possible GPL violation by Free

possible GPL violation by Free

[Yoshinori K. Okuji]

Hello,

I got information about a possible GPL violation in France. A network
service company called "Free" provides a kind of ADSL modem named
"Freebox". This "Freebox" is not only an ADSL modem but also has
functions of a router, an IP phone and a TV, using video streaming via
ATM. Although the "Freebox" does not contain any information about GPL,
a rumor says that this runs Linux as the kernel and VideoLAN for the
video streaming. And, this company does not provide the source code
even to those who have Freeboxes. I don't know any other software used
in Freebox, but at least Linux and VideoLAN are under the term of GPL.
This information seems to be given by anonymous people working for the
company.

The company Free reasons that they don't need to make the source code
available, because they don't sell Freebox but merely _rents_ Freebox
to customers. So the company thinks that customers do not own Freebox
legally, and so they have no right to claim that they can ask the
source code.

But, if this is a good reason, I think many other people can refuse to
publish source code. For example, a distributor who "rents" CDROMs can
say, "I am not forced to give you the source code, because you do not
own your CDROM."

Unfortunately I have little knowledge on French copyright laws, so I
cannot judge if this is wrong.

Regards,
Okuji

Re: possible GPL violation by Free

[Jon Masters]

On Sat, 9 Oct 2004 19:58:25 +0200, Yoshinori K. Okuji <okuji@gnu.org> wrote:

> The company Free reasons that they don't need to make the source code
> available, because they don't sell Freebox but merely _rents_ Freebox
> to customers. So the company thinks that customers do not own Freebox
> legally, and so they have no right to claim that they can ask the
> source code.

Hi there,

Someone should then perhaps call them and find out whether it's
possible to purchase one of these boxes - thereby trapping them in to
not having this argument.

Je le ferais, mais mon francais n'est pas tres bon, et je n'habite pas
en France.

Jon.

Re: possible GPL violation by Free

[Sam Hocevar]

On Sat, Oct 09, 2004, Yoshinori K. Okuji wrote:

> I got information about a possible GPL violation in France. A network
> service company called "Free" provides a kind of ADSL modem named
> "Freebox". This "Freebox" is not only an ADSL modem but also has
> functions of a router, an IP phone and a TV, using video streaming via
> ATM. Although the "Freebox" does not contain any information about GPL,
> a rumor says that this runs Linux as the kernel and VideoLAN for the
> video streaming.

   The Freebox does not run VideoLAN software but has a built-in
hardware MPEG-2 decoder. Free uses VideoLAN software to stream video,
but this is internal use and perfectly complies with the GPL. I may add
that a VideoLAN developer works for Free and still commits code into the
SVN repository, which he is not required to do.

   If there is a problem here, it looks like a problem with Linux (and
probably GNU) only.

> And, this company does not provide the source code
> even to those who have Freeboxes. I don't know any other software used
> in Freebox, but at least Linux and VideoLAN are under the term of GPL.
> This information seems to be given by anonymous people working for the
> company.
> 
> The company Free reasons that they don't need to make the source code
> available, because they don't sell Freebox but merely _rents_ Freebox
> to customers. So the company thinks that customers do not own Freebox
> legally, and so they have no right to claim that they can ask the
> source code.

   Do you have a reference to an official statement for this? A lot of
companies are rumoured to say a lot of things, and you should really
cautiously check your facts. If this is indeed they reasoning, it
impugns the general GPL interpretation that renting a piece of hardware
is distribution of the software therein.

   To carefully verify this, you need to have a Freebox user ask
Free for the Linux source code. No one else is entitled to do it.
Maybe you could even find a Linux developer who has a Freebox and did
contributions to the kernel significant enough that they must be in the
Freebox.

   If Free is using an unmodified kernel, they are already providing
the sources for it (ftp://ftp.free.fr/pub/linux/kernel/). If they are
using a modified version of the kernel, then they should be asked for
the source. If anyone is going to do this, please be diplomatic, and
try to rely on facts rather than Internet rumours. I would hate to see
Free exasperated by Slashdot morons and deciding not to contribute to
VideoLAN any longer.

Regards,
-- 
Sam. <http://sam.zoy.org/>

Re: possible GPL violation by Free

[Willy Tarreau]

Hi,

On Sat, Oct 09, 2004 at 07:58:25PM +0200, Yoshinori K. Okuji wrote:
> I got information about a possible GPL violation in France. A network
> service company called "Free" provides a kind of ADSL modem named
> "Freebox". This "Freebox" is not only an ADSL modem but also has
> functions of a router, an IP phone and a TV, using video streaming via
> ATM. Although the "Freebox" does not contain any information about GPL,
> a rumor says that this runs Linux as the kernel and VideoLAN for the
> video streaming.

When they built the first freebox, I found an inside photo on the net.
I don't remember which chip it was (several years ago), but it was clear
from the maker that it only supported vxworks. And at this time, people
were already saying it was running linux. There are so many rumors about
many devices running linux that people should check (at least provide the
result of an nmap -O). For most end-users, "linux" is the word for "a
reliable embedded OS with IP support".

However, I also found a photo of the new one on the net, which shows
a big broadcom BCM6348. This one supports both linux and vxworks, but
judging by the number of responses on google, there is a great chance
that broadcom pushes linux on it since they also provide many other
solutions involving linux.

Regards,
Willy

Re: possible GPL violation by Free

[Rik van Riel]

On Sun, 10 Oct 2004, Sam Hocevar wrote:

>    To carefully verify this, you need to have a Freebox user ask
> Free for the Linux source code. No one else is entitled to do it.

This is some serious misinformation, that needs to be corrected.

Please take a look at your copy of the GPL, in particular section 3.
It states that the distributor of the software has 3 options, the
third one only for non-profit distribution, so not applicable here.
This leaves Free with 2 options:

1) distribute the source together with the binaries, which they
   do not appear to be doing

2) distribute the source with an offer, for ANY 3rd party, to
   get the source code on request (they don't appear to be doing
   this either)


In addition to this, I find the reasoning that "people rent the
box, so we don't sell the software" to be very suspicious.  Even
if the boxes are only rented, the software on them is still being
distributed!

IANAL, of course, so YMMV ...

-- 
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

Re: possible GPL violation by Free

[Sam Hocevar]

On Sun, Oct 10, 2004, Rik van Riel wrote:

> >    To carefully verify this, you need to have a Freebox user ask
> > Free for the Linux source code. No one else is entitled to do it.
> 
> This is some serious misinformation, that needs to be corrected.
> 
> Please take a look at your copy of the GPL, in particular section 3.
> It states that the distributor of the software has 3 options, the
> third one only for non-profit distribution, so not applicable here.
> This leaves Free with 2 options:
> 
> 1) distribute the source together with the binaries, which they
>    do not appear to be doing
> 
> 2) distribute the source with an offer, for ANY 3rd party, to
>    get the source code on request (they don't appear to be doing
>    this either)

   I know the GPL and I know they don't appear to be doing any of these
two things. However it might be hidden in some obscure agreement between
Free and the user, renounced upon in such an agreement (which would
violate the GPL, like QuakeLives did) or indeed not be there at all. And
the only people who can verify this are the Freebox users.

> In addition to this, I find the reasoning that "people rent the
> box, so we don't sell the software" to be very suspicious.  Even
> if the boxes are only rented, the software on them is still being
> distributed!

   As stated in my previous email, I agree with you on this. Renting is
distributing.

-- 
Sam.

Re: possible GPL violation by Free

[Rik van Riel]

On Sun, 10 Oct 2004, Sam Hocevar wrote:

> > This leaves Free with 2 options:

>    I know the GPL and I know they don't appear to be doing any of these
> two things. However it might be hidden in some obscure agreement between
> Free and the user, renounced upon in such an agreement (which would
> violate the GPL, like QuakeLives did) or indeed not be there at all. And
> the only people who can verify this are the Freebox users.

Even if the Freebox users were to renounce their own
rights under the GPL, I do not see how they could
renounce OUR rights for us ...


-- 
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

Re: possible GPL violation by Free

[Helge Hafting]

On Sat, Oct 09, 2004 at 07:58:25PM +0200, Yoshinori K. Okuji wrote:
> Hello,
[...] 
> The company Free reasons that they don't need to make the source code
> available, because they don't sell Freebox but merely _rents_ Freebox
> to customers. So the company thinks that customers do not own Freebox
> legally, and so they have no right to claim that they can ask the
> source code.
> 
Perhaps customers can demand to _rent_ the source code too then?  ;-)

Helge Hafting

RE: possible GPL violation by Free

[David Schwartz]

> On Sun, 10 Oct 2004, Sam Hocevar wrote:

> > > This leaves Free with 2 options:

> >    I know the GPL and I know they don't appear to be doing any of these
> > two things. However it might be hidden in some obscure agreement between
> > Free and the user, renounced upon in such an agreement (which would
> > violate the GPL, like QuakeLives did) or indeed not be there at all. And
> > the only people who can verify this are the Freebox users.

> Even if the Freebox users were to renounce their own
> rights under the GPL, I do not see how they could
> renounce OUR rights for us ...

	The GPL doesn't give any rights to anyone but the people the software is
distributed to. Though the agreement must be enforceable by any third party,
that third party must actually be a recipient of the agreement, either
directly or indirectly.

	So in other words, if you make a custom binary of the Linux kernel and
distribute it to me, then you have to give me an agreement that any third
party can enforce to get the source code. But I don't have to give that
agreement to any third parties if I don't want to.

	The rationale behind this requirement in the GPL is that without it,
redistribution would be difficult. Since the GPL allows the recipients of
the code to further distribute it, they must be also able to distribute the
right to the source code.

	The GPL does not permit you to impose any other restrictions. So you can't
use this as a loophole to escape the requirement of distributing the source
code. A simple way to understand it is this -- wherever the executable can
go, so too must the source go. Wherever the executable can go, so too must
the right to redistribute the executable (and therefore, so to must go the
ability to get the source).

	If you lawfully obtained the executable to anything derived from GPL'd
code, you should be able to obtain the source code. If not, you might or
might not be able to. If you have the executable, and didn't steal it or
something, you should also have either the source code or the right to
easily obtain the source code.

	DS

Re: possible GPL violation by Free

[Moritz Muehlenhoff]

In gmane.linux.kernel, you wrote:
> Although the "Freebox" does not contain any information about GPL,
> a rumor says that this runs Linux as the kernel and VideoLAN for the
> video streaming.

Please research such issues further before making public accusations.

I don't know the internals of Freebox, but Free surely has profound
knowledge of free software and it's licensing issues (they funded
libavcodec development and provide the bandwidth for the savannah/
sourceforge alike gna.org in cooperation with FSF France.)

Cheers,
        Morit

Re: possible GPL violation by Free

[Eric Rannaud]

Hello,

On Sun, 2004-10-10 at 12:28 +0200, Willy Tarreau wrote:
> (at least provide the
> result of an nmap -O). For most end-users, "linux" is the word for "a
> reliable embedded OS with IP support".

Here it is, on a Freebox v1 (the Freebox distributed now is version 3,
but version 1 was still distributed less than one year ago (i.e. under
the 3 years limit in the GPL)).
Disclaimer: this scan output should be taken carefully. Please do not
jump to conclusions.
(IP and MAC hidden)

--------------------------------
Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2004-10-10 20:23
CEST
Initiating SYN Stealth Scan against XX.XX.XX.254 [1660 ports] at 20:23
Discovered open port 22/tcp on XX.XX.XX.254
Discovered open port 199/tcp on XX.XX.XX.254
The SYN Stealth Scan took 5.12s to scan 1660 total ports.
For OSScan assuming that port 22 is open and port 1 is closed and
neither are firewalled
Host XX.XX.XX.254 appears to be up ... good.
Interesting ports on XX.XX.XX.254:
(The 1658 ports scanned but not shown below are in state: closed)
PORT    STATE SERVICE
22/tcp  open  ssh
199/tcp open  smux
MAC Address: 00:07:XX:XX:XX:XX (Freebox SA)
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux 2.4.0 - 2.5.20
OS Fingerprint:
TSeq(Class=RI%gcd=1%SI=40A886%IPID=Z%TS=100HZ)
T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%
DAT=E)

Uptime 41.944 days (since Sun Aug 29 21:XX:XX 2004)
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=4237446 (Good luck!)
TCP ISN Seq. Numbers: 99D03998 9A7D22DF 9A644725 9A6FDD72 9A0BEAA0
IPID Sequence Generation: All zeros

Nmap run completed -- 1 IP address (1 host up) scanned in 8.556 seconds
-------------------------------


If I remember correctly my contract, after 36 months, I become the owner
of the freebox. The argument about renting does not seem to hold,
anyway.

I will contact Free to ask for more information.

Best,

     /er.



-- 
Eric Rannaud <eric.rannaud@ens.fr>
http://www.eleves.ens.fr/home/rannaud/

RE: possible GPL violation by Free

[David Schwartz]

> If I remember correctly my contract, after 36 months, I become the owner
> of the freebox. The argument about renting does not seem to hold,
> anyway.

	In the United States, it is illegal to rent computer software without the
copyright holder's permission. Arguments such as, "I'm selling/renting the
computer/hard drive, the software just happens to be on it" don't generally
impress the courts.

	In any event, it seems pretty obvious to me that renting a physical medium
that contains an encoded copyrighted work is a form of distribution of that
work. The operation of that physical device is as much a derived work of the
copyrighted work as the visual/audio experience of seeing a play is a
derived work of the script for the play.

	In other words, I don't think any court or lawyer would find the "we're
renting the computer, not distributing the software that comes with it and
is required for its operation" to be persuasive. IANL, YMMV.

	DS

Re: possible GPL violation by Free

[Måns Rullgård]

"David Schwartz" <davids@webmaster.com> writes:

> 	In any event, it seems pretty obvious to me that renting a
> physical medium that contains an encoded copyrighted work is a form of
> distribution of that work. The operation of that physical device is as
> much a derived work of the copyrighted work as the visual/audio
> experience of seeing a play is a derived work of the script for the
> play.

Are you sure it's not a performance?

-- 
Måns Rullgård
mru@mru.ath.cx

Re: possible GPL violation by Free

[Colin Leroy]

Hi,

> Initiating SYN Stealth Scan against XX.XX.XX.254 [1660 ports] at 20:23
> PORT    STATE SERVICE
> 22/tcp  open  ssh
> 199/tcp open  smux
> MAC Address: 00:07:XX:XX:XX:XX (Freebox SA)
> Device type: general purpose
> Running: Linux 2.4.X|2.5.X
> OS details: Linux 2.4.0 - 2.5.20

I think you just scanned the router, or whatever network appliance it is,
behind the freebox :-)

The freebox is quite transparent when it's plugged to the network. Try to 
just plug in to your computer and assign it an IP using arp -s...

(not sure, however)
-- 
Colin

Re: possible GPL violation by Free

[Eric Rannaud]

On Mon, 2004-10-11 at 09:14 +0200, Colin Leroy wrote:
> Hi,
> 
> I think you just scanned the router, or whatever network appliance it is,
> behind the freebox :-)
> 
> The freebox is quite transparent when it's plugged to the network. Try to 
> just plug in to your computer and assign it an IP using arp -s...
> 
> (not sure, however)

Ermmm, indeed, that's quite possible :-{ I've been lured by the MAC
address, which was correct. But that didn't mean anything.
The problem is that once the freebox is disconnected from the xDSL line,
it becomes completely silent on the network. nmap -O -P0 is meaningless.

It does seem to act like a bridge, indeed.

Mathieu wrote:
> Are you sure you don't scan your computer : the freebox v1 don't have
> router mode and act like a bridge.

No, my computer doesn't look like that.

I have asked Free for more information about the OS running on the
freebox. I don't know what kind of tests could be performed on such a
device. If you have any suggestion.

   /er.

-- 
Eric Rannaud <eric.rannaud@ens.fr>
http://www.eleves.ens.fr/home/rannaud/

Re: possible GPL violation by Free

[Pierre]

> When they built the first freebox, I found an inside photo on the net.
> I don't remember which chip it was (several years ago), but it was
> clear
> from the maker that it only supported vxworks. And at this time,
> people
> were already saying it was running linux. There are so many rumors
> about
> many devices running linux that people should check (at least provide
> the
> result of an nmap -O). For most end-users, "linux" is the word for "a
> reliable embedded OS with IP support".

It is certain that the freebox run linux on mips processor [0] :
see the cv of the developper of the freebox [1] [2]
They seem to have done minor contribution [3]

It seem [4] that linux is writen on a flash memory of the freebox with the
firmware of the ADSL modem (if it wasn't how the freebox could connect
throught ADSL for download root and new firmware).

Also it is said that  if you forgot to give
back to them you paid about 300 ??? and it is yours.

I don't know if there is a real GPL violation, but knowing the free support
it will be very difficult to communicate with them...

[0] http://www.idt.com/news/Feb03/02_24_03_1.html
[1] http://alex.krnl.org
[2] http://www.figuiere.net/hub/cv.html
[3] http://www.uclibc.org/lists/uclibc-cvs/2003-January/003068.html
[4] http://www.hifocus.net/freebox3.php3

Deux elements logiciels sont stockees en memoire flash : le noyau linux
et le firmware du chipset Alcatel pour la connexion WAN. Le reste de la
configuration (filtres, logiciels, drivers...) est telecharge a chaque
demarrage et stocke en memoire vive.

RE: possible GPL violation by Free

[David Schwartz]

> Moreover, Freebox boots (each power cycle) over the network and
> downloads the OS (which seems to Linux and it's not resident). The
> bootstrap code used to boot over network is from Broadcom (for V4
> model). So even if you can buy it, you just have a box without any
> OS inside.

	This is clearly a form of software distribution, regardless of who owns or
doesn't own the box the software is being distributed to. The argument then
becomes who it is that's entitled to the source code.

	So now the question becomes can you "lend" someone GPL'd software without
having to "lend" them the source code. It is pretty clear that this practice
is illegal in the United States:

"(b)(1)(A) Notwithstanding the provisions of subsection (a), unless
authorized by the owners of copyright in the sound recording or the owner of
copyright in a computer program (including any tape, disk, or other medium
embodying such program), and in the case of a sound recording in the musical
works embodied therein, neither the owner of a particular phonorecord nor
any person in possession of a particular copy of a computer program
(including any tape, disk, or other medium embodying such program), may, for
the purposes of direct or indirect commercial advantage, dispose of, or
authorize the disposal of, the possession of that phonorecord or computer
program (including any tape, disk, or other medium embodying such program)
by rental, lease, or lending. Nothing in the preceding sentence shall apply
to the rental, lease, or lending of a phonorecord for nonprofit purposes by
a nonprofit library or nonprofit educational institution. The transfer of
possession of a lawfully made copy of a computer program by a nonprofit
educational institution to another nonprofit educational institution or to
faculty, staff, and students does not constitute rental, lease, or lending
for direct or indirect commercial purposes under this subsection."

	And here's the truly hilarious part -- if not for their download scheme,
they would be exempt from this law! It goes on to list as an exception:

"(i) a computer program which is embodied in a machine or product and which
cannot be copied during the ordinary operation or use of the machine or
product."

	IANAL.

	DS

Re: possible GPL violation by Free

[Glennie Vignarajah]

Helge Hafting a écrit: 
 
> Perhaps customers can demand to _rent_ the source code too then? 

 After few discussions on proad.free.adsl and on linuxfr.org
(http://linuxfr.org/~superzen/15187.html), it seems that Free
_lends_ the Freebox (at no charge) while people use their Internet
Access. When one stops his Internet Access abonnement, he has sent
it back.
 Moreover, Freebox boots (each power cycle) over the network and
downloads the OS (which seems to Linux and it's not resident). The
bootstrap code used to boot over network is from Broadcom (for V4
model). So even if you can buy it, you just have a box without any
OS inside.
-- 
Glennie
"Personne ne survit au fait d'être estimé au-dessus de sa valeur." 

Re: possible GPL violation by Free

[Matthieu Castet]

> On Sun, 2004-10-10 at 12:28 +0200, Willy Tarreau wrote:
> > (at least provide the
> > result of an nmap -O). For most end-users, "linux" is the word for "a
> > reliable embedded OS with IP support".
> 
> Here it is, on a Freebox v1 (the Freebox distributed now is version 3,
> but version 1 was still distributed less than one year ago (i.e. under
> the 3 years limit in the GPL)).
> Disclaimer: this scan output should be taken carefully. Please do not
> jump to conclusions.
> (IP and MAC hidden)

Are you sure you don't scan your computer : the freebox v1 don't have
router mode and act like a bridge.
It seem suspicious that all the port are closed instead of filtered.

On the freebox v3 it is difficult to use nmap for guessing the os : in
router mode all the port are filtered except those you forward to your
computer.

Matthieu