GPL violations by wireless manufacturers

GPL violations by wireless manufacturers

[vanstadentenbrink]

[ Please CC replies as I am not subscribed ]

I have had some luck resolving the GPL violation by wireless 
manufacturers issue. I have sent letters regarding the issue to 
Linksys, Belkin and Buffalo. This is the letter I received from 
Buffalo Technologies and below that is the letter I sent to the three 
manufacturers:

--------------
Hi Sir,
 
We are aware of these requirements and we have the PDF document 
(attached) and a statement/notice that will be put onto the website 
within 48 hours for this product. Please let me know if you require 
further assistance or if you would like to talk further.
 
NOTICE:
This product uses software of GPL/LGPL.
You have the right to acquire source code, change it, and re-
distribute it.
The warranty on the product is only applicable if the original or an 
official Buffalo firmware is on the unit.
Please refer to GNU_LICENSE.PDF.
We don’t have any obligation to pay if a user has to pay to 
distribute or change the source code.
 
Thanks for your time.
 
Craig Reid
Technical Sales Engineer
-----------

-----------
Dear sirs, 

Hereby I would like to inform you that the software on at least one  
of your products is offered in violation of the General Public  
License (GPL) as published by the GNU Software Foundation.  This may 
not be known to you due to inclusion of acquired or  licensed 
technology from third-party manufacturers in your  product.  

The affected product is the Buffalo (Melco) WBR-G54 Wireless  Access 
Point 

The infringement of the GPL consists of the following: 

Your product makes use of Linux kernel version 2.4.5 and  Busybox 
software, which are both licensed under GPL  terms and conditions. 
The GPL allows copying and  distribution of licensed software, 
provided that the  complete corresponding machine-readable source 
code or  a written offer to a complete machine-readable copy of the  
corresponding source code accompanies the product. As  you have 
fulfilled neither of these obligations, you are in  violation GPL 
terms and conditions.
 
Your product includes a kernel driver module that is  inserted into 
the GPL licensed Linux kernel when the  product is turned on. There 
is no possible way for the user  to prevent the insertion of this 
module into the kernel. It is  also impossible for the user to remove 
the kernel module  from the running kernel. The operation of the 
included  software on your product depends on the operation of the  
kernel module. For these reasons the kernel driver module  is not 
offered as a separate work as described in Section II  of the GPL and 
must therefore be distributed under the  terms and conditions of the 
GPL. As you have not  included the complete corresponding machine-
readable  source code or a written offer to a complete machine- 
readable copy of the corresponding source code you are  clearly in 
violation of GPL terms and conditions.
 

Because of the huge liability your company could be facing I  advise 
you to take appropriate measures to cease offering your  product in 
violation of the GPL.  


With Regards, 


Richard Ten Brink
--------

RE: GPL violations by wireless manufacturers

[David Schwartz]

> Your product includes a kernel driver module that is  inserted into
> the GPL licensed Linux kernel when the  product is turned on. There
> is no possible way for the user  to prevent the insertion of this
> module into the kernel. It is  also impossible for the user to remove
> the kernel module  from the running kernel. The operation of the
> included  software on your product depends on the operation of the
> kernel module. For these reasons the kernel driver module  is not
> offered as a separate work as described in Section II  of the GPL and
> must therefore be distributed under the  terms and conditions of the
> GPL.

	Perhaps it's not a separate work from the programs that access it, but it's
certainly a separate work from the kernel. The kernel can operate just fine
without the module. The module extends the kernel through a well-defined
boundary.

	The GPL says:

"These requirements apply to the modified work as a whole.  If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.  But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it."

	So is a Linux distribution "a whole which is a work based on the" Linux
kernel? Would you argue that RedHat can't include proprietary software on
the same CD as the Linux kernel? All the software on the CD, assuming it's
Linux software, likewise extends the kernel through a well-defined boundary.

	DS

RE: GPL violations by wireless manufacturers

[vanstadentenbrink]

[ Please CC replies as I am not subscribed ]

In response to DS:

> So is a Linux distribution "a whole which is a work based on the" Linux
> kernel? Would you argue that RedHat can't include proprietary software on
> the same CD as the Linux kernel? All the software on the CD, assuming it's
> Linux software, likewise extends the kernel through a well-defined boundary.

No, definitely not. If that were the case, SuSE and Lindows etc. etc. 
would not be able to distribute proprietary software together with 
GPL'ed software. The GPL calls this 'mere aggregation':

"In addition, mere aggregation of another work not based on the 
Program with the Program (or with a work based on the Program) on a 
volume of a storage or distribution medium does not bring the other 
work under the scope of this License."

These wireless products are different. The user doesn't have a choice 
to use or not to use the non-gpl'ed kernel module. He can not prevent 
the module from loading, he can not remove it from the running kernel 
and the device doesn't operate without the module. The module and the 
embedded Linux OS on the device are so interconnected that they can 
not be considered 'seperate works' under the GPL. Therefore the 
kernel module actually is GPL software itself.

Buffalo Technology's response indicates that they agree with me (or 
perhaps they just don't want any trouble).

In response to Zack Gilburd:

> ...But where are the downloads? :-\

They don't have to offer the source as a download under the GPL. They 
just have to enable you to get to the source. As soon as Buffalo puts 
on the their website that they use GPL'ed software (they said they 
would do that within 48 hours) you should be able to request and 
receive the source code of the embedded Linux OS as well as the 
source code of the kernel module.


Richard Ten Brink

RE: GPL violations by wireless manufacturers

[David Schwartz]

> In response to DS:

> > So is a Linux distribution "a whole which is a work based on the" Linux
> > kernel? Would you argue that RedHat can't include proprietary
> > software on
> > the same CD as the Linux kernel? All the software on the CD,
> > assuming it's
> > Linux software, likewise extends the kernel through a
> > well-defined boundary.

> No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> would not be able to distribute proprietary software together with
> GPL'ed software. The GPL calls this 'mere aggregation':

> "In addition, mere aggregation of another work not based on the
> Program with the Program (or with a work based on the Program) on a
> volume of a storage or distribution medium does not bring the other
> work under the scope of this License."

	But they're not just on the same CD. The additional work extends the Linux
kernel and is useless without it (or without something that emulates it).

> These wireless products are different. The user doesn't have a choice
> to use or not to use the non-gpl'ed kernel module.

	So any software a Linux distribution installs by default has to be GPL?

> He can not prevent
> the module from loading, he can not remove it from the running kernel
> and the device doesn't operate without the module.

	That the device doesn't operate without the module says nothing about the
relationship between the linux kernel and the module. That they provide no
interface to unload the module doesn't change the fact that there's a
boundary between the kernel and the module that keeps them separate works.

> The module and the
> embedded Linux OS on the device are so interconnected that they can
> not be considered 'seperate works' under the GPL. Therefore the
> kernel module actually is GPL software itself.

	Obviously, I don't agree. The linux kernel is totally usable without the
module. The module only extends the kernel through a standardized interface.
This is sufficient, in my book, to make them separate works. That they are
shipped on the same medium and that the user can't separate them is
irrelevent -- you can't separate them if they're shipped on the same CD
anyway without a scalpel.

	The GPL can't declare a legal fiction and thereby make it into a fact. I
would think it's quite probable that a court would interpret the GPL's "work
based on" concept to be equivalent to the legal concept of a derived work.
Otherwise, the GPL can't restrict its distribution (a copyright holder has
the right to control the distribution of derived works but not works that
aren't derived, even if they meet the license's definition of 'based on').

> Buffalo Technology's response indicates that they agree with me (or
> perhaps they just don't want any trouble).

	Perhaps they just prefer to release the module under the GPL.

	DS

developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Roger Larsson]

This begun as a short reply, but I

On tisdagen den 24 juni 2003 13.20, vanstadentenbrink@ahcfaust.nl wrote:
> They don't have to offer the source as a download under the GPL. They
> just have to enable you to get to the source. As soon as Buffalo puts
> on the their website that they use GPL'ed software (they said they
> would do that within 48 hours) you should be able to request and
> receive the source code of the embedded Linux OS as well as the
> source code of the kernel module.

ONLY if you are a customer, are you? If not, why all this noice?
(They could require you to enter a serial number to get the source...)


A customer of a product B that uses GPL project A can
require the source for A. But what about the primary developer?
Suppose the company charges an obscene amount of money for
the product (that might be an enhanced project A, like a patch to allow 
compilation on Win32) - the primary developer might not afford to buy that
product.

One can hope that the customer is smart enough to release the source
to the original developer... But there are no guarantees...

/RogerL

-- 
Roger Larsson
Skellefteå
Sweden

Re: developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Krzysztof Halasa]

Roger Larsson <roger.larsson@skelleftea.mail.telia.com> writes:

> A customer of a product B that uses GPL project A can
> require the source for A. But what about the primary developer?
> Suppose the company charges an obscene amount of money for
> the product (that might be an enhanced project A, like a patch to allow 
> compilation on Win32) - the primary developer might not afford to buy that
> product.

There is no problem with that. Still, the company may choose not to
release the product at all. But, if it does, anyone (any customer)
can make that software public, as permitted by the license.
-- 
Krzysztof Halasa
Network Administrator

RE: GPL violations by wireless manufacturers

[vanstadentenbrink]

[ CC replies as I am not subscribed ]

In reply to DS:

A final attempt to convince you; after that it is back to the paid 
legal work for me :).

When you load a non-gpl kernel module (like that kernel driver module 
on the router) you 'taint the kernel', as it is called. After doing 
so, the running kernel is a 'modified program' under the gpl. 
Distributing a modified program 'as a whole' gpls (is that a verb?) 
the combination as a whole.

Under the gpl you are however allowed to distribute the gpl kernel 
and the non-gpl module separately, like NVidia does with their non-
gpl kernel modules. Distribution on separate volumes would also be 
allowed (mere aggregation).

How do you distribute the two separately? My opinion is: definitely 
not by making the driver module load itself automatically, thereby 
tainting the kernel automatically, with no option for removal of the 
module, like the wireless router does. You have to provide the user 
an option to load or at least unload the module at will.
 
So how would you distribute a non-gpl module separately in a wireless 
router? I honestly don't know. Fact of the matter is that in my 
opinion it is quite scary to use a GPL'ed OS on an embedded system if 
you want to keep your modules a secret. It is a 'viroid'-license as 
Bill G. calls it, because of its license-infecting capabilities.

Regarding the "work based on" = "derived" issue: unfortunately I can 
tell you a lot about Dutch and European Law, but I know too little 
about American law to judge on that.

Regards,


Richard.

On 24 Jun 2003 at 11:18, David Schwartz wrote:

> > In response to DS:
> 
> > > So is a Linux distribution "a whole which is a work based on 
the" Linux
> > > kernel? Would you argue that RedHat can't include proprietary
> > > software on
> > > the same CD as the Linux kernel? All the software on the CD,
> > > assuming it's
> > > Linux software, likewise extends the kernel through a
> > > well-defined boundary.
> 
> > No, definitely not. If that were the case, SuSE and Lindows etc. 
etc.
> > would not be able to distribute proprietary software together 
with
> > GPL'ed software. The GPL calls this 'mere aggregation':
> 
> > "In addition, mere aggregation of another work not based on the
> > Program with the Program (or with a work based on the Program) on 
a
> > volume of a storage or distribution medium does not bring the 
other
> > work under the scope of this License."
> 
> 	But they're not just on the same CD. The additional work extends 
the Linux
> kernel and is useless without it (or without something that 
emulates it).
> 
> > These wireless products are different. The user doesn't have a 
choice
> > to use or not to use the non-gpl'ed kernel module.
> 
> 	So any software a Linux distribution installs by default has to be 
GPL?
> 
> > He can not prevent
> > the module from loading, he can not remove it from the running 
kernel
> > and the device doesn't operate without the module.
> 
> 	That the device doesn't operate without the module says nothing 
about the
> relationship between the linux kernel and the module. That they 
provide no
> interface to unload the module doesn't change the fact that there's 
a
> boundary between the kernel and the module that keeps them separate 
works.
> 
> > The module and the
> > embedded Linux OS on the device are so interconnected that they 
can
> > not be considered 'seperate works' under the GPL. Therefore the
> > kernel module actually is GPL software itself.
> 
> 	Obviously, I don't agree. The linux kernel is totally usable 
without the
> module. The module only extends the kernel through a standardized 
interface.
> This is sufficient, in my book, to make them separate works. That 
they are
> shipped on the same medium and that the user can't separate them is
> irrelevent -- you can't separate them if they're shipped on the 
same CD
> anyway without a scalpel.
> 
> 	The GPL can't declare a legal fiction and thereby make it into a 
fact. I
> would think it's quite probable that a court would interpret the 
GPL's "work
> based on" concept to be equivalent to the legal concept of a 
derived work.
> Otherwise, the GPL can't restrict its distribution (a copyright 
holder has
> the right to control the distribution of derived works but not 
works that
> aren't derived, even if they meet the license's definition of 
'based on').
> 
> > Buffalo Technology's response indicates that they agree with me 
(or
> > perhaps they just don't want any trouble).
> 
> 	Perhaps they just prefer to release the module under the GPL.
> 
> 	DS
> 
> 

Re: developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Zack Gilburd]

[-- Attachment #1: signed data --]
[-- Type: text/plain, Size: 750 bytes --]

On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> A customer of a product B that uses GPL project A can
> require the source for A. But what about the primary developer?
> Suppose the company charges an obscene amount of money for
> the product (that might be an enhanced project A, like a patch to allow
> compilation on Win32) - the primary developer might not afford to buy that
> product.

Not exactly.  By my understanding of the GPL, if you plan on distributing 
binaries outside of your corporation, you MUST make the source available to 
any and all third parties.  In adition, you must bundle the source code with 
the binary.

That's just what I have read from the GPL -- IANAL.

-- 
Zack Gilburd
http://tehunlose.com

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Bryan Andersen]

Zack Gilburd wrote:
> Not exactly.  By my understanding of the GPL, if you plan on distributing 
> binaries outside of your corporation, you MUST make the source available to 
> any and all third parties.  In adition, you must bundle the source code with 
> the binary.

Please actually read the GPL License before you spew.

GPL only requires you to distribute source to those you distribute 
binaries to, not everybody.  If the binary seller wishes they can 
provide source to everybody but it is not required.

- Bryan

Re: developers and GPL in products (Was: Re: GPL violations by wi reless manufacturers)

[David Lang]

no, you have to make source available to anyone you give the binary to.

you can't prevent that person from giving the source to the world, but you
are not required to.

they could compress the source and stick it on the driver CD that they
bundle with the product and you would not be allowed to duplicate that CD
(it contains commercial programs), but you could copy the source off of
the CD and put it on your website.

David Lang

On Tue, 24 Jun 2003, Zack Gilburd wrote:

> Date: Tue, 24 Jun 2003 17:27:51 -0700
> From: Zack Gilburd <zack@tehunlose.com>
> To: linux-kernel@vger.kernel.org
> Subject: Re: developers and GPL in products (Was: Re: GPL violations by
>     wi reless manufacturers)
>
> On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> > A customer of a product B that uses GPL project A can
> > require the source for A. But what about the primary developer?
> > Suppose the company charges an obscene amount of money for
> > the product (that might be an enhanced project A, like a patch to
> allow
> > compilation on Win32) - the primary developer might not afford to buy
> that
> > product.
>
> Not exactly.  By my understanding of the GPL, if you plan on
> distributing
> binaries outside of your corporation, you MUST make the source available
> to
> any and all third parties.  In adition, you must bundle the source code
> with
> the binary.
>
> That's just what I have read from the GPL -- IANAL.
>
> --
> Zack Gilburd
> http://tehunlose.com
>

Re: developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Robins Tharakan]

Therefore, if Company A "sells" the package to anybody outside the
company then it has to "make available" the source, including people
like the primary developer.

But i think the second part of Zack's reply might not be right.
The company A only needs to make "available" the source. it doesnt
"have" to bundle the source with the binaries... (maybe make it
available on the website or make some such provisions...)

robins

On Wed, 2003-06-25 at 05:57, Zack Gilburd wrote:
> On Tuesday 24 June 2003 11:25, Roger Larsson wrote:
> > A customer of a product B that uses GPL project A can
> > require the source for A. But what about the primary developer?
> > Suppose the company charges an obscene amount of money for
> > the product (that might be an enhanced project A, like a patch to allow
> > compilation on Win32) - the primary developer might not afford to buy that
> > product.
> 
> Not exactly.  By my understanding of the GPL, if you plan on distributing 
> binaries outside of your corporation, you MUST make the source available to 
> any and all third parties.  In adition, you must bundle the source code with 
> the binary.
> 
> That's just what I have read from the GPL -- IANAL.
> 
> -- 
> Zack Gilburd
> http://tehunlose.com

Re: GPL violations by wireless manufacturers

[Horst von Brand]

"David Schwartz" <davids@webmaster.com> said:
> > In response to DS:
> 
> > > So is a Linux distribution "a whole which is a work based on the" Linux
> > > kernel? Would you argue that RedHat can't include proprietary
> > > software on
> > > the same CD as the Linux kernel? All the software on the CD,
> > > assuming it's
> > > Linux software, likewise extends the kernel through a
> > > well-defined boundary.
> 
> > No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> > would not be able to distribute proprietary software together with
> > GPL'ed software. The GPL calls this 'mere aggregation':
> 
> > "In addition, mere aggregation of another work not based on the
> > Program with the Program (or with a work based on the Program) on a
> > volume of a storage or distribution medium does not bring the other
> > work under the scope of this License."

> 	But they're not just on the same CD. The additional work extends
> the Linux kernel and is useless without it (or without something that
> emulates it).

Just like Oracle, or Opera, or my sendmail binary, or a lot of other
stuff. That they would be useless without Linux doesn't make them GPL. The
GPL is quite clear; the head penguin also clarified that propietary modules
are OK.

Now can we please stop this? If there is something to discuss around this,
it is clearly _not_ kernel development.
-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

Re: developers and GPL in products (Was: Re: GPL violations by wireless manufacturers)

[Brian Davids]

Robins Tharakan wrote:
> Therefore, if Company A "sells" the package to anybody outside the
> company then it has to "make available" the source, including people
> like the primary developer.
> 
> But i think the second part of Zack's reply might not be right.
> The company A only needs to make "available" the source. it doesnt
> "have" to bundle the source with the binaries... (maybe make it
> available on the website or make some such provisions...)

There is a choice of ONE of THREE options.  Company A may EITHER:

1. include the source
OR
2. accompany the binary with a written offer for the source
OR
3.  if it is a noncommercial RE-distribution of the binary, include the 
offer that was received in terms with #2.

If the binary is downloaded from somewhere, having the source available 
at the same place counts as #1.

IANAL, but that's how it all boils down for me.  Hopefully that'll help 
someone understand that part a little better.


Brian Davids

Re: GPL violations by wireless manufacturers

[Andre Hedrick]

Horst,

Now stop being rational and using logic, this is all a touchy-feely issue.
First thing is IANAL comes to the surface, and few can say they have a
lawyer and less a team of lawyers.  If you have proof, and filed your
copyright with LOC goto court.  Stop pissing around and making noise.

There are those who can do it.
The rest say they can.

The latter is a BOHA, and the former is serious.

Cheers,

Andre Hedrick
LAD Storage Consulting Group

On Tue, 24 Jun 2003, Horst von Brand wrote:

> "David Schwartz" <davids@webmaster.com> said:
> > > In response to DS:
> > 
> > > > So is a Linux distribution "a whole which is a work based on the" Linux
> > > > kernel? Would you argue that RedHat can't include proprietary
> > > > software on
> > > > the same CD as the Linux kernel? All the software on the CD,
> > > > assuming it's
> > > > Linux software, likewise extends the kernel through a
> > > > well-defined boundary.
> > 
> > > No, definitely not. If that were the case, SuSE and Lindows etc. etc.
> > > would not be able to distribute proprietary software together with
> > > GPL'ed software. The GPL calls this 'mere aggregation':
> > 
> > > "In addition, mere aggregation of another work not based on the
> > > Program with the Program (or with a work based on the Program) on a
> > > volume of a storage or distribution medium does not bring the other
> > > work under the scope of this License."
> 
> > 	But they're not just on the same CD. The additional work extends
> > the Linux kernel and is useless without it (or without something that
> > emulates it).
> 
> Just like Oracle, or Opera, or my sendmail binary, or a lot of other
> stuff. That they would be useless without Linux doesn't make them GPL. The
> GPL is quite clear; the head penguin also clarified that propietary modules
> are OK.
> 
> Now can we please stop this? If there is something to discuss around this,
> it is clearly _not_ kernel development.
> -- 
> Dr. Horst H. von Brand                   User #22616 counter.li.org
> Departamento de Informatica                     Fono: +56 32 654431
> Universidad Tecnica Federico Santa Maria              +56 32 654239
> Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>