non-literal fashion. (Non-expressive, e.g., strictly functional elements are not entitled to copyright.) If there is a substantive amount of copying of expressive elements, and it wasn't explicitly permitted, and it doesn't fall into one of the allowed categories, and plaintiff has valid title, then there would be a ruling of infringement.

And indeed, there isn't a bright line. The courts had a rough time working out even those guidelines. If you'd read the caselaw, you'd have known that quite a while ago. ;-)

Also, sorry, I'm not going to try to understand software law and leave it solely to the courtroom gladiators. It's too important to remain ignorant of. You shouldn't, either.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 7:51 UTC (Thu) by drag (guest, #31333) [Link] (7 responses)

Well do you suppose that the developer didn't realise that people were downloading code from that CVS server?

I don't think that he was that clueless on how CVS works. The excuse stinks.

It's similar to sticking a program (say.. modified GPL'd gimp plugin) on a public website, telling people that it's your copyright, telling people that it's BSD licensed, and then being confused about weither or not this constitutes 'distribution'.

Sounds like the guy is playing up the old OpenBSD anti-GPL arguements about the licensing being confusing and difficult to understand.

The earlier excuse was that was used was that the guy was working on a replacement for GPL'd code and he used functions and bits of logic from the GPL code to aid in the development of his own code. AS a sort of developer crutch, I guess.

As he progressed he would replace the borrowed logic from the GPL'd code with his own.

He made a mistake by forgetting about replacing this and that code snippet. So through the development proccess these bits of bcm43xx code wound up on the public CVS server.

How not to handle a licensing violation

Posted Apr 12, 2007 8:05 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (6 responses)

"drag" wrote:

I don't think that he was that clueless on how CVS works. The excuse stinks.

I'm going to muster all powers of diplomacy at my disposal, and point out that neither I nor anyone else present is making an "excuse" for Marcus. Thus my overall comment that "Either way, it's copyright violation, and needed to be fixed...", which seems to have eluded your notice.

In addition, I'll point out, pro bono publico, that I nowhere suggested Marcus being clue- deficient about CVS. What I said was that (1) I speculated that he might have forgotten that borrowings from bcm43xx were still present when he made his comments, and (2) Nathan says he has reason to think Marcus thought CVS checkin wasn't yet "distribution" for copyright purposes. (If you think developers aren't prone to forgetting that the public can and does grab things from their public CVS repositories, you probably haven't known many developers.)

There's a certain lovely irony in a habitual Linux user (that would be me) making efforts to understand what happened, and, for his pains, being accused of making "excuses". It isn't much compared to the larger ironies noted by others, but I thank you for your contribution, anyway.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 8:58 UTC (Thu) by dark (guest, #8483) [Link] (2 responses)

Hmm. In the flamewar archive there is a link to a commit that replaces
original bcw code with code from bcm43xx, apparently to fix a bug. That
doesn't fit with your speculation (1) at all.

How not to handle a licensing violation

Posted Apr 12, 2007 16:04 UTC (Thu) by rickmoen (subscriber, #6943) [Link] (1 responses)

"dark" wrote:

In the flamewar archive there is a link to a commit that replaces original bcw code with code from bcm43xx, apparently to fix a bug. That doesn't fit with your speculation (1) at all.

Actually, I can see that, too: It would require only that use borrowed code for that purpose and intend to fully rewrite it before commit, but then by commit time have forgotten that necessity. Negligent? Of course. So is the scenario Nathan Myers described. Figuring out what did happen with Marcus is an interesting exercise, and the smart money might bet on Nathan's scenario rather than mine -- but I'd argue that it's at least equally useful to visualise all the various plausible ways such things could happen. As "ajross" says, if you anticipate the potential for screwups, there are meaures you can take to make them less likely.

Rick Moen
rick@linuxmafia.com

How not to handle a licensing violation

Posted Apr 12, 2007 18:11 UTC (Thu) by cventers (guest, #31465) [Link]

You know... the truth is that I don't really know what Marcus was
thinking (if at all) when checking GPL code into the OpenBSD repository.
But this is a great time to point out that it is human nature to give
more 'rope' in allowances for what /might/ have happened if you look
favorably on the party in question. It is here that I think Theo did the
biggest disservice -- to his own developer Marcus. By reacting as he did,
he put everyone on edge and made it that much more difficult to accept
that it was a simple 'mistake'.

How not to handle a licensing violation

Posted Apr 12, 2007 9:31 UTC (Thu) by drag (guest, #31333) [Link] (1 responses)

"There's a certain lovely irony in a habitual Linux user (that would be me) making efforts to understand what happened, and, for his pains, being accused of making "excuses". It isn't much compared to the larger ironies noted by others, but I thank you for your contribution, anyway."

You misunderstood what I ment.

I didn't think _you_ were making excuses for him.

What you stated was realy very close to what Theo stated for Marcus's excuses. So I thought you were talking about _their_ excuses.

Plus I don't think that it's impossible or stupid to think that could happen. I think it's unlikely.

I am still willing to beleive it one way or the other. The guy deserves the benifit of the doubt.

It's just fishy excuses, that's all. I think that they could come up with something better.

How not to handle a licensing violation

Posted Apr 12, 2007 9:33 UTC (Thu) by drag (guest, #31333) [Link]

PS. But if that is what happenned then that's possible.

I agree that realy it doesn't matter. The problem is resolved one way or the other.

I just wish the OpenBSD developers would choose to work _with_ the bcm43xx folks to help get broadcom driver support for OpenBSD rather then spend their time fighting them.

The whole thing is pretty stupid.

How not to handle a licensing violation

Posted Apr 12, 2007 14:21 UTC (Thu) by ajross (guest, #4563) [Link]

Note that there are processes that can help with this sort of misunderstanding. Every commit to the kernel, for example, includes a chain of "signed-off" tags indicating the developers who have reviewed the patch.

The related agreement in Documentation/SubmittingPatches includes a section detailing exactly what "signed-off" entails in the context of license and copyright law. So at least in principle, every change includes an affirmative promise that there are no hidden license violations. It's not possible for such a change to reach a relaese without the whole chain of developers from the original author to Linus failing to follow the rules.

What seems interesting is that OpenBSD appears to have no equivalent. They just delegate commit privileges without training and assume everyone is clean and competent.

How not to handle a licensing violation

Posted Apr 12, 2007 17:14 UTC (Thu) by JoeF (guest, #4486) [Link]

I now see that, per "ncm" (Nathan Myers, whom I always heed closely), elsewhere on this thread, Marcus simply didn't realise that checking into an outside-accessible CVS server constituted "distribution".

I am sorry, but I don't quite believe that an experienced developer, as Marcus has been described, would not know that having code in a publicly accessible archive is distribution.
I can see that for a newbie, but not for a seasoned developer.
If it really was the case that an experienced developer didn't know what checking code into a public CVS server means, there would be something seriously lacking in the OBSD projects.

How not to handle a licensing violation

Posted Apr 12, 2007 10:37 UTC (Thu) by gypsumfantastic (guest, #31134) [Link]

Oh, what a brilliant, brilliant flamewar.

Hypocrisy, righteous indignation, genocide? All the makings of a truly world-class immolation-fest.

See, Tim O'Reilly? You can shove your civility up your vegemite causeway. The white-hot heat of angry confrontation. That's how truths get revealed, dialectics synthesised, decisions taken and the world moved on.

How not to handle a licensing violation

Posted Apr 11, 2007 21:05 UTC (Wed) by jengelh (subscriber, #33263) [Link] (9 responses)

Since you can always go public later, I take the private approach first FWIW.

How not to handle a licensing violation

Posted Apr 11, 2007 22:26 UTC (Wed) by man_ls (guest, #15091) [Link] (8 responses)

Well said. You lose nothing, and you can win a lot: for a start, the other side cannot blame you for "going public before telling them in private". Later you can publish the conversation if the other side is not receptive.

How not to handle a licensing violation

Posted Apr 11, 2007 22:49 UTC (Wed) by k8to (guest, #15413) [Link] (7 responses)

In the usual case you lose nothing. In the case where falsely labelled code is being actively distributed to the public, many people are exposed to risk for the period of the delay. This is a real problem.

How not to handle a licensing violation

Posted Apr 11, 2007 23:27 UTC (Wed) by MathFox (guest, #6104) [Link] (6 responses)

We are talking about copyright infringement here (removing authorship information from the source file, redistributing code without a license.) That is a crime. What makes the situation worse is the serious risk that innocent parties could be duped in infringing the same copyrights.

In any decently ran company including third party code and obfucating its source is a cause for termination. The liabilities of illegally redistributing code for a company are huge.

dealing with copyright infringement

Posted Apr 12, 2007 7:56 UTC (Thu) by man_ls (guest, #15091) [Link] (5 responses)

Come on, guys. Who can honestly think that one or two days will make any difference? Does Moglen's SFLC have the same urgency? I imagine they take their time while their private negotiations are in progress.

Besides, copyright infringement is only a crime if you sue the infringer. The goal of all this "handling licensing violations" is precisely to bring third parties into compliance without suing.

dealing with copyright infringement

Posted Apr 12, 2007 8:05 UTC (Thu) by k8to (guest, #15413) [Link] (4 responses)

Again, comparing this with typical GPL issues is not a good fit. Typical infringers are doing so in private and no harm comes of delay. Certainly when all you lose is a delay for the infringing party to come into compliance, the need for urgency is almost nonexistent.

dealing with copyright infringement

Posted Apr 12, 2007 11:46 UTC (Thu) by grouch (guest, #27289) [Link] (3 responses)

Pirates! Make the scum-bags walk the plank, keel haul the lot of 'em and then hang 'em from the yard arm! The world's economies will collapse if there is any delay in securing our most preciousss IP! Delay is death!

I have to agree with corbet, madscientist, man_ls, and others who advocate a quiet, private attempt at resolution first. I strongly suspect there would have been no appreciable delay in public notification of the problem, by the BSD developer himself, had he been contacted privately with the details of the problem.

dealing with copyright infringement

Posted Apr 12, 2007 16:54 UTC (Thu) by k8to (guest, #15413) [Link] (2 responses)

Your tone seems to be equating the public notification of a problem with a measure of punishment. If this is an accurate description of the the intent, it would certainly be a mistake. I see no such indication.

dealing with copyright infringement

Posted Apr 12, 2007 17:13 UTC (Thu) by man_ls (guest, #15091) [Link] (1 responses)

I would say "insult" rather than "punishment", but both are related. I have to be a bit verbose to explain it, please be patient with me.

Private notification can be as quick as public notification, if the receiving party reacts promptly to it. Now, an honest, conscious developer would surely react to the private notification with the same swiftness as if she had the public eye on her. Therefore, believing that a public notification can get a swifter response than a private one is equivalent to thinking that the receiving developer is not honest or conscious; or at least that you do not trust said developer to make the right thing on her own. It is natural to feel insulted by such a thought.

The punishment comes if you really think that the developer has done a bad thing, and it is implied by such loaded words as "falsely labelled", "crime", "duped", etc. Then you have to punish the guilty developer, and since you cannot trust someone who did a bad thing you have to go for a public beating.

If you believe the code misuse is the result of an honest mistake, and that it will be prompty resolved, you ought to be much more inclined to try a private notification first.

dealing with copyright infringement

Posted Apr 12, 2007 17:23 UTC (Thu) by k8to (guest, #15413) [Link]

For my part, "falsely labelled" was referring not to the action but the status of the code. That is, the code was in a barbed, dangerous state: that of being falsely labelled. The loading was to convey the danger, not any malfeasance.

How not to handle a licensing violation

Posted Apr 11, 2007 20:48 UTC (Wed) by ajross (guest, #4563) [Link] (1 responses)

One of the things I haven't seen discussed is how exactly this happened. It just seems incredibly sloppy. Apparently the OpenBSD developer intended to start with a working driver and reimplement it piecewise until he had replaced all the code. But is that kosher? That would strike me as almost the very definition of a "derived work", no?

Now, surely there are people who would disagree* with this analysis and say that it's fine. But shouldn't the developer have asked first? Something like "Is this OK to go into CVS as it is, or should I do development somewhere else?" Did any conversation like ever take place? Why not?

Even if this is an one-time process failure, the general lack of interest in enforement makes one wonder if, perhaps, this isn't the only such license violation in the tree.

* The original AT&T/BSD settlement involved a similar piecewise replacement of the Bell Labs code with "pure" Berkeley code, for example. So maybe this is just a tacit assumption in the BSD world.

How not to handle a licensing violation

Posted Apr 11, 2007 22:29 UTC (Wed) by bronson (guest, #4806) [Link]

Looking for a quick win, I totally understand that. It's far easier to start with a working driver and then make incremental changes than it is to just bring up hardware cold.

But... How did the GPL code end up in CVS?? That's just amazing to me. OpenBSD is normally so tight with its code -- how did they let a mistake like this happen? And is there other tainted code in their CVS?

How not to handle a licensing violation

Posted Apr 11, 2007 22:40 UTC (Wed) by k8to (guest, #15413) [Link] (7 responses)

There's no particular problem to my thinking of starting with the GPL code and rewriting it until the original is gone. There's no particular problem with doing this among multiple OpenBSD developers in collaberation in a source repository.

The problem is that the source repository is public, and so was essentially made available to the public in an ongoing fashion. This is where the license is being trammaled upon, and is also a clear and present risk to the public in that they are at risk for acquiring and incorporating tainted code under false pretenses.

In this situation, I cannot criticize the choice of bringing the problem to the attention of the public immediately. In the usual GPL situations, the problem is that binaries are being provided without source, or that code is being linked in a manner which is not license-compatable. Neither of these situations will lead to further legal problem if they are addressed at a measured and diplomatic pace in private. This particular problem _did_ represent the real possibility of the creation of additional legal problems for any number of third parties in a present manner.

Thus the communication of the problem in the manner it was communicated was reasonable. There was no error.

How not to handle a licensing violation

Posted Apr 12, 2007 3:07 UTC (Thu) by njs (subscriber, #40338) [Link] (3 responses)

>There's no particular problem to my thinking of starting with the GPL code and rewriting it until the original is gone.

There are multiple theories on this. The situation you propose is likely okay as a matter of law (it would probably depend on the similarity between the original and the rewritten version), and that's enough for some people. Other people get understandably put off by those words "likely" and "probably", so they only accept code that was built in a fully clean-room fashion. Most commonly one is worried about contamination from proprietary code, but contamination from GPL code would work exactly the same way.

I am pretty sure that the OpenBSD developers fall, as a rule, into the more-cautious second group.

How not to handle a licensing violation

Posted Apr 12, 2007 17:47 UTC (Thu) by NRArnot (subscriber, #3033) [Link] (2 responses)

> There's no particular problem to my thinking of starting with the GPL code and rewriting it until the original is gone.

IANAL but I'm pretty certain that there is a problem! The situation is very similar to the translation of a book out of one language and into another, perhaps followed by renaming all the characters and places until no words at all of the original remain (though if there is no common script or phonetics, such as Chinese to English, that can't happen anyway). A good human-language translation often requires linguistic restructuring of the order of a paragraph and not infrequently some degree of re-invention of the plot details. (For example, what to do when something arises out of a character mis-hearing one word as another, when in the target language the mis-hearing could not arise?) Regardless of such rewriting and even re-plotting, a translation is quite definitely a derived work in law.

This is why when folks are doing reverse-engineering of proprietary stuff they tend to adopy very stringent two-team "clean-room" approaches, to make sure that nothing derivative of decompiled machine code gets copied into the new project. This is of course a paranoid approach necessary where you know that the original author's lawyers are definitely out to get you if they can.

How not to handle a licensing violation

Posted Apr 13, 2007 16:39 UTC (Fri) by notamisfit (guest, #40886) [Link] (1 responses)

Just out of curiosity, does this mean that the copyright to GNU Emacs is still in the hands of James Gosling?

How not to handle a licensing violation

Posted Sep 3, 2008 20:57 UTC (Wed) by dvdeug (subscriber, #10998) [Link]

There is no "the" copyright to GNU Emacs; it's possible that James Gosling could hold some copyright to GNU Emacs. However, I believe that any court would settle a legal battle by evoking estoppel; you can't let someone publicly put that much work into a product and then after 20 years contest their right to do so. For example, Kevin McClory who worked on a film script with Ian Fleming claimed that the cinematic James Bond was a derivative work of his work, but a court said that you can't wait until the DVDs of movies made in the 60s out to press a copyright claim.

How not to handle a licensing violation

Posted Apr 12, 2007 9:05 UTC (Thu) by dark (guest, #8483) [Link]

There wouldn't have been a problem in any case if the GPL parts of the
code had been clearly marked and accompanied by their license. Then the
license could be removed once all the covered code is gone, and in the
meantime the work in progress is in compliance.

If it's the developer's intention to replace all the GPLed code
eventually, then it seems to me that clearly marking it is a necessary
step. But that didn't happen.

How not to handle a licensing violation

Posted Apr 12, 2007 13:03 UTC (Thu) by lysse (guest, #3190) [Link] (1 responses)

> Thus the communication of the problem in the manner it was communicated was reasonable. There was no error.

Does "reasonable" include an acceptance of the consequences of such an action? Because honestly, I'd have seen Theo's response coming a mile off, and almost certainly would have responded in a similar manner myself, were I in Theo's position; and the communication of the problem only remains "reasonable" if the communicators were prepared for that entirely predictable response, even if they hadn't specifically anticipated it. (If they were expecting an "oops, sorry, we'll get that sorted", the kindest thing that could be said is that they hadn't considered their audience.) The subsequent statements of those communicators indicate that they were not so prepared.

Whatever one thinks of Theo, he comes across as straightforward (to a fault), loyal, and guileless; whatever one thinks of the wisdom of his response, it comes across as entirely natural. Someone attacked one of "his people" and he went mama-bear on them.

How not to handle a licensing violation

Posted Apr 16, 2007 17:42 UTC (Mon) by tuxchick (guest, #42009) [Link]

Funny, whenever I read one of Theo's diatribes, I think "mentally
unbalanced." Not loyal, true blue, and all that. After going nuclear over
this, what's he going to do when it's something serious?

How not to handle a licensing violation

Posted Apr 11, 2007 22:53 UTC (Wed) by rfunk (subscriber, #4054) [Link] (8 responses)

I've watched bits of the fallout from this on both sides, first at
undeadly.org and then in comments on the linux-elitists list and here.
It seems to me that there's quite a bit of unnecessary enmity on both
sides. Each side's partisans seem to be too quick to assume that the
other side was completely in the wrong (and are just bad people to boot).

I'm glad Our Editor is trying to strike a middle ground and push for more
diplomatic sort of thing in the future. I wish more people around here
(and over there) could do that.

How not to handle a licensing violation

Posted Apr 12, 2007 2:58 UTC (Thu) by k8to (guest, #15413) [Link] (7 responses)

I like diplomacy. I think highlighting the importance of diplomacy is important. I read through the list, and the problem report _is_ diplomatic.

So while I agree with you, I'm pretty perplexed about how this particular issue brings about this particular discussion.

How not to handle a licensing violation

Posted Apr 12, 2007 7:12 UTC (Thu) by ekj (guest, #1524) [Link] (6 responses)

The message is diplomatic. Very even. They for exampel explicitly offer to let the BSD-developers have atleast some code under BSD-license.

"You copied my code in violation of the license, however if you talk to me I'm willing to relicense some of the code so that you can continue to use it." is very cooperative.

The *recipient-list* wasn't, however, very diplomatic. The same message sent only to the responsible developer would've been diplomatic. Escalating if you don't get a prompt positive reply from the developer would also have been fully justified.

This was also justified, but at the same time more alienating than it needed to be. BSD and GPL developers tend to share 90% - 95% of the goals afterall, so it's a pity getting into stupid figths over the remaining 5-10%

How not to handle a licensing violation

Posted Apr 12, 2007 8:03 UTC (Thu) by k8to (guest, #15413) [Link] (5 responses)

I rather think mailing the developer then after a day or so "escalating" it is more hostile. It suggests compliance is being demanded instead of simply informing the interested parties of the problem.

How not to handle a licensing violation

Posted Apr 12, 2007 13:13 UTC (Thu) by lysse (guest, #3190) [Link] (4 responses)

That's your right, but expect to find yourself on the bad side of people who disagree with you, even if they're fully aware of your opinions. I for one would interpret you coming to me before going over my head as considerably less hostile. (I'd also expect you to wait for me to reply, rather than deciding that if I didn't break off my hospital stay, or pick your email up off the floor my ISP dropped it on, inside 24 hours to get you an acknowledgement, then I'm clearly not interested - but hey, perhaps I just have that annoying expectation of being treated like a human being.)

Also, the interpretation of the message as a demand for compliance anyway would seem to negate your point.

How not to handle a licensing violation

Posted Apr 12, 2007 16:57 UTC (Thu) by k8to (guest, #15413) [Link]

This all is absolutely correct, in the case that other parties are not being harmed with delay. In the case that they are, the small harm to the ego of the transgressing party is the lesser of two evils.

How not to handle a licensing violation

Posted Apr 12, 2007 20:04 UTC (Thu) by bfields (subscriber, #19510) [Link] (2 responses)

I'd also expect you to wait for me to reply, rather than deciding that if I didn't break off my hospital stay, or pick your email up off the floor my ISP dropped it on, inside 24 hours to get you an acknowledgement, then I'm clearly not interested

Personally, I hope that I never give anyone the impression that I'd be offended if they took care of urgent business for me while I was temporarily away. It's solving the problem that's the important thing--I don't see why I should care whether it's me that solves it or not.

How not to handle a licensing violation

Posted Apr 12, 2007 23:55 UTC (Thu) by lysse (guest, #3190) [Link] (1 responses)

That's not what I said, is it? You're talking about going to a delegate; I'm talking about intepreting silence negatively.

So to put the orchard back: Would you be so happy if whoever went to someone else who could sort the problem out did so with the words "bfields stole our code on purpose, can you sort them out please?"? And that the someone else in question took the assertion at face value and sacked you?

How not to handle a licensing violation

Posted Apr 13, 2007 16:37 UTC (Fri) by bfields (subscriber, #19510) [Link]

That's not what I said, is it? You're talking about going to a delegate; I'm talking about intepreting silence negatively.

Well, you did say "I'd also expect you to wait for me to reply". That's not something I'd expect--if you have an urgent issue (and discovering that I was publicly distributing code with serious license issues would count), I'd definitely prefer that you go to whoever you need to (including people "over my head") to get the problem solved if I don't reply promptly, rather than wait some indefinite length of time with the problem unsolved.

Would you be so happy if whoever went to someone else who could sort the problem out did so with the words "bfields stole our code on purpose, can you sort them out please?"?

Why would I care?

Anyway, I don't see that in the original message; was that something that was said later in the flamewar?

And that the someone else in question took the assertion at face value and sacked you?

And here I'm totally lost. Was Marcus sacked? Who was taking anything at "face value"? What does this have to do with who problem reports should be addressed to?

Words have meanings (plural)

Posted Apr 11, 2007 23:39 UTC (Wed) by ncm (guest, #165) [Link] (1 responses)

I read through the whole thread. Aside from the personalities involved and certain disorders, there were some definitional misunderstandings.

First among these must be that Marcus, the amateur bcw developer, didn't think that committing file versions to (public) CVS amounted to "distribution". That was the "mistake" that Theo alluded to, over and over, and that Michael, who complained, couldn't see as a simple "mistake" because it happened repeatedly. I.e., Michael saw him distributing copyrighted code over and over, while Marcus didn't think he was distributing at all. Michael thought Theo was claiming the copying itself was the mistake, and objected that it could not have been accidental.

(If OpenBSD used Monotone, or a similar distributed repository, it mightn't have come up, because he would have been checking the code into his local repository.)

Another was when Theo announced that Michael was calling Marcus a thief by saying the copying and distribution couldn't have been a "mistake". Copyright violation isn't thievery. Distributing somebody else's code with the copyright notice filed off is not allowed, but the remedy is just to stop distributing (i.e. take it out of public CVS), and no criminal codes are violated.

Words have meanings (plural)

Posted Apr 12, 2007 17:45 UTC (Thu) by JoeF (guest, #4486) [Link]

First among these must be that Marcus, the amateur bcw developer, didn't think that committing file versions to (public) CVS amounted to "distribution". That was the "mistake" that Theo alluded to, over and over

Marcus certainly is not an amateur developer. he obviously has commit rights, which you usually only get if you are a pretty experienced developer. And as experienced developer, he should have known that committing to a public CVS archive is distribution. Quite frankly, because of that, I don't buy this whole "mistake" thing.

Missing information

Posted Apr 12, 2007 3:32 UTC (Thu) by paravoid (subscriber, #32869) [Link]

There is an important piece of information that is missing from the article.
bcm43xx, unlike most (if not all) drivers, followed the Chinese Wall approach on the reverse engineering; that is, one team of developers looked at the disassemblies of Broadcom's code and wrote specs and another team took the specs and implemented a driver.

As a result, there are actually open specifications on the hardware -- unlike most drivers where the code *is* the specification.
Usually, BSD developers can only read through the GPL code to implement a driver and try(?) hard not to copy actual code (i.e. derive) from Linux.

In this case, there was no reason of reading or copying the code from Linux.
There were open specifications, like those that Theo has been asking from every vendor by *publicly* attacking them (talk about PR...)

The bcm43xx project went through the trouble of having distinct teams, one to read the proprietary code and one to write the GPL one, so their code would not be tainted by any implementation details.
The particular BSD developer had _open specifications_ and instead he preferred *copying* the implementation from Linux.
Not to mention replacing all ocurrences of "bcm43xx" with "bcw", stripping the GPL license, stripping the copyright, adding his name and making numerous CVS commits on the way.

How can this be called "an honest mistake"? It's nothing but honest.
This is a blatant copyright violation and an insult on the excessively time-consuming work of the bcm43xx developers.
IMHO, it should be treated as such. Michael Buesch was too *kind*.

I'm happy this was public and all of we were informed.
The deletion of the bcw driver was an unforunate event but I'm happy for it because the BSD developers (and its benevolent dictator) would not do what was needed, again IMHO, in this case: reverting the driver before the commits of the infringing code and banning the developer who made that commit from further development of this particular code.

How not to handle a licensing violation

Posted Apr 12, 2007 6:56 UTC (Thu) by peha (guest, #2168) [Link]

It is strange that in a comunity that encourage freedom and openness, it is a bad thing to rather politly point out a misstake in public would!

If people often do similar things as Marcus Glocker his misstake may not be so big, and thus going public with the misstake is not a big thing either.

On the other hand if the misstake is big then going public is necessary to prevent future misstake.

Per

How not to handle a licensing violation

Posted Apr 12, 2007 8:19 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (17 responses)

1. knowing Theo and how he'd "reinterpret" any private mail in public doing a private notification would have been madness. The OpenBSD folks have made this kind of public process necessary by their systematic hostility towards Linux wireless projects.

2. the OpenBSD people had already started distributing the contentious code, in fact SUN was looking at adapting their driver for Solaris. There was no way to handle this quietly at this stage - one had to notify third-parties because third-parties were already getting involved

Writing it has been mishandled by both sides is misleading. The initial notification was not closing any doors (one could fault it for being impersonnal, but given previous bad blood between the projects that was a good thing), and the Linux people did not react to the numerous flamebaits the other party shovelled at them.

Every way you look at it OpenBSD folks brought this on their heads themselves. Given the circomstances the Linux project has been pretty gracious about the whole thing.

How not to handle a licensing violation

Posted Apr 12, 2007 13:17 UTC (Thu) by lysse (guest, #3190) [Link] (5 responses)

> knowing Theo

Oh good, you can settle a bet I have with a friend. What newspapers does he take, and which pages does he turn to first?

How not to handle a licensing violation

Posted Apr 12, 2007 14:58 UTC (Thu) by dark (guest, #8483) [Link] (4 responses)

A few comments up, you asked, "Does 'reasonable' include an acceptance of
the consequences of such an action? Because honestly, I'd have seen Theo's
response coming a mile off..."

And here you are, mocking someone for making exactly that kind of
analysis.

How not to handle a licensing violation

Posted Apr 13, 2007 0:09 UTC (Fri) by lysse (guest, #3190) [Link] (3 responses)

Had nim-nim said "given Theo's actions in the past" (and actually cited specific examples) in support of his claim that Theo would dishonestly misrepresent private communications in public, I'd not have made that criticism. As you note, I have no problem at all with deduction from prior experience.

How not to handle a licensing violation

Posted Apr 13, 2007 0:11 UTC (Fri) by lysse (guest, #3190) [Link]

I'm sorry; nim-nim's implication. It didn't have the courage to be a claim.

How not to handle a licensing violation

Posted Apr 13, 2007 8:24 UTC (Fri) by nim-nim (subscriber, #34454) [Link] (1 responses)

Since you seem to want to enter a pissing contest where did I wrote dishonestly?

Theo's worldview and vocabulary is not the same as those of mere mortals. I certainly hope the misrepresentation is not intentional, but all his public interventions I've read so far (and this thread is no different) tend to spin reality in another dimension.

As to citing specific examples: plonk, if you trying to pretend you don't know what I wrote about you're nothing but a troll.

How not to handle a licensing violation

Posted Apr 13, 2007 13:21 UTC (Fri) by lysse (guest, #3190) [Link]

Right, so you withdraw from accusing Theo of acting with deliberate dishonesty, instead level what amounts to an accusation of schizophrenia, and then *you* describe *me* as a troll for asking you to support your claims...?

I'm sorry that I ever wasted my contempt on you.

How not to handle a licensing violation

Posted Apr 12, 2007 13:23 UTC (Thu) by lysse (guest, #3190) [Link] (10 responses)

> in fact SUN was looking at adapting their driver for Solaris

Google comes up empty on this claim. Would you care to furnish us with some specific evidence to that effect?

How not to handle a licensing violation

Posted Apr 12, 2007 14:13 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (8 responses)

Read the thread. It's explicitely written in one of the messages (do not use the archives of the OpenBSD ML, they lack half the messages, use the Linux ML archives)

How not to handle a licensing violation

Posted Apr 12, 2007 14:57 UTC (Thu) by lysse (guest, #3190) [Link] (7 responses)

I'm sure you won't mind posting a URL. After all, as the claimant, it's your responsibility to provide support.

How not to handle a licensing violation

Posted Apr 12, 2007 15:17 UTC (Thu) by nim-nim (subscriber, #34454) [Link] (6 responses)

Here
http://article.gmane.org/gmane.linux.drivers.bcm54xx.deve...

Please do your own reading next time

How not to handle a licensing violation

Posted Apr 12, 2007 23:50 UTC (Thu) by lysse (guest, #3190) [Link] (5 responses)

...and what a surprise, it's hearsay - moreover, Quaker.Fang is described as an OpenSolaris developer, not a Sun developer.

As for "do your own reading": 1. I attempted due diligence (hence the Google reference); 2. even had I read and remembered this particular line in that email, I would not have associated it with the claim you made.

Because it's different.

As I suspected - you got nothin'. Please don't make baseless claims and then get defensive when you're called on them next time.

How not to handle a licensing violation

Posted Apr 13, 2007 6:04 UTC (Fri) by nim-nim (subscriber, #34454) [Link] (1 responses)

You can think whatever you like.

Every other bit Theo tried to dismiss was substanciated big time in replies and only got him up to his neck. I note he didn't try to attack this one - you can ask in the thread if you don't trust the Linux guys but their case has been pretty solid so far and my money is on them.

Whatever qualifier you apply to Quaker Fang it doesn't change the basic point that third parties were getting involved. How did they knew they were getting involved? Probably the say way they learnt of the infringement, by reading what people write on specialized mailing lists. It's a small world.

How not to handle a licensing violation

Posted Apr 13, 2007 13:16 UTC (Fri) by lysse (guest, #3190) [Link]

> You can think whatever you like.

I am happy to be so permitted. So can you; you can even say what you like, and there's not a damned thing I can do to stop you. But you don't get to throw around unsubstantiated allegations and unsavoury implications without being called on them; that kind of behaviour is cowardly and despicable. (And yeah, I see you just did it again.) You may (and clearly do) think that Theo is the lowest of the low - but I don't believe that Theo has ever acted with the kind of wilful disregard of such niceties as evidence and honesty that you have exhibited here; I don't want to associate with people who think only "nice people" have the right to be treated well; and on the basis of what I've seen, I would trust Theo over you without hesitation.

How not to handle a licensing violation

Posted Apr 13, 2007 6:05 UTC (Fri) by k8to (guest, #15413) [Link] (2 responses)

It seems the essential issue that the code was being actively considered for use in another project remains, and the rough description is not entirely inaccurate.

Let us all make *some* room in order to allow discussion to occur.

How not to handle a licensing violation

Posted Apr 13, 2007 13:00 UTC (Fri) by lysse (guest, #3190) [Link] (1 responses)

But then we have to return to the "hearsay" point. What has been presented isn't evidence of anything except what the original mail writer believed to be the case; he may be mistaken, he may not be aware of the most current facts, etc.

We can make some room, sure; but for one thing, it's manifestly unfair to start slinging concrete accusations around on the back of unsupported hypotheses; and for another, the GPL is clear that it applies to distribution rather than receipt, so the point (of whether the code was about to be reused by Sun, Microsoft, or some random guy who wanted to make his machine work) has no relevance at all.

Which makes it curious that it was raised in the first place, let alone overstated as wildly as it was.

How not to handle a licensing violation

Posted Apr 14, 2007 13:35 UTC (Sat) by Los__D (guest, #15263) [Link]

...the GPL is clear that it applies to distribution rather than receipt, so the point (of whether the code was about to be reused by Sun, Microsoft, or some random guy who wanted to make his machine work) has no relevance at all.

What? Distributions about to reuse a driver, has no affect on the distribution clause? What do you think they would like to reuse it for?

How not to handle a licensing violation

Posted Apr 13, 2007 9:08 UTC (Fri) by johill (subscriber, #25196) [Link]

Quaker Fang mentioned he'd look into it here: http://www.opensolaris.org/jive/thread.jspa?messageID=108575

Liability and notice

Posted Apr 12, 2007 12:10 UTC (Thu) by BrucePerens (guest, #2510) [Link]

This is different from a no-source infringement of the sort we usually see in the commercial world. Some innocent third party could have pulled that code off of the BSD repository and used or derived from it without knowing its licensing or provenance. That person could have been damaged by this. IMO a notice about the copyright and licensing status of the file had to be published with all possible dispatch to protect such people.

Bruce .

How not to handle a licensing violation

Posted Apr 12, 2007 15:18 UTC (Thu) by mheily (subscriber, #27123) [Link] (2 responses)

Clearly, the OpenBSD dev who committed the tainted code was in the wrong and it was within the rights of the bcm43xx devs to request it's removal. Since the bcm43xx devs wanted to make the problem a very public issue, it was also Theo's right to go on their mailing lists and complain. What this incident really exposes is the license schism between the BSD camp and the GPL camp.

It's too bad that the bcm43xx team chose to work under the GPL since reverse engineering a complex piece of hardware is such a difficult thing to do that we need all the free software developers we can get. The end result is a driver that is only useful as a "glue" between the kernel and the hardware, due to the use of magic numbers, undocumented registers, etc.

What is even worse is that the bcm43xx team is openly hostile to the idea of Broadcom using their driver to create a proprietary binary-only Broadcom driver for Linux. What's so terrible about having a a fully functional vendor-supported driver that you can study, reverse-engineer, and use to improve the capability of the free bcm43xx driver? Is nothing better than something?

If the driver were freely licensed under the BSD or ISC license, all of the free operating systems -- and even the commercial ones like Solaris and OS X -- could use it and contribute to it's development. A device driver is not like a normal piece of software, it is really only useful for one thing: talking to a specific class of hardware. There is no reason to lock it away behind a restrictive license.

How not to handle a licensing violation

Posted Apr 12, 2007 17:01 UTC (Thu) by k8to (guest, #15413) [Link]

According to paravoid above, there is a reverse-engineering derived specification created by the bcm43xx authors. If true, the perceived problem you mention with the choice of GPL is alleviated.

How not to handle a licensing violation

Posted Apr 12, 2007 19:59 UTC (Thu) by ajross (guest, #4563) [Link]

Unfortunately, you have your facts pretty mixed up. The reverse engineering was not done by the bcm43xx team. That work was done in a "clean room" manner by a separate group of people, who make the resulting specification available to the public at:

http://bcm-specs.sipsolutions.net/

The choice of the GPL was made for the code implementing the driver (as it must be, obviously -- it's distributed as part of the Linux kernel), not for the hardware information required to write it.

As far as I can see, this misunderstanding invalidates every one of the points you have made. Nothing was locked away. All of the reverse-engineering work is available. Everyone is free to create drivers under any license.

I disagree entirely.

Posted Apr 12, 2007 16:32 UTC (Thu) by leoc (guest, #39773) [Link] (3 responses)

I think this is exactly how a license dispute should be settled. Since humans are involved, there will always be emotional political disagreements (and BSD vs GPL is a classic), but the lack of lawsuits in this conflict demonstrates the superiority of the free software model. Contrast this to the proprietary software industry, where multi-year lawsuits over copyright, patents, and other so called "intellectual" property are the norm.

I disagree entirely.

Posted Apr 14, 2007 17:20 UTC (Sat) by dirtyepic (guest, #30178) [Link] (2 responses)

...but the lack of lawsuits in this conflict demonstrates the superiority of the free software model. Contrast this to the proprietary software industry, where multi-year lawsuits over copyright, patents, and other so called "intellectual" property are the norm.

You do realize the only reason for the lack of lawsuits is the lack of money involved, not because of some fanciful moral high ground we somehow occupy, right? If there was anything to gain besides our egos we'd be right down there in the mud with them.

I disagree entirely.

Posted Apr 16, 2007 19:08 UTC (Mon) by dvdeug (subscriber, #10998) [Link]

And that demonstrates the superiority of the free software model, in that it reduces the incentive to have long drawn out lawsuits.

I disagree entirely.

Posted Apr 17, 2007 21:14 UTC (Tue) by leoc (guest, #39773) [Link]

There is plenty of money involved here. Linux and BSD systems are widely used, and are collectively worth billions of dollars in infrastructure. The ongoing "ownership" of the code bases behind these systems is worth a lot of money to a lot of people, which is why companies like IBM, Sun, HP, etc spend a lot of time participating in the open source community.

Theo's quote ambiguous?

Posted Apr 16, 2007 19:38 UTC (Mon) by intgr (subscriber, #39733) [Link]

Article writes:

OpenBSD developers do honestly care about the provenance and legitimacy of their code. So the claims were taken seriously; OpenBSD leader Theo de Raadt remarked "This is a major problem in our code base" and said that the issue would be resolved.

Theo's full comment in the e-mail states:

We always try to make our stuff as clean as possible too. In fact, I think no other code base out there is as clear of violations as ours. This is a major problem in our code base.

I originally interpreted the above comment as Theo's bragging of a clean code base, then sarcastically claiming that being "clear of violations" is a major "problem" in their code base, implying that Linux developers have no business in complaining about it.

Please don't turn this into a flame war, but did anyone else get it that way? Did Theo mean it that way?

How not to write a boring article

Posted Apr 19, 2007 17:53 UTC (Thu) by jimmybgood (guest, #26142) [Link]

Howdy Corbet! As long as folks at this site keep suggesting I support the site with a subscription, I figure I owe them an explantion as to why the site isn't worth it.

When a writer gets to the conclusion and starts it with the phrase, "Needless to say...", he should take stock and think about saying something that does need to be said. Well, I'm in a generous mood, so I'll give you an example for free.

You did say one thing that needed to be said, "The initial contact from the Linux side was clearly mishandled." You put in your 2 cents worth - good! But, you didn't really apply any analysis. So why did they handle it that way? And why did Theo respond the way he did? I have no idea about the former, but I do about the latter.

Look at the code. Marcus Glocker is never going to be a great coder. He was assigned a project, but really didn't have the skill to make much headway. Trying to deny his failure, he started to cheat, so that he could show some progress. He got caught and was publically humiliated. Theo backed him up. You know, if I were to pick one developer that I would want to have with me should I get jumped by gang-bangers on the way home from a pub, it would be Theo de Raadt.

Before you start thinking, "Gee, jimmybgood thinks my article is worth two cents," let me say that you blew it on the last sentence. "...we can only hope that all of the people involved will approach a solution in a way which allows that rational discussion to take place."

Certainly, I don't. Few things are as entertaining as a Theo de Raadt flame fest. Your subscribers don't want to read about rational resolutions. That's why there are 102+ comments here. Your subscriber-only article is nothing more than a lame opportunity to gossip. Hundreds of forums encourage users to do that for free.

Why? Because, writing something that's worth paying to read is really, really hard work and, like coding, requires talent that most people don't have. Even Bruce Schneier repeats himself.


Copyright © 2007, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds