GPL violations by wireless manufacturers

[ Please CC replies as I am not subscribed ]

I have had some luck resolving the GPL violation by wireless manufacturers issue. I have sent letters regarding the issue to Linksys, Belkin and Buffalo. This is the letter I received from Buffalo Technologies and below that is the letter I sent to the three manufacturers:

--------------
Hi Sir,

We are aware of these requirements and we have the PDF document (attached) and a statement/notice that will be put onto the website within 48 hours for this product. Please let me know if you require further assistance or if you would like to talk further.

NOTICE:
This product uses software of GPL/LGPL.
You have the right to acquire source code, change it, and re- distribute it.
The warranty on the product is only applicable if the original or an official Buffalo firmware is on the unit.
Please refer to GNU_LICENSE.PDF.
We don’t have any obligation to pay if a user has to pay to distribute or change the source code.

Thanks for your time.

Craig Reid
Technical Sales Engineer
-----------

-----------
Dear sirs,

Hereby I would like to inform you that the software on at least one of your products is offered in violation of the General Public License (GPL) as published by the GNU Software Foundation. This may not be known to you due to inclusion of acquired or licensed technology from third-party manufacturers in your product.

The affected product is the Buffalo (Melco) WBR-G54 Wireless Access Point

The infringement of the GPL consists of the following:

Your product makes use of Linux kernel version 2.4.5 and Busybox software, which are both licensed under GPL terms and conditions. The GPL allows copying and distribution of licensed software, provided that the complete corresponding machine-readable source code or a written offer to a complete machine-readable copy of the corresponding source code accompanies the product. As you have fulfilled neither of these obligations, you are in violation GPL terms and conditions.

Your product includes a kernel driver module that is inserted into the GPL licensed Linux kernel when the product is turned on. There is no possible way for the user to prevent the insertion of this module into the kernel. It is also impossible for the user to remove the kernel module from the running kernel. The operation of the included software on your product depends on the operation of the kernel module. For these reasons the kernel driver module is not offered as a separate work as described in Section II of the GPL and must therefore be distributed under the terms and conditions of the GPL. As you have not included the complete corresponding machine- readable source code or a written offer to a complete machine- readable copy of the corresponding source code you are clearly in violation of GPL terms and conditions.

Because of the huge liability your company could be facing I advise you to take appropriate measures to cease offering your product in violation of the GPL.

With Regards,

Richard Ten Brink
--------

Perhaps it's not a separate work from the programs that access it, but it's
certainly a separate work from the kernel. The kernel can operate just fine without the module. The module extends the kernel through a well-defined boundary.

The GPL says:

"These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it."

So is a Linux distribution "a whole which is a work based on the" Linux
kernel? Would you argue that RedHat can't include proprietary software on the same CD as the Linux kernel? All the software on the CD, assuming it's Linux software, likewise extends the kernel through a well-defined boundary.

DS

[ Please CC replies as I am not subscribed ]

In response to DS:

No, definitely not. If that were the case, SuSE and Lindows etc. etc. would not be able to distribute proprietary software together with GPL'ed software. The GPL calls this 'mere aggregation':

"In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License."

These wireless products are different. The user doesn't have a choice to use or not to use the non-gpl'ed kernel module. He can not prevent the module from loading, he can not remove it from the running kernel and the device doesn't operate without the module. The module and the embedded Linux OS on the device are so interconnected that they can not be considered 'seperate works' under the GPL. Therefore the kernel module actually is GPL software itself.

Buffalo Technology's response indicates that they agree with me (or perhaps they just don't want any trouble).

In response to Zack Gilburd:

They don't have to offer the source as a download under the GPL. They just have to enable you to get to the source. As soon as Buffalo puts on the their website that they use GPL'ed software (they said they would do that within 48 hours) you should be able to request and receive the source code of the embedded Linux OS as well as the source code of the kernel module.

Richard Ten Brink

But they're not just on the same CD. The additional work extends the Linux
kernel and is useless without it (or without something that emulates it).

So any software a Linux distribution installs by default has to be GPL?

That the device doesn't operate without the module says nothing about the
relationship between the linux kernel and the module. That they provide no interface to unload the module doesn't change the fact that there's a boundary between the kernel and the module that keeps them separate works.

Obviously, I don't agree. The linux kernel is totally usable without the
module. The module only extends the kernel through a standardized interface. This is sufficient, in my book, to make them separate works. That they are shipped on the same medium and that the user can't separate them is irrelevent -- you can't separate them if they're shipped on the same CD anyway without a scalpel.

The GPL can't declare a legal fiction and thereby make it into a fact. I
would think it's quite probable that a court would interpret the GPL's "work based on" concept to be equivalent to the legal concept of a derived work. Otherwise, the GPL can't restrict its distribution (a copyright holder has the right to control the distribution of derived works but not works that aren't derived, even if they meet the license's definition of 'based on').

Perhaps they just prefer to release the module under the GPL.

DS

This begun as a short reply, but I

ONLY if you are a customer, are you? If not, why all this noice? (They could require you to enter a serial number to get the source...)

A customer of a product B that uses GPL project A can
require the source for A. But what about the primary developer? Suppose the company charges an obscene amount of money for
the product (that might be an enhanced project A, like a patch to allow compilation on Win32) - the primary developer might not afford to buy that product.

One can hope that the customer is smart enough to release the source to the original developer... But there are no guarantees...

/RogerL

Roger Larsson
Skellefteå
Sweden

[ CC replies as I am not subscribed ]

In reply to DS:

A final attempt to convince you; after that it is back to the paid legal work for me :).

When you load a non-gpl kernel module (like that kernel driver module on the router) you 'taint the kernel', as it is called. After doing so, the running kernel is a 'modified program' under the gpl. Distributing a modified program 'as a whole' gpls (is that a verb?) the combination as a whole.

Under the gpl you are however allowed to distribute the gpl kernel and the non-gpl module separately, like NVidia does with their non- gpl kernel modules. Distribution on separate volumes would also be allowed (mere aggregation).

How do you distribute the two separately? My opinion is: definitely not by making the driver module load itself automatically, thereby tainting the kernel automatically, with no option for removal of the module, like the wireless router does. You have to provide the user an option to load or at least unload the module at will.

So how would you distribute a non-gpl module separately in a wireless router? I honestly don't know. Fact of the matter is that in my opinion it is quite scary to use a GPL'ed OS on an embedded system if you want to keep your modules a secret. It is a 'viroid'-license as Bill G. calls it, because of its license-infecting capabilities.

Regarding the "work based on" = "derived" issue: unfortunately I can tell you a lot about Dutch and European Law, but I know too little about American law to judge on that.

Regards,

Richard.

the" Linux

etc.

with

a

other

the Linux

emulates it).

choice

GPL?

kernel

about the

provide no

a

works.

can

without the

interface.

they are

same CD

fact. I

GPL's "work

derived work.

holder has

works that

'based on').

(or

Not exactly. By my understanding of the GPL, if you plan on distributing binaries outside of your corporation, you MUST make the source available to any and all third parties. In adition, you must bundle the source code with the binary.

That's just what I have read from the GPL -- IANAL.

Zack Gilburd
http://tehunlose.com

Please actually read the GPL License before you spew.

GPL only requires you to distribute source to those you distribute binaries to, not everybody. If the binary seller wishes they can provide source to everybody but it is not required.

- Bryan

no, you have to make source available to anyone you give the binary to.

you can't prevent that person from giving the source to the world, but you are not required to.

they could compress the source and stick it on the driver CD that they bundle with the product and you would not be allowed to duplicate that CD (it contains commercial programs), but you could copy the source off of the CD and put it on your website.

David Lang

Therefore, if Company A "sells" the package to anybody outside the company then it has to "make available" the source, including people like the primary developer.

But i think the second part of Zack's reply might not be right. The company A only needs to make "available" the source. it doesnt "have" to bundle the source with the binaries... (maybe make it available on the website or make some such provisions...)

robins

Just like Oracle, or Opera, or my sendmail binary, or a lot of other stuff. That they would be useless without Linux doesn't make them GPL. The GPL is quite clear; the head penguin also clarified that propietary modules are OK.

Now can we please stop this? If there is something to discuss around this, it is clearly _not_ kernel development.

Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

There is a choice of ONE of THREE options. Company A may EITHER:

1. include the source
OR
2. accompany the binary with a written offer for the source
OR
3. if it is a noncommercial RE-distribution of the binary, include the offer that was received in terms with #2.

If the binary is downloaded from somewhere, having the source available at the same place counts as #1.

IANAL, but that's how it all boils down for me. Hopefully that'll help someone understand that part a little better.

Brian Davids

There is no problem with that. Still, the company may choose not to release the product at all. But, if it does, anyone (any customer) can make that software public, as permitted by the license.

Krzysztof Halasa
Network Administrator

Horst,

Now stop being rational and using logic, this is all a touchy-feely issue. First thing is IANAL comes to the surface, and few can say they have a lawyer and less a team of lawyers. If you have proof, and filed your copyright with LOC goto court. Stop pissing around and making noise.

There are those who can do it.
The rest say they can.

The latter is a BOHA, and the former is serious.

Cheers,

Andre Hedrick
LAD Storage Consulting Group