Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ability to correct errors in GPLv2 compliance: the right thing to do

redhat.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#11

Post by dsr_ »

sgift wrote: post #3

"The right thing to do" from a programmers perspective is to never use any dependency which uses anything with *GPL as its license if they can use something else instead. Sometimes, the only viable option is licensed under one of these licenses and then you have to look very carefully and probably involve legal support, but for all the other cases life gets far easier if you just don't use such dependencies and take…

You always pay for somebody else's code.

Sometimes you pay them with dollars. Sometimes you pay them by open-sourcing your own code. Sometimes you pay them by acknowledging their contributions. And sometimes you pay them by fixing the bugs.

Not knowing how you are going to pay for someone else's code before you use it is ridiculous, and refusing to pay for it in the manner that they have indicated is acceptable is reprehensible.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#12

Post by johannes1234321 »

adrianN wrote: post #8
sgift wrote: post #3

"The right thing to do" from a programmers perspective is to never use any dependency which uses anything with *GPL as its license if they can use something else instead. Sometimes, the only viable option is licensed under one of these licenses and then you have to look very carefully and probably involve legal support, but for all the other cases life gets far easier if you just don't use such dependencies and take…

The right thing to do is to just make the source available when the license requires you to do so. It's not that hard. If in doubt, just make it available.

It's hard if you licensed some of the code elsewhere and boundaries are unclear (and then ignore all the fallout from publishing - others can't use it and will call support, security researchers might find bugs, ...)

If more code would be shared it would be a better world, but the way s not simple. Respecting licenses of ocurse is a requirement.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#13

Post by belorn »

sgift wrote: post #3

"The right thing to do" from a programmers perspective is to never use any dependency which uses anything with *GPL as its license if they can use something else instead. Sometimes, the only viable option is licensed under one of these licenses and then you have to look very carefully and probably involve legal support, but for all the other cases life gets far easier if you just don't use such dependencies and take…

The only companies that can follow a policy of license purity and waste money rewriting code is those companies that live in markets with very little competition. The more harsh the competition is the more agile the company need to be in reducing cost and using any free code that help create the product while keeping to your core business model.

For example, game developers will use any code that don't conflict with the model of selling copies under exclusive rights. Blizzard Entertainment which is currently one of the largest game developer studio in the world has used everything from LGPLv3 to custom permission granted by free software developers. Having a lawyer read a standard license and evaluate if it can be used is much cheaper than pushing the release date on a game a few months further, not counting the additional cost of having to write your own XML parser, html, javascript, fonts, or what have you. It also the reason why game studio are willing to pay a lot of money for third-party libraries with extensively custom written restrictive licenses. So long it fit the business model, and it save money and time, then using it is a competitive advantage in a industry that is heavily over saturated.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#15

Post by anon1385 »

throwaway2048 wrote: post #7
toyg wrote: post #5

Earlier quoted context omitted.

> Are there copyright holders engaging in abusive litigation? Some enforcement efforts have been controversial, particularly the VmWare suit and other efforts by SFConservancy. I wouldn't call them trolls, but a lot of people think they are too heavy-handed. On the other hand, with nobody wielding a stick, there is no real incentive not to abuse free licenses - which is exactly why the GPL exists in the first place.

How are they too heavily handed? the only thing they ask for in negotiation and lawsuits is GPL compliance, they dont demand money, or anything else. If following the license is too much to ask for, what exactly does "not heavy handed" mean?

> they dont demand money

A linux developer demanding money from GPL violators is (seemingly) what triggered this action. See http://www.zdnet.com/article/linux-beats-internal-legal-thre...

>McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions.

>what exactly does "not heavy handed" mean

It means not permanently revoking their licence to use the code again, even once they have become compliant. It's a common complaint made about the GPLv2 which was clarified in GPLv3

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#16

Post by gpm »

I don't think this is a good thing.

The GPL is a tool to scare companies into doing the right thing and releasing their code. By committing to this we lose the ability to scare those companies. It becomes much more worthwhile to play chicken hoping no one will notice that you are using GPL code in your closed source binary.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#17

Post by throwaway2048 »

anon1385 wrote: post #15
throwaway2048 wrote: post #7

Earlier quoted context omitted.

How are they too heavily handed? the only thing they ask for in negotiation and lawsuits is GPL compliance, they dont demand money, or anything else. If following the license is too much to ask for, what exactly does "not heavy handed" mean?

> they dont demand money A linux developer demanding money from GPL violators is (seemingly) what triggered this action. See http://www.zdnet.com/article/linux-beats-internal-legal-thre... >McHardy has sued companies for Linux GPLv2 violations in over 38 cases. In one, he'd requested a contractual penalty of €1.8 million. The company also claimed McHardy had already received over €2 million from his actions. >what ex…

The poster i was replying to was talking about SFC, not that case.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#18

Post by LukeShu »

gpm wrote: post #16

I don't think this is a good thing. The GPL is a tool to scare companies into doing the right thing and releasing their code. By committing to this we lose the ability to scare those companies. It becomes much more worthwhile to play chicken hoping no one will notice that you are using GPL code in your closed source binary.

I disagree--I firmly believe that this is a good thing.

If Foo Corp intentionally/accidentally violates the GPLv2 on software owned by CA/Cisco/HPE/Microsoft/SAP/SUSE, but decides to do the right thing/come clean and release the code...

without this (plain GPLv2): Their license to the GPLv2 was revoked, is still revoked, and are liable to each of the owners. Even if one owner reinstates the license, the others don't have to.

with this (GPLv2 with GPLv3-cure): Their license is provisionally reinstated upon coming in to compliance, and permanently reinstated 60 days later if none of the copyright holders object.

With the plain GPLv2 it was worth it to play chicken. Now, it no longer is.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#19

Post by LukeShu »

Note that the FSF and the SF Conservancy have already been doing this, and recommending you do this, as part of their Principles of Community-Oriented GPL Enforcement.

https://www.fsf.org/licensing/enforcement-principles

> Community-oriented compliance processes should extend the benefit of GPLv3-like termination, even for GPLv2-only works.

> GPLv2 terminates all copyright permissions at the moment of violation, and that termination is permanent. GPLv3's termination provision allows first-time violators automatic restoration of distribution rights when they correct the violation promptly, and gives the violator a precise list of copyright holders whose forgiveness it needs. GPLv3's collaborative spirit regarding termination reflects a commitment to and hope for future cooperation and collaboration. It's a good idea to follow this approach in compliance situations stemming from honest mistakes, even when the violations are on works under GPLv2.

Re: The ability to correct errors in GPLv2 compliance: the right thing to do

#20

Post by eitland »

gpm wrote: post #16

I don't think this is a good thing. The GPL is a tool to scare companies into doing the right thing and releasing their code. By committing to this we lose the ability to scare those companies. It becomes much more worthwhile to play chicken hoping no one will notice that you are using GPL code in your closed source binary.

IMO you underestimate the effort of rewriting released software in a shirt timeframe, especially software running on premise.
Post reply on HN