Is Sveasoft Violating the GPL?

Ron Harwood writes "First, Linksys was violating the GPL by not releasing their source for their Linux implementation on the WRT54G wireless router and WAP54G access point. When this was rectified, third party firmware started showing up. Well, now it looks like Sveasoft (one of the third party developers) has decided to restrict access to their modified source code to subscribers - that also will need to pay $49 for a CD rather than being able to download it." The thread summary at DSLReports only makes it clear that this is all very complicated.

GPL

[mfh]

Say it isn't so!

The thread summary at DSLReports only makes it clear that this is all very complicated.

There's nothing complicated about this. It's all smoke.

Sveasoft can track the subscribers who redistribute their binaries by attaching some kind of tag to each firmware binary (as demonstrated by the different MD5 sums found so far). This makes sense, considering Sveasoft thought TheIndividual was someone else at first. Arno Nym has done some work to try to find what the unique identifier is. It is unknown wether this is allowed under the GPL.

This is not allowed under the GPL.

Neither subscribers nor non-subscribers have any right to future code Sveasoft has not yet released. It is "his" code, and he can choose not to distribute it. But once he does distribute it, wether publicly or privately to his subscribers, it is under the GPL and is free for *anyone* to redistribute.

Not true. If he made his code using a GPL base, it's not his property exclusively. Fruits of the tree become trees of the fruit.

Sveasoft has changed their minds about offering the source code as a free download, and now only offers it on a CD sent through the mail for a price of $50. This seems to be a violation of the GPL, but we need to hear back from the FSF about that.

Total violation. Off with their heads.

Sveasoft has accused several people of "pirating" the Sveasoft pre-release firmware and posting it online illegally, and has had websites shut down because of this. This is unbelievable considering Sveasoft says they allow this (see above).
Sveasoft is also ending the subscriptions (but refunding their money) of people who have posted their MD5 sums of the binaries. It says nowhere in the subscriber contract that they can't do this.
There have been a couple of nasty e-mail exchanges between forum members (TheIndividual, joakimsen) and Sveasoft. Sveasoft acts almost holier-than-thou (IQ 170) and seems to think the GPL doesn't apply to him [disclaimer: my personal opinion].
Sveasoft is now charging $50 for the source code, which is just rediculous considering it costs almost nothing to distribute it over the internet.

Now this reminds me of the SCO, but on a much smaller scale. Microcosm as Macrocosm, I guess.

People: don't use GPL code if you can't RTFM.

Lawyers win

[Puls4r]

There is no way out of this cycle. The lawyers will be getting rich, the "small" guys will still not have the $$$ to protect their GPL licenses in court, and the circle will continue, albeit viciously.

Not a violation

[CptChipJew]

Nowhere in the GPL does it say they HAVE to offer their software as a free download on the Internet.

Furthermore, they are allowed to sell disc media based on "cost of materials". Yes 49.99 is a bit exorbitant, but well within their rights.

This is why I've always felt the GPL needs to either be replaced or improved. Downloads on the Internet ought to be a requirement, as all GPL'd software involves an advanced enough audience that knows how to download software.

Actually

[Sycraft-fu]

Everything was fine, up until they tried to prevent peopel from redistributing code. Last I checked, you had to pay to get the binary AND the source code. Nothing in the GPL says you have to give out the source, or binary, for free. It says that if you give out a binary, you have to give out the source. So you are free to charge for your software, but the source had better be on the disk as well (or available on the web).

Where they cross the line is in trying to stop people from distributing modified version. Nope, sorry, can't do that. That's the "viral" part MS complains about. Even if your product costs money, someone is free to make their own version that does not for free, the GPL gaurentees that.

This is really the thing that commercial companies worry the most about. Source distribution, though generally not done, isn't a big threat to most of them. The threat is then that with that source people are allowed to make their own versions of the product for free.

However, as you said, if you can't deal with the GPL's rules, don't use GPL code. I have no sympathy. The redistribution part is real, real clear.

Re:GPL

[dorlthed]

Sveasoft has changed their minds about offering the source code as a free download, and now only offers it on a CD sent through the mail for a price of $50. This seems to be a violation of the GPL, but we need to hear back from the FSF about that.

Total violation. Off with their heads.

What the fuck are you talking about? This is not even 'a little' violation. There's nothing in the GPL saying that you have to make the source code available through the cheapest way possible, or through the Internet. You are and always have been allowed to charge for the cost of procuring and making the source code available. It's just that they're allowed to redistribute it as well, for free if they want.

Maybe you're the one who needs to RTFM, before you make an accusatory post on Slashdot.

Re:GPL

[black mariah]

This is not allowed under the GPL.

Tracking who you sold the code to, and what they did with it, may be a bit unethical but it is in no way against the GPL.

Not true. If he made his code using a GPL base, it's not his property exclusively. Fruits of the tree become trees of the fruit.

But he's still right. Until you distribute your modifications, nobody has any right to them whatsoever. Read the GPL a few more times.

People: don't use GPL code if you can't RTFM.

Don't comment on the GPL unless you understand it. The only thing that Sveasoft is doing that is even a little bit out of sync with the GPL is the cost of the source, but even that isn't outlined in the GPL. After you get the source, you are free to do whatever you want with it. There is absolutely nothing here that violates either the letter or spirit of the GPL. It is a total lack of understanding of the GPL that makes you THINK there is a problem.

Re:Bounces on the line and kicks up chalk...

[gregmac]

It does say "reasonable cost", so it could be challeneged (likely by the EFF).

Sveasoft could probably justify $49 as being "reasonable". There is the cost of shipping and the media, of course, which isn't very much. But someone also has to burn it. They could very well be charging a normal hourly fee (say $50/hr) to have that person burn the CD. You could also factor in the cost of the cd burner itself (depreciated over x number of copies), or maybe a rental fee for using the burner. They could also being doing the same thing with a system dedicated to burning the CDs.

Although most people will think those claims are rediculus (and I'll admit, towards the end, they are ;) ). But I think at the least it's reasonable to bill out the time someone spends doing it. After all, the more time someone spends burning a CD, the less time they spend programming or otherwise making money for the company -- why NOT bill it out?

Now, that all said, $100,000 would be a bit extreme. While proving $49 is "reasonable cost" with the above arguments might stand up in court, I think you'd have a hard time saying your hourly fee is $500,000 or that you really REALLY needed that Sun Fire server to handle the burning.

Re:Actually

[mfarver]

Everything was fine, up until they tried to prevent peopel from redistributing code.

I do not see any evidence they are trying to prevent people from redistributing the code. The Seavsoft follks see to be upset about other sites that make the seavsoft binaries available without the source.

I just logged into seavsoft's site and as a paying licensee I can still download both the binaries and the source. Sveasoft is doing nothing wrong. as far as I can tell (and in fact already has a letter from the FSF blessing their business model).

The sites that have reposted the seavsoft binaries without offering source are violating the GPL... Now its probably not Sveasoft's place to go after these guys but OTOH the violators are trying really hard to piss off Sveasoft.

Sveasoft is using the GPL in a creative, but legal way. Put this way: if you pay them for a license you get access to prerelease binaries and sourcecode. You then have a choice of licenses: you can choose to continue to follow the Seavsoft license, which will get you access to future revs of the code, or you can redistribute under the terms of the GPL which results in termination of the Seavsoft license and access to future revs.

Mark

Re:Bounces on the line and kicks up chalk...

[Spy Hunter]

Yeah, but by that logic they could just make the source avaliable only on special solid platinum CDs hand-carved by tibetan monks and charge three billion dollars each. Sure, it's the actual cost of distribution, but it's not reasonable. An FTP server would do the job for at least three orders of magnitude less money and be more convenient for everyone to boot. I don't think a judge would be impressed by that argument, even if it doesn't exactly violate the letter of the GPL.

Re:NOT violating the GPL

[zaxios]

Just because Sveasoft is responding to someone who redistributes their source code in a tit-for-tat fashion doesn't mean this source code distributer is being prevented (in a legal sense) from releasing the code.

Right. Terminating accounts is probably not, in a legal sense, preventing people from redistributing. But Sveasoft is also shutting down servers (in an unspecified way, presumably not DDoS) that are hosting the code. Their attempts to prevent redistribution go beyond just denying access to their service.

Put another way, if you sent some modified, half finished code you were working (whose origins were under GPL) to some friends for comment, would you want it released to everyone? Probably not. You'd want their feedback and then an opportunity to fix it up and then release it when it's good and ready.

Two points. Firstly, it doesn't matter if, once you have in any form released the code, you decide that you don't want it released. It's out there. You can't cherry pick your GPL clauses. Secondly, that sort of development really misses the point of OSS, in which source is usually available throughout the dev cycle so people can improve it before its final release - not that breaching the Open Sourced spirit grounds for litigation, mind you, but it's worth noting.

This is over the line

[DDumitru]

The GPL says that if you receive the code, you are free to redistribute it under the GPL. This policy does not allow you to "freely" distribute the code.

Consider a hypothetical license:

If you agree not to redistribute the package under the GPL the software
costs $50.

If you violate this agreement, the package costs $50,000.

The real problem here is that Sveasoft is not distributing the code under the GPL but instead under the GPL and under their license. This "combined" license is a modification to the GPL, which they cannot do.

The part of the GPL that is violated is: ... You may not impose any further restrictions on the recipients' exercise of the rights granted herein. ...

While you can argue that terminating a "subscription" is not a restriction on rights. This is just wrong. If you get the code, you are free to do anything with it you want under the GPL. Except in this case, if you actually re-distribute the code, you are penalized for availing yourself of your rights.

If the FSF stated that their subscription policy was *not* a violation, they are wrong. Penalties for re-distribution is clearly a license restriction.

Hopefully, some group with actual copyrights (like the iptables people) will declare this policy in violation of the GPL and demand that Sveasoft stop.

Re:I believe that GPL is pretty clear on this

[lordcorusa]

Under the GPL you are only entitled to the source if you got the binary. I would assume that once your subscription gets canceled, you will be unable to get new binary updates and hence you have no right to the source for those updates.

Re:I believe that GPL is pretty clear on this

[Anonymous Coward]

Uh, no. The GPL doesn't say anything whatsoever about subscriptions. You get the right to receive and redistribute the source for the version you have received in binary form. That's it.

You enter into a separate contract with Sveasoft to receive support and they can choose to nullify that contract if you have exercised your right to redistribute the source. Nothing prevents you from taking what you've gotten, forking it and doing whatever you want with it. You just can't do that and continue to get support from Sveasoft.

While it bends the spirit of the GPL, it's arguably within the letter of the GPL.

There's nothing to stop 100 people from unofficially pooling money to pay for subscriptions and each time a new version comes out, one of those people gets the update, nullifying their support contract, and then continue to help support the others still getting their subscriptions.

Re:I believe that GPL is pretty clear on this

[black mariah]

Sveasoft cannot refuse source access FOR THOSE WHO HAVE OBTAINED A BINARY FROM THEM.

Agreed, and entirely correct.

Refusal to pay for a subscription is not a valid reason for restricting source access (once binaries have been sold).

Agreed again. To a point.

Consequently the GPL implies that every binary bought from Sveasoft must come with a free subscription to the source code.

Incorrect. The GPL doesn't imply anything, it spells it out in a relatively clear manner. Yes, if you buy the binary you must be provided, in some way, with the source code. The single incorrect word in your statement is *subscription*. You are not entitled to future revisions of the code. At the time that you buy the binary, you are entitled to the code *FOR THAT VERSION*. The is absolutely no implication that you are entitled to future versions of the software. This may be a loophole, it may be structured like this. I think it's the former, because even as much of a loon as I think Stallman is, I don't see him leaving a gaping wound like that in the GPL by accident.

Sveasoft are not free to cancel this subscription if the source is redistributed.

Ah, but they are. Your subscription comes with a Terms of Service. Their ToS states that the code for the 'release' binary you are given can be distributed all you want. However, distribution of the 'pre-release' version is grounds for termination of your subscription. You don't have to give the code back, you don't lose your rights under the GPL to distribute the code in the future, you simply are no longer a subscriber to their service. This is not a restriction on the software, it is a ToS agreement.

Re:Bounces on the line and kicks up chalk...

[dachshund]

Yeah, but by that logic they could just make the source avaliable only on special solid platinum CDs hand-carved by tibetan monks and charge three billion dollars each.

Accompany it with a written offer ... to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed ...

on a medium customarily used for software interchange

You're right. I doubt that you'll find a judge who'll accept your argument that a sold platinum CD hand-carved by Tibetan monks represents any sort of "medium customarily used for software interchange."

Re:Bounces on the line and kicks up chalk...

[hazem]

he GPL only kicks in when you DISTRIBUTE your modifications.

My thoughts exactly. Now suppose someone like Sveasoft wants to have beta testers of their product, and to become one, you pay $49. You're now part of the club and maybe could be considered part of the organization.

So, they send you binaries to test. Are you considered internal to the organization now? Or is this an external distribution? If it's the former, they may not have to give you the source at all. And if they do give you the source, they could "kick you out of the club" if you chose to distribute that source that is in beta form. If it's the latter, then what actually constitutes "in-house" vs a public distribution?

This issue will be of interest to many businesses considering working with FLOSS as part of their business model. Many could be uncomfortable with not-quite-finished versions of their software gaining world-wide distribution, especially when their name is attached to it. By forcing them to distribute source to their beta-versions, they really lose the ability to beta test with any more people than are actual employees. Losing beta testing could be a factor to decide against adopting FLOSS.

On the other hand, by allowing beta "in-house" distributions, there is the risk of being perpetually in beta. Here, if someone wants the software at all, they put their name on a web form to become a "member". The software never exits "beta" and they never have to distribute their source code changes.

Re:NOT violating the GPL

[Eric Smith]

Sveasoft are terminating the accounts of those that redistribute source. This seems like an attempt to prevent people redistributing source, which I understand to be illegal under the GPL

They are not "imposing any further restrictions on the recipients' exercise of the rights granted herein." (section 6 of the GPL). Terminating a subscription does not affect those rights in any way. They even got confirmation of that from the FSF.

They could also say that if you redistribute their version, they will use a voodoo doll to place a curse on you, and that wouldn't violate the GPL terms either. Both actions are entirely outside the scope of the GPL.

Re:NOT violating the GPL

[Eric Smith]

Then the GPL applies to recipients of the binaries. Only those third parties involved need apply.

Not necessarily. The old Sveasoft model was that customers paid $20 for a subscription, and got access to binaries "accompanied by" sources (both on the same download server), thus satisfying section 3a of the GPL.

Their new model of only providing sources to people who pay $50 apparently is an attempt to rely on section 3b of the GPL instead. Section 3b, however, requires that the source code be made available to "any third party", not just the party to whom they have distributed the binary.

Sveasoft has stated that they will only sell the $50 source code disc to customers who have bought the $20 subscription. This seems to violate the "any third party" requirement of section 3b.

Re:Actually

[renard]

You have all the rights that the GPL gives you. They are asking you (using a stick) not to exercise them.

And that's against the GPL. It's not your right if someone can retaliate against you for exercising it. Think about free speech: "Sure, you can call the President an idiot, that's your right. But if you exercise it, the police here will throw you in jail."

But you still do have all those rights (and a few more).

They are free to grant you more rights. They are not free to restrict your GPL-approved actions in any way, shape, or form. And that includes the retaliatory measures discussed above.

-renard

Re:Actually

[zurab]

Firstly, Like QT, it is under a dual-licence.

It cannot be, because it's not all their code. If it was all their code, they could offer it under 100 different licenses and nobody would care.

GPL controls

distribution, not use. Now, you can have the software distributed to you under the terms of sveasoft ... [emphasis mine]

This, in and of itself, is already a GPL violation: Sveasoft cannot redistribute the software under their own license; no matter what "goodies" they offer you in return.

GPL requires that modifications be redistributed under GPL also - this does not mean it's OK to offer them under different licenses as long as you get your users to agree to something different.

Re:I believe that GPL is pretty clear on this

[atallah]

You are missing the point.

There are no additional restrictions to the GPL code.

As a subscriber (for a fee) you may have access to GPL'd binaries and source.

If you redistribute the binary, you must also make the source available (under the GPL). However by doing so, you nullify the subscriber agreement. This has no effect on any binaries & source that you have downloaded so far; those are still licensed to you under the GPL. The only effect that the termination of the subscription will have is that you will no longer be able to download binaries from Sveasoft.

GPL code does not mean that "i have the right to have it", it only means that if you give/sell the compiled code to me, you must also provied the source.

A similar example would be RedHat terminating your up2date account because you violated the terms of service. It is irrelevant that up2date was downloading GPL binaries - you just won't have access to their mechanism for providing them.

Re: who distributed the binary

[some guy I know]

attaching some kind of tag to each firmware binary

OK, then, don't redistribute the binary; just redistribute the source.
(Get together with another subscriber and compare source first, to see if any "tags" were placed in the source, too.
It should be much easier to remove the tags from the source code than from the binaries.)

Re:I believe that GPL is pretty clear on this

[Spy Hunter]

While the spirit of the GPL may see it as a restriction, the letter probably does not.

Well, we are getting into pretty philosophical territory here. You're right, I could see a judge going either way on this. But don't think the GPL just ignores other contracts that might conflict with it; section 7 of the GPL deals quite nicely with this issue. If you have signed a contract that makes it impossible for you to satisfy the GPL's conditions (such as not restricting redistribution), you cannot distribute the software at all. Just because the restricting clause is in a different contract doesn't excuse you from complying with the GPL.

Re:I believe that GPL is pretty clear on this

[rking]

"Sveasoft cannot refuse source access FOR THOSE WHO HAVE OBTAINED A BINARY FROM THEM."

Agreed, and entirely correct.

Agreed, entirely correct but INCOMPLETE.

The GPL section 3 requires that they either provide source along with the binary (in which case you don't need to purchase a separate source code CD to redistribute it) OR they must accompany their binary distribution with a written offer valid for at least three years, to give any third party, for a charge no more than their cost of physically performing source distribution, a complete copy of the source code (in which case they can't restrict it only to subscribers).

I'm not sure which path you're claiming they followed. It looks to me like they're in breach either way.

Re:This is all misleading...

[Anonymous Coward]

When they say "if you redistribute this code, your subscription is cancelled", they are placing an additional restriction upon redistribution, and thus violating section 6 of the GPL

Not so. Read the sentence you put in bold again, paying particular attention to the phrase at the end:

You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

The GPL doesn't say that you cannot have restrictions of any kind, only that they cannot restrict the rights granted by the GPL. Where in the GPL does it say that it gives you the right to get future binary releases from a distributor? It doesn't. Thus, the ending of someone's subscription is not a restriction of any rights granted by the GPL.

But they don't have the right to prevent people from distributing it.

Fortunately they aren't. They aren't preventing it nor are they restricting it. You are free to redistribute the code you received to your heart's content--modified or unmodified, as you desire. Everyone you distribute it to has those same GPL rights. The only thing that is being restricted are non-GPL rights, and doing that does not violate the GPL.

Re:I believe that GPL is pretty clear on this

[duffahtolla]

I bought the WRT54G just 2 months ago with the expectation that I'd be able to download QOS firmware for free without any hassles

That article you mention has a link that pointed to Satori_v2_2.00.8.7sv-pre1.bin.zip as having QOS. Note that this is version 2.0 so I'm guessing QOS has been in the firmware for quite sometime.

On this page they list links for both binaries and source for Satori v.4.0

http://www.linksysinfo.org/modules.php?name=Downlo ads&d_op=viewdownload&cid=8 [linksysinfo.org]

This is the PUBLIC version which sveasoft has realeased for FREE.

Are you saying that only the latest, pre-release firmware will satisfy your needs? Are you saying that they removed QOS in laster versions and are only releasing it to subscribers? Otherwise, I just don't understand why you are slamming Sveasoft when they have given you what you wanted for free.

Re:Bounces on the line and kicks up chalk...

[rjstanford]

On the other hand, by allowing beta "in-house" distributions, there is the risk of being perpetually in beta. Here, if someone wants the software at all, they put their name on a web form to become a "member". The software never exits "beta" and they never have to distribute their source code changes

This is a very good point. There are a lot of parallels between it and the "private club" drinking rules in some parts of the South. Basically, there are still cities that are so dry that you're not even allowed to serve alcohol with dinner. However, there's an exemption in there for "private clubs". So basically everywhere is a "private club" which offers a free, simple membership to its guests. Convenient and legal. The kind of "internal beta program" you describe sounds awfully similar from a legal standpoint.

Back to the private clubs, there's even an organization (called Unicard) which came up and allows you to join it, which then provides you with "reciprocal memberships" at almost everywhere. Saves you from having to carry around a stack of membership cards.

Something similar could easily happen here - have a "BetaTestClub" come up, and contract (completely legally) with software firms to provide confidential software testing. It could recruit unpaid "testers" from everywhere via its website, and allow you do download software to test. Since the software would be officially unreleased (and you could have some nastyRestrictive contracts between the BTC and the corporations involved), the corps wouldn't be forced to release their code mods to anyone.

Hmm.

Re:I believe that GPL is pretty clear on this

[Anonymous Coward]

If by now you still can't see how that is a loophole through which the entire GPL will someday be sucked and turned inside out, there isn't really much left to convince you, short of letting it happen.

Here's my take on it: Cringely is wrong, and why he thinks it's OK to completely ignore the threats and harassments with which James Ewing answers exercise of GPL rights (that's where the GPL violation is, folks!) is beyond me.

The Open Source "community" must defend itself against people who have repeatedly made it very clear that they have no intent whatsoever to allow people to reuse their code. If Cringely puts himself in bed with people who do that, I think I'm going to ignore him from now on.

This issue has convinced me to never again publish code under an unmodified GPL license. I will not have my code proprietized by some asshole who thinks its ok to take it from me for free and make a living of threating those who want to reuse his modifications.