Why GPL-licensed code is dangerous for businesses to use

[notyoueither]

That is pure BS. We are currently considering if we should go GPL with our proprietary code. We could go full free, but then several of our competitors would gain free acces to our some 30 years experience in the area and implement it in their properitary code.

It's a political choice that we probably should go free, but why the hell should we dig our own grave ?

Why would you go GPL? So that you could then use GPL?

[Asher]

And in your nightmare scenario the damage from opening source is greater than the monetary damage for normal infringement.

Yes, but that doesn't matter. It's explicitly in the license, the court doesn't weight the terms to see if they're unreasonable to that specific infraction, they do it in general terms.

See the RIAA lawsuit where the woman had to pay what, a million dollars for 24 songs?

You have the opportunity retract this statement now.

Why would I? It's the general consensus among lawyers, the FSF, and virtually everyone else who understands the industry. Why do you think violators comply rather than taking it to court?

[Kuciwalker]

Asher, in every single one of your "we can't know what code is in our product", the GPL can't possibly be the problem because the solution is the same in any world regardless of the existence of the GPL! Any of your employees in that case has the ability to cause major or even irreparable harm to the company.

[Asher]

Because Blackcat and Kuci don't seem to comprehend the immense value of proprietary software for many businesses, maybe this article would help. It's not GPL-related, but it demonstrates the value of software and why opening the sourcecode is far more dangerous than a simple up-front fine or payment:

http://www.cjr.org/the_audit/a_code_theft_at_goldman_is_a_t.php

A Code Theft at Goldman Is a Tantalizing Story

Reuters’ Matthew Goldstein broke a fascinating story on Sunday, reporting that a Goldman Sachs computer programmer stole at least part of the code the investment bank uses for its so-called program trading.

Sergey Aleynikov, a Russian immigrant who’s a naturalized U.S. citizen, who coded for Goldman, left to go to a Chicago firm for three times his $400,000 salary. Before he left, he swiped 32 megabytes of top-secret computer code (accidentally, he says) related to Goldman’s proprietary automated trading software.

What’s that and why’s it so important?

The platform is one of the things that apparently gives Goldman a leg-up over the competition when it comes to rapid-fire trading of stocks and commodities. Federal authorities say the platform quickly processes rapid developments in the markets and uses top secret mathematical formulas to allow the firm to make highly-profitable automated trades.

Oh, yeah, that.

In his original piece, Goldstein pointed to the work of blogger “Tyler Durden” of Zero Hedge, who had been writing about Goldman (which, awkwardly, and as a matter of disclosure, is one of The Audit’s funders) suddenly falling off the New York Stock Exchange’s automated-trading charts the week before. That’s strange because Goldman is always No. 1. The NYSE has since said it was a screw-up, but it’s an awfully coincidentally timed screw-up.

Zero Hedge has been all over this story since with sometimes-hyperbolic posts like the one linked above asking whether the incident will “destroy Goldman Sachs.” Something tells me no, no it will not. But there’s a lot of interesting analysis and background in that post (applaud Goldstein for linking to it, as well).

According to a Factiva search, Reuters had the story all by its lonesome (in the mainstream press, anyway) for some seventeen hours. The New York Times, Wall Street Journal, and Financial Times all had no news of the scandal in their Monday editions.

Bloomberg picked up the ball and advanced it a bit on Monday.

I think Bloomberg’s piece handles the news angle better than any of the other big-press pieces today, too. It leads with the prosecutor saying that “may lose its investment in a proprietary trading code and millions of dollars from increased competition if software allegedly stolen by a former employee gets into the wrong hands.”

That’s a key question for Goldman shareholders, obviously. Bloomberg points out that Aleynikov uploaded the code to a German website and it’s unclear who, if anyone, got their hands on it. It’s unclear if or how much Goldman’s trading could be affected by the theft.

The Times, on B1 today, quotes a market participant saying it wouldn’t be easy to use the stolen code in the U.S., but that “in countries that are more lawless it could have value.”

Germany is the least likely lawless place, but it will be interesting to find out why Aleynikov used a German server for his upload. Goldman told the Times and the Journal, which stuffs the story on C3, that the theft wouldn’t affect it, but both papers use the past tense, which leaves the question open as to whether it could yet affect it.

But the most interesting part of Bloomberg’s story is this quote from Assistant U.S. Attorney Joseph Facciponti (which the NYT borrows):

The bank has raised the possibility that there is a danger that somebody who knew how to use this program could use it to manipulate markets in unfair ways.

Which raises the obvious question of whether Goldman Sachs itself uses the program to manipulate markets in unfair ways. What controls are there on this? Who regulates it? I’ll look forward to some explanatory pieces on this in the days ahead.

Newsweek wrote about the case today, but unfortunately fell into some incorrect bloggy speculation about which Chicago firm had hired Aleynikov, saying “speculation is that the Chicago-based employer is a small company called Getco, which uses “highly-automated algorithms” to enhance “liquidity and efficiency to electronic financial markets.”

It’s easy to get things wrong on a developing story like this, especially if you crib speculation off the Internet.

The Aleynikov/Goldman story could turn out to be a simple theft story or it could be something much more. Whatever, it’s one to keep an eye on.

Note that the system they're referring to is the Goldman Sachs equivalent of the stuff I did at Lehman.

[notyoueither]

Asher, in every single one of your "we can't know what code is in our product", the GPL can't possibly be the problem because the solution is the same in any world regardless of the existence of the GPL! Any of your employees in that case has the ability to cause major or even irreparable harm to the company.

Why do you continually insist this is the case when reasonable people can see plainly that is not the case?

What have you not explained?

[Asher]

Asher, in every single one of your "we can't know what code is in our product", the GPL can't possibly be the problem because the solution is the same in any world regardless of the existence of the GPL! Any of your employees in that case has the ability to cause major or even irreparable harm to the company.

You're thinking far, far too superficially. It's ALWAYS a risk, there is not just ONE problem.

Of course it's a problem if an employee is stealing code.

It is a potentially BUSINESS-ENDING PROBLEM if they steal GPL code.

It's a matter of severity.

[Kuciwalker]

Yes, but that doesn't matter. It's explicitly in the license, the court doesn't way the terms to see if they're unreasonable to that specific infraction, they do it in general terms.

See the RIAA lawsuit where the woman had to pay what, a million dollars for 24 songs?

Asher, it's obvious you just don't get copyright law. I certainly am not an authority on it, but you're fundamentally confusing issues. The RIAA case is a case of statutory damages.

Why would I? It's the general consensus among lawyers, the FSF, and virtually everyone else who understands the industry.

Cite.

Why do you think violators comply rather than taking it to court?

Show me an example of a violation where opening the source was more damaging than the potential monetary damages and the defendant had sufficient resources to actually put up a defense, and they open-sourced their code rather than fight for monetary damages instead.

[Kuciwalker]

You're thinking far, far too superficially. It's ALWAYS a risk, there is not just ONE problem.

Of course it's a problem if an employee is stealing code.

It is a potentially BUSINESS-ENDING PROBLEM if they steal GPL code.

It's a matter of severity.

It's a potentially BUSINESS-ENDING problem if they steal any code.

[Kuciwalker]

Because Blackcat and Kuci don't seem to comprehend the immense value of proprietary software for many businesses, maybe this article would help.

Asher, now you are just blatantly lying. You go on ignore with Ben for a while.

[Asher]

It's a potentially BUSINESS-ENDING problem if they steal any code.

It's not, as KH and I have both tried to explain to you. You incorporate 50 lines from a competitor's code in yours, you cut them a royalty check or a lump sum payment. That's how it works.

[notyoueither]

It's not, as KH and I have both tried to explain to you. You incorporate 50 lines from a competitor's code in yours, you cut them a royalty check or a lump sum payment. That's how it works.

Or you use more, and you buy them, if you are Microsoft.

[BlackCat]

It's not BS. If you are even considering GPLing your code, obviously it's not very valuable.

What part of that did you think was BS specifically?

Being public owned, GPL could be an order

About the value of the code - well, that is a company secret

[Asher]

Asher, it's obvious you just don't get copyright law. I certainly am not an authority on it, but you're fundamentally confusing issues. The RIAA case is a case of statutory damages.

I'm not confusing issues, I just provided a very simple, easy-for-Kuci-to-understand example that the courts don't judge on an individual basis what is a fair punishment. It applies in both cases.

Why would I? It's the general consensus among lawyers, the FSF, and virtually everyone else who understands the industry.

Cite.

Is this seriously news to you? It's no wonder why you're on the wrong side of this debate. Not only have you never developed complex software on large teams, you're not aware of the GPL much, if at all.

I don't need to cite this for obvious reasons. The general consensus is the GPL is legal, which is why they have a 100% compliancy rate from violators. If you don't think the GPL and its terms are legal and enforceable, and especially if you're making the claim that others think this is the case, the onus is on you to prove it. The legality of the GPL is the status quo.

Show me an example of a violation where opening the source was more damaging than the potential monetary damages and the defendant had sufficient resources to actually put up a defense, and they open-sourced their code rather than fight for monetary damages instead.

It hasn't happened yet because, as I said, virtually every company with incredibly valuable IP drills it into developers heads that the GPL == BAD, STAY AWAY. Or at least, no one's gotten caught yet.

I can also point out that there's a 100% success rate of every GPL violation resulting in the source code of the violator becoming open. Even Microsoft -- which certainly has the funds to fight this if they didn't believe the GPL was a valid license and despises the GPL and Linux more than any company on this planet -- hasn't fought it in court for a very obvious reason.

[Asher]

Or you ise more, and you buy them, if you are Microsoft.

Yes, it could become an investment opportunity also.

[Asher]

Because Blackcat and Kuci don't seem to comprehend the immense value of proprietary software for many businesses, maybe this article would help.

Asher, now you are just blatantly lying. You go on ignore with Ben for a while.

I'm not lying. What am I lying about?

I can't understand what has gotten into you. You're usually on the ball, but not today.

Your argument is that the GPL is not dangerous. Why? It's not really clear, but so far you've tried a number of different absurd arguments including the gamble that the courts wouldn't enforce the explicit and fundamental terms of the GPL. You've also made the claim that it's not dangerous because "it is not the problem", as the problem is you can't control what people contribute to your project in all cases so therefore it's not a GPL issue and therefore it is not dangerous?

Honestly, I think you're high or something. Either that or your weird sleep patterns are taking its toll.

I welcome my addition to your ignore list. Get some sleep, take me off, re-read this thread.

I'll bear no grudges as I think this is an oddity more than anything else, for you.