Hacker News Reader

Comment by kogepathic | Hacker News Reader

> it's a good first step though

Not only is it a good first step, but since the product clearly runs Linux, the author should be able to download all GPL source code from Honeywell. Being able to build the device firmware yourself from source is hugely beneficial to understanding the structure of the firmware and can even help in understanding the behaviour of the device.

If Honeywell aren't providing a GPL archive for the Tuxedo with the kernel and any GPL licensed user-space programs, they are violating the GPL.

I'm not sure the author is aware that the source code for these should be freely available from Honeywell

View on HN

Honeywell does have a number of opensource projects, with tuxdeo touch being one of them http://www.security.honeywell.com/opensource/

Is running software/application in the Linux environment deem it a derivative work? Does Honeywell have to adhere to a GPL if they aren't modifying the Linux kernel?

It's not clear to me that they would need to follow GPL.

Yes, the licensing terms are on distribution, not on modification. They have to provide the source, even if it's not been modified.

They have to provide the source for the kernel and whatnot - but if the interesting stuff is in userspace applications which aren't derivatives of copyleft code, they don't have to provide the source for _those_

> but if the interesting stuff is in userspace applications which aren't derivatives of copyleft code

Of course. Honeywell can run their own proprietary applications on top of a Linux/GNU system. I didn't mean to imply that you could request the source code to every program running on the device.

However they need to provide the source code for any GPL licensed portions. IIRC they should also provide build scripts so you can create a firmware image yourself.

GPL only requires providing build scripts for GPL software. In this case it means they can't strip kernel makefiles from the kernel source to make it harder to build independently.

True. Though Honeywell can elect to mail you the source code printed on flash cards without any particular order.

I don't remember what the GPL3 says, but the GPL2 (Linux is under GPL2) says something like "a medium customarily used for software interchange" must be provided.

That seems a tad excessive. Does any company do this, outside of high security systems?

That has nothing to do with security, and everything to do with malicious compliance.

Reply on news.ycombinator.com