Slashdot Log In
Linksys and the GPL, Again
Posted by
michael
on Thu Jul 31, 2003 09:57 AM
from the unclear-on-the-concept dept.
from the unclear-on-the-concept dept.
Rob Flickenger writes "While poking around on the Linksys WRT54G (one of the new Linux 2.4.5 based APs) at a SeattleWireless Hack Night session, we noticed a number of binaries in their firmware (including Zebra, PPP 2.4.1, and iptables to name three) that are released under the GPL, some of which are obviously modified. The question is, where is the source code to Linksys' modifications? Their "GPL Code Center" has the packages, but they are the pristine distributions, without any changes whatsoever. I've asked Linksys for clarification, but given Linksys' customer service reputation, I highly encourage other interested parties to ask them as well. More details are up on my weblog on oreillynet.com."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
How does Cisco relate to this (Score:5, Interesting)
Re:How does Cisco relate to this (Score:5, Interesting)
Parent
Not GPL Violation-RTFC (Score:5, Interesting)
Also, the claim that Broadcom may need to release their source also seems to be in error due to the fact that their modified GCC has not been publicly released, and the only one that can claim the right to examine said source code of the GCC modifications is Linksys.
RTFA-and the comments that follow...
Parent
Re:Not GPL Violation-RTFC (Score:4, Informative)
Parent
Troubling. (Score:5, Insightful)
Is this going to chase away companies adopting Linux for use with their products?
Re:Troubling. (Score:5, Insightful)
Parent
Re:Troubling. (Score:5, Insightful)
Under GPL, you basically have your hands tied. You can't legally modify and use the code withouth submitting them back, and you can't really submit back the changes because they are usually hacks to get it to work how you want (not "improvements" on the code).
That's incorrect. The GNU GPL does not require you to submit anything back to the project you modified. However, the source code is under the GNU GPL, and the GNU GPL does require you to make that source code available if you redistribute the program. Check section 3.
If you make changes (even a hack to get something to work right on your hardware, or even to correct someone's spelling mistake in an error message), those changes are also under the GNU GPL, and you are similarly required to make that source code available if you redistribute the program.
I work on several open source / free software projects, including the FreeDOS Project [freedos.org]. I've dealt with companies who use and redistribute FreeDOS and forget to provide the source code. Usually, all it takes is a friendly note: "hey, you forgot to make the source code available ... see section 3 of the GNU GPL ... here are some ways to do that." If the email is not harrassing ("show me the source or I'll sue your pants off") or intimidating ("you are so lame, why didn't you include the source?") the company will correct it and make the source code available as soon as possible.
The key thing to remember here is not to be an asshole to Linksys/Cisco. If they didn't provide the source code, just remind them what to do, and they'll fix it. If we act like assholes, what kind of message does that send to Linksys/Cisco?
(I'm not suggesting the original poster is an asshole - he's not. But we should be sure to keep our attitudes in check when dealing with Linksys/Cisco.)
-jh
Parent
Re:Troubling. (Score:5, Informative)
What the hell are you talking about? The original maintainers don't have to accept your patches in order for you to be able to distribute binaries. Just make whatever changes you want, no matter how trivial, and then make sure to distribute the source right alongside the binaries (have a link to the source on the same page that links to the binaries, or put the source and binaries on the same CD, etc). You don't have to care what the original author thinks about the changes you've made. You just have to distribute the source.
Better yet, if the changes you're making are for "internal use only", then you don't even have to distribute the source, simply because you're not distributing binaries (you don't see Google/Amazon/whatever falling over itself to give you it's source code, do you?).
Parent
Re:Troubling. (Score:3, Offtopic)
Why use something GPL'd when you can use *BSD that has little or no encumbarance like this?
Or am I missing something here?
(Note: I'm a Debian bigot - not a *BSD one)
Re:BSD (Score:5, Insightful)
Parent
Re:Troubling. (Score:5, Insightful)
Companies that don't play by the rules shouldn't be using Linux, even if it costs us good driver support, etc. One of the benefits of using the GPL is that it provides a self-protection mechanism to ensure that Linux is not closed off and fragmented into opaque binary distros. If such fragmentation were allowed, you will see exactly the problems you had previously with commercial vendors appearing in Linux products, only multiplied.
Parent
Re:Troubling. (Score:5, Insightful)
In this case, the only evidence AFAICT that the Linksys binaries are based on modified code is that files are installed in non-standard locations, which hardly requires source modification. And, as usual, the complainant hasn't bothered to wait for a response from the company in question. (Atypically, he at least asked.) It's far from clear that we need to go to DefCon 3 over this.
Parent
Re:Troubling. (Score:5, Informative)
>are you talking about the bsd license? do you see this happening with bsd?
If you don't see it, it is probably because the commercial forks aren't called BSD anymore.
Windows notoriously used BSD networking code. Do you suppose the Microsofties contributed their changes back to the code base? So far as we know, no one has forked and closed an entire *BSD distribution, but I would imagine that most of the basics of them have been forked and closed multiple times.
I suppose that you could say that shows that the protections of the GPL are overkill; after all, the *BSD's are surviving quite nicely. You could also say that the GPL gives us tools to prevent anti-social behaviour, and that those tools are being applied to Linksys.
Parent
Re:Troubling. (Score:5, Insightful)
This is FUD. Companies don't support linux because they want to be community friendly. They do it because there is a demand and they want to make money. If they are going to profit from GPL code, then they should follow the terms of the license agreement. It really is that simple.
Parent
Re:Troubling. (Score:5, Insightful)
If a company doesn't like the GPL, what's wrong with approaching the authors and saying 'Look, we can't live with this, can we negotiate some other license?'. Instead dishonest companies break the law, and violate the authors' copyright. If someone did it to them, they would be using words like 'theft' and 'pirate'. It's not playing hardball, it's called common courtesy.
Parent
Re:Troubling. (Score:5, Insightful)
Parent
Re:Troubling. (Score:5, Insightful)
This should be the appropriate line of behavior when you notice a potential GPL violation.
1) Contact the author of the software in question.
They are the ones that have the right to persue a copyright violation, and thus should be the ones to deal with the potential violators, not an angry vigilante. Furthermore, there may be other circumstances which you are not aware of, like if the author is distributing the code in question under a second license. For all you know that "obviously modifed" version was writen by the author himself, so make some money on the side.
2) The author should politely contact the suspect explaining that there is some concern that they might be using his software against the terms of the licence (GPL), and request more information about the situation.
3) The author should check with the good guys at the FSF to make sure he understands all the nuances of the GPL in this situation.
4) If the suspect is not cooperative, the author should then send a more stongly worded letter, stating that the company is in violation of the law. It would be very preferable to hire a laywer to help draft this letter and take a second look at the situation at this point.
5) If the company is still not cooperative, then and only then the author should publicise the violation to the community in the hope that public backlash will cause the company reverse their opinion.
6) As a last resort legal actions should be taken, if money can be had for the trial.
Yes, Linksys has a history of things like this but that does not justify these knee-jerk reactions.
Parent
Re:Troubling. (Score:5, Insightful)
> stories lately where companies that are embracing
> Linux are being carefully scrutinized. Maybe it's
> counterproductive to constantly play the hardline
If these companies were using VXWorks or Windows CE you can be damn sure that they would be required to comply with every detail of the much more complex licenses. Why should they not be required to comply with the GPL? It's not like it's difficult or expensive.
> Is this going to chase away companies adopting
> Linux for use with their products?
Only the ones who think that "Free software" == "public domain".
Parent
DMCA... (Score:4, Offtopic)
Are you sure you're not infringing your countries' laws by fiddling around with the internals of the router
Or is that still legal?
Re:DMCA... (Score:5, Funny)
SlashDork: You're violating the GPL.
Linksys: So, slap me on the wrist. BTW you're going to jail for violating the DMCA.
Parent
Who takes the reigns? (Score:5, Insightful)
If there were people like that around, I would like to see them follow up this case, and those like it.
In the absence of open lawyers, I think a lot of GPL and licensing issues will not be followed up. Without someone to pursue a law or contract, it doesn't really do much.
We've been lucky until now because all the people using GPL software have the open source spirit. But the more open source gets into a market driven economy, the more we will see this type of thing.
Bring on the Open Lawyers!
oxymoron (Score:5, Funny)
while you're at it, imagine whirled peas
Parent
obviously ? (Score:5, Insightful)
What he means by obviously modified? The file size is different? Maybe they just compiled it with different parameters!
Re:obviously ? (Score:5, Informative)
Look at the busybox binary.
run strings on it.
There is at least 1 error message that isn't in standard busybox. That is a surefire sign that they made a modification to it.
As for zebra, I heavily suspect it's the same deal.
Parent
Re:obviously ? (Score:5, Informative)
Parent
A new bad guy? (Score:5, Interesting)
To date, many people have asked, no one has recieved.
It looks like Linksys wants to use superior GPL code, but doesn't want to play by the rules and let competitors in on the action. If they were going to act this way, than they should have stuck to proprietary works.
Re:A new bad guy? (Score:4, Interesting)
Parent
Re:A new bad guy? (Score:5, Informative)
Parent
Re:A new bad guy? (Score:4, Informative)
Parent
Reasons why this might not be true (Score:5, Insightful)
This may just be stuff sent to the configure script, using the vanilla sources.
binaries are compiled with a modified GCC (with a signature string of "GCC: (GNU) 3.0 20010422 (prerelease) with bcm4710a0 modifications"). That bcm4710 refers to the Broadcom chipset that this AP is actually made from.
Did they release the modified GCC? Somehow I doubt they put gcc on the access point. Since they did not release the binary, they don't need to release the source.
Re:Reasons why this might not be true (Score:4, Insightful)
binaries are compiled with a modified GCC
Could this, plus params sent to ./configure cause the obvious changes?>
Parent
Re:Reasons why this might not be true (Score:4, Informative)
If it was LinkSys who modified GCC and used it as their own compiler (and did not distribute it), then now, they do not need to release the source.
However, the authors speculation was that it was Broadcom who modified GCC to produce code for their own chip, the BCM4710. If Broadcom was distributing the modified compiler as part of an SDK to third-party developers using the chip, then Broadcom would have to release their changes.
Parent
Re:Reasons why this might not be true (Score:5, Insightful)
Parent
Re:Reasons why this might not be true (Score:4, Insightful)
Yes, but only to the third party developers, they have no obligation to release the source to the world. Ask one of those third party developers to get you a copy.
Parent
Re:Reasons why this might not be true (Score:5, Informative)
i really dont think they do; read your GPL, if you release binary code, you have to supply a means of getting the source code. but to hit your argument at the base... the fact is, they don't even need to provide binaries for the modified gcc. it is being used "in house" and there is therefore no need to redistribute the changes. (remember, gcc is not provided to the end user in the router firmware)
Parent
Re:Weak point of the GPL (Score:4, Insightful)
No thanks, the GPL is hard enough to sell as it is. Remember that fracas about using GPL'd Java packages? Holy shit! People were claiming that since technically the GPL'd Java code was linked at *runtime* that maybe the entire project would have to be GPL'd. Wow.
Give me a BSD or Apache license any day... licenses should not, in my opinion, have an almost religious ideology behind them.
You also said: By using a tool not generally available to build the source, the distributor has made it difficult for end users to enhance the software.
GPLers throw around that phrase a lot, "end users". The assumption is that an end user even knows what a compiler is. Most of them do not. For a true end user the GPL doesn't do or mean shit. I mean, come on, they have the "right" to modify their software... and most of them don't even know what a commandline is. That's very useful.
To the *developer*, the GPL is potentially another story. It's great to have access to code, to make changes, etc. But, let's keep that straight... the GPL is for the developer crowd and not the end user. It is not liberating the end user from anything at all.
Parent
How do we tell? (Score:5, Interesting)
Then again, if someone did sue for copyright infringement, what kind of damages could you claim?
Why is it "obvious"? (Score:5, Insightful)
The article also states that LinkSys is using a modified GCC. So what? They aren't distributing a modified GCC, so they are not bound to distribute sources.
GPL loophole? (Score:5, Interesting)
When your new GCC reads in the code for Foo, it compiles it incorrectly so that it convenently produces a program with your desired changes. This could be done by constructing a lookup table with original Foo code lines corresponding to modified code lines.
The result: from the original GPL Foo source, you have your own custom binary. Upon distribution of this binary, you are bound by the GPL to give access to the source, i.e. the original GPL Foo source. Since you're not distributing your custom GCC binary, you don't need to give access to its source either.
I'm sorry if I just broke Linux. Tell me if I'm wrong!
Parent
Not a GPL loophole. (Score:4, Insightful)
My interpretation is that if you routinely need to change pieces of GCC to change your code, then the GCC source *is* your source and the GPL requires you to release it.
Parent
Details of issue (Score:5, Informative)
1) "One perfect example of this is Zebra, the advanced dynamic routing software package. By opening the firmware file directly, as well as by making queries through the makeshift ping interface mentioned earlier, we noticed that the zebra running on the WRT54G doesn't use the standard configuration file locations. This means that it must certainly be a modified binary." He also mentions that Linksys seems to have used a modified GCC to compile their software, "with a signature string of "GCC: (GNU) 3.0 20010422 (prerelease) with bcm4710a0 modifications"). That bcm4710 refers to the Broadcom chipset that this AP is actually made from."
2) Yes, the author DID email Linksys asking for the source code. You can read that message here. [nocat.net] According to the update at the bottom of the weblog entry, he got a response shortly before midnight on 29 July, but it just said that the issue was being directed to second level support.
GPL compliance re: GCC (Score:5, Interesting)
If they were provided with a modified version of GCC, they themselves do have a right to the modified source. The GPL provides you with the freedom to make and distribute modifications to a program which is licensed to you.
However, it doesn't say that you have to provide the program itself to anyone.
I use GPM for mouse handling. The software was made available by the author(s). I can make modifications to it all I want, but unless I provide someone else with a binary based upon my modified source, I don't have to provide source code to anything.
Know your rights well. Know where they stop even better -- you don't want to come off as a maniac claiming rights to that which isn't yours, but be sure that you know what rights are provided to you.
I'd like to know RMS' take on GPL'd apps being distributed as part of an "embedded" device. Google, here I come...
Sick SCO on 'em! (Score:4, Funny)
2. Then SCO could sue Linksys to release their code so they could see if it contains their "IP". Then the Slashdotters could see the code.
3. PROFIT!!!
Take this sig and shove it.
When on the opposite side of the fence.... (Score:4, Insightful)
I just presume that, given the audience that visits Slashdot, people will at least be smart enough to realise that they're now on the other side of the fence. Sure, maybe SCO are wrong. But maybe, just maybe, they believe they're in exactly this same position.
like with SCO -- prove it (Score:5, Insightful)
In both cases, I say, prove it. Prove that Linksys didn't build the source using their compiler (which they haven't given you a binary to, and so don't owe you source) and the original source code which the author of the article admitted was available for download, using configure flags to specify an alternate configuration file location.
Guess what? It's totally possible that Linksys is in full compliance with the GPL. This guy didn't bother to make sure that the code was in violation before crying foul and putting up a "Linksys sucks -- email them and ask for the modified source!" page.
I took two minutes to "apt-get source zebra", and look at this:There's nothing to see here, folks. There's no story here, because just like with the SCO stories, there is absolutely no substantiated evidence.
Congratulations, Michael. You have been trolled. Maybe if you'd read the article before posting it to the front page you'd have spared Linksys some bad publicity.
GPL loophole? No way! (Score:4, Informative)
Their modified GCC is not 'normally distributed with the major components of the operating system'. So according to this clause it needs to be distributed (in source or binary form). But, since GCC is under the GPL the source of the modified GCC must be released.
QED.
Modified GCC issues (Score:5, Interesting)
Say I create a modified compiler that recognizes some piece of code, or tag and replaces it with an "improved" piece of code. For example, it recognizes the code for a particular driver, like the tg3 driver in the Linux kernel, for one example, and inserts optimized compiled code in place of the actual code in the output binary, where this optimized code is actually a completely new driver, derived from the original GPL driver.
Now technically, I haven't broken the GPL if I distribute the output binary in a product but don't distribute the source for the optimized driver. The optimizations are present in gcc, not the source code, and I'm not distributing gcc. The changes in the output binary are just the way that the compiler I used "interprets" the code that was compiled. It does, of course, break the spirit of the GPL. Is there a way to address this, or is it a giant glaring loophole in the GNU Public License?
-Todd
Re:request? (Score:3, Insightful)
Did anyone formally read the linked weblog that forms the basis of this article? It just might contain the answer. Imagine that.
Cheers,
Ian
Re:request? (Score:5, Insightful)
He's basically making 2 claims.
1. Zebra uses non-standard file locations, so it must be modified.
2. GCC used to compile the system has been modified (binary signature is different).
However, I'm currious to what extent of moving files constitutes being "modified". Are these changes that can be made with "./config --target-dir=/someplace/else"? If so, then the claim is baseless because no modification of the source was necessary.
As for GCC, we can see that it was modified because the binary signature is different. Does this constitute a GPL violation? Possibly, I'm unclear what the intent of the GPL is in a situation like this. Basically, GCC was modified and used internally by LinkSys. If I modify GCC and don't distribute it to anyone other than me, do I have to put the changes out on a website (or anywhere)? No. Is it different for a corporate entity?
If binaries compiled with an undistributed modified GCC are distributed, does that then require the disclosure of the modifications to GCC? I think that the spirit of the GPL would have to say yes, but since IANAL, they may be perfectly within the law to keep it. It's exclusion may be just an oversight.
The last time a LinkSys issue came up, we discovered that it was just a matter of someone jumping the gun too quickly. I think that LinkSys is a smart company, and I think they respect the Linux community. I don't think they would shoot themselves in the foot with licencing issues. Let's all have a little patience and give them the benifit of the doubt until there are more facts than speculations, shall we?
Parent
Re:More and more... (Score:5, Insightful)
What are you talking about?
Parent