diff options
Diffstat (limited to '2009/gpl-enforecment-lisog2009')
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/e680_jtag.jpg | bin | 0 -> 96700 bytes | |||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/gpl-compliance.pdf | bin | 0 -> 4225616 bytes | |||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/gpl-enforcement.mgp | 492 | ||||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/x800_dbgconn_closeup.jpg | bin | 0 -> 91400 bytes | |||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/x800_debcon_pcb.jpg | bin | 0 -> 86510 bytes | |||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/x800_jtagfinder.jpg | bin | 0 -> 43885 bytes | |||
| -rw-r--r-- | 2009/gpl-enforecment-lisog2009/x800_jtagfinder_probes.jpg | bin | 0 -> 63122 bytes |
7 files changed, 492 insertions, 0 deletions
diff --git a/2009/gpl-enforecment-lisog2009/e680_jtag.jpg b/2009/gpl-enforecment-lisog2009/e680_jtag.jpg Binary files differnew file mode 100644 index 0000000..38a94f9 --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/e680_jtag.jpg diff --git a/2009/gpl-enforecment-lisog2009/gpl-compliance.pdf b/2009/gpl-enforecment-lisog2009/gpl-compliance.pdf Binary files differnew file mode 100644 index 0000000..804ccb3 --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/gpl-compliance.pdf diff --git a/2009/gpl-enforecment-lisog2009/gpl-enforcement.mgp b/2009/gpl-enforecment-lisog2009/gpl-enforcement.mgp new file mode 100644 index 0000000..4c33bc3 --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/gpl-enforcement.mgp @@ -0,0 +1,492 @@ +%include "default.mgp" +%default 1 bgrad +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +%nodefault +%back "blue" + +%center +%size 7 + +GPL License Enforcement + + +LiSoG Stammtisch Juli 2009 + +%center +%size 4 +by + +Harald Welte <laforge@gpl-violations.org> + + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Introduction + + +Who is speaking to you? + an independent Free Software developer, consultant and security analyst + who earns his living off Free Software since 1997 + who is one of the authors of the Linux kernel firewall system called netfilter/iptables + who has been involved with many Free Software and Open Hardware projects, such as OpenPCD, OpenPICC, OpenBSC, OpenEZX, OpenMoko, ... + who has started gpl-violations.org + who has been spending a lot of time recently explaining the FOSS development model to management of semiconductor companies + who IS NOT A LAWYER + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Disclaimer + +Legal Disclaimer + + All information presented here is provided on an as-is basis + There is no warranty for correctness of legal information + The author is not a lawyer + This does not comprise legal advise + The authors' experience is limited to German copyright law + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Ideas and Goals of the GNU GPL + + Free Software + Software that has fundamental freedoms: + to use it for any purpose + to "help your neighbour" (i.e. make copies) + to study it's functionality (reading source code) + to fix it myself (make modifications and run them) + + Copyleft + Is the legal idea to + exercising copyright to grant the above freedoms + assure that nobody can take away the freedom + + The GNU General Public License + Is a legal instrument to apply they copyleft idea on software + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The GNU GPL revisited + +Revisiting the GNU General Public License + Regulates distribution, not usage + Allows distribution of source code and modified source code + The license itself is mentioned + A copy of the license accompanies every copy + Allows distribution of binaries or modified binaries, if + The license itself is mentioned + A copy of the license accompanies every copy + The complete source code is either included with the copy (alternatively a written offer to send the source code on request to any 3rd party) + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Complete Source Code + +%size 3 +"... complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable." + + For standard C-language programs, this means: + Source Code + Makefiles + compile-time Configuration (such as kernel .config) + + General Rule: + Intent of License is to enable user to run modified versions of the program. + Provide whatever is needed for that, and you will make them happy! + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Derivative Works + + What is a derivative work? + Not dependent on any particular kind of technology (static/dynamic linking, dlopen, whatever) + Even while the modification can itself be a copyrightable work, the combination with GPL-licensed code is subject to GPL. + As soon as code is written for a specific non-standard API (such as the iptables plugin API), there is significant indication for a derivative work + This position has been successfully enforced out-of-court with two Vendors so far (iptables modules/plugins). + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Derivative Works + + Binary-only kernel modules + In-kernel proprietary code (binary kernel modules) are hard to claim GPL compliant + Case-by-case analysis required, as the level of integration into the GPL licensed kernel code depends on particular case + There is no general acceptance or tolerance to binary-only kernel modules in the Linux (development) community. Not even Linus himself has ever granted an exception for such modules! + Create all kinds of techical problems, too - kernel API's and ABI's change all the time... + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Derivative Works + + Glue Code + Acts as glue layer between GPL licensed code and proprietary code + Some Vendors think they can avoid the GPL by doing so + Is definitely not a bullet-proof legal solution, especially when it is clearly visible that the only purpose of this glue code is to "get rid" of the GPL. + So please, don't try it. + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Derivative Works + + Moral Issues + Apart from what is legally possible, there are moral issues + Even if in a particular case there is no legal way to claim a binary-only kernel module is a derivative work, you might still be acting against the authors' wishes + By shipping binary-only kernel modules, you violate the "moral code of conduct" of the Free Software community + But it is the work of this very community that enables you to build your product based on Free Software + Such action might have long-term detrimental effects on the motivation of FOSS developers (dissatisfaction, demotivation, ...) + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +GPL And Embedded Systems + + Historical background: + The GPL was written for userspace programs running on existing operating systems + Covering a whole OS (and even userspace programs) is not an ideal match, but if you read it carefully it still makes sense + + Toolchain: +%size 3 +"... the source code distributed need not include anything that is normally +distributed (in either source or binary form) with the major components +(compiler, kernel, and so on) of the operating system on which the executable +runs, unless that component itself accompanies the executable." + Practical case: + You've modified gcc for a specific embedded platform + Therefore, this gcc is not "normally distributed with the operating system" and you have to distribute it together with the source code + gcc itself is covered under GPL, so you need to provide binaries and source code(!) + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +GPL And Embedded Systems + + The "Scripts" + (scripts to control compilation and installation, see earlier slide) + In case of embedded hardware, the "scripts" include: + Tools for generating the firmware binary from the source (even if they are technically no 'scripts') + + + Embedded DRM + Intent of License is to enable user to run modified versions of the program. They need to be enabled to do so. + Result: Signing binaries and only accepting signed versions from the bootloader (without providing the signature key or a possibility to set a new key in the bootloader) is not acceptable! + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Practical Source Code Offer + + Some Rules + The "complete corresponding source code" has to be made available + It has to be made available for each and every object-code version that was distributed + If you strip down the source code offer (e.g. remove proprietary source code), try to see whether the result actually compiles + If the product is mixed free / proprietary software, consider including the proprietary parts (as object code) in the "source code package", so the full firmware image can be rebuilt without having to tear apart an existing image and ripping out those proprietary programs from there. + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The biggest myths about the GPL + +The biggest myths about the GPL + The GPL is not enforcible + Software licensed under GPL has no copyright + Unmodified distribution does not require source code availability + The vendor can wait for a source code request (without offering it) + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The most common mistakes + +The most common mistakes + not even once reading the GPL text and/or the FAQ from the FSF + not including the GPL license text with the product + not including a written offer with the product + not considering that the GPL also applies to software updates + only providing original source code (e.g. vanilla kernel.org kernel) + not including the "scripts to control installation" + only providing off-site hyperlinks to license and/ore source code + not responding to support requests for source code + charging rediculously high fees for physical shipping of source code + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +License Compatibility + + There's lots of Free Software available + Different Software uses different Licenses: + Linux: GPL + glibc: LGPL + apache: Apache Software License + Perl: Artistic + ucd-snmp: BSD + If you combine (i.e. link) differently-licensed software, + check license compatibility + in case of doubt, ask legal person and/or contact software authors + authors might give you an exception or consider making licenses compatible + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Dual Licensing + + The copyright holder (often the original author) can provide alternative licensing + Some projects do this as a business model (reiserfs, MySQL) + In some projects it's impossible due to the extremely distributed copyright (e.g. Linux kernel) + However, in smaller projects it never hurts to ask whether there would be interest in providing an alternative (non-copyleft) licensing + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +GPL Violations + + When do I violate the license + when one ore more of the obligations are not fulfilled + + What risk do I take if I violate the license? + the GPL automatically revokes any usage right + any copyright holder can obtain a preliminary injunction banning distribution of the infringing product + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Past GPL enforcement + +Early GPL enforcement + + GPL violations are nothing new, as GPL licensed software is nothing new. + However, the recent GNU/Linux hype made GPL licensed software used more often + The FSF enforces GPL violations of code on which they hold the copyright + silently, without public notice + in lengthy negotiations + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The Linksys case + + + During 2003 the "Linksys" case drew a lot of attention + Linksys was selling 802.11 WLAN Acces Ponts / Routers + Lots of GPL licensed software embedded in the device (included Linux, uClibc, busybox, iptables, ...) + FSF led alliance took the usual "quiet" approach + Linksys bought itself a lot of time + Some source code was released two months later + About four months later, full GPL compliance was achieved + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The Linksys case + + Some developers didn't agree with this approach + not enough publicity + violators don't loose anything by first not complying and wait for the FSF + four months delay is too much for low product lifecycles in WLAN world + The netfilter/iptables project started to do their own enforcement in more cases that were coming up + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Enforcement case timeline + + In chronological order + some user sends us a note he found our code somewhere + reverse engineering of firmware images + test purchase to verify device ships gpl-incompliant + sending the infringing organization a warning notice + wait for them to sign a statement to cease and desist + if no statement is signed + contract technical expert to do a study + apply for a preliminary injunction + if statement was signed + try to work out the details + grace period for boxes in stock possible + try to indicate that a donation would be good PR + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Sucess so far + + Success so far + amicable agreements in a number (100+) of cases + some of which made significant donations to charitable organizations of the free software community + preliminary injunction against Sitecom, Sitecom also lost appeals case + court decision of munich district court in Sitecom appeals case + more preliminary injunctions (Siemens, Skype, Fortinet, D-Link) + more settled cases (most of which not published) + negotiating in more cases + public awareness + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Cases so far (1/4) + + + Allnet GmbH + Siemens AG + Fujitsu-Siemens Computers GmbH + Axis A.B. + Securepoint GmbH + U.S.Robotics Germany GmbH + Netgear GmbH + Belkin Compnents GmbH + ASUS GmbH + Gateprotect GmbH + Sitecom GmbH / B.V. + TomTom B.V. + Gigabyte Technologies GmbH + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Cases so far (2/4) + + + Sun Deutschland GmbH + Open-E GmbH + Siemens AG (second case) + Deutsche Telekom AG + Hitachi Inc. + Tecom Inc. + ARP Datacon GmbH + Conceptronic B.V. + D-Link GmbH + Adaptec Deutschland GmbH + Belkin Compnents GmbH (second case) + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Cases so far (3/4) + + + Siemens AG (third case) + TARGA GmbH + Medion AG + naviflash GmbH + Maxtor Inc. + Cisco Deutschland GmbH + Fortinet + naviflash GmbH + iRiver Europe GmbH + Cisco Deutschland GmbH (second case) + Acer Deutschland GmbH + SMC Networks GmbH + + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +Cases so far (4/4) + + + Samsung, Thecus, Western Digital, Avocent, Canyon, Digital Data, Cowon, DGStation, Smartlink, Sphairon, DeviceVM, Kenwood, Telegent, Barracuda Networks, Ovislink, Assman, Gamepark Holdings, Hermstedt, Longshine, Motorola, Skype, Agfeo,... + + totally > 100 cases + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +What we've learned + + + Copyleft-style licenses can be enforced! + A lot of companies don't take Free Software licenses seriously + Even corporations with large legal departments who should know + Reasons unclear, probably the financial risk of infringement was considered less than the expected gains + The FUD spread about "GPL not holding up in court" has disappeared + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +What can companies do + + + What companies can do + Education and training for engineers + managers + Think before copying/using/combining software + Use proper R&D process and revision control + Make sure you always have the complete source tree for every software release + Have the source code package ready when you ship a software release + Participate in the FSFE FTF Legal Network + + If you embrace the community and use an open source development process, your source code is released publicly before you even ship the product to the customer + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The supply chain issue + + In todays industry, suply chains are often very long + Silicon (SoC) maker designs the actual chip + BSP (Board Support Package) is developed in-house or by contracted 3rd party + This BSP is what typically contains Linux, u-boot and/or other GPL licensed software + Development board with chip + BSP sold to board makers (ODM) + Often even full "turnk-key solutions" either by chip maker or 3rd party + A OEM with recognized brand name buys the product from the ODM + Maybe one or two other companies between OEM And ODM + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The supply chain issue + + The long supply chains cause problems since + the original developers who wrote the code are hard to access + typicaly, nobody in the supply chain knows what the products contain + even if the upstream supplier provides [some] source code, typically, the OEM type customers don't even have any staff skilled enough to confirm it is complete + many jurisdictions are involved, especially those with lack of respect for copyrights in general + most consumer electronics today are manufactured in China, Taiwan, Korea or Vietnam + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The supply chain issue + + The long supply chain forces us to + take legal action against the OEM or distributor in Germany or the EU + rely on them transforming legal threat into economic threat on their upstream suppliers + this only works if distributor is important customer of upstream supplier + However + enforcing the GPL in the CE market has proven reliable this way + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% +%page +GNU GPL - Copyright helps Copyleft +The End + + +%size 4 + Further reading: +%size 4 + The http://gpl-violations.org/ project +%size 4 + The Free Software Foundation http://www.fsf.org/, http://www.fsf-europe.org/ +%size 4 + The GNU Project http://www.gnu.org/ +%size 4 + The netfilter homepage http://www.netfilter.org/ +%% http://management.itmanagersjournal.com/management/04/05/31/1733229.shtml?tid=85&tid=4 + + diff --git a/2009/gpl-enforecment-lisog2009/x800_dbgconn_closeup.jpg b/2009/gpl-enforecment-lisog2009/x800_dbgconn_closeup.jpg Binary files differnew file mode 100644 index 0000000..112d8f8 --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/x800_dbgconn_closeup.jpg diff --git a/2009/gpl-enforecment-lisog2009/x800_debcon_pcb.jpg b/2009/gpl-enforecment-lisog2009/x800_debcon_pcb.jpg Binary files differnew file mode 100644 index 0000000..87a6bbd --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/x800_debcon_pcb.jpg diff --git a/2009/gpl-enforecment-lisog2009/x800_jtagfinder.jpg b/2009/gpl-enforecment-lisog2009/x800_jtagfinder.jpg Binary files differnew file mode 100644 index 0000000..e790d4d --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/x800_jtagfinder.jpg diff --git a/2009/gpl-enforecment-lisog2009/x800_jtagfinder_probes.jpg b/2009/gpl-enforecment-lisog2009/x800_jtagfinder_probes.jpg Binary files differnew file mode 100644 index 0000000..370e215 --- /dev/null +++ b/2009/gpl-enforecment-lisog2009/x800_jtagfinder_probes.jpg |
