Why GPL-licensed code is dangerous for businesses to use

[Kuciwalker]

Dude, the penalties are monetary in the case of the CSS because the damage is monetary. There's no monetary remedy for damage caused by closing what must be open sourced according to a license.

This isn't true.

As an example, there are a number of companies whose business models involve dual-licensing their code under the GPL and a proprietary license that allows closed source redistribution, and charging for that other license.

[Kuciwalker]

Someone could just as easily add some lines of proprietary code to something you thought was BSD, and you'd be equally culpable.

And are much less likely to do so because prop code is not readily available.

I expect most people who develop real OSS* have a job that involves access to proprietary code.

*OSS other people would actually want to borrow code from

[Kuciwalker]

This is all in the "know the license before you use stuff" boat. The GPL is only dangerous in the sense that it's common; you would have the same problem regardless if you are getting code off the internet without vetting it.

This goes under "there would be more use of OSS if the GPL didn't exist/was niche"., i.e. the GPL damages the OSS community.

I don't believe there's strong evidence this is true. Arguably Linux is successful because it can't be closed. Firefox isn't licensed under the GPL, but the MPL is functionally equivalent for the purposes of this discussion.

[Kuciwalker]

Plus the development chains for OSS are much likely much longer than for prop code. More people with licensing rights = more difficult to come to resolution

By the same token, you are probably less likely to be sued. Though if it's any of the Gnu stuff you've taken, then all the copyright has been assigned to the FSF.

[Asher]

No offense Asher, but your stance is actually a bit Ben'ish. You are right that GPL is poison for a company that want to make proprietary code, but then it's up to this company to have guidelines for what external code they use and that they have a vetting procdure for such.

As someone who has supposedly professionally developed large software programs, you know this is impossible. That's why the GPL is dangerous, and that's ALSO why it's essential for any company serious about protecting its software IP to let all their employees know how DANGEROUS it is.

It is completely and utterly ridiculous for someone to say "the GPL is not dangerous, just don't use GPL code". Someone who says that is either an academic or someone who has never worked on large, complex code that hundred or thousands of people may be working on at various points in time in various parts of the world while employed at various companies. There's ALWAYS a risk that the code someone is entering is violating a license or a law. Someone could've googled the code snippit online and included it in their code without realizing it came from a GPL product. A low-level code monkey behind on his code may include a GPL part intentionally never thinking he'll get caught. Someone may include code from a previous firm they still had, which is an illegal theft of proprietary code.

This risk, which Kuci and apparently you, think is the "only thing dangerous" is a something that will always be there. It's a risk that is inherent to the profession. And as a result, the GPL is the most dangerous of all code thefts because it doesn't result in removal of the code or a royalty or monetary payment, is results in the effective nullification of the ENTIRE BODY OF INTELLECTUAL PROPERTY.

The GPL is dangerous because the "punishment" for a license violation is in a completely different stratosphere of any other license. And if your company is in the business of selling your software, if someone in any of the chain includes a GPL code snippit of any kind, your business has effectively been terminated. You've lost any real revenue streams you had, you will likely go under.

As I said, every company I've ever worked for -- when I was working on their closed-source software -- they've hit everyone over the head with the hammer on a regular basis saying "GPL IS DANGEROUS. DO NOT LOOK AT OR TOUCH AND CERTAINLY DO NOT EVER INCLUDE GPL CODE". It's called a viral license for a reason. It is dangerous, I don't see how any reasonable person could argue any other way.

And to be labeled as "Ben" because of my position, which I'd hope any reasonable person could see is the logical and frankly, common-sense one, is really ridiculous. I can't decide if you've decided to intentionally try to troll me with this nonsense to fill my venomous void now that Ben and I aren't talking, or if you are still arguing with this hare-brained approach to save face.

Anyone who thinks the GPL isn't dangerous doesn't understand the value of commercial code or doesn't understand the GPL.

[Kuciwalker]

As someone who has supposedly professionally developed large software programs, you know this is impossible.

You keep claiming this. I call bull****. What are you doing, copy-pasting things that come up in Google Code?

[Kuciwalker]

It is completely and utterly ridiculous for someone to say the GPL is not dangerous, just don't use GPL code. Someone who says that is either an academic or someone who has never worked on large, complex code that hundred or thousands of people may be working on at various points in time in various parts of the world while employed at various companies. There's ALWAYS a risk that the code someone is entering is violating a license or a law. Someone could've googled the code snippit online and included it in their code without realizing it came from a GPL product. A low-level code monkey behind on his code may include a GPL part intentionally never thinking it'll get caught. Someone may include code from a previous firm they still had, which is an illegal theft of proprietary code.

And this is why THE DANGER HAS NOTHING TO DO WITH THE GPL.

[BlackCat]

As someone who has supposedly professionally developed large software programs, you know this is impossible.

You keep claiming this. I call bull****. What are you doing, copy-pasting things that come up in Google Code?

WFT

[Kuciwalker]

This risk, which Kuci and apparently you, think is the "only thing dangerous" is a something that will always be there. It's a risk that is inherent to the profession. And as a result, the GPL is the most dangerous of all code thefts because it doesn't result in removal of the code or a royalty or monetary payment, is results in the effective nullification of the ENTIRE BODY OF INTELLECTUAL PROPERTY.

In the "I have no idea what license my code is under" environment, you could be violating any license that is ARBITRARILY WORSE than the GPL.

And this is all assuming they can force your code open in the first place.

[Asher]

If opening the source would be a larger penalty than whatever monetary damages would normally be awarded, I don't see how they would possibly award that.

It's really quite simple, Kuci. They would award that because it is EXPLICITLY IN THE LICENSE. It's no secret.

If I license my code with a clause "and you owe me ONE TRILLION DOLLARS if you copy this!" the courts aren't going to let that override normal infringement penalties.

Because that is completely unreasonable. Opening the source code, on its face, is not -- particularly when there's precedents outside of the court system of people complying.

I also hope I don't need to lecture you on why it's a stupid argument to simply hope that the court doesn't force you to open-source your product because you think it's ridiculous. Businesses can't take that chance, and frankly it won't happen anyway. I'm 99% sure the courts would enforce the terms of the license.

[Asher]

As someone who has supposedly professionally developed large software programs, you know this is impossible.

You keep claiming this. I call bull****. What are you doing, copy-pasting things that come up in Google Code?

Okay, it all makes sense now. You very clearly have never worked on large, complex software.

I'll give an example. When I worked at Lehman Brothers, at any given time there were 30 to 40 active developers on their Fixed-income and Equity Trade Workflow & Management system I worked on, around the world.

About 7 or so were proper Lehman employees working out of NYC. The rest of the team was made up of at least half a dozen different consultancies, some of which sub-contracted the positions again. There's a complex hierarchy of people from around the world -- NYC, Boston, San Francisco, Toronto, London, Mumbai, and Bangalore. Code is being committed virtually 24/7 at rapid paces -- we pushed out a new release every Friday night. There's virtually no code audits because there's no time or resources for it. There wasn't even proper QA cycles.

In this kind of environment, it is ABSOLUTELY impossible to ensure every line of code being checked in is not GPLed. How would you do that? Write a tool to search Google Code for every line of code checked in, then check to see if it exists and if so what license it is?

Come on, Kuci...

It is impossible for Lehman in this case to know that there's never going to be GPL code in their project. You keep falling back on this incredibly lame argument "you should know the terms of the license, so it's not dangerous!". That's not how the real world works. Development is usually fast-paced, dirty, and there's code flying every which way from many people. All it takes is one little douchebag in Mumbai who was a week behind on his project to find some code snippits online that implemented the algorithm he's trying to do (which is not uncommon in the fin serv market, BTW) and include those in his project. To him the risk assessment is simple: he probably won't get caught, and if he does he'll just get fired. For Lehman it'd mean they lose their proprietary trading system, which -- if you knew the market -- would be a MASSIVE deal. (If you google, some guy stole the source for the equivalent software from a major international investment bank the other week and its value was measured in the millions of dollars).

[Asher]

In the "I have no idea what license my code is under" environment, you could be violating any license that is ARBITRARILY WORSE than the GPL.

What the hell kind of argument is this? Even if in theory any license could be arbitrarily worse than the GPL, that doesn't make the GPL not dangerous.

And I challenge you to find one license that would cause more damage to the Lehman Brothers and IBMs of this world than the GPL.

[BlackCat]

As someone who has supposedly professionally developed large software programs, you know this is impossible. That's why the GPL is dangerous, and that's ALSO why it's essential for any company serious about protecting its software IP to let all their employees know how DANGEROUS it is.

It is completely and utterly ridiculous for someone to say the GPL is not dangerous, just don't use GPL code. Someone who says that is either an academic or someone who has never worked on large, complex code that hundred or thousands of people may be working on at various points in time in various parts of the world while employed at various companies. There's ALWAYS a risk that the code someone is entering is violating a license or a law. Someone could've googled the code snippit online and included it in their code without realizing it came from a GPL product. A low-level code monkey behind on his code may include a GPL part intentionally never thinking it'll get caught. Someone may include code from a previous firm they still had, which is an illegal theft of proprietary code.

When I was working for a company based on proprietary code, we didn't have any problem with GPL - why ? we didn't use external SW.

This risk, which Kuci and apparently you, think is the "only thing dangerous" is a something that will always be there. It's a risk that is inherent to the profession. And as a result, the GPL is the most dangerous of all code thefts because it doesn't result in removal of the code or a royalty or monetary payment, is results in the effective nullification of the ENTIRE BODY OF INTELLECTUAL PROPERTY.

That is pure BS. We are currently considering if we should go GPL with our proprietary code. We could go full free, but then several of our competitors would gain free acces to our some 30 years experience in the area and implement it in their properitary code.

It's a political choice that we probably should go free, but why the hell should we dig our own grave ?

[Kuciwalker]

It's really quite simple, Kuci. They would award that because it is EXPLICITLY IN THE LICENSE. It's no secret.

And in your nightmare scenario the damage from opening source is greater than the monetary damage for normal infringement.

Because that is completely unreasonable. Opening the source code, on its face, is not -- particularly when there's precedents outside of the court system of people complying.

It may be reasonable for some cases and not for others. The whole reason it's a nightmare scenario is because of the unreasonable ones - obviously!

I also hope I don't need to lecture you on why it's a stupid argument to simply hope that the court doesn't force you to open-source your product because you think it's ridiculous. Businesses can't take that chance, and frankly it won't happen anyway.

As I said, I'm sympathetic to the argument against using GPL because of the legal uncertainties. But it doesn't make the GPL dangerous to people who've decided not to use it.

I'm 99% sure the courts would enforce the terms of the license.

You have the opportunity retract this statement now.

[Asher]

When I was working for a company based on proprietary code, we didn't have any problem with GPL - why ? we didn't use external SW.



That is pure BS. We are currently considering if we should go GPL with our proprietary code. We could go full free, but then several of our competitors would gain free acces to our some 30 years experience in the area and implement it in their properitary code.

It's a political choice that we probably should go free, but why the hell should we dig our own grave ?

It's not BS. If you are even considering GPLing your code, obviously it's not very valuable.

What part of that did you think was BS specifically?