Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My insulin pump controller uses the Linux kernel. It also violates the GPL

old.reddit.com

Post reply on HN
Print view View original

91–100 of 268 posts

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#91

Post by kevin_thibedeau »

teddyh wrote: post #6

> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it. This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that: 1. The GPL requires the company to send the user a written offer of source code. 2. The user uses this offer to request the source code from the company. 3. If the…

The written offer with a limited term of three years is just one permitted method of distribution. If an offer was never made then they're not covered by that clause and are bound to comply by other means without the protection of the three year window.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#92

Post by schmuckonwheels »

teddyh wrote: post #87
ryandrake wrote: post #78

Earlier quoted context omitted.

Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.

Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL , and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The…

> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately.

You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines.

In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source.

If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#93

Post by teddyh »

kevin_thibedeau wrote: post #91
teddyh wrote: post #6

> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it. This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that: 1. The GPL requires the company to send the user a written offer of source code. 2. The user uses this offer to request the source code from the company. 3. If the…

The written offer with a limited term of three years is just one permitted method of distribution. If an offer was never made then they're not covered by that clause and are bound to comply by other means without the protection of the three year window.

Yes. I did not cover these cases because approximately nobody does that.

I mean, the absolutely simplest, and cheapest, way for companies to comply with the GPL is to ship the source code together with the software. Stick it in a zip file in a directory somewhere. The company can then forget the whole thing and not worry about anyone contacting them and ranting about source code and the GPL. But no company does that.

The other simple way for companies to comply with the GPL is for companies to provide a link to download the source code at the same place that users download the program itself. If the user did not download the source code when they had the chance, that’s the user’s problem. This will also let the company ignore any GPL worries. No company does this, either.

(The GPL provides a third way for individuals and non-profits, which is not relevant here.)

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#94

Post by SpicyLemonZest »

opello wrote: post #57
Aurornis wrote: post #12

Earlier quoted context omitted.

Support staff or even engineers are not in a position to be making that call. It’s a legal department decision, even if it seems obvious to you.

I agree that a front-line CSR or even engineer is not likely the right person, but surely then the responsible action is to redirect the request to the responsible department or person?

Absolutely, and companies that routinely get requests like this train customer service agents on specific trigger words like "license" or "GDPR" that must be redirected. Without that training, it's not obvious why "it's GPLv2 licensed" is more compelling than the last customer's argument that the device warranty obligates you to drop everything and immediately fix the minor UI bug they reported.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#95

Post by teddyh »

schmuckonwheels wrote: post #92
teddyh wrote: post #87

Earlier quoted context omitted.

Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL , and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The…

> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines. In theory, that written offer on…

> If that was true, anyone reselling an Android phone could open themselves up to legal liability.

That’s only an appeal to ridicule. If those are valid, here’s an opposing one:

If this is not true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#96

Post by schmuckonwheels »

JoshTriplett wrote: post #85
schmuckonwheels wrote: post #74

Earlier quoted context omitted.

This got buried on HN a few days ago which is a shame: https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community. Which brings us to the question: what is this guy going to do with (presumably) the…

> Linus rants Linus is arguing against a strawman that Conservancy never actually argued. See https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelev... for details. > Which brings us to the question: what is this guy going to do with (presumably) the kernel source? https://openaps.org/

If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Separately, do you think it's remotely a good idea?

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#97

Post by isodev »

schmuckonwheels wrote: post #74
JoshTriplett wrote: post #54

Earlier quoted context omitted.

This is an open legal question, which the Conservancy v Vizio case will hopefully change; in that case, Conservancy is arguing that consumers have the right to enforce the GPL in order to receive source code.

This got buried on HN a few days ago which is a shame: https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community. Which brings us to the question: what is this guy going to do with (presumably) the…

> what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel?

As the original Reddit comment explains, Insulet is an American company.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#98

Post by gpm »

teddyh wrote: post #95
schmuckonwheels wrote: post #92

Earlier quoted context omitted.

> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines. In theory, that written offer on…

> If that was true, anyone reselling an Android phone could open themselves up to legal liability. That’s only an appeal to ridicule. If those are valid, here’s an opposing one: If this is not true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.

Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales.

That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#99

Post by RHSeeger »

schmuckonwheels wrote: post #88
kevin_thibedeau wrote: post #84

Earlier quoted context omitted.

It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form: "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definit…

The recipient of that object code is the medical device supplier, not the end-user. It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code. In other words, assume you are the second owner in all cases when it comes to certified medical equipment. AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received…

> In other words, assume you are the second owner in all cases when it comes to certified medical equipment.

By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it.

It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.

Re: My insulin pump controller uses the Linux kernel. It also violates the GPL

#100

Post by Y_Y »

schmuckonwheels wrote: post #92
teddyh wrote: post #87

Earlier quoted context omitted.

Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL , and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The…

> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines. In theory, that written offer on…

My Android phone does come with an explicit written offer of source. It's in Settings>About>Legal.
Post reply on HN