BMW Australia Refusing to Comply with Terms of GNU Public License • Hacker News Board

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#161

Post by ryao » Thu, Mar 03, 2016, 6:51 PM UTC

coldpie wrote: post #157

ryao wrote: post #150

Earlier quoted context omitted.

Are there any organizations that pursue GPL violations that would stick to clear-cut cases of GPL violations where there is strong concensus among OSS developers that violations have occurred like the BMW case? For full disclosure, I am one of the ZoL developers. I believe that ZoL can prevent certain types of storage related failures that other production solutions do not, including those on systems intended to keep…

I haven't followed the ZFS stuff much at all, but SFC's news post about it the other day did make me wonder why they were doing it. I think it's important to enforce the GPL and other copy-left licenses when they are being blatantly violated, even if the original authors no longer care about the project. But if it's an unintentional license incompatibility, where the spirit of the licenses are roughly aligned, who re…

It might help if you wrote to them telling them how you feel. I will not think badly of you whatever you decide to do going forward. I realize that this is an awkward situation and if I were you, I would probably have made the same decisions.

The unfortunate situation aside, thank you for your work on Wine. Wine has been helpful to me on multiple occasions. :)

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#162

Post by kuschku » Thu, Mar 03, 2016, 6:59 PM UTC

Deregibus wrote: post #137

qznc wrote: post #131

Earlier quoted context omitted.

"the GPL requires you to make the modified source code available to the program's users " Source: https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc... BMW does not have to provide the sources to everybody. Only to its users. edit: tzs also has a point. Hm?

I was also under that impression as well, but from that same page you posted: https://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWritten... Which sounds like if you didn't provide the source with the program up front then you're required to give it to anyone that asks since they may have received the program indirectly.

> since they may have received the program indirectly.

Which is rarely possible for a car OS, honestly.

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#163

Post by icebraining » Thu, Mar 03, 2016, 7:23 PM UTC

amscanne wrote: post #114

icebraining wrote: post #98

Earlier quoted context omitted.

If it's an application, no, but if it's a kernel module (e.g. drivers to talk to their devices), then yes. They still have to offer a copy of the kernel source, even if they haven't modified it.

>If it's an application, no, but if it's a kernel module (e.g. drivers to talk to their devices), then yes. There is debate about this, but there are certainly cases of compliant non-GPL modules. It doesn't strictly follow. (Consider Ndiswrapper, for example.) > They still have to offer a copy of the kernel source, even if they haven't modified it. I don't really think the license implies technical minutae like this.…

There is debate about this, but there are certainly cases of compliant non-GPL modules. It doesn't strictly follow. (Consider Ndiswrapper, for example.)

Ndiswrapper is GPL-licensed. The resulting modules are probably not, but they are usually not distributed anyway.

I don't really think the license implies technical minutae like this. The source must simply be made available "on a medium customarily used for software interchange". Whether you point to a tag on kernel.org or host it own your own web servers (both cases including the Kconfig) is irrelevant.

Sure, but have they pointed?

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#164

Post by btilly » Thu, Mar 03, 2016, 7:28 PM UTC

tzs wrote: post #129

zmmmmm wrote: post #119

To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. If he does then included with the car should be an offer for how to access the GPL source code. He should have followed that (or clearly stated that he could not locate it in his email). The requirement for him to enter the VIN to access t…

> To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. (All section references below are to GPLv2, since that is what the Linux kernel uses) Section 3 governs distribution of object or executable code. Section 3 gives these requirements: a) Accompany it with the complete corresponding machin…

Read option B more carefully.

The requirement is NOT that you have to give out source code to anyone who asks. It is that the written offer you give out can be used by anyone. Did BMW hand out a written offer with the car that says how to get source code? If so, then it is fine if that offer requires you to enter a piece of information like a VIN.

BMW is under no obligation to hand out written offers to random strangers. You'll have to find someone who bought a car to get an offer.

Now why would BMW set things up this way? Well it is unlikely that all cars have the same exact source code. So without the VIN, BMW doesn't even know which copy to give you! So what are they going to do when someone shows up, is rude, clearly doesn't have the offer in hand, and then demands source code? Apparently they are going to tell him that he needs a VIN.

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#165

Post by Matthias247 » Thu, Mar 03, 2016, 7:28 PM UTC

lucaspiller wrote: post #11

dmm wrote: post #4

What GPL licensed software are they actually infringing upon? The linked post[1] says they found mentions of systemd, but does the firmware actually contain a linux kernel? I don't see anything that looks like a kernel in the file listing. Also if the firmware is properly signed delivering it over http shouldn't matter, right? [1] https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...

Apparently Mini (also made by BMW) has a similar update structure, and that runs QNX, so it's likely this does too: http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/

It's indeed a Linux system, and probably one of the first that BMW brought into market. It might also use GENIVI software components, which is an alliance for automotive linux software.

The carmakers are typically developing multiple systems in parallel by different suppliers. And even if they look similar from a customer perspective they might have been developed completely seperatly.

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#166

Post by wepple » Thu, Mar 03, 2016, 8:04 PM UTC

boobsbr wrote: post #156

genericacct wrote: post #124

Frankly: given recent news (hacked jeeps, software used to cheat on emission tests) I think it is time to _require_ _all_ software used on vehicles that transit on public roads to be open sourced and available to the public. (for independent testing and verification in the name of public safety)

I think this problem is impossible to solve, and it's the same on faced by electronic voting. How can you guarantee that the software running in the car is the same one provided by the car manufacturer? A more detailed explanation: You can't guarantee that software provided by the manufacturer and the dump you could retrieve from the car – through an API call, or through forceful means – are the same as the one which…

I don't think it's impossible. Manufacturers should provide the software for audit and assessment. Car tinkerers[1] can usually quite easily pull various firmwares directly off chip, and if the two diverge in a significant way the car company will have a LOT of explaining to do.

[1] http://opengarages.org/handbook/

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#167

Post by kazinator » Thu, Mar 03, 2016, 8:24 PM UTC

Misleading title; it looks more like they in fact refuse to acknowledge at all that some of the code is someone else's.

> Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence [sic]

I.e. "This is all our software; there is no third-party GPL stuff in it, so we need not comply with any such license."

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#168

Post by tzs » Thu, Mar 03, 2016, 8:31 PM UTC

btilly wrote: post #164

tzs wrote: post #129

Earlier quoted context omitted.

> To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. (All section references below are to GPLv2, since that is what the Linux kernel uses) Section 3 governs distribution of object or executable code. Section 3 gives these requirements: a) Accompany it with the complete corresponding machin…

Read option B more carefully. The requirement is NOT that you have to give out source code to anyone who asks. It is that the written offer you give out can be used by anyone. Did BMW hand out a written offer with the car that says how to get source code? If so, then it is fine if that offer requires you to enter a piece of information like a VIN. BMW is under no obligation to hand out written offers to random strang…

Let D be the distributor, C be their customer, and T be a third party. The language of 3(b) says that D must give C a written offer to distribute the source to any T. I don't see anything in it that says T has to have a copy of the offer.

It says "any third party", and unless there is something in the license that restricts this I'd expect a court to go with the normal meanings of "any" any "third party".

The GPL FAQ agrees with my reading, saying that "If you choose to provide source through a written offer, then anybody who requests the source from you is entitled to receive it" [1].

I'd say that requiring the VIN number in order to identify which software to provide source for is reasonable and would be allowed by the license.

[1] http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO...

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#169

Post by kazinator » Thu, Mar 03, 2016, 8:48 PM UTC

voxic11 wrote: post #88

greydius wrote: post #80

Please correct me if I'm wrong. I thought the GPL only required providing the source code to the purchasers of the product. (Who can then redestribute it if they'd like.) I didn't think it meant that if you use GPL code in your product, then you are obligated to make your code available to everyone.

You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public. It seems in this case they released a patch to their software and made the patch available to the public.

If I sell some device with an upgradable firmware (which contains GPLed materials), I can allow users to download upgrades from my site without putting them through hoops to prove that they own the hardware. Yet if they ask for the source code, then I can put them through the hoops: convince me that you're actually one of my users, then you can have it.

And it's not because users who don't have my hardware cannot use the firmware. In fact, users of hardware which is not mine could potentially be users of the firmware. If a competitor clones my hardware, so that the firmware runs on it, the users of that cloned hardware can benefit from the upgrades that I provide, because I don't validate that they are using the genuine hardware.

I don't have to provide the cloned firmware with free upgrades and all to the users of the competing hardware, and in fact, I am not offering those upgrades to the users of that hardware. It just so happens that they are able to help themselves to it because it accessible (for the sake of the utmost convenience to genuine users). That is not the same thing as it being distributed to the entire public.

Just because something is accessible to the public doesn't mean that it's being offered to the public. Distribution requires some kind of offer. An accidental leak is not distribution, for example.

Re: BMW Australia Refusing to Comply with Terms of GNU Public License

#170

Post by nathan_long » Thu, Mar 03, 2016, 9:28 PM UTC

boobsbr wrote: post #156

genericacct wrote: post #124

Frankly: given recent news (hacked jeeps, software used to cheat on emission tests) I think it is time to _require_ _all_ software used on vehicles that transit on public roads to be open sourced and available to the public. (for independent testing and verification in the name of public safety)

I think this problem is impossible to solve, and it's the same on faced by electronic voting. How can you guarantee that the software running in the car is the same one provided by the car manufacturer? A more detailed explanation: You can't guarantee that software provided by the manufacturer and the dump you could retrieve from the car – through an API call, or through forceful means – are the same as the one which…

> it could internally store and run the shady code from the manufacturer, while giving you a perfectly legit and signed dump as the one provided by the manufacturer.

If you had the right to replace it with your own copy, you could make it blink lights in morse code at various points in the software to prove it was executing your code. Of course they could still do sneaky things, but it would be harder.