From rick Thu Jul 12 13:13:39 2007 Date: Thu, 12 Jul 2007 13:13:39 -0700 To: linux-elitists @zgp.org Subject: Re: [linux-elitists] ultra 20 m2 X-Mas: Bah humbug. User-Agent: Mutt/1.5.11+cvs20060403 Quoting Steven Critchfield (le @drunkenlogic.com): > A derivative work is one that _INCORPORATES_ portions of other code. Actually, that incorporates substantial amounts of copyrightable expressive elements. Such copying can be either literal or non-literal: See, for USA jurisdictions, the decision in Micro Star v. FormGen, Inc., 154 F.3d 1107 9th Cir. 1998, where a competitor's game program was ruled derivative even though it didn't have a single line of code in common with the original; the copy incorporated audiovideo display data, a protected creative work, from the original, thereby incorporating the "story" (not the story idea, but its various expressive elements) of the original game. > This is why some people consider the GPL to be a viral license. > Specifically if you can't stay at arms distance from it,.... ...which means nothing more than avoiding using someone else's copyrighted creative works without permission.... > you are likely going to be required to release under the terms of the > GPL. Rubbish. Infamous misinformation, at that. Let's say I was working, some years back, at a Linux firm when one of these issues came up. I could probably name the firm without harm because it can't seem to make up its mind what its name is, but that's a bad habit, so I won't. Let's say an e-mail request came in, one morning, for matching source code access per the terms of GPLv2 clause 3b from a pleasant-sounding guy at Mountain View Data, who noted that the firm had published a binary RPM of an ndmp backup utility coded from a programmer in, say, New Hampshire. He noted that the firm's version, which it published as part of a Red Hat variant distro for clusters, seemed to have improvements, and he wanted to see them. This was referred to me as the firm's unofficial licensing guy. The request sounded sensible to me, and so I inquired with Software Engineering about source -- and they panicked. It turned out that some failure of communication between Professional Services and Software Engineering had permitted some code from two of the firm's major business partners, which was proprietary and shared under NDA, had been added to the GPL ndmp by one department, and then released to the public by the other department without double-checking code provenance.[1] I sent a summary of the situation to Jay S., the chief company counsel, waited half an hour, and went to knock on his door. Now, Jay is a very sharp fellow, and I was always proud that Jay considered me relatively clueful for a non-lawyer, so he would often let me work things out rather than hand me explanations on a platter. RM: Let me guess: We're not going to provide source code to the Mountain View Data guy. JS: No, we aren't. RM: But we _are_ obligated to do so under the terms of GPLv2 clause 3b that we accepted when we made derivative works and redistributed, right? JS: Yes. RM: Hold on. Let me work this out.... Failing to provide the source violates the New Hampshire guy's copyright, which is a tort, because we've been carrying out actions permitted only if we meet that obligation.... This is going to be one of those situations where we are forced by circumstances to choose between two torts, and so are picking the one that's harmless, right? JS: Right. RM: OK, complying with the request would mean violating our contracts with [names of the two heavy-hitter business partners], and being in breach of contract with them would be very bad, subjecting us to possible serious tort litigation as well as souring important relationships and ruining our reputation generally. So, very bad outcomes if we do that. On the other hand, let's say that we cease offering the modified ndmp package to all outside parties right now. We've been violating the New Hampshire guy's copyright in a very minor way up until now, but (1) he almost certainly didn't know about it, and didn't complain, (2) he's probably suffered about zero demonstrable economic loss aka "actual damages", which is all (other than enjoining further infringement) that's even potentially available unless one has registered one's copyright with the Library of Congress either prior to infringement or within three months of publication, (3) almost no open source coder bothers to register (which allows collection of statutory damages plus attorney's fees), because it takes $35 and some paperwork. The New Hampshire guy would have standing to sue, but isn't motivated, isn't annoyed at us, and couldn't collect anything -- and we're just about to fix the only thing that could annoy him. The Mountain View guy completely lacks standing concerning the ndmp code (not being the affected copyright owner), and therefore couldn't even potentially sue anyone. JS: Right. RM: So, we're going to reply back to the Mountain View Data guy saying, "We're really sorry for the inconvenience, but the modified ndmp code was made available in binary RPM form accidentally, and should not have been. Accordingly, we've removed it from the ftp site." And thus we'll have fixed the problem _and_ done the right thing. JS: You got it. Another case that should be more familiar: NeXT, Inc. started distributing binary-only releases of modified gcc, hacked to include ObjC (and, IIRC, C++?) support. FSF asked politely for the source to their changes; Jobs and company initially stated that this was contrary to their company policy. What happened next is frequently misrepresented, in recountings. It is -not- true that NeXT, Inc. was "required" to release its source modifications to gcc under GPLv2. It had been committing the tort of copyright violation, but tort law _nowhere_ has the power to compel violators to release their changes to the public. That's not how it works. If Jobs had wished, Next, Inc. could have said something like "Oh, we misunderstood, but wish to do the right thing, and are therefore ceasing effective immediately to distribute our modified gcc. We apologise for any problems this causes." What would FSF's recourse have been? Absent gcc copyright registration, it could have sued for an injunction ordering cessation of infringement (pointless, as it would have already ceased), and for actual damages, which would have been nil. With copyright registration, it could have done the same, but sought statutory damages plus attorney's fees. Statutory damages are in a range subject to the judge's discretion, but, if defendant credibly claims to have been "not aware and had no reason to believe" they were infringing copyright, damages would typically be $200 per work.[2] So, FSF would have about zero motivation to sue, even if they hated NeXT, Inc.'s guts and wanted to punish it. My point: NeXT, Inc. _elected_ to give back source code, after the obligatory initial period when they behaved like jerks, not because they had to (which they absolutely did not), but rather because it was greatly to the company's advantage to be able to give/sell customers compilers with enhanced language support. So, Steven: Please do not continue to spread that ridiculous and erroneous assertion about infringers supposedly being "required" to release changes. It's done more than enough damage, over the years. [1] http://linuxmafia.com/~rick/lexicon.html#stepwise-disaster [2] http://en.wikipedia.org/wiki/Statutory_damages_for_copyright_infringement http://www.law.cornell.edu/uscode/html/uscode17/usc_sec_17_00000504----000-.html From rick Thu Jul 12 14:42:21 2007 Date: Thu, 12 Jul 2007 14:42:22 -0700 To: linux-elitists @zgp.org Subject: Re: [linux-elitists] ultra 20 m2 X-Mas: Bah humbug. User-Agent: Mutt/1.5.11+cvs20060403 Quoting Steven Critchfield (le @drunkenlogic.com): > Yr. welcome, sir. I've been meaning to publish some account of that illustrative incident at the unnamed Very Ancient Linux Systems firm, specifically because this misconception is so widespread, so this was a welcome opportunity. > Okay, so the required wording is over the top. One would be required to > release as GPL or GPL compatible license code that one still wishes to > distribute. The alternative is to stop distribution and hope that the > limited damage created isn't worth the original authors wishing to sue. I suppose a third alternative might be to not care if the authors sue. (See below.) The main point is: Remedies for infringement are limited to ones traditional for torts (a term meaning failures of private duties to other firms or companies, resulting in non-criminal wrongful acts), and simply don't ever include court-mandated source release. An infringed copyright owner can sue for: o Injunction against additional infringement. Pointless if infringer has already stopped. o Actual damages. Typically an open-source coder will not be able to prove any. In the staggeringly unlikely event that the owner has _also_ filed a timely copyright registration with LoC, and paid his/her $35: o Statutory damages. For reasons cited, we're talking $200, in a typical case of an open source codebase and a colourable claim of accidental infringement. o Owner's attorney fees. Close to nil if the infringer immediately files a response with the court saying "Er, we did that but it was accidental, so we'd like to petition for judgement or settlement to that effect." So, plaintiff's haul is likely to be laughably small, which underlines his/her lack of motive for suing in the first place. -- Cheers, "I don't like country music, but I don't mean to denigrate Rick Moen those who do. And, for the people who like country music, rick @linuxmafia.com denigrate means 'put down'." -- Bob Newhart