diff options
Diffstat (limited to '2010/gpl_enforcement-coscup2010')
| -rw-r--r-- | 2010/gpl_enforcement-coscup2010/abstract.txt | 14 | ||||
| -rw-r--r-- | 2010/gpl_enforcement-coscup2010/gpl_enforcement.pdf | bin | 0 -> 845991 bytes | |||
| -rw-r--r-- | 2010/gpl_enforcement-coscup2010/gpl_enforcement.snm | 0 | ||||
| -rw-r--r-- | 2010/gpl_enforcement-coscup2010/gpl_enforcement.tex | 421 | ||||
| -rw-r--r-- | 2010/gpl_enforcement-coscup2010/linux_netfilter_singapore_entertainment.jpg | bin | 0 -> 640673 bytes |
5 files changed, 435 insertions, 0 deletions
diff --git a/2010/gpl_enforcement-coscup2010/abstract.txt b/2010/gpl_enforcement-coscup2010/abstract.txt new file mode 100644 index 0000000..91f3463 --- /dev/null +++ b/2010/gpl_enforcement-coscup2010/abstract.txt @@ -0,0 +1,14 @@ +GNU GPL Compliance in Embedded Devices + +GNU/Linux is a the most popular choice of an Operating System in many areas +of Embedded computing. It can be found in embedded networking equipment, +personal navigation systems, media players, mobile phones to print servers, +NAS, in-flight entertainment systems and even bicycle ergometers. + +Using the Linux kernel and other GPL licensed software is a convenient and +especially inexpensive choice. However, it is still copyrighted software +subject to a license: The GNU General Public License. + +The presentation will look at typical GPL violations in the embedded market +and how they could have easily been avoided by little extra effort in +product development. diff --git a/2010/gpl_enforcement-coscup2010/gpl_enforcement.pdf b/2010/gpl_enforcement-coscup2010/gpl_enforcement.pdf Binary files differnew file mode 100644 index 0000000..c652a8c --- /dev/null +++ b/2010/gpl_enforcement-coscup2010/gpl_enforcement.pdf diff --git a/2010/gpl_enforcement-coscup2010/gpl_enforcement.snm b/2010/gpl_enforcement-coscup2010/gpl_enforcement.snm new file mode 100644 index 0000000..e69de29 --- /dev/null +++ b/2010/gpl_enforcement-coscup2010/gpl_enforcement.snm diff --git a/2010/gpl_enforcement-coscup2010/gpl_enforcement.tex b/2010/gpl_enforcement-coscup2010/gpl_enforcement.tex new file mode 100644 index 0000000..5aa3080 --- /dev/null +++ b/2010/gpl_enforcement-coscup2010/gpl_enforcement.tex @@ -0,0 +1,421 @@ +% $Header: /cvsroot/latex-beamer/latex-beamer/solutions/conference-talks/conference-ornate-20min.en.tex,v 1.7 2007/01/28 20:48:23 tantau Exp $ + +\documentclass{beamer} + +% This file is a solution template for: + +% - Talk at a conference/colloquium. +% - Talk length is about 20min. +% - Style is ornate. + + + +% Copyright 2004 by Till Tantau <tantau@users.sourceforge.net>. +% +% In principle, this file can be redistributed and/or modified under +% the terms of the GNU Public License, version 2. +% +% However, this file is supposed to be a template to be modified +% for your own needs. For this reason, if you use this file as a +% template and not specifically distribute it as part of a another +% package/program, I grant the extra permission to freely copy and +% modify this file as you see fit and even to delete this copyright +% notice. + + +\mode<presentation> +{ + \usetheme{Warsaw} + % or ... + + \setbeamercovered{transparent} + % or whatever (possibly just delete it) +} + + +\usepackage[english]{babel} +% or whatever + +\usepackage[latin1]{inputenc} +% or whatever + +\usepackage{times} +\usepackage[T1]{fontenc} +% Or whatever. Note that the encoding and the font should match. If T1 +% does not look nice, try deleting the line with the fontenc. + + +\title{GNU GPL License Compliance} + +\subtitle +{With specific focus on Embedded Devices} + +\author{Harald Welte} + +\institute +{gpl-violations.org\\gnumonks.org\\hmw-consulting.de} +% - Use the \inst command only if there are several affiliations. +% - Keep it simple, no one is interested in your street address. + +\date[COSCUP 2010] % (optional, should be abbreviation of conference name) +{COSCUP 2010} +% - Either use conference name or its abbreviation. +% - Not really informative to the audience, more for people (including +% yourself) who are reading the slides online + +\subject{Embedded Linux} +% This is only inserted into the PDF information catalog. Can be left +% out. + + + +% If you have a file called "university-logo-filename.xxx", where xxx +% is a graphic format that can be processed by latex or pdflatex, +% resp., then you can add a logo as follows: + +% \pgfdeclareimage[height=0.5cm]{university-logo}{university-logo-filename} +% \logo{\pgfuseimage{university-logo}} + + + +% Delete this, if you do not want the table of contents to pop up at +% the beginning of each subsection: +%\AtBeginSubsection[] +%{ +% \begin{frame}<beamer>{Outline} +% \tableofcontents[currentsection,currentsubsection] +% \end{frame} +%} + + +% If you wish to uncover everything in a step-wise fashion, uncomment +% the following command: + +%\beamerdefaultoverlayspecification{<+->} + + +\begin{document} + +\begin{frame} + \titlepage +\end{frame} + +\begin{frame}{Outline} + \tableofcontents + % You might wish to add the option [pausesections] +\end{frame} + + +% Structuring a talk is a difficult task and the following structure +% may not be suitable. Here are some rules that apply for this +% solution: + +% - Exactly two or three sections (other than the summary). +% - At *most* three subsections per section. +% - Talk about 30s to 2min per frame. So there should be between about +% 15 and 30 frames, all told. + +% - A conference audience is likely to know very little of what you +% are going to talk about. So *simplify*! +% - In a 20min talk, getting the main ideas across is hard +% enough. Leave out details, even if it means being less precise than +% you think necessary. +% - If you omit details that are vital to the proof/implementation, +% just say so once. Everybody will be happy with that. + +\begin{frame}{About the speaker} +\begin{itemize} +\item Using + playing with Linux since 1994 +\item Kernel development since 1999 +\item IT security expert, focus on network protocol security +\item Board-level Electrical Engineering +\item System-level Software for PPC, ARM, x86 +\item IANAL, but companies not complying with the license forced me to spend lots of time with legal issues +\end{itemize} +\end{frame} + + +\section{FOSS Licenses} + +\subsection{Free Software and Copyleft} + +\begin{frame}{Free Software}{Definition by the FSF} + % - A title should summarize the slide in an understandable fashion + % for anyone how does not follow everything on the slide itself. + Free Software has to ensure the following key freedoms: + \begin{itemize} + \item + Freedom to use the software for any purpose + \item + Freedom to make copies "to help your neighbor" + \item + Freedom to study its functionality (source code) + \item + Freedom to fix it yourself (make modifications) + \end{itemize} +\end{frame} + +\begin{frame}{Copyleft}{A concept to ensure Freedom} + Copyleft is an idea to use copyright to ensure Software Freedoms + \begin{itemize} + \item Use/claim copyright on the software + \item Create a license that is permissive enough for the 4 Freedoms + \item However, put some conditions/obligations in the license + \begin{itemize} + \item ensure the source code will always be available + \item ensure nobody is able to remove the 4 Freedoms from the software + \end{itemize} + \item Use that license for the software. + \end{itemize} +\end{frame} + +\subsection{The GNU GPL} + +\begin{frame}{The GNU GPL}{An implementation of Copyleft} +The GNU General Public License (GPL) +\begin{itemize} + \item is a Copyleft Free Software License + \item assures the original author that his work will always have the freedoms + \item establishes a level of fairness: You can use my code, if you share your additions back with us. + \item is a big motivation factor for many community members +\end{itemize} +\end{frame} + +\begin{frame}{Revisiting the GPLv2 License Terms} +The GNU GPLv2 +\begin{itemize} + \item Regulates distribution, not use (running the program) + \item Allows distribution of source code and modified source code, if + \begin{itemize} + \item The license is mentioned + \item A copy of the license text accompanies each copy + \end{itemize} + \item Allows distribution of or modified binaries, if + \begin{itemize} + \item The license is mentioned + \item A copy of the license text accompanies each copy + \item The source code is either included with the copy, or a written offer is made on how the source can be obtained. + \end{itemize} +\end{itemize} +\end{frame} + +\begin{frame}{Complete Corresponding Source Code}{As required by GPLv2} +\dots complete source code means all the source code for all modules it (the software) contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. +\begin{itemize} + \item For a C language program, this means + \begin{itemize} + \item Source Code + \item Makefiles + \item compile-time configuration (e.g. kernel .config) + \end{itemize} + \item General rule + \begin{itemize} + \item Intent of the license is to enable the user to run modified versions of the program + \item If you provide everything needed for that, there will be no discussion + \end{itemize} +\end{itemize} +\end{frame} + +\begin{frame}{Modifications of GPL'd source code}{The details that matter} +\begin{itemize} + \item In the GPL, it does not matter if you have modified the GPL'd program or if you ship it unmodified. + \item You always have to provide the source code! + \item If you modify the source code, your changes have to be visible/identifiable + \item For practical reasons, I suggest shipping original upstream tarball + a diff/patch with your changes +\end{itemize} +\end{frame} + +\subsection{GPL - Compatible source code offer} + +\begin{frame}{Complete + Corresponding Source}{For every Release you make} +\begin{itemize} +\item Whenever you {\em distribute} GPL licensed software, the license applies. This includes + \begin{itemize} + \item Actual sale of a physical embedded device with the software in flash + \item Download of a firmware update as a file from a website + \item Shipping of firmware updates on physical storage + \item Distribution of firmware updates e.g. by over-the-air mechanisms in DVB-S or other networks + \end{itemize} +\item Every time, the conditions of the license have to be fulfilled (mention there's software under GPL, include full license text, include or offer complete corresponding source code +\item For every release you ever ship (even beta release if it ever is shipped only to one customer), you need the {\em complete corresponding} source code. +\end{itemize} +\end{frame} + +\subsection{GPL - Derivative Works} + +\begin{frame}{Derivative Works}{Keeping it clean} +Derivative works are a question of copyright law, not the GPL +\begin{itemize} +\item whenever you couple a GPL and a non-GPL program tightly (e.g. static/dynamic linking), your're entering a legal grey area +\item there is little or no precedent on derivative works of software +\item you're violating the intention of the author. If he wanted you to link from proprietary programs, he would have used LGPL +\item try to work {\em with} the community, rather than against it +\end{itemize} +\end{frame} + +\begin{frame}{Intermission} +Take a break, go one step back +\begin{itemize} +\item The License is not a means to itself +\item Intent of the license is to make sure people can modify + enhance the product +\item The more open your product is, the less you have to worry +\item Using Linux + FOSS without enabling community to modify+enhance is cheating! +\item Try to make friends of the developer community, not enemies! +\end{itemize} +\end{frame} + +\begin{frame}{License compliance is not an afterthought} +Complying with the license terms is relatively easy {\em if} you consider the license terms {\em before} starting R\&D +\begin{itemize} +\item you can integrate building source releases in your build process +\item you can decide which software can be combined given the license terms +\end{itemize} +\end{frame} + +\begin{frame}{License compliance is not an afterthought} +Achieving license compliance after shipping the product is very hard +\begin{itemize} +\item lack of good engineering practise could mean old source code is gone +\item engineers working on the product might have left the company +\item you and your customers are under a lot of time pressure (legal threat) +\item you might have already shipped a derivative work to GPLd software and now have to release parts that you originally wanted to keep proprietary +\end{itemize} +\end{frame} + +\section{Linux and the Embedded Market} + +\subsection{Linux-based systems everywhere} + +\begin{frame}{Linux and Free Software (FOSS) everywhere} +\begin{figure}[h] +\centering +\includegraphics[width=100mm]{linux_netfilter_singapore_entertainment.jpg} +\end{figure} +\end{frame} + +\begin{frame}{Areas of Embedded Linux} +\begin{itemize} +\item Embedded Network Devices (DSL-Modem, Router, WiFi-AP, NAS) +\item Telecommunications equipment (Switch, DSLAM, ...) +\item In-flight / In-vehicle entertainment +\item Personal Navigation Devices (Tomtom GO) +\item Mobile Phones (EZX, MAGX, Android, LiMo, WebOS) +\item PoS terminals, ATMs, Payphones +\item Digital Media Players, Set-Top-Boxes, Video Recorder +\item Exercycles + Fitness Gear +\item Building automation + control +\item VoIP telephones, VoIP switches, PBX +\item e-Ink readers, Tablet computers, MIDs +\end{itemize} +\end{frame} + +\subsection{Embedded Linux supply chain} + +\begin{frame}{Embedded Linux Supply Chain} +In a typical case, the supply chain consists minimal of +\begin{itemize} +\item The silicon maker of the SoC containig the core that runs Linux +\item The supplier of the reference design / board for that SoC +\item The ODM building an actual circuit board using that SoC +\item The OEM selling the product under his brand in the target market +\end{itemize} +\end{frame} + +\begin{frame}{Embedded Linux Supply Chain} +Situation can be further complicated by +\begin{itemize} +\item A 3rd party supplier of the BSP / SDK for the SoC or reference board +\item Multiple companies involved on the ODM or OEM side (building parts of a product, later integration into the real product e.g. IVE for a car) +\item 3rd party suppliers of application programs (which might use FOSS) +\end{itemize} +\end{frame} + +\begin{frame}{Embedded Linux Supply Chain} +Problems in the supply chain: +\begin{itemize} +\item OEM has no clue what kind of software ODM put into the product +\item ODM has limited technical skill and has no clue what BSP provider did +\item End user buys a product with license/copyright violations and has no clue + \begin{itemize} + \item who the entities in the supply chain are + \item who actually caused the license/copyright violation + \end{itemize} +\end{itemize} +\end{frame} + +\subsection{GPL - Embedded Systems} + +\begin{frame}{GPL and Embedded Systems}{Interpreting the meaning} +\begin{itemize} +\item The GNU GPLv2 was written for the GNU project, at the time this project was +working on replacing individual application programs on top of a proprietary +UNIX operating system kernel. +\item scripts used to control compilation and installation + \begin{itemize} + \item Intent: To enable the user to modify + run modified versions + \item In case of embedded systems, the "scripts used to control installation" include the software required for installing the program onto the target device + \end{itemize} +\end{itemize} +\end{frame} + +\begin{frame}{GPL and Embedded DRM}{Sometimes called Tivo-ization} +\begin{itemize} +\item Some companies want to lock down their Linux-based system, by + \begin{itemize} + \item Cryptographic verification of bootloader by ROM loader + \item Cryptographic verification of kernel image by bootloader\dots + \end{itemize} +\item This is problematic from a GPL point of view, since + \begin{itemize} + \item You are depriving the user from practically exercising his right to run modified versions of the program + \item Thus, violation not of the GPLv2 wording, but likely of the GPL's intention + \item Legal outcome unclear, different scholars have different opinions, also depends on jurisdiction + \end{itemize} +\item GPLv3 makes this intent explicit in the license text +\end{itemize} +\end{frame} + +\section{GPL Violations and License Enforcement} + +\subsection{GPL Violations} + +\begin{frame}{GPL Violations} +\begin{itemize} +\item GPL violations are not new, just like GPL licensed software is not new +\item However, increased popularity of GNU/Linux based systems increase GPL violations +\item Today, many more people and companies unfamiliar with the history and values of Free Software start using and (re)distributing FOSS +\end{itemize} +\end{frame} + +\subsection{Business Risk of GPL Violations} + +\begin{frame}{Business Risk of GPL Violations}{Or: How to convince your managers} +If you ship a product that is incompliant to the GNU GPL, +\begin{itemize} +\item you are committing a copyright infringement not different from shipping a product with unlicensed copies of MS Windows +\item you can face civil and criminal charges in court +\item civil charges include (German jurisdiction) + \begin{itemize} + \item immediate cease + desist (halt of product sales) + \item information of which quantity of the product has been sold to whom + \item damages for lost revenue (see dual licensing) + \end{itemize} +\item civil charges can also be filed against every distributor/store/importer +\end{itemize} +\end{frame} + +\subsection*{Outlook} + +\begin{frame}{Outlook} + Outlook + \begin{itemize} + \item + Blatant GPL violations in embedded devices are declining, but are likely to continue due to lack of skill or negligence. + \item + We'll see more {\em derivative works} types of GPL violations, and we'll see actual legal enforcement and precedent in this area over the next years. + \item + Stronger copyright protection demanded by content industry will also mean stronger protection for FOSS licenses. Imagine GPL enforcement with {\em three strikes} law in France ?!? + \end{itemize} +\end{frame} + +\end{document} diff --git a/2010/gpl_enforcement-coscup2010/linux_netfilter_singapore_entertainment.jpg b/2010/gpl_enforcement-coscup2010/linux_netfilter_singapore_entertainment.jpg Binary files differnew file mode 100644 index 0000000..91b839f --- /dev/null +++ b/2010/gpl_enforcement-coscup2010/linux_netfilter_singapore_entertainment.jpg |
