News Blog

I'm out at JavaOne in San Francisco this week and one discussion I've heard popping up with some regularity is, "Do we need to do something to protect open source in a cloud computing world?" I've written about aspects of this topic at length previously. However, given that this is an area that is buzzing up a bit, I thought it would be useful to boil down the key issues and give my personal take.

The nub
Copyleft licenses, such as the GPL used for the Linux kernel and the majority of other open-source projects, require that the source code for enhancements and other modifications to GPLd code be made available to the commons if the modified software is distributed. Distribution is the key here. If the modified code is only used within a company, that's not distribution. Germane to our purposes here, neither is access to services provided by that code over a network. In other words, offer access to a CRM or content management system built from a GPL foundation solely in the form of a hosted service and there you can make any proprietary changes or extensions you like and there's no requirement that you make the source code for those available.

A loophole?
Some view this as a simple loophole to be plugged. The GPL was originally written very much within the context of Unix programmatic and operating system interfaces. Therefore, the reasoning goes, the only reason the GPL didn't encompass access via Web services is that there were no Web services--at least in anything like their current form--when the GPL was created. That the new GPLv3 specifically doesn't address this "loophole" either was more a matter of practicality than principle by this view.

And, in fact, one approach to eliminating this loophole is a straightforward enough approach. The Affero GPL is a straightforward extension to the GPLv3 license that essentially expands the definition of distribution to encompass the delivery of services over the network.

Questionable assumptions
My take is that the "cloud computing as loophole" school of thought rests on some questionable assumptions.

The big implicit assumption is that without adequate license protections, corporations will strip mine open source and the entire communal development process will just wither away over time. A favorite proof point in favor of this argument is how Linux (which uses the copyleft GPL license) largely triumphed over BSD Unix (which predates Linux and was more capable early on, but which uses a far more permissive license that doesn't place any restrictions on proprietary extensions or use).

However, BSD has a lot of problems as an exemplar. Early BSD development was mired in all manner of fractious argument between distributions (before they were called that) and, certainly not least, a prolonged legal battle with AT&T, which owned the Unix copyrights at the time. It is, therefore, an open historical question whether the GPL was the magic ingredient that led Linux to success or whether all manner of legal, community, and timing matters weren't ultimately much more important. And, in support of the contrary view, I'd note that Linux aside, some of the most important open-source projects--such as Apache--do use BSD or BSD-like licenses.

Even more fundamentally, I see more than a little contradiction when some of the strongest open-source advocates argue that open source needs licenses that protect it thoroughly. After all, if open source truly is a superior model for development and adoption, aren't companies that go down the proprietary path only hurting themselves?

Practical problems
Finally, I see extending the concept of distribution to cover Web services as problematic from a practical perspective. Distribution in the GPLv2 and GPLv3 licenses draws (mostly) a hard-edged line. If you're an enterprise using software internally, anything goes. If you're using GPL code in software you're selling to the public--whether downloaded, on a CD, or in embedded firmware--you must make the relevant sources available. However, as more and more companies of every stripe make parts of their computing infrastructure available to their customers--think online banking, for example--where does it end? The boundaries become very fuzzy--which would inject lots of uncertainty into just about any use of open source in an enterprise environment.

Ultimately, as folks such as Tim O'Reilly and Simon Phipps have discussed, there are many other issues of "freedom" in a cloud computing world. Matters of data portability and privacy for example.

For my part, I'd argue that open source has demonstrated that it can stand on its own without heroic measures to prop it up. Sure, continue to evangelize the benefits of open source and maybe even take a stick to any gross violators. But the more interesting, and important, questions lie elsewhere.

A couple weeks ago, the Linux Foundation released a podcast interview with Linus Torvalds that, among other topics, touched on if or when Linux would "upgrade" from the GPLv2 license to the new GPLv3 version that was approved last year after much acrimony. Allison Randal's summary over at O'Reilly Radar seems about right: "In the end, what we have is a stable system by reason of inertia. It may eventually shift, but not anytime soon."

One major reason is that Linus just doesn't see any compelling reason to make the shift--which is to say that he doesn't see any particular advantage to Linux at this time. That said, he's indicated the relicensing of OpenSolaris under GPLv3 could persuade him to make such a move. (Sun Microsystems floated such a move as sort of a trial balloon but it was shelved--at least for a bit--because of vocal objections from the OpenSolaris community.) In other words, if shifting Linux to GPLv3 would give Linux access to code that it wouldn't otherwise be able to use, that could be interesting. On GPLv3--as on many other matters--Linus is a rather pragmatic individual. Truth be told, far more pragmatic than many of the other highly visible personalities around open source.

Thus, don't expect Linus to push Linux toward the GPLv3 for philosophical reasons. Indeed, he's objected loudly to the GPLv3--although his more recent rhetoric has calmed--precisely because it essentially makes philosophical judgements about allowable uses (especially Digital Rights Management) that have nothing directly to do with code.

However, in the wake of this interview, a meme was also making the rounds that it would be difficult from a practical and legal perspective to move Linux over to the GPLv3. At issue is that Linux (as in the Linux kernel) is licensed under GPLv2. Some GPL’d software is licensed under the terms “GPLv2 or later,” but not Linux itself. Furthermore, contributors to Linux do not assign their copyrights to some other controlling entity--as do, for example, contributors to the Free Software Foundation’s GNU project. Thus, the logic goes, relicensing Linux under GPLv3 would require getting agreement from hundreds of contributors or more--and, perhaps, even having to rewrite code submitted by people who don't agree to the shift or who couldn't be contacted.

I'm not a lawyer and have no legal opinion on this, but I wanted to point out that Eben Moglen discussed this situation at the Red Hat Summit last May. While certainly not a definitive opinion, as the former general counsel for the Free Software Foundation that created the GPL, Eben's voice surely carries some weight. As I noted in a piece I wrote at the time:

From Eben’s perspective, “My guess is that Linux is a collective work…as evidenced by a decade of LKML [the Linux Kernel Mailing List] discussions. That’s my guess.” So, while it remains very much an open question whether Linus (and the other lead kernel developers) would want to make the move to GPLv3, it’s unclear that there are any fundamental roadblocks (such as having to get explicit agreement from every person and organization who ever contributed to Linux) should he choose to do so.

To be sure, the answers to legal questions are often ambiguous; as Eben also noted, there are alternative theories that could play here as well. However, if Linus and the other key kernel developers were to back a shift to GPLv3, and if there were reasonable legal air cover from respected Open Source authorities for doing so, it seems unlikely that we'd see a substantive challenge to such a move. Oh sure, there would be loud hand-wringing over at Debian and in other forums--this is open source after all. But, as a practical matter, I'd expect any "controversy" to blow through pretty quickly.

I think that Alfresco's Matt Asay and I share some of the same concerns about the current spate of lawsuits that BusyBox and the Software Freedom Law Center (SFLC) have been busily filing. On the one hand, open-source developers have to protect their rights. However, as Matt notes:

My primary concern is that this (and the other two ongoing BusyBox lawsuits) will create more misunderstanding about the requirements the GPL imposes. It won't be helpful to have this result in less GPL-licensed software being adopted.

Put another way: if using GPL software comes to be seen as an invitation to get sued, fewer people will use GPL software. Whether individual enforcement actions can be justified isn't really the point. It's whether, collectively, copyleft-style licenses (including the GPL) start to look more legally risky than beneficial. CNET.com's Stephen Shankland took a look at SFLC's increasingly hard-line approach to license enforcement in "GPL defenders say: See you in court."

The latest BusyBox lawsuit against Verizon seems especially problematic.

Essentially, Verizon distributes Actiontec MI424WR routers to its customers for its Fios Internet service. It's unclear to me whether the device is sold or loaned or given away as part of the service; perhaps it's different by geographical location as I've heard conflicting experiences. In any case, the router is an integral part of Verizon's service. The routers use firmware that contains a variety of GPL software including BusyBox, a set of small versions of many common Unix utilities combined into a single executable.

The crux of the complaint is that Verizon allows its customers to download the router firmware from Verizon. Thus, although Actiontec apparently provides source code as required by the GPL on its own Web site, Verizon does not. It's also unclear whether the Verizon firmware is identical to Actiontec's and, if there are differences, whether they are relevant to the GPL or BusyBox. Regardless, the complaint focuses on the fact that Verizon offers firmware binaries for download without offering the corresponding source code; it makes no mention of Verizon distributing the binaries for a unique version of BusyBox.

Because Verizon is distributing firmware binaries without an offer of source code, this would, in fact, appear to be a violation of the GPL.

But it seems a rather picayune and hyper-technical one--especially if the Verizon firmware uses the same BusyBox code that is already available on the manufacturer's Web site.

It seems only a small step from this case to others that would raise some real concerns about using open source. I'm not a lawyer and draw no conclusion about whether these different sets of facts could trigger GPL violations or not. I merely note that they're close enough to the Verizon case that fine legal parsing would be needed to distinguish them.

• What if the entity distributing the routers was less clearly an OEM and more of a conventional retail outlet or electronics distributor? Presumably Best Buy doesn't today have to offer open-source source code for all the products that it sells, but what if it were to offer downloads to drivers and such as a convenience to customers? Could it run afoul of the GPL in the same way as Verizon?
• And why exactly does it matter whether the software binaries are being offered for download anyway? Even if they're just burned into flash inside the device, how is that different?
• OK, you say. So long as the hardware device comes with a piece of paper of whatever pointing the user to some source code download location at the original manufacturer's Web site, there's no problem. I guess that means that stores need to be careful about selling products in OEM packaging (i.e., not retail boxed). How would Micro Center even know whether some unboxed Seagate drive they're selling uses GPL code in its firmware or not?

To my non-lawyer (but reasonably open source-educated) eyes, these cases aren't clearly unique from that of Verizon. And, if they can't be clearly distinguished, they suggest scenarios that would be troubling to a lot of vendors making use of GPL software.

(Throughout this post, I've used the generic term "GPL." The new iteration of the license, GPLv3, includes some specific language related to end-user hardware devices that may or may not be relevant in this context. In any case, the reality is that the vast bulk of existing GPL software still uses the GPLv2 version.)

The Software Freedom Law Center on Friday said it has filed a suit against Verizon Communications alleging that it has violated the terms of the General Public License, which governs the use of thousands of free and open-source software products.

The suit is the fourth that the SFLC has filed on behalf of two programmers who wrote BusyBox, a software utility package covered under the GPL. BusyBox is typically embedded in hardware devices that use the Linux open-source operating system.

The move reflects a more aggressive stance that the SFLC, which provides legal counsel to free and open-source developers, has taken this year.

Verizon distributes a wireless router made by Actiontec Electronics to customers of its Fios fiber-optic broadband service.

The router uses the BusyBox software, and under terms of the GPL, Verizon has to make the source code available to people who use the device, according to the SFLC suit (PDF).

The first suit alleging misuse of the BusyBox software, which the SFLC filed in September of this year, was settled quickly. The SFLC also sued Xterasys and High-Gain Antennas in November.

The Software Freedom Law Center (SFLC) said it has filed suit against two companies for allegedly violating the General Public License, which covers usage of Linux and thousands of other free and open-source products.

The suits are the second and third time that the nonprofit foundation has filed suit, signaling a willingness to use the court system to enforce the GPL.

The plaintiffs are two programmers--Erik Andersen and Rob Landley--who wrote BusyBox, software covered by the GPL version 2 often used in conjunction with the Linux operating system in embedded devices.

The suit was filed against Xterasys and High-Gain Antennas; both companies manufacture wireless communications hardware.

The SFLC said it had contacted the two companies to notify them about the alleged violations but were forced to file suit because they received no response.

In October, it settled a similar case with Monsoon Multimedia filed on behalf of the same plaintiffs over use of the BusyBox software.

Under the terms of the GPL version 2, people who make additions to software covered by the GPL have to make the source code of that program available.

"We let companies do what they like with BusyBox on their hardware, and what we asked in return was that they let us reproduce what they've done with BusyBox on our hardware. That's the deal embodied in the GPL," said Rob Landley, in a statement.

Consumer electronics maker Monsoon Multimedia said Monday it intends to comply with the terms of the General Public License version 2--used in Linux and countless other open-source programs--to try to settle a lawsuit filed last week.

The Software Freedom Law Center, which provides legal services to free and open-source software programmers, announced on Thursday a suit against Monsoon Multimedia. The lawsuit claims that Monsoon violates the terms of the GPL because it does not make the source code used in its Internet video device available.

Specifically, the company includes software from BusyBox in its product. BusyBox is a set of Unix utilities used in embedded systems and licensed under the GPL version 2.

On Monday, Monsoon Multimedia said that it will make the appropriate BusyBox source code publicly available on its Myhava Web site "in the coming weeks."

"Since we intend to and always intended to comply with all open-source software license requirements, we are confident that the matter will be quickly resolved," said Graham Radstone, CEO at Monsoon Multimedia.

The case had caught the attention of the software industry because such a lawsuit--if not settled--could test the enforceability of the GPL.

The Software Freedom Law Center said Thursday that it has filed a copyright infringement lawsuit against a consumer electronics company, Monsoon Multimedia, for allegedly violating the license that governs the use of the Linux operating system.

This is the first case filed in the United States against a company for allegedly not complying with the terms of the General Public License (GPL) version 2, according to the SFLC, which provides legal representation for free software projects. The GPL is used by Linux and countless other free and open-source software programs.

The suit was filed on behalf of the creators of BusyBox, a set of Unix utilities used in embedded systems and licensed under the GPL version 2. (Click here to see a PDF of the complaint.)

Under the terms of the GPL version 2, people can use GPL software within their own products. But when they redistribute that software, they must make the source code available.

A request to see the source code used by Monsoon Multimedia came up in a discussion forum, but a request sent by the SFLC to the firm was not answered, according to an SFLC representative.

Representatives from Monsoon Multimedia, which makes digital consumer devices for viewing video on the PC or TV, did not comment on the suit on Thursday.

The plaintiffs in the case are Erik Andersen and Rob Landley, who hold the copyright to the BusyBox software. They are seeking damages and an injunction.

The Free Software Foundation has made many efforts over the years to enforce the license, but typically has taken a much lower-key approach. A programmer in Germany, Harald Welte, has been more aggressive, though, in a case that was settled.

Linux is widely used inside consumer electronics devices, such as the digital video recorder TiVo and those that Monsoon Multimedia makes.

(Credit: Zim Rent-a-car)

I read this Charlie Babcock (InformationWeek) interview with Peter Levine (CEO, XenSource) and Wes Wasson (corporate VP of worldwide marketing, Citrix), and I'm left with the feeling that XenSource really doesn't see Xen's future in open source, but rather in Windows.

Which makes me think it may be time to fork the project and move on. But then, the company already did that for us, didn't it?

Apple has acquired the source code for CUPS, an open-source project for managing printing on Unix and Linux systems.

Michael Sweet, CUPS author and an owner of the company Easy Software Products that owned the CUPS software copyright, said last week that Apple hired him and acquired the copyright in February.

CUPS, which stands for the Common Unix Printing System, will continue to be released under the General Public License (GPL) and Lesser GPL (LGPL) licensing terms. However, Apple has an exception from the terms of the license.

"Software that is developed by any person or entity for an Apple Operating System...that is linked to the CUPS imaging library or based on any sample filters or backends provided with CUPS shall not be considered to be a derivative work or collective work based on the CUPS program and is exempt from the mandatory source code release clauses of the GNU GPL," according to the CUPS list of frequently asked questions. "This exception is only available for Apple OS-Developed Software and does not apply to software that is distributed for use on other operating systems."