Usenix President - Linux Needs Better Paper Trail

Anonymous Coward writes "Usenix Association president Marshall Kirk McKusick is a veteran of BSD's intellectual property scuffle with AT&T in the 1990s, and he's got some thoughts and advice for the keepers of the Linux kernel going forward, commenting: 'There isn't a well-documented ownership trail with Linux. So, they have opened themselves up to a swamp of 'he said-she said' about where code came from'."

The only problem with that quote is... its entirel

[SeanTobin]

Dating back to when linux (the kernel) didn't even have a version number, code was always attributed to where it came from. I'm sure everyone is familiar with at least the changelog [kernel.org] and its attributions. And of course actual comments with names and email addresses are all over the sourcecode itself.

Now, Mr. McKusick might have a partial point. Its entirely possible that some gremlin over at Caldera took a bunch of SCO's 'Intelectual' Property and threw it into the main kernel under the GPL. In which case once the lines of code are actually identified, I suspect we will know who contributed them in under 20 minutes (10 minutes of which will be the article sitting on /. in The Mysterious Future!) In the unlikely event of SCO ever saying which lines are thiers, we may end up with the interesting situation where a Caldera/SCO employee put them there - and get to slap SCO for abusing the legal system.

In any event, I'd be willing to put money on Linux's source code source documentation beating SCO's out any day of the week.

A new agreement

[ch-chuck]

I guess, in the spirit of the GNU GPL, they'll have to come up with something, call it the FDA - a "Full Disclosure Agreement" that you *must* sign before contributing code, stating that you WILL tell everybody about the project and publish your code contribution, sort of a bizarro-world NDA.

It's not really a problem

[maximilln]

From what I've seen ownership never becomes a problem until large amounts of money become involved or until one group attempts to sandbag another group based upon their ownership. Since this is the open source community, most commonly under the GPL license, there is no worry about this sandbagging unless someone attempts to take a fork and make it commercial.

Is this where the need for a paper trail comes in? Suppose someone takes the kernel and starts their own independent development on it. Hypothetically, in five years, they could rewrite or replace over 50% of the kernel with their own code. From what I understand the GPL license requires that any code that it becomes part of must also be GPL. If the total code package is several million lines, however, who is going to pay to subpoena the source code for a commerical product to prove that it was indeed started from a GPL/open source project? Who will pay to have the code audited and what prevents a potentially unscrupulous commerical entity from playing mix and match with subroutines so carefully that the resulting audit would take more time to arrange properly that to actually audit the lines one by one?

I suppose, in this case, the paper trail wouldn't make a darn bit of difference. The paper trail isn't going to make it any easier to subpoena source code from a commercial entity if they're stonewalling.

Enter my tin-foil argument that Windows9x/2x is nothing more than badly mangled Linux and a customized window manager built with a crytpically designed compiler--but no one ever gets to see the source code so they'll never be able to prove it.

Re:The only problem with that quote is... its enti

[Short Circuit]

You know, I suspect they've already discovered copied code...by a Caldera employee. Possibly even with written permission on file.

But the point of their lawsuit is to prove that at least some of the code in Linux came from SCO's IP through IBM. They're damned sure not to point out any pasting they did. It would point to an apparent flaw in their logic.

(And whether that flaw is really a flaw, and not a dynamic company changing its policies, is a subject for another debate. But I won't represent them.)

GPL does NOT grant you rights...

[Anonymous Coward]

It actually is inaccurate to call what the GPL grants you a "right." A right can only be granted to you by a sovern governmental entity, or God. The GPL only grants you permission to share code, modify, fork, etc... Now, that permission comes with the promise that they will never be modified. That, combined with the reality of the hodgepodge of copyright ownership all mixed into a program all work to make it near impossible to revoke that promise; but it is still, nonetheless, a promise.

What?

[Anonymous Coward]

'There isn't a well-documented ownership trail with Linux. So, they have opened themselves up to a swamp of 'he said-she said' about where code came from'

So what? There is a basic flaw in this argument! In the USA anyway, you are presumed innocent until proven guilty. Anybody alleging that source was stolen and placed into Linux must prove that source code:
a. existed somewhere prior to being placed into Linux
b. was stolen, not just happens to resemble code that might have been developed independently by someone else

In short, there should be no burden of proof on Linux's part to prove that the source was not stolen; the burden of proof must be on the accuser to prove that the source was stolen!

Knowing who submitted exactly which piece of code to Linux will not drain the swamp of 'he said-she said' about where code came from'. In fact, it will make it a lot worse. Consider: company A claims that some portion of Linux source, submitted by person B, was stolen. Person B had business dealings with company A prior to or during the time that the source was submitted. Company A will say that this proves the source was stolen from them since person B obviously had opportunity! They will claim this even if person B had dealings totally unrelated to software within company A.

RMS:I told you so

[line-bundle]

Was this not one of the reasons the GNU project wanted copyright assigned to it?

Re:What?

[praksys]

In the USA anyway, you are presumed innocent until proven guilty.

That is only true in criminal trials, and not always true even then. Copyright is civil matter, so the standard is usually "on the balance of the evidence". If one side can produce a pile of documents relating to the development of some code, and the other side can only produce a guy who says "I wrote it" then it is a pretty safe bet that the side with all the ducuments will win.

Sound stupid? Welcome to the wacky world of intellectual property.

foo

[JDizzy]

This is why the old 4-clause bsd license enforced the notion of not being able to remove the copyright notice itself, and always giving credit for authorship of the code, plus the normal lack of warranty bits. RMS has quotes on the internet and his fsf.org site about this, and to summarize he says that it is too much of a burden to mark the names of each and every contributor to the code. This is just the way the GPL assymilates code, and makes it stink. Marshal is probably right about this since he was at the CSRG when BSD came under the gun about att code infringment..

Re:paper trail?

[ichimunki]

Papyrus is not made of wood. It is made of reeds. Neither is a lot of your better paper made of wood. The better stuff is pure hemp or cotton in the West and bast (mulberry) in the East. In fact, even your basic wood pulp papers these days have so many clays and polymers (sizing and bindings which make it possible to even run paper through something like an ink-jet printer without it falling apart) in them that saying they are made from wood pulp is almost misleading.

If Linux is going to need a paper trail, I'd suggest a good acid-free archival quality paper. After Eldred v. Ashcroft-- and knowing the way Congress thinks-- Linus' great-great-great-grandchildren could well be defending the kernel from some sort of late-breaking attack over 100 years from now.

Re:How many closed source people copy code?

[jimfrost]

How many closed source companies copy code from various places?

I can't tell you about the industry as a whole, but so far I haven't seen even one case of a large body of source that didn't have code cribbed from somewhere else (my current employer excluded, I haven't been here long enough to know one way or the other).

Often this is not widely known, i.e. only one developer might know it happened.

I do note that over time the practice has become more strongly discouraged. I believe it was the GPL that was behind a lot of that, with smaller companies anyway, because the GPL has been a very tempting code base -- but with obvious legal strings attached.

Re:It's not really a problem

[Anonymous Coward]

> From what I've seen ownership never becomes a problem until large amounts of money become involved or until one group attempts to sandbag another group based upon their ownership. Since this is the open source community, most commonly under the GPL license, there is no worry about this sandbagging unless someone attempts to take a fork and make it commercial.

So the SCO Trail Of Lawsuits doesn't seem to fit the bill here? Let's see:

* Large amounts of money - check.
* One group attempts to sandbag another group based on ownership - check

So how come "It's not really a problem"?

Re:And ironically...

[Fnkmaster]

You Linux advocates...

I don't think I ever said I was a Linux "advocate" - I advocate the right tool for the job. Sometimes it's Linux, sometimes it's not.

I take all people's opinions and weigh them based on their own value, unless somebody has demonstrated a track record with me of excellent quality thought. I won't accept anybody's argument by authority, thank you very much. I do however think that everybody has known for some time that Linux kernel development needed more structure, needed SCM and so on, and it's got that now. And I acknowledge that from a business PR perspective, McKusick is probably right, but that his recommendations wouldn't necessarily have prevented a challenge like SCO's from occuring in the first place, and they may well have had other burdensome consequences.

You BSD people need to stop acting like you're right all the time, that's not a very good way to make new friends. Truthfully though, I don't know what I can stand less, the script kiddie types who think they are |33+ because they run Linux, or the supercilious, grumpy old BSD engineer types.