Why GPL-licensed code is dangerous for businesses to use

[Koyaanisqatsi]

Yes and no. The problem is that non-GPL'd code can be very easily exploited for cash. For instance, if an app is completely public domain then there is nothing stopping me from grabbing the code, slapping a different logo on it, and selling it to people who don't realize it's out there for free. There have been cases where people try to do that with GPL'd code, but the GPL is what they get smacked with and what forces them to stop sale. It's not petulant, it's just acknowledging that, hey, I put the time and effort into this and made the decision to not make money off of it and instead release it for people to use, so you have to respect that decision and not exploit it.

Now, whether that moral argument applies to code that goes through a large transformation is a different discussion.

[Kuciwalker]

How can you say it's not? One small slipup from anyone in the production chain, from an outsourced worker in India to an unpaid intern, can jeopardize the IP of the whole project. There's no other word for that than 'dangerous'.

I agree, not knowing the provenance of your source code is dangerous. But that danger exists even in a world where the GPL doesn't.

[Kuciwalker]

You are repeatedly making the assumption that GPL code is intentionally used and linked to. That is not the problem. If people use the GPL code and they know it's GPL, they deserve what's coming to them.

The problem is I don't think you comprehend just how very easy it is to "contaminate" a project by linking it to GPL code or inserting GPL code snippits into a product. It's virtually impossible to ensure this never happens on any reasonably sized project aside from drilling it into employee's heads that GPL == VERY BAD, DO NOT TOUCH. A simple error by a low-level employee can jeopardize everything.

Seriously? Why should this be limited to GPL? Why should you be linking ANY libraries you don't have licenses to??

In Cisco's case, they got burned by a subcontractor several levels below them. They knew and understood the problems with the GPL and had a policy to never, ever use the code. The GPL was still, demonstrably, very dangerous to them.

And we've been over this example a thousand times and it can't penetrate your thick skull that THE GPL WASN'T THE DANGER. They were exposed to the same risk in every world regardless of their GPL policy. They could have had GPL = BAD DON'T TOUCH literally branded onto their employees' arms and it wouldn't have helped.

At this point, if you bring up Linksys for another round despite me destroying you on it the past three times, I'll take it as a concession and leave the thread. You're acting just like Ben here.

[Asher]

Kuci. I am at a loss for words. You don't get it. Not going to bother explaining to ou why the GPL terrifies companies with significant IP invesents.

[Asher]

I take sincere offense to that Ben comment BTW. I am telling you exactly why companies like IBM are scared of it because I have been to their IP seminars. I have gotten the lectures. You do not comprehend the scope of the damage the GPL can do. There aremultiple ****ups in the Linksys case. But the major reason it is used time and time again as a business horror story is the severity of the Gpl punishment. At this point if you do nit understand you are ignoring reality for the sake of you posterity.

[BlackCat]

No offense Asher, but your stance is actually a bit Ben'ish. You are right that GPL is poison for a company that want to make proprietary code, but then it's up to this company to have guidelines for what external code they use and that they have a vetting procdure for such.

[Kuciwalker]

I take sincere offense to that Ben comment BTW.

Good, you should be offended by your own ridiculous behavior in this thread.

I am telling you exactly why companies like IBM are scared of it because I have been to their IP seminars. I have gotten the lectures. You do not comprehend the scope of the damage the GPL can do.

I'm aware of the precise scope of the potential damage from including GPL code in your product.

There are three cases:

1) You are OSS. Yay, you can include GPL code*. GPL is not dangerous.

2) You are closed source. Therefore you aren't even thinking of using GPL code. GPL is not dangerous.

3) You are closed source but somehow are including arbitrary code you don't have a license for. The GPL is not your problem; no policy you have on GPL can prevent any damage it causes, and you'd be potentially ****ed in a world without GPL anyway. GPL is not dangerous.

* deliberate simplification

[self biased]

GPL isn't dangerous in the same way that a hammer isn't dangerous; improperly used both are.

[KrazyHorse]

The title is obviously misleading, Kuci. However, there are a few real issues here:

1) GPL is more dangerous than regular proprietary software. GPL software is floating around on the internet, both in compiled and source code form. Half the time it's published without the redistributor making much of a deal if any of the license behind the code (at most there's a sentence on one of the pages that it's GPLed). If you want proprietary closed source code it's really difficult to get. If you want just the compiled form it's easier, but you still need to jump through a few hoops that yell "illegal" at you

2) If you nab somebody's proprietary stuff and abuse it then, in most circumstances, you will be able to come to a reasonable understanding with them (i.e. pay them a bunch of money). Even if it goes to court the penalties will be monetary (because the claimed damage was monetary), and will be limited by a reasonableness standard. If you use GPL stuff and it goes to court then I can't see the court doing anything but forcing you to open the source.

3) The GPL damages the reputation of OSS in the for-profit closed source community in general. It's completely reasonable to avoid using even BSD licensed code/software because the IP control of open source stuff is going to be inferior to that of the for-profit closed source stuff. What if somebody used a few lines of GPL code in the stuff you thought was BSD (and therefore safe to use)? Also, if this happens with stuff I bought from MS et al then I have their balance sheet in between me and the damages I will suffer as a result, which is not the case with most OSS.

4) Some OSS apostles will claim that 3 doesn't matter, because they're closed source ****ers, so **** em. But they fail to recognize that if the closed-source, PAYING community recognizes the value of community-generated OSS then it can be a motivation for programmers to build OSS apps in their spare time (to add to their resume).

[Kuciwalker]

2) If you nab somebody's proprietary stuff and abuse it then, in most circumstances, you will be able to come to a reasonable understanding with them (i.e. pay them a bunch of money). Even if it goes to court the penalties will be monetary (because the claimed damage was monetary), and will be limited by a reasonableness standard. If you use GPL stuff and it goes to court then I can't see the court doing anything but forcing you to open the source.

If opening the source would be a larger penalty than whatever monetary damages would normally be awarded, I don't see how they would possibly award that.

If I license my code with a clause "and you owe me ONE TRILLION DOLLARS if you copy this!" the courts aren't going to let that override normal infringement penalties.

[Kuciwalker]

1) GPL is more dangerous than regular proprietary software. GPL software is floating around on the internet, both in compiled and source code form. Half the time it's published without the redistributor making much of a deal if any of the license behind the code (at most there's a sentence on one of the pages that it's GPLed). If you want proprietary closed source code it's really difficult to get. If you want just the compiled form it's easier, but you still need to jump through a few hoops that yell "illegal" at you

3) The GPL damages the reputation of OSS in the for-profit closed source community in general. It's completely reasonable to avoid using even BSD licensed code/software because the IP control of open source stuff is going to be inferior to that of the for-profit closed source stuff. What if somebody used a few lines of GPL code in the stuff you thought was BSD (and therefore safe to use)?

This is all in the "know the license before you use stuff" boat. The GPL is only dangerous in the sense that it's common; you would have the same problem regardless if you are getting code off the internet without vetting it.

Also, if this happens with stuff I bought from MS et al then I have their balance sheet in between me and the damages I will suffer as a result, which is not the case with most OSS.

This isn't a GPL thing; it's again a problem with using code without sufficient assurances that you are licensed to do so. Someone could just as easily add some lines of proprietary code to something you thought was BSD, and you'd be equally culpable.

[KrazyHorse]

2) If you nab somebody's proprietary stuff and abuse it then, in most circumstances, you will be able to come to a reasonable understanding with them (i.e. pay them a bunch of money). Even if it goes to court the penalties will be monetary (because the claimed damage was monetary), and will be limited by a reasonableness standard. If you use GPL stuff and it goes to court then I can't see the court doing anything but forcing you to open the source.

If opening the source would be a larger penalty than whatever monetary damages would normally be awarded, I don't see how they would possibly award that.

If I license my code with a clause "and you owe me ONE TRILLION DOLLARS if you copy this!" the courts aren't going to let that override normal infringement penalties.

Dude, the penalties are monetary in the case of the CSS because the damage is monetary. There's no monetary remedy for damage caused by closing what must be open sourced according to a license.

[KrazyHorse]

This is all in the "know the license before you use stuff" boat. The GPL is only dangerous in the sense that it's common; you would have the same problem regardless if you are getting code off the internet without vetting it.

This goes under "there would be more use of OSS if the GPL didn't exist/was niche"., i.e. the GPL damages the OSS community.

[KrazyHorse]

Someone could just as easily add some lines of proprietary code to something you thought was BSD, and you'd be equally culpable.

And are much less likely to do so because prop code is not readily available.

[KrazyHorse]

Plus the development chains for OSS are much likely much longer than for prop code. More people with licensing rights = more difficult to come to resolution