Why GPL-licensed code is dangerous for businesses to use

[Asher]

How is the rule usually drafted? Do you mean that employees are forbidden to write GPL code on their own time independent of company resources?

No, it's just a rule forbidding the use of anything GPL (usually "open source" in general to prevent confusion), even when it comes down to production tools like the GIMP.

IBM was actually the most strict of all the places I worked at. We weren't allowed to even go to the GCC website or install GCC or look at the sourcecode. They were extremely paranoid about a developer even looking at GPL code/functionality and implementing something even accidentally similar, which could theoretically result in IBM having to open the sourcecode to its very lucrative product base.

[BlackCat]

No, it's just a rule forbidding the use of anything GPL (usually "open source" in general to prevent confusion), even when it comes down to production tools like the GIMP.

Well, thats where these companies fail. They should be able to distinguish between open source and GPL.

[Asher]

Well, thats where these companies fail. They should be able to distinguish between open source and GPL.

It's only practical. There's a massive array of open source licenses, and if they're going to be used the legal team needs to scour it...which itself is not cheap.

[DanS]

This is interesting. I was under the impression that IBM released a lot of code to Linux. Isn't that code GPL?

[BlackCat]

It's only practical. There's a massive array of open source licenses, and if they're going to be used the legal team needs to scour it...which itself is not cheap.

Of course such isn't cheap, but if it can save you a ****load in dev. costs, it could be worth it.

[Asher]

This is interesting. I was under the impression that IBM released a lot of code to Linux. Isn't that code GPL?

Yes, but Linux development works in what they call a "clean lab". If you do Linux or any GPL contributions, you CANNOT work on any non-GPL IBM product. It's a division in the company.

[Dinner]

Yes, but Linux development works in what they call a "clean lab". If you do Linux or any GPL contributions, you CANNOT work on any non-GPL IBM product. It's a division in the company.

Wow, I didn't know it was that strict.

[BlackCat]

Well, it's probably overkill, but considering how the US legal system works, it's probably a sane precaution.

[Asher]

They've been burned before on lawsuits that they "reverse engineered" other code due to similarities. It's a precaution.

All email at IBM self-destructs after 30 days. (It deletes itself). That's because they've been burned before by having emails/memos subpoenaed. You can't give to the courts what you don't have.

[BlackCat]

Hope that they have procedures for their backups too

That is what usually makes me ROFL when a file on some server are seen being deleted in movies

[onodera]

My router is running a badass open source firmware because Linksys got burned after it included GPL code in its original firmware.
I think this effect of the viral licensing is exactly what Stallman had in mind when he designed the license. Infiltrate as much commercial software as possible and force it open.

[Asher]

My router is running a badass open source firmware because Linksys got burned after it included GPL code in its original firmware.
I think this effect of the viral licensing is exactly what Stallman had in mind when he designed the license. Infiltrate as much commercial software as possible and force it open.

It's also precisely why GPL software is a niche compared to dominant commercial software.

If you're referring to DD-WRT, BTW, the current version has virtually no code that was written by Linksys. The effect of the GPL here has always been massively overstated. Most custom firmware builds are simply Linux distros designed for routers, no more and no less. This could easily be accomplished with other licenses just as well, and in fact most routers sold today do use other licenses.

GPL proponents now absolutely hate DD-WRT, while not too long ago they were singing its praises.

[DanS]

I've been thinking about this some and doubt GPL really chills open source activities. It's true that Microsoft may have a more draconian policy re code contributions because of GPL. But Microsoft employees have tried to be helpful in steering people in the right direction on a GPL open source project in which I am involved. There's more than one way to help out an open source project.

[Asher]

Reading about the history of the Linksys fiasco gives me shivers still.

Linksys is a very successful purveyor of WiFi More about WiFi routers, in particular the WRT54G 802.11g wireless home gateway. In March, 2003, Cisco Systems (Nasdaq: CSCO) More about Cisco Systems bought Linksys for US$500 million. After the acquisition, in June 2003, complaints appeared on discussion boards such as LKML and Slashdot claiming that Linksys was violating the GPL by not providing source code for certain code used in its WRT54G wireless access point. (See for instance this posting.) The Linksys product included both the Linux kernel and other GPL code.

This is the nightmare scenario for an acquiror worried about open source. In the trade this is known as "buying a lawsuit."

The FSF stepped in, stating publicly that it was spearheading enforcement for multiple copyright holders who had licensed materials under the GPL: "[W]e are leading a coalition of many copyright holders in the WRT54G, as Linux is only one part of a large body of GPL'ed software in the product. We formed this coalition because, having done enforcement cases for a product with a broad range of copyright holders before, we have found that separate enforcement actions and/or law suits from individual copyright holders make attainment of compliance more difficult."

Undoubtedly informal enforcement actions are easier with fewer parties involved. However, this statement as it relates to "law suits" is a bit disingenuous, for two reasons: first, FSF has never actually led a formal defense group to enforce the GPL in court, and second, if it did so, it would likely do so based not on convenience, but necessity, as separate suits might be impossible due to legal due process requirements.
What Can Be Learned

Linksys eventually released the source code at issue. Various Web reports place the release at three to four months after the first demand by the FSF. It is amusing to read the morally outraged postings on this subject that describe this result as glacially slow. It seemed fast to me. The only way to do it faster would have been a scorched earth TRO action or some jackbooted GPL police.

The first take-away from this case is the difficulty of doing enough diligence on software development in an age of vertical dis-integration. Cisco knew nothing about the problem, despite presumably having done intellectual property diligence on Linksys before it bought the company. But to confound matters, Linksys probably knew nothing of the problem either, because Linksys has been buying the culprit chipsets from Broadcom (Nasdaq: BRCM) More about Broadcom, and Broadcom also presumably did not know, because it in turn outsourced the development of the firmware for the chipset to an overseas developer.

To discover the problem, Cisco would have had to do diligence through three levels of product integration, which anyone in the mergers and acquisitions trade can tell you is just about impossible. This was not sloppiness or carelessness -- it was opaqueness.

You can see why IBM is paranoid. They would lose hundreds of millions of dollars, if not billions of dollars, if some of their applications became 'contaminated' in any way by the GPL.

[Kuciwalker]

It had something to do with virtualization implementation, and it was linked (statically) to some binary but GPLed tool.

Yes but THEIR code is GPL, that was the whole point of the story. And if it's a separate piece of code that got linked to non-MS GPL code, then it has nothing to do with the code MS released under GPL for the Linux kernel.