French court issues damages award for violation of GPL | Hacker News Reader

French court issues damages award for violation of GPL

heathermeeker.com

> Entr’Ouvert sued Orange in 2010

How such a simple thing could take 14 years to untangle?

How could anyone trust in courts that have such a spectacular efficiency?

Hi, developper of Lasso from Entr'ouvert here (sorry for the english, I'm more used to talk about programming than french law):

It took so much time for many reasons :

* first the judge advised us to try to mitigate, mitigation failed because Orange/FranceTelecom did not want to mitigate anything (we asked in mitigation for nearly what we won in the end),

* we returned in tribunal, and the judge asked for an expertise to see if really the fact that Orange linked their program with Lasso inside an Apache module was violating GPLv2,

* we lost on first instance,

* we made appeal and won but not on the counterfeiting accusation, only on some other kind of violation in French named "parasitism", the fact is french juridication doctrine on "licences" was that is was a contract, and only a contract and the could only invoke civil contract law and not use counterfeiting laws,

* we did not agree with that, and neither did the european justice court, so we asked the french equivalent of the 2nd circuit (Cours de cassation) to overrule the court of appeal doctrine,

* we won in the cours de cassation,

* so we returned to the appeal court and we won.

And here we are.

The inefficiency come from many aspects : * french judiciary lacks money and resources, it's not new, everything is slow, budget of ministry of justice by citizen, is half or one third of the same budget is germany, but for specialized justice like counterfeiting of software, it's a special court, which should be faster than for usual civil law,

* BUT france is not California, litigation about software licences and especially free software licence is extremely rare, and usually between commercial entities which have real contractual obligation between them, so that the court can concentrate on the commercial aspect (you owed so much, you had to deliver this and did not, etc...) here we did not have any commercial relation with Orange on this project (we had a long time ago on other project not related to the one for which they used Lasso)

* ALSO france has very special doctrine called (in french) "non cumul de la responsabilité contractuelle et délictuelle", it means that if there is some kind of contract between you and a third party, that imposed them to not violate some law which can also be an offense/crime, the invoked responsibility can only coming from the contract and not from the offense/crime law (counterfeiting is an offense in France), so we had to break this doctrine in "Cours de cassation" before being authorized to litigate on counterfeiting.

> we asked the french equivalent of the 2nd circuit

Minor note: not really the French equivalent of the 2nd circuit

US (federal) courts are like: district, appeals (e.g. 2nd circuit, 9th circuit, cafc, etc), supreme. The circuit courts are all on the same level, they don't hand cases between each other.

French court has another layer in there? And moreover, it's not geographically separated, but rather by subject matter? (US has only one such court, the cafc).

E.g. you can't remand from 2nd circuit down to an appeals court, because there is no appeals court underneath the 2nd circuit.

But you also can't say that court is like the supreme court, because there is a constitutional court above it, which is the analogy to the US supreme court

Yeah, Cassation Court is a sort of sub-Supreme Court. It has the ability to break rulings (French casser, hence the name) if the law wasn't well done, or if the wrong law was applied to the case, or if some judicial norms (laws, basic rights, jurisprudence) were not balanced correctly in a ruling ; It does not rule on the facts of the case, only on the way it was judged.

Rulings of the Cassation court are usually applicable as case law, which is much less common in continental legal systems than it is in Common Law legal systems.

By the way, the French legal system has two main circuits ("orders") : the judiciary order (penal and civil) and the administrative law order, which handles disputes and trials between government entities (local, regional, or national), and between government entities and private entities (in most cases). The equivalent of the Cassation court in the administrative order is the Conseil d'Etat.

Seems cool

I'm just psyched to learn it has multiple separate subject-matter segregated appeals courts. Always looked like a saner approach than geographically separating circuit courts. Get judges with more specialized expertise in various areas.

And "circuit" in the US is about region, not hierarchy. California has a hierarchy of federal courts and as 9th circuit, they are allowed to rule differently from the hierarchies of federal courts in Texas (in the 5th circuit) or Colorado (in the 10th). They don't have to but they can.

At some point, if the US Supreme Court steps in (which they don't have to), one reasoning gets picked (or yet another one cooked up) which then stands for all regions and the courts are then strongly dissuaded from screwing with it any further.

Merci pour l'explication, je pense que c'est très claire en anglais!

I guessed the meaning (with a little French vocabulary knowledge), then checked with Google Translate, and my guess was right. It means:

Thanks for the explanation, I think it's very clear in English.

https://translate.google.com/?sl=auto&tl=en&text=Merci%20pou...

Good on you for starting the the course. I’m sure this will have a chilling affect on big companies that think it’s ok to ignore licenses.

So Orange won 12 years time to pay whatever you won in the end?

That's a factor of about 2.2x, assuming 7% capital gains year-on-year.

If the sums are large, it would've made a lot of sense for Orange to delay the decision for 12 years until having to pay.

But I'm not sure at all of the sums here were that substantial.

Isn't that assuming that Orange's legal costs would have been the same whether or not they settled?

> That's a factor of about 2.2x, assuming 7% capital gains year-on-year.

Why would you assume 7% year on year? Did you look into Orange's stock price or quarterly/yearly reports, or did you think all companies have the same return as investing in the S&P500 would have?

https://www.boursorama.com/cours/1rPORA/

e.g. over 10 years, their stock price is roughly the same as it was back then after a few years slightly higher.

7% is (roughly) what you can make by investing in ETFs tracking some "world market" index like MSCI World, FTSE All World, et cetera, averaged over long periods.

That stock pays dividends of about 7.07% a year it seems

Did you mean "copyright infringement" instead of "counterfeiting"? Counterfeiting is when you make a knock-off product and claim it's the original.

Also I assume "mitigation" is "settlement"?

In French "contrefaçon" is the act of violating some "intellectual property" right including but not limited to copyright, so it's very broad.

I don't think there's an exact translation.

Mitigation from context means arbitration.

More likely to be mediation than arbitration.

Yes, it was mediation.

I think he meant "litigation" which is quite transparent and can mean arbitration.

How did you find out that Orange had actually modified the code?

Because the judge allowed to seize the source code, it's called "saisie contrefaçon" in french judicial slang.

>(we asked in mitigation for nearly what we won in the end),

did you also get your legal fees paid for, which is often a thing in various European lands - not sure in France?

It doesn’t end here. I won money this way and getting them to actually pay is near impossible unless you want to burn like $50k on lawyers putting caveats on all their stuff.

Like, the law is so broken, nothing happens if they just don’t pay. Eventually your “win” can expire after 13 years or something and if you didn’t collect the money then it’s no longer collectible.

Not sure what country you are in, but in France if the other party is not going forward with it you use a "commissaire de justice", which is a regulated profession with special powers and will be able to seize money straight from the other party bank account (while taking a fee and a % for himself for his services). It works whether the other party is a legal or a moral person, they're also allowed to get inside their home or office and seize physical things, or even put a place for sale. See [1].

You need a "titre executoire", which a judgment in court is. If on the other hand you have a simple normal everyday contract and the customer isn't paying for it, you can ask the court for a titre executoire, where the other party can argue and the judge can check whether it was a real contract / you delivered / ... and if yes will give an order to pay -- it takes between 2 weeks and 3 months in my experience, if you get the titre and the other party still doesn't pay then you can use the commissaire de justice de seize from their account.

If your contract is for a sum below 5000 you don't need to involve the court, only to have tried amical resolution before, and then the unpaid contractual debt act as a titre executoire by itself, that the commissaire can act on (though as that point the other party is allowed to involve a judge to protect themselves if needed or wanted).

They usually send a notice to banks and banks have to return what accounts they own for said person, to allow the proportional seizure.

Now this has limits of course, most importantly if the other party is insolvent, or if the commissaire cannot find their assets or they don't have any, etc ... But for a company like Orange, it's a non issue.

This will be paid, one way or the other.

[1] https://www.service-public.fr/particuliers/vosdroits/F922

Sounds a lot like what in Britain are called the bailiffs, or (in more modern language) court enforcement officers.

Bailiffs are just one option [0]. But, as in France, you have to go through court to trigger any form of collection after non payment of a judgement.

0: https://www.gov.uk/government/publications/what-to-do-if-a-d...

No you don't have to ? The judgment itself act as a "titre executoire", it's an order to pay that you can give to the commissaire de justice, not involving the courts anymore.

It should take 1 or 2 months to get the money, it's nearly automatic even if the loser want to go again to "cours de cassation" (french 2nd circuit).

Which law is broken? Why are you talking in $ when the court case is in France?

And the violation might've been even earlier (since the contract was 2005).

650K euros is not a lot of money for a big company in any year.

Getting away with the violation for 14-19 years before losing an appeal and finally paying up just seems petty.

Orange S.A. made €43.47 billion revenue last year ($4.8B operating, $2.6B net).

If I made $100k / yr, this is like fighting in court for two decades over $1.

[1] "Orange S.A. Consolidated financial statements", https://gallery.orange.com/finance#l=row&lang=en&om=eeeb89fa...

If I was a lawyer for this company, I'd be telling my boss we won. Decades of reselling something we didn't own for a pittance of a fine is a win in my book.

They never reselled it, I have no proof of that but I'm pretty sure of it, in fact the use of this software stopped in 2016 when the french state site mon.service-public.fr stopped (see https://fr.wikipedia.org/wiki/Mon.service-public.fr), software was used from 2009 to 2016, by a french administration named DGME, so 7 years. Orange extended its own identity provider (used in their old ISP trademark "Wanadoo") which was some kind of proprietary SSO protocol a bit like CAS, and extended it with Lasso to deliver a real SAML identity provider for this project to French state); they never have any incentive to use it for themselves and they do not resell softwares anyway.

The background of all that is only supposition from me (we participated to the same project as the contractor of another administration, la Caisse des dépôts et Consignation, but we were never inside the project of delivering Mon.Service-public.fr itself which was the project won by Orange Business Services and using Lasso), but I think it happened because an engineer was expected to deliver the software but its managers never asked him how he would do it, and at some point someone waved the problem of the license away because everything was too late anyway. It's just my own big corporation fiction, your mileage may vary.

It's easier to say sorry than ask for permission

EAFP is the acronym, even used in Python.

https://docs.python.org/3/glossary.html#term-EAFP

Our supreme court got involved, I don't think that's a fast process in any country.

What you say is true, and relevant to the discussion, but... it doesn't answer anything. A very long and dragged out process takes away the justness of it all, and the fact that the supreme court was involved does not change that in any way. If you're a victim, the courts are supposed to provide a remedy. Even the supreme court. That's at least part of their reason for existing. If you have to wait 14 years for a remedy, they're not doing their job right, no matter how supreme they are.

The fact that it goes the same in other countries also doesn't help. The system is broken everywhere, that's all.

Sadly, "justice" isn't the job of the supreme court, it's to interpret the constituion. If it takes 10 months or 10 years, that's not an issue in the grand scheme of things.

For the US, the right to a speedy trial is for criminal cases, not civil. And I don't think breaking software licenses is a criminal act unless a mass of damages were done. That's basically the logic that LLM's are working off of right now; get into dubious lawsuits and become top of the food chain by the time the litigation settles.

Heck, quite a few pieces of tech work that way. Lootboxes came and went in western video games before it even had time to be challenged.

Just so you know, the role of the supreme court may not be 1:1 between what you're used to in the US and the rest of the world

In France the supreme court's role isn't tied to the constitution, just the law. They're to dictate which ways the law is to be interpreted and homogenize the decisions by the different lower courts.

We have a different (actually, two...) administrative organs that ensure that the law follows the constitution

> They're to dictate which ways the law is to be interpreted and homogenize the decisions by the different lower courts.

FWIW, the U.S. Supreme Court also has this role. People focus more on their constitutional cases because those are the most impactful/famous, but a lot of their workload is just interpreting normal laws, especially ones that have diverged among the various lower courts.

There is no explicit limit on the role of the supreme court. Nor is there any actual explicit role in the constitution for it. It's just one sentence. I think they even once tried a criminal case.

It deals with lots of constitutional issues, but Congress could basically just defund it and remit constitutional complaints to other venues if they wanted to. This is done in part with FISA and other national security measures. Congress deemed there to be no venue in the courts for a complaint.

Conseil constitutionnel + ?

Justice in France has been broken and supremely inefficient for a very long time unfortunately.

I find that a lot of support services for individuals are like that in France, technically there but made ineffective because they are very slow.

It's the same in all the western countries, that's the point. It's better than nothing but not enough at all

I was involved in a high profile business case that took over 6 years and went up to the Supreme Court. Another case I was involved in years ago took 7 years to resolve.

I've heard stories that India was the worst with some cases passing down through generations over 50 60 70 years.

Are there any (democratic) countries where the courts run efficiently?

I just waited in jail for 10 years in the USA for trial while the lawyers just got a series of continuances and then the prosecution dropped the case. So, the USA is definitely not exempt. I've had civil litigation go on for a decade in the USA too, which I don't think is uncommon. Sometimes you'll go around to an appellate court multiple times which adds, say, two years each time.

If you look at death penalty cases in the USA it can take more than 20 years to exhaust all the appellate courts.

Wow. Did you get any compensation for those years?

No, sadly, where I live you only get compensated for being in prison after conviction. If you spend 10 years in pre-trial detention and are acquitted you are not eligible for compensation.

Wait, you were in jail for 10 years? What happened?

Justice is very slow in France.

Every year a lot of cases are closed because there's nobody to work on them.

Are there similar countries where Justice is significantly faster, though?

Why are we expecting a blind woman to be fast, anyways?

It's slow for resolution on an individual instance, but if its establishing stronger precedent on all future situations then perhaps it's good that the details were tracked through.

One thing to note is that the library was also available for commercial licensing from the start. Makes it easy to demonstrate harm and establish damages.

Now we need two more landmark cases:

- one that awards damages for a pure GPL library that doesn't have commercial licensing available

- one that exonerates some company that is LGPL compliant but is sued by the likes of Digia in hope of squeezing some money out of them

For the first one, a forced release of source code is more important than the damages.

I would also like to see a few AGPL cases to demonstrate its validity.

Not a lawyer, but IIUC it's never going to be the case that a GPL violation legally compels someone to release the resulting source code. There is no rule in copyright law that says you have to do that, and the GPL is just a license agreement at the end of the day, not a law. The best you can do is say you'll collect some fine for copyright violation or breach of contract if they don't release the source code, which was the issue of substance here too.

As an analogy, if I have a plot of land with a sign that says "$1 million to enter", and someone enters without paying, the worst I can do is something like a trespassing charge, not collect $1 million because the sign said so.

> There is no rule in copyright law that says you have to do that, and the GPL is just a license agreement at the end of the day, not a law. The best you can do is say you'll collect some fine for copyright violation or breach of contract if they don't release the source code, which was the issue of substance here too.

In the US, a GPL can be both a license and a contract at the same time [1]. The distribution rights granted by a GPL to the user are conditional on the user's compliance with the GPL.

Contract law allows for punitive damages. Copyright law allows for 1. permanent injunctions against the defendant's continued use and/or distribution of the copyrighted work and 2. statutory damages xor actual damages. Every GPL requires distribution of source code under the same licensing terms to users already given the object code, so the party suing to enforce the GPL can request that the court compel distribution of the source code; the court can agree or disagree. The court can also decide to give the GPL violator the choice of 1. releasing the source code or 2. no longer distributing any copies or derivatives of the GPL'd software until the violator releases the source code or 3. whatever else. The court may impose a punitive fine in any case.

[1] https://sfconservancy.org/news/2022/may/16/vizio-remand-win/

Tangential question (not a lawer, either): The damages to the copyright holder are one thing. What about the damages of the users of the software, though, due to the fact that they couldn't access the source code and modify it to their liking, which is what the GPL promises them? And what about damages incurred by competitors who, in their software, complied with the terms of the GPL and made their source code available?

I know, those are all very hard to quantify but still.

This is true until a Judge decides otherwise under penalty of permanent imprisonment.

As for the AGPL, the AGPL is regarded as the most deadly toxic irradiated poison ever concocted to big tech. You'll be in a very serious meeting with your supervisor, HR, and lawyers if you use AGPL code in big tech. But they'll more likely just outright terminate you. If you maintain a prominent AGPL project, they will not hire you and put you on a blacklist when they find out.

The virality of the AGPL is something no lawyer wants to test in court. They're scared shitless of it.

Off-topic, but does anyone know any good lawyers for enforcing the terms of open source licenses based in the EU?

Everyone we’ve used in the US doesn’t want to tackle something from Europe. They’ve recommended a firm but just figured I’d collect a range of opinions from here given the context.

Do you know what the licensing cost was? Wonder if Orange came out ahead.

650k euros penalty over 15 years nearly..

The headline implies a win, but I'm not so sure... $820K USD isn't a deterrent and to the plaintiffs, it's minus 100s of hours, distraction and legal fees which will be high given the complexity.

In France the loser must reimburse the winner's legal fees, so those damages are likely in addition to paying Entr’Ouvert's legal costs: https://manhattan.institute/article/to-curb-abuse-in-civil-c...

Presumably not their own costs (time spent, stress, miscelanneous expenditures incurred due to having to attend court) though, right?

NAL, but I think these laws typically include all reasonable expenses, but that you'd need to justify/receipt those expenses. So, travel to court each day, accommodation, anything related to running the case, sure. Stress, unlikely because you can't attribute a direct value to it. I think opportunity cost is the biggest for most people, you almost certainly wouldn't be able to claim lost revenue due to your time in court.

No, the french judiciary system is clearly advantageous for big actors, the article 700 (right to be reimbursed of expenses) is a flat fee estimated by the court event if you give every receipts, we got 60k euros, which a less than we spent, which is I think around 100k for 14 years of litigation (we never tried to make the sum as we did know it would no be useful in the end), plus others costs like expertise fees which were shared 50/50 between us and Orange/FranceTelecom.

Entr'Ouvert's website suggests they could've offered a commercial license. Possibly that would've cost Orange less than $820K/€500K. So maybe we should compare that, instead of the full replacement cost.

Entr'Ouvert's offering in 2004 was 500k€ or 0.4€ per users.

Les sociétés Orange versent au demeurant au débat un mail interne de la société Entr'Ouvert en date du 16 septembre 2004 s'inscrivant manifestement dans les négociations commerciales au sujet de la licence du logiciel LASSO faisant état de deux propositions, soit « une licence Lasso illimitée à 500.000€ ( à débattre :))) » ou «une licence Lasso par utilisateurs à 0,4€ (c'est la solution que je pousserai volontiers (') ». Elles versent également une autre proposition commerciale de la société Entr'Ouvert en date du 23 juin 2010 portant notamment sur une licence commerciale du logiciel LASSO dans le cadre de projets en cours de France Telecom pour lesquels un prix de 250.000€ est proposé.

It does set legal precedent though which is great.

The legal precedent: « IF you’re sued and IF you’re found guilty, then you MAY have to pay LESS than the inflation adjusted cost of paying a commercial license, 20 years in the future »

Not really. This is just the beginning. Governments are leaning into open source and will likely see protections like this, and their enforcement as helping secure the open supply chain. Which is something they’re already trying to do.

I’m not sure about the rest of you out there with companies, but for me the trend seems clear and I’m gonna be much more cautious going forward with the kind of licenses I use both as a vendor and buyer.

France has a civil law system where precendent is not binding nor persuasive.

Is it so different in practice?

Landmark decisions ([0], [1]) set precedent. The conseil constitutionnel has ruled that its precedent is binding [2]. In fact the majority of current constitutionnal law in France was willed into "constitutionnal" status by a landmark decision of the conseil [3]. I mean precdent can move _laws_ to the _constitution_ (see [4]). That seems pretty binding and persuasive.

[0] https://fr.wikipedia.org/wiki/Grands_arr%C3%AAts_en_droit_ad...

[1] https://fr.wikipedia.org/wiki/Grands_arr%C3%AAts_de_la_Cour_...

[2] https://www.conseil-constitutionnel.fr/decision/1962/6218L.h...

[3] https://fr.wikipedia.org/wiki/D%C3%A9cision_Libert%C3%A9_d%2...: essentially, the council ruled that the preamble of the constitution also had constitutional value (which was not the case previously and still is not for laws) - since it also mentions other texts (the preamble of the 1046 Constitution, the 1789 Bill of rights, etc. those texts also have the same legal power as the constitution.

[4] https://en.wikipedia.org/wiki/Fundamental_principles_recogni...

But it does provide clarified opinion on how to apply tge law in similar cases, and that will be followed in future cases.

That's how it works in Germany, and in principle our systems are similar enough.

It doesn't even matter if it will be considered for other cases - simply having an example showing that yes the GPL can be enforced will work as a deterrent before things even go to court.

Is that also true of opinions of the French supreme court?

In Denmark, another civil law system the highest court can give judgement in cases of principal character that should be followed in the future.

A precedent doesn't have to be binding to be effective

From the article:

> The compensatory damages were based on both lost profits of the plaintiff and disgorgement of profits of Orange. Moral damages compensate the plaintiff for harm to reputation or other non-monetary injury.

Sounds like they had their profits from the breach taken away, and they also had to pay extra in "moral" damages, and also likely would have had to pay both sides' legal fees, as well as having to sink hundreds or thousands of hours into the case.

Damages for breach of IP rights (or contract) are generally calculated on the basis of well defined principles, it's not like where a regulator is handing down a fine and has a broad level of discretion to come up with whatever number it deems fair in the circumstances.

Not to mention it took 14 years for this case to be resolved. I don't know if the defendant continued infringing over all that time, but $820k for a "license" to do so for 14 years seems like not a big deal.

Sounds like one of those fines that most companies would just shrug off as a cost of doing business. If I were the defendant's lawyer, I think I'd be pretty successful at framing this to my client as a win.

> Orange used the Lasso software in the solution, but did not pass on the rights to its modifications free of charge under GPL, or make the source code to its modifications available.

Has Orange now made the modified code available? The artice doesn't mention that.

"dual licensed", is much more likely that Orange buy a commercial license

Primary source: https://www.courdecassation.fr/decision/65cdbcdf2425a7000825...

Orange has to pay €860k[1] (≈ $934k) + lawyer fees to Entr'Ouvert.

[1] €500k + €150k + €150k + €60k = €860k

It's way more, 4 100 000 €

3 millions euro for copyright, 500 000 € for moral damage, 500 000€ for the money Orange made and at least 100 000€ for the lawyer fees plus 1/3 of the remaining fees.

And 3 ADs in IT magazine(to show what Orange did wrong).

In the document :

- Condamner in solidum les sociétés Orange et Orange Business Services à payer à la société Entr'Ouvert les sommes suivantes :

3 000 000 euros (trois millions d'euros) en raison des conséquences économiques négatives de l'atteinte aux droits d'auteur de la société Entr'Ouvert, dont le manque à gagner et la perte subis,

500 000 euros (cinq cent mille euros) au titre du préjudice moral subi par la société Entr'Ouvert,

500 000 euros (cinq cent mille euros) au titre des bénéfices réalisés par les sociétés Orange et Orange Business Services.

- Autoriser la société Entr'Ouvert à procéder à la publication de tout ou partie de la décision à intervenir après signification de l'arrêt, dans trois magazines professionnels spécialisés choisis par la société Entr'Ouvert, ainsi que sur les sites internet des sociétés Entr'Ouvert et Orange, aux frais d'Orange, dans la limite de 5 000 euros HT par publication ;

- Condamner in solidum les sociétés Orange et Orange Business Services à payer à la société Entr'Ouvert la somme de 100 000 euros (cent mille euros) au titre de l'article 700 du code de procédure civile, ainsi qu'aux entiers dépens en ce compris les frais d'Huissiers dont ceux relatifs à la saisie-contrefaçon.

No, 4.1 millions was the request (“Entr'Ouvert, appelante, demande à la cour de...”; later, “La société Entr'Ouvert soutient que...”). What was awarded is in the section “Dispositif”, the rest of the document is just the recapitulation of the case, including what was requested by both parties.

Interesting detail in the judgement:

Orange's had lawyers argued that the GPL was in English and that the translation offered was invalid, and that its dispositions were contrary to French law. The judges seemed particularly ticked off by this argument, noting that the lawyers did not bother to point out any examples of either point.

That’s really absurd, if two companies from non-English-speaking countries couldn’t sign contracts in English basically all of international business would collapse.

Being sarcastic, I bet the commercial license from EntrOuvert was way cheaper than 860k, this horrendous decision should mean firing of the managers involved in Orange, but being a semipublic company the incentives are wrong and these managers probably have promoted since then.

Well, turns out the CEO of Orange back then was Thierry Breton, and indeed nowadays Mr. Breton is a European Commissioner, so things turned out pretty well for him.

I wouldn’t say having a reputation as counterfeiter and ripper off of open source IP, as “working out pretty well” but YMMV, I guess it depends on your value system hahahahaha! :)

If they haven’t been promoted in the 14-20 years since the violation occurred, their career has really stalled.

The first sentence on "https://lasso.entrouvert.org/" starts:

> Lasso is a free software C library [...]

I wish people would stop saying "free software".

It was confusing from the beginning, and hasn't stopped being confusing.

Imagine RMS saying, "I'm glad you asked that. By 'free', we don't mean free as in beer (nor what everyone means when they search for some kind of 'free software'); we mean free as in freedom. Which I will proceed to speak about for half an hour, now that you're engaged by this small bit of wordplay that you had no reason to suspect was wordplay."

(Not that the ambiguity of "free software" was the cause of the Orange violation of Lasso. But, really, please stop calling it "free". Say "GPL", or some other license, or "libre", or anything other than "free".)

Ironically the French language makes the distinction where English doesn't:

Libre - free as in 'You are free to do as you wish.'

Gratuit - free as in 'I’ve got two free tickets for the film.'

I wouldn't call it ironic, I'm pretty sure there's two separate words for free in the vast majority of languages. English is the outlier, not the other way around.

English used to have "gratis", but it’s not used anymore.

In French (which matters in this particular case since all actors are French) there is no confusion between "logiciel libre" and "logiciel gratuit" though. There isn't a word that can mean both.

I think these days in English the acronym FLOSS is the most common word for free as in freedom software.

Nah you got it backwards. Stop using "Open". It cheapens and confuses the goals and purpose of Free software.

I think it's fair to say -- sadly -- that most people don't even know of the FSF's goals, and think "free software" and "open source software" are the same thing. And I don't think we're going to fix that problem by insisting random people use the terms properly.

"Free" is a terrible word to use in English for this concept. It gives the absolute wrong impression, and no one is going to sit through RMS lecturing about "free as in speech, not as in beer". It's a pity English has such a common word with two meanings like that.

To use your phrasing, the choice of the world "free" cheapens (literally!) and confuses the goals and purpose of free software.

If your slogan requires that you define a word or words in it, it's probably not a good slogan.

Should've named it Freedom Software. As an additional bonus it would instantly win over half of the US population.

To be fair, the second sentence is

> Lasso is [...] licensed under the GNU General Public License

Agreed, I think this is something the English language community should solve.

IMHO, I think “free” should be reserved for the wider meaning encompassing all the various aspects of freedom.

And a (new?) word like “gratis” should be used for the you-dont-have-to-pay-money-for-this-now meaning.

"Gratis" isn't new in English; unfortunately it's just fallen out of use.

The problem is that even if we were to re-adopt a word like "gratis", it would take decades, at best, before using "free" to mean the same thing would fall out of the collective consciousness. So even if people agreed to start using "gratis" to mean "without monetary cost", you'd still end up with plenty of people getting the wrong impression from a term like "free software".

The best way to fix it is to have a new word for free-as-in-speech. If we could adopt "libre", and start calling it "libre software", it would probably require less explanation. Or, rather, it might still sometimes require explanation (because some people just won't know what "libre" means at all), but it won't cause people to immediately assume the wrong thing, at least.

(I also enjoyed another poster's suggestion to call it "freedom software", and thus immediately gain the support of a certain half of the US population that tends to shut off their brains when they hear the word "freedom".)

Or at the very least call it capitalised Free Software, to make it clear you're using a marketing term (in this case, RMS's).

It can't be that bad considering they actually delivered and achieved the goal of an entirely free Unix clone.

Yes, but even reading your sentence, it's not clear whether you intend to mean that unix clone is without cost, or libre. I think most people (especially non-technical people) would assume the former.

Why have I never heard this argument applied to the concept of free speech?

Because software is often sold/licensed for money and "speech" isn't?

Because "free speech" as a term of its own is already well-known and well-defined, fairly universally in US culture. "Free software" is only known in tech circles, and even then it isn't always particularly well-known or well-understood.

In a way it's an education problem, but it's also a "why should I care about this topic?" problem, for which the vast majority of people will -- quite reasonably -- answer "I shouldn't".

Just set my code on one project from MIT to GPL, since it's a personal project without public funding. I was expecting this kind of consequences if someone breaches the license, I'm glad it's the case.

You're glad that you have to pay lawyers for a decade to get some recourse?

A more generous interpretation of their comment is that they are glad that some legal precedence has been set. The same case would not go through courts for another decade.

On the other hand, many companies view GPL software as some sort of kryptonite these days. So a good number of them -- at least the ones that are knowledgeable about software licensing -- won't even go near your software. Personally I'd consider this a good thing; opinions vary, of course.

Certainly there will be some companies that will just see open source code out there and use it, without considering the license at all (not even sure this is most often malice; I expect usually it's just a random developer who doesn't know any better).

But ultimately it's up to the copyright holder if they want to bring some sort of legal action or not. With MIT, you can't stop anyone from doing much of anything, for the most part. With the GPL, you at least give yourself the option, should you decide it's worth pursuing.

> The Court of Cassation, which is the supreme court of France, reviewed the case and issued an order on October 5, 2022 overturning the decision of the Court of Appeal. The case was then remanded to the Court of Appeal, which issued its order this week.

I know nothing of france's legal procedures, but it seems strange that the lower court, after being ordered something, could drag its feet for so long.

I'm not familiar with the US system but I don't think the court de cassation is actually comparable to the US supreme court. The court de cassation only overturns judgements on the basis of technical details of law, whether every procedure was followed as they should, etc.

It doesn't provide any feedback on the actual judgement it overturns (or not). So the court that does the actual judging is free to get to the same judgement as before if it respects the process correctly this time. But this is essentially a new judgement that starts from zero and takes as much time as the first time.

And the “is this law constitutional?” part is done by the Constitutional council, which is not quite a court. And there’s a second Supreme Court (Conseil d’État) anyway. Quite different from the US.

Roman law vs Common law

> this is essentially a new judgement that starts from zero and takes as much time as the first time

Did the court de cassation overturn every single detail pertaining to the original judgement? Kinda feels like they should be able to speed up the new judgement, and only change whatever detail or details the superior court said were wrong.

Well, I don't know much about this subject, but these delays make justice less just, and I don't understand how this is not obvious to everyone but the guilty.

The case is almost always sent to a different court from the one that had its judgement overturned. The new court doesn't necessarily have to redo everything from scratch, only the precise points that were overturned, but obviously if it was something early in the procedure then many things might need to be reviewed.

I believe what contributes most to the delay though is just that the French legal system (like most others) is overloaded and it just takes time until the case gets to the front of the queue.

The upper court probably didn't direct the lower court to issue a specific judgment, but clarified a legal question, and then the trial had to be repeated in the lower court, with this interpretation of the legal question in mind.

> I know nothing of france's legal procedures, but it seems strange that the lower court, after being ordered something, could drag its feet for so long.

The cour de cassassion can't rule on the case. It rules on whether the previous ruling was made properly according to legal standards. It is possible that the cc broke the previous decision for a reason unrelated to the case matter, and so the lower court can reissue a decision respecting the spirit of their first decision, but without the legal error.

Court procedures take a huge amount of time in France and nothing prevents appeals, etc. So it's pretty much usual for the case to take years in the first court then for one party to appeal, which again takes years, and finally for one party to appeal the appeal, which sends the case to Cassation, which again takes years and possibly sends the case back to appeal (which is what has happened here).

It's not very unusual for criminal cases to drag on for a decade between arrest and end of all procedures, for instance.

You're assuming they had the bandwidth to even just process the order from the inbox.

It sounds like the reason it took so long was that they had to decide whether this was a copyright claim or a breach of contract claim.

Could someone more versed on license law clarify this, at first glance it seems like an obvious breach of contract if they've just used the entire Lasso library and not followed the license. Was orange copying specific parts of the library and hoping nobody notices?

Copyright in Europe fundamentally does not work like Copyright in US. More precisely, the law does not govern the monetary gains possible from copying but rather the author's artistical expression in the work. Which is kind of moot regarding source code, but, it makes for an important decision: author's rights are created automatically and you cannot transfer them under any circumstances whatsoever.

Per default, the law states that the author retains all rights. They can license it, e.g. to their employer, exclusively; The employer can then sublicense that. However what licenses are possible is exhaustively defined in the law; on an abstract basis at least (e.g. using, creating derivative works, ...). It has been not exactly clear if conditions evoked on a license still have their roots in these licensable acts, or if they are based on contract law - where literally anything goes as long as it's not against the law or immoral.

Both can be enforced. However, I'd argue that it is good that it was decided that this is a copyright law matter, because this gives authors _much_ more protection than contract law, where all circumstances need to be evaluated for each single case and rulings might as well contradict each other.

Not a lawyer yet, though.

> However, I'd argue that it is good that it was decided that this is a copyright law matter, because this gives authors _much_ more protection than contract law

Copyright law may give the authors more power; but unfortunately, experience teaches us that there's usually not much incentive for the authors to enforce their rights. (The case in TFA is an exception, since the author profits directly from dual-licensing.).

For this reason, the SFC has been trying to get the courts to also see it as a contract; and specifically, one in which all other possible users of the software are beneficiaries. This gives random third-parties standing to sue for damages. If it works, it means that the SFC (for example) could go around suing companies which violate the GPL without needing involvement from the original copyright holders.

https://writing.kemitchell.com/2021/10/19/SFC-v-Vizio-Compla...

Maybe some European countries, but copyright law varies across Europe.

You can definitely transfer copyright in the UK, rather than an exclusive license.

You might be confusing copyright with moral rights which are not transferable but I believe that is the same in the US.

I’m glad there’s finally some cases setting precedent for the GPL.

I am personally not a fan of GPL family licenses BUT I am sick of fellow OSS developers who keep telling me not to worry about the minutiae of the license. (Usually some form of “Oh don’t worry because we aren’t litigious right now, as long as you stick with our incorrect interpretation of the license”)

My team is responsible for a lot of corporate contributions to open source (some GPL) and I have to pay extra attention to the license terms as a result.

There’s a lot of GPL software that operates in the grey (and many OSS devs who don’t understand their license choices), and I very much like my licenses to be as black and white as possible so I can avoid any risk.

Having legal precedence to point to will help make concerns concrete.

It's a good thing to point out that judges are notoriously indifferent about "he said that she said" type arguments. In the presence of anything that looks like a license text or contract that's usually what they take as the starting point for a decision. In so far that is enforcable of course. Most longer licenses usually have some language stating what happens when certain things aren't enforcable.

With GPL, the version matters. I'm not aware of any GPL v1 licensed stuff, it probably was a bit short lived. But there's quite a few things licensed under GPLv2 and GPLv3. v3 tried to close a few loopholes v2 had that some companies working with e.g. Linux or Java see as a feature rather than a bug.

Many corporate lawyers don't like GPL style licenses and particularly AGPL because these licenses have a lot of things to say about things like intellectual property, patents, servers, and uses that are/aren't allowed that probably isn't OK with most corporate lawyers worth their money. With GPLv2, this stuff has been through the courts a few times so the industry seems comfortable with it at this point.

Whether those lawyers are right or not is not something engineers should be overruling based on vague notions of fairness, gut feelings, loose interpretations, etc. The whole "it's fine because we're all nice people" doesn't have much value in a court room. Licenses are for when people stop being nice to each other.

I prefer the MIT license for my own projects. It's simple and clear and completely uncontroversial with corporate lawyers. It has decades of use, is well understood, and has very little ambiguity. Lots of OSS is licensed with it. It's fair for developers and users. Users being able to do what they want with the software is fully intentional on my part. That's a freedom I give them with that license and not something I actively want to restrict. Fully understood and intentional.

> I prefer the MIT license for my own projects.

Yes, but it's a different license! It's not really comparable with regards to preference because the goal of MIT or BSD is different to GPL.

If $PROJECT-1 can be modified and then redistributed as closed-source by $COMPANY, then MIT is a good fit.

If $PROJECT-2 must only ever be redistributed if $COMPANY redistributes their modifications and derivatives as open-source, then GPL is a good fit.

It depends on the specific project, which is why I cannot say "I prefer MIT" or "I prefer GPL", because for some projects I don't want it repackaged and released as proprietary software, while with others I do want others to repackage and redistribute as proprietary software.

Proclaiming a preference for one type of license over another is akin to saying "I prefer bicycles", because you aren't going to prefer bicycles when needing transport to move house.

I disagree. The GPL is fundamentally an ideological document with an ideological purpose in a way that the BSD and MIT licenses are not.

All software and copyright licenses are ideological documents. You don't see the ideology in BSD and MIT because it is your preferred ideology.

I agree that the GPL's ideology is different, but I don't think you need to agree with the GPL's ideology to use it, just as you don't need to agree with the BSD or MIT licenses' ideologies to use them.

You can simply make a practical choice, based on what your goals are for a specific project. If you're looking to build a community around your project where both hobbyists and corporate users/contributors end up in your commit history, you might choose (A)GPL. That's not to say there are no public corporate contributions to BSD- or MIT-licensed projects, but I expect using the (A)GPL could increase the likelihood. Well, aside from the effect of companies that simply refuse to touch GPL'd software.

You aren’t discussing the controversial part at all. You have laid out the part that everyone agrees with.

GPLv2 means you pass your modifications back - easy.

GPLv2 might mean that by calling a libraries static functions from your code, that is a “modification”, and now must include code that is not logically a modification at all. This is even more grey area if you dynamically link them - hard.

“What is a derivative” has feed millions of lawyer’s family’s, imo this type of broad interpretation does not belong in OSS. Give it to me or don’t, I promise to pass my modifications back, but don’t pretend that integrating it into my code is modification that allows you to see what I do with it.

LGPL makes more sense. But GPLv2/3 has a business model and that is why it is popular and complex.

I wasn't discussing any part at all, I was explaining why the goal of the project determines the license and not the preference of the authors.

If the goal is to allow others to close off the product, then one license is suitable. If the goal is to prevent others from turning it into a closed source product, then you choose the other license.

When the goal is "popularity amongst closed off companies", then one license makes sense. If the goal is "popularity for the community" then the other license makes sense.

There was a no value in arguing over which is easier for companies unless the goal is popularity for companies and o close off.

After all, any company that simply wants to use the software without redistribution doesn't really care.

> What is a derivative” has feed millions of lawyer’s family’s, imo this type of broad interpretation does not belong in OSS

I am sorry but your view is dying out because it’s unrealistic.

Most things in life have grey areas, most things in life have legal concerns and liability attached.

Even the simplest possible things, like If you sell bicycles and someone breaks their neck, they could sue and there will be grey areas as to the bicycles’s quality. If you sell food and someone gets food poisoning, same thing.

The fact that software developers could make millions and never worry about law, is a giant privilege and it’s disappearing because software is no longer just for kittens and porn, it is now everywhere and it’s responsible for life and limb

One problem I see with the GPL (all versions) is that they make a big deal out of 'linking' your program.

And in a world were C was the only language that mattered, that might have been fine. But more modern languages might have more diverse notions of what linking is and ain't, and there might be gray areas, too.

Dynamic linking (also what most more modern languages do instead of traditional static linking) always has been an utter mess when it comes to GPL "virality".

It's completely untested in court and a lot of legal scholars doubt the reasoning and interpretations given by the FSF (namely that dynamically linking with a GPLed work transfers the same GPL license to that work) would be allowed by current copyright law.

More or less amounts to the question of "do you need to use parts of the original work to make a derivative work".

Another, possibly far bigger problem, is that it's entirely possible to effectively neuter the GPL with a secondary contract. We know this is legally possible because of what Red Hat does (cut you off as a customer if you redistribute the source code of RHEL) as well as a far more direct legal case in Germany where a WordPress theme maker was able to prevent distribution of a theme they made by arguing that the contract made when the theme was sold overrode the terms of the GPL and prevented the buyer from sharing the theme because of agreed to terms in the contract.

Unless the GPl'd work provides a novel API that the GPL code implements; that has been tested in court. The API is protected, by copyright, and linking to that API requires the use of the API. That's why you can't just link to GPL'd code will-he–nill-he, without the possibility of serious repercussions.

> Another, possibly far bigger problem, is that it's entirely possible to effectively neuter the GPL with a secondary contract.

I don't really think that's a problem, per se.

Regarding your second example, that's totally fair: effectively the theme maker (who is presumably also the sole copyright holder) did not actually give the theme to the other party licensed under the GPL: they licensed it differently in that sale, which is 100% their right to do.

The Red Hat example is a little more complex, I think. The GPL says you cannot add extra conditions to redistribution. If Red Hat owned the copyright for everything they distribute, that would be fine: they couldn't say RHEL was GPL-licensed, but they'd be in the clear.

I'm actually surprised they've gotten away with this: as far as "ambiguity in GPL enforcement" goes, I feel like it's not all that ambiguous that RH is committing a GPL violation by adding that condition. All it would take would be for rightsholders of a major component of RHEL (like perhaps the Linux kernel) to complain about this. (Then again, there may be no publicly-stated contract or policy here; RH may just cut off customers who share, and cite vague "we reserve the right to cut you off for any reason" policies.)

(Also I might be getting details wrong here; I'm just going by your description and haven't done my own research into these cases.)

It's pretty clear what it means, based on the goals of the license: To allow the user to easily replace/modify the (L)GPL licensed (part) of a program.

For GPL, that means you can only include GPLed code if you make the whole program available for user to modify and redistribute.

For LGPL, you can include LGPLed code if you make just the LGPLed part of the app available for easy replacement. (so normally this means some form of dynamic linking, and very commonly used in practice with eg. glibc)

So if some company statically links (L)GPLed code to their app or makes it in other ways hard to modify/replace, it's a violation.

> as well as a far more direct legal case in Germany where a WordPress theme maker was able to prevent distribution of a theme they made by arguing that the contract made when the theme was sold overrode the terms of the GPL and prevented the buyer from sharing the theme because of agreed to terms in the contract.

What case was that?

> It's fair for developers and users. Users being able to do what they want with the software is fully intentional on my part. That's a freedom I give them with that license and not something I actively want to restrict. Fully understood and intentional.

Sure, but GPL is fair as well. Just differently.

I like MPLv2, because it seems like it is exactly equivalent to MIT for projects that don't modify my code, and if they do, it forces them to distribute the changes they made to my code. In practice, I strongly believe that it gives developers leverage against their management: as a developer, I can say "I must upstream my changes because it's MPLv2" (which is not exactly right but managers don't really understand it anyway). MIT doesn't give me that leverage: managers know too well that they can just pretend it's theirs (often even forgetting attribution).

The main downside with GPL licenses, from the perspective of corporations, is the requirement to share your changes if you distribute the code. GPL v3 and AGPL were both designed to close loopholes that were useful for certain corporations that didn't want to open source their own code. I believe the main ones were "Tivoization" (devices where you can't run modified code due to DRM) and cloud SaaS services where modified GPL code is run without sharing the changes because technically the cloud is not "distribution". GPL v3 was designed to stop the former and AGPL to stop the latter.

FAANG companies generally hate AGPL and ban the use of code licensed under it which is a backdoor way of admitting that their cloud platforms include modified GPL code whose changes are not publicly available.

The permissive licenses like MIT and BSD allow corporations to take your code and modify it without paying you or even sharing the changes with you. All they have to do is give you credit. That's not something any sane corporate lawyer is going to care about.

Both of these types of licenses permit commercial use without paying the people who wrote the code and the entire FOSS community rejects non-commercial licenses as "not open source" at all. Corporations only object to GPL because it prevents them from taking other people's work, modifying it, distributing it and profiting from it without sharing their changes. That can reduce corporate profits by allowing competitors to build derivative works off of the same code.

Personally, I'd prefer if there was a major non-commercial license for code because that would ensure nobody is profiteering off of my work without paying me. People who aren't in this line of work find it strange when you explain to them that somebody could write a portion of a highly successful product and never see a cent in royalties from it.

> I'd prefer if there was a major non-commercial license for code

Non-commercial licenses are considered non-free.

If you intend to be share your code with the world and don't want others to profit on your work without giving anything in return, go with something like (A)GPL. Sure, people will be able to profit on your work, but in return, you get all their bug fixes, testing, support, and improvements.

You have to realize that most contributions to GPL software is made by people who work for money, something that a non-commercial license would not let them do. So by releasing your software with such a license, you prevent the best people from eventually contributing. And why would you open source your software if not to take advantage of the contribution of others (in code or otherwise)? Another reason why you would want to publish your software under GPL (or compatible) is to make use of other GPL (or compatible) software and libraries, you can't do that if you publish under a non-commercial license. So, lots of drawbacks, few advantages.

If you really insist on using a non-commercial license, there are a few listed here: https://www.gnu.org/licenses/license-list.html#NonFreeSoftwa...

> And why would you open source your software if not to take advantage of the contribution of others (in code or otherwise)?

Because some people do things for different reasons than you might?

I'm not the person you're replying to, and usually use GPL for things that I care about, and BSD 3-clause for things where I don't care so much. But I can see the appeal of a non-commercial license, about only allowing something for personal (or, say, non-profit) use, and refusing to allow anyone to profit monetarily off your work.

It's fine if you don't want to use something like that, but I think it's unfair to cast aspersions on the concept.

Of course the corporate lawyers and enterprise settings are going to take this position, but I find your flippant dismissal of GPLs core uses and purposes seem to belie you are just in a group that prefers the non-user friendly licensing.

That’s ok, but you can’t hand wave away that GPL, especially v3+, is about protecting and defending the user (like tron), while MIT/BSD is not, by calling it “vague notions of fairness” as if GPL hasn’t already seen wins in the courts… on this point I think some research might be due for me though.

I’m just so very tired of the “hey me and my banker/lawyer/insurance friends all hate this - that means it’s useless and dangerous for everybody”

I say the GPL and copyleft and the four freedoms for the user are the tools we use to fight these types of corporations in the first place, and I truly believe not only is GPL not dead but that it will play a vital role in our near and long term future.

Choose your weapons wisely.

Imo the question is do you want to protect passive users access to the code or developers freedom to use the code how they want it even if that does mean they take existing code, modify it slightly, put it in an embedded device, and enable temper protections on the MCU preventing anyone but them from signing new firmware images? If that embedded device is something harmless like a video player or gaming console most open source developers would probably like to use the license as a crowbar to force the device open, but what if it's a medical device, or a payment terminal the user is explicitly not trusted to modify?

If anything medical devices, especially implants, should be modifiable. Otherwise you're stuck with an unmaintainable device (possibly in your body) once the manufacturer goes out of business or the support window ends or whatever. Right to repair and all that.

And this is a very real concern. https://spectrum.ieee.org/bionic-eye-obsolete

For external devices breaking some big, visible "last inspected on XX/XX" seal to do so would be acceptable.

For payment terminals you could do the secure boot thing where replacing the manufacturer keys and flashing custom firmware wipes the TPM storage.

To me it's not solely about modification. It's also about transparency. While I most likely would shy away from trying to modify the software of a medical device, I think it should be illegal to lock down those devices so that people can't at least see the code that's running it.

If you're going to build something that's going to directly affect my health, I would much appreciate it if it were easy for researchers to find bugs and security issues with the software that controls it.

But ultimately I don't care about the whole "legally locked down" thing, and think that concept is a net negative for society. If I can buy a medical device to use at home, then it should be on me if I decide to modify it and it injures or kills me. I expect the law hasn't really kept up with that notion; I wouldn't be surprised that in many cases the manufacturer might still be liable. But that's a legal problem (that should be fixed!), not an ideological one.

> ... or a payment terminal the user is explicitly not trusted to modify

This is the worst thing, IMO. I wholeheartedly reject the concept of software that I am given to use, but am not "trusted" to modify. Screw that. Unfortunately I do have to use software like that. But I think the entire concept is garbage.

For payment terminals the core problem is that the trust model is ass-backwards. The user is the one at risk from a faulty authn device, so they should be the side "controlling" the authn flow. Merchants would be fine just carrying dumb plastic cards with an ID number. Though these days there's little reason not to just make both sides smart… it could even run on the phones they already have!

> That’s ok, but you can’t hand wave away that GPL, especially v3+, is about protecting and defending the user (like tron), while MIT/BSD is not, by calling it “vague notions of fairness” as if GPL hasn’t already seen wins in the courts… on this point I think some research might be due for me though.

It sacrifices the user's freedoms for this. Which is exactly the concern corporate lawyers have with this. Fine if that's what you want but the net result tends to be the vast majority of big companies pretending your project does not exist. Can't look, can't touch, can't use, etc. If a blanket ban on your project across most commercial users is what you are after, AGPL does the job.

> vast majority of big companies pretending your project does not exist.

Good.

Even so that point is wrong as GPL software is widely used in the industry (Linux, gcc, gnu make, etc).

To me, frankly, that would be the goal. For some of the things I work on, I would much rather a company be allergic to it, than believe they can do whatever they want with it.

But for other things, I don't really care.

> I’m glad there’s finally some cases setting precedent for the GPL.

Given that France uses Civil law and not Common law, does precedent / case law actually matter? (IANAL.)

* https://en.wikipedia.org/wiki/Civil_law_(legal_system)

* https://en.wikipedia.org/wiki/Common_law

It matters in an advisory sense (that is, other courts may use it to gain understanding), but not in a legally binding sense.

In practice, precedence has about the same legal power in both common law and civil law jurisdictions.

That is civil law courts tend to go with the precedent most of the time on the one hand. And on the other hand, a common law judge can always do a bit of nitpicking to argue why the case before her is special and thus different enough from the precedent (or she can pick from multiple different precedents, and then come up with a justification for why the one she picked matches the case before her the most).

> a common law judge can always do a bit of nitpicking

This makes sense. Precedents ruled by mistake/etc. should not set the law.

Some, but not all, precedents are absolutely legally binding in the French system, they have the same force as the law (unless a later law contradicts them).

Yes, not sure if this is the case but higher courts in civil law systems tend to have some precedent setting powers. It's just more limited than in common law. I'm not sure if this is the case in this ruling in france, but even if it isn't

In a civil law system judges still are aware of previous decisions in similar cases and consistent application of the law is still a principle which exists. The precedent might not be binding but a judge who is in doubt will still uses existing case law and so will appeal courts. They will just always refer to the law as the source of the decision, not the previous cases

> There’s a lot of GPL software that operates in the grey (and many OSS devs who don’t understand their license choices),

Do you have examples? What kinds of misunderstanding are there? And what gets clarified by this case that wasn’t clear before?

I can’t give specific examples without calling out some projects.

But usually it’s a misunderstanding of what derivative works are. E.g building an extension to a GPL app. Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL.

Or things like what constitutes distribution. E.g employees vs contractors vs third party collaborators etc…

But when I have to deal with said project owners, they bring up that the GPL is about the spirit of the license, not the exact words. They often say not to worry about litigation.

This case doesn’t specifically clarify those terms but it does highlight that GPL violation is a serious issue that can’t just be treated as a suggestion.

That any lawsuit has taken place and won means that

1. I can point to cases where the license choice is impactful when working with existing projects or when setting up new OSS projects in my industry

2. It also means that the license proponents may feel more empowered (as they should) to take action against infringement.

Basically, very few people take software licenses as seriously as they should. Cases like these help make them a more serious matter.

The more seriously people take it, the easier my job gets for multiple reasons.

And since someone might ask, the license I advocate for the most is Apache 2.0. It covers the most ground, with the most clarity and the most protections for all parties involved.

>But usually it’s a misunderstanding of what derivative works are. E.g building an extension to a GPL app. Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL.

The GPL doesn't explicitly define the concept of derivative work. The FSF's interpretation is that linking creates a derivative work, but there's no universal consensus among lawyers on this issue.

LWN has an article that presents a few different views on this topic: https://lwn.net/Articles/548216/

The term "derivative work" (or similar) is sometimes defined in law, but of course very abstractly (i.e. not specific to software) and differently depending on jurisdiction. (See https://en.wikipedia.org/wiki/Derivative_work) IMO it's exactly because of this ambiguity that many developers' understanding of the term is likely to be incorrect, and that most of us don't really understand what our license choice entails.

Yes , exactly my point. The vagueness is intentional to cause this level of confusion.

> Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL.

I can almost hear the chairs squeaking under the many SaaS devs reading this. IANAL, but as far I know the debate is not settled on whether this clause applies to SaaS, that is when you do not distribute the software per se, and the general consensus so far is that it does not. This is the "raison d'etre" for the AGPL license, which covers the SaaS use case.

Interesting examples. Also, a weird take for them to think that’s not triggering the virality, if not that, what then? Directly using the source code only?

> the GPL is about the spirit of the license, not the exact words. They often say not to worry about litigation.

Even weirder. Especially since then, why pick the GPL at all? The only reasons I can see is that you care about free software, and want virality for that reason, and/or you want companies to pick a commercial license.

I believe this is coming from the developers of a piece of GPL software who want to allow proprietary extensions. However, extensions to their software must import a python module that they created to register with their software or something. They don't want to invest time in separating that module and its dependencies into a different project with a different license (some variant of the LGPL), so they choose to believe that importing a python module is somehow different from linking a C library.

From the point of view of the owner of the software, I can see how you can think that your intention matters more than the word of the license. It's wrong in a legal sense, of course, but it makes some kind of sense of you say "nah, we'd never sue for that".

The European Commission have published an interesting article disputing the possible viral effect of linking in EU law: https://joinup.ec.europa.eu/collection/eupl/news/why-viral-l...

It doesn’t practically change much for most developers, but imo it underlines a bit of the challenge of misunderstandings and the complexity around the sharp corners of open source, in particular outside of the US as most licenses were designed in the US by Americans.

One argument for you could be that if there is no problem, why aren't they using MIT instead that works the way they want it? No need to use the wrong license if they mean something else.

I also hate when projects take BSD/Apache licensed code and change it to GPL.

While it seems technically permissible, to me it also muddies the original code’s licensing as well, especially if not well known.

It is also bizarre that someone could take BSD code, make trivial modifications, and now such cannot be sent upstream or used under the original license.

I happily call out a surprisingly under-appreciated case of this…

We only have KVM virtualization on x86 today because Citrix meticulously developed an x86 instruction emulator (many thousand lines of dense code).

The Linux kernel took that BSD code and relicensed it as GPL. Sure, at some point one might argue that later modifications by the Linux developers are significant contribution that makes are unique… If I observe a good change Linux made, it is perhaps now questionable that as a 3rd party I create a PR to push the same change upstream… This is an accidentally evil side of GPL that isn’t talked about.

But at least in the early days, it also means one cannot freely use Linux’s copy but can do so from Xen —- even though it is the exact same code!!

Licensing also invites a trap where careless developers relicense GPL as BSD, and then a conscientious party unknowingly uses the BSD implementation in a closed source product.

The only saving grace is most code is horrible for reuse purposes and it is often easier to either reimplement it (from scratch) or use a well known BSD-licensed gem.

> Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL

Wasn't this the, "if the source is in your tree everything is GPL" and otherwise "if it's downloaded module as a package it is not"? Or was that LGPL? Asking to show clarification for everyone.

edit: the question was stated as ignorant to get a few decent explanations. Thank you for the effort!

> But usually it’s a misunderstanding of what derivative works are. E.g building an extension to a GPL app. Many don’t believe that simply importing a GPL Python module is enough to make your extension have to comply to GPL.

AIUI that's a far from settled question in copyright law (with e.g. Oracle vs Google being mostly reversed on appeal, and different courts applying different standards). For someone who's not in the business of copyright minutiae, it's not a completely unreasonable belief to have.

Extensions, importing, linking? If your (A)GPL licensed app has a plugin framework, does that 'infect' all the plugins to be similarly licensed? There's likely different situations here, or no? Like e.g. Hashicorp go-plugin where separately compiled plugins are dropped into a directory and communicated to via gRPC cross-process. Or WebAssembly Components being composed together.

I'll tell you a fact that isn't popular or commonly known.

At some point Google just took the headers of OpenJDK (GPL licensed) and used it in Android, without relicensing Android to GPL. ( https://arstechnica.com/tech-policy/2016/01/android-n-switch... )

Apparently this is fair use according to the US Supreme Court. Technically speaking the case that went to the USSC concerned some prior closed source version of Java, but Oracle doesn't to think there's a material difference since they're not suing Google again for that, and neither do I.

The FSF's argument that linking to GPL libraries require you to relicense the code to GPL rests on the legal argument that APIs, headers, etc. are copyrightable. USSC decided that, well, for only for Google's case, sure, fair use, whatever.

IMHO the GPL was drafted and marketed specifically to make its legal position seem uncertain, and the outcome of the Oracle v Google case doesn't make things clear. I'm not sure whether you'd actually see a court make a decision on the "GPL" given that the case would almost certainly be a matter of copyright infringement, not a matter of license interpretation, so the license text does not matter. If I were a lawyer I'd advice corporate clients to steer waaay clear of anything GPL.

On the other hand, some people freak out too much. All I did was use a ghostscript dll, which is LGPL if I recall correctly. :/

> very few people take software licenses as seriously as they should.

Isnt the fact that it has taken this long and required a straight up violation of the direct terms of the licence proof that people were probably justified in not caring until now?

FFMPEG. Look at the amount of legal horse fertilizer here: https://www.ffmpeg.org/legal.html ... and every time I've seen people asking what they can and can't do, someone from the ffmpeg devs (once in a couple of years when they actually respond to someone) just says "talk to your lawyer". I mean, flip a few switches and suddenly you're under a different licence ... and all this you have to look up yourself. Many (especially smaller) devs just don't care and distribute ffmpeg together with their (often non-oss) tools. Given the amount of these in the wild, if someone really had an axe to grind, they could sue hundreds, maybe thousands of devs of all sizes. It's a total minefield. And one of the most popular (L)GPL packages in existence.

My experience with FFMPEG is that it’s usually not directly distributed for probably those reasons. The only times I remember getting it directly with software, was for GPL software.

Eh, I'm just gonna point out that you can find ffmpeg code (proprietary decoders even) distributed with Electron. I'm not even going to think about how many proprietary apps built on top of Electron have no idea about that. Look at the answer here: https://stackoverflow.com/questions/67799370/legal-issues-in...

It is currently pretty clearly describe. Compile it in LGPL mode and you are good for propriétaire use cases.

There is nothing fundamentally dangerous with the LGPLv2.1.

It is mainly annoying in case of static linking due to the obligation of providing object files but will not contaminate your codebase like the GPL does.

What constitutes linking, dynamic linking, and static linking, if you use python and plugins? Can the rights holder of proprietary software contribute to or distribute a GPL or LGPL plugin for that software?

The important part with LGPL is not really about static vs dynamic linking.

The important part is that you should be able to modify the LGPL library that the application uses. In the case of a python module or plugins, it is possible, so that's ok for LGPL. You can even statically link LGPL libraries with your proprietary application as long as you provide a way to relink your application with a modified version of these libraries.

Fair enough, but it's still not entirely clear what constitutes linking, especially when it comes to Python, and what the situation is with plugins. The GPL FAQ Says:

https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins

> It depends on how the main program invokes its plug-ins. If the main program uses fork and exec to invoke plug-ins, and they establish intimate communication by sharing complex data structures, or shipping complex data structures back and forth, that can make them one single combined program. A main program that uses simple fork and exec to invoke plug-ins and does not establish intimate communication between them results in the plug-ins being a separate program.

> If the main program dynamically links plug-ins, and they make function calls to each other and share data structures, we believe they form a single combined program, which must be treated as an extension of both the main program and the plug-ins. If the main program dynamically links plug-ins, but the communication between them is limited to invoking the ‘main’ function of the plug-in with some options and waiting for it to return, that is a borderline case.

No company should ever do business under terms that are this unclear. It's just asking for trouble. Use another licence that is not this ambiguous.

Even saying it's OK with Python is a simplification. In almost all cases it is but what if you compile Python to binary, strip its symbols, statically link, then for good measure, upload the binary to an app store.

That scenario is not a good fit for LGPL.

Also you say static vs dynamic linking is not important, but here in the GPL FAQ there is reference to this:

https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins

You don’t have to distribute the plugin as xGPL but you do need to make it compliant.

The L/GPL would widely consider Python imports as dynamic linking.

Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result.

This too is somewhat of a grey area though that the GPL is vague on.

> You don’t have to distribute the plugin as xGPL but you do need to make it compliant.

My reading of the GPL is that if you are the rights holder of some software, and there is a xGPL licensed plugin to said software, you can only distribute changes to the plugin if you also distribute your software as xGPL. In other words it is impractical for you to make changes to xGPL licensed plugins to your software.

> Many companies will instead do shim/bridges that aren’t GPL themselves but something like MIT. The bridge talks to proprietary code and the GPL but doesn’t bridge the license over as a result.

I'm fairly sure this is not legal, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLWrapper

The point is there is too much in the GPL that is open ended and can only be known for sure after litigation.

The Python websocket-client library switched from LGPL to BSD without realizing you need to get all contributors to sign off on that.

https://github.com/websocket-client/websocket-client/issues/...

It looks like that did get rectified a few years later:

https://github.com/websocket-client/websocket-client/issues/...

> I’m glad there’s finally some cases setting precedent for the GPL.

There's been a few before: https://gpl-violations.org/news/

> Usually some form of “Oh don’t worry because we aren’t litigious right now, as long as you stick with our incorrect interpretation of the license

Where do you see that attitude in the OSS world? In my experience that's how the games industry operates wrt to mods but for open source projects you usually have a clear license IME.

I worked for a Multinational US company that was doing business with a Scandinavian company. The Scandinavian company wrote a GPL plugin to our software and wanted us to make contributions to it. We didn't think we could do that and still be within the terms of the GPL, they insisted that we could because they would be fine with it.

As the author of the GPL code they have the authority to dual licence it, so surely the fact that they state they are fine with it (especially if in writing) would be enough?

I'd worry the other way, if you're contributing to the GPL code, you'd need to relinquish your rights to any IP contributed to the third party.

Our concern was not that our contribution would be GPL licensed, our concern was that we didn't have permission under GPL to distribute the contributions even if we were fine with them being GPL licensed. For details as to why we were concerned, see https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins - for any company that should be a clear signal to stay away.

An employee of a company saying it's fine in an email is also not issuing another licence. We did suggest they use another licence than GPL, which they eventually did after months of arguing with them that just saying "it's okay because we don't care" makes no material difference to us and that GPL does not unambiguously provide us permission to do what they want us to do.

Of course it was fine, they were the copyright holder. I assume your contribution copyrights were transferred to the other company? As they were publishing the whole plugin as GPL.

> I assume your contribution copyrights were transferred to the other company?

I'm not sure why you would assume this, but it would not have happened.

Furthermore, given this https://www.gnu.org/licenses/gpl-faq.en.html#GPLPlugins - and given there were no exceptions in the plugin, it just seemed like a complete mess to us. Of course the Scandinavian company disagreed because, as I said, they figured we should not care because they are okay with it.

Just quoting from above:

I think it's strange how you can be entirely sure about something which the GNU is not sure about, but the thing is neither the GNU's speculation or yours would be relevant, it would have to go through costly and time consuming litigation to know for sure.

Why would anyone want that?

The legal precedent seems to be "If you steal GPL code, 14 years later you have to pay $650k - assuming the developer didn't give up before that"

One of the key advantages to a legal precedent is that the next time it won’t take 14 years.

France has a civil law system [0] which doesn't place nearly as strong an emphasis on precedent as common law does, so this specific case probably won't help speed anything up.

[0] https://en.m.wikipedia.org/wiki/Civil_law_(legal_system)

Precedent isn't binding in civil law systems, but that doesn't mean it is ignored. Especially when set by higher courts

For the first time, I can see the advantage of AI for a forum like HN. Have the AI scan the comments and generate a summary and links to show/hide, as an example:

80% of comments are pedantic. 10% of comments discuss the actual topic. 5% of comments are excited/hopeful. 30% of comments are probable astroturfing. 20% of comments are by users who are most likely millenials. 1% of comments are by former /.'ers. etc.

Ideally this could just run locally and operate on any website as needed, like browser userscripts now.

Entr’Ouvert sued Orange in 2010

Your license choice matters based on your wherewithal to litigate upon bad actors.

And your license choice segments good actors into those who will and won't use your software.

The rest is theory.

Seems it would have simply been prudent for company to have obtained a commercial OSS exemption. And if not offered to have requested one. Shady undertones that companies seem almost to want to use OSS without ever raising that commercial issue, as if sneaking around hoping the authors will never wise up to their rights—just to save a few bucks?

Breach of contract.

Have there been any other cases of GPL violations where damages were awarded?

I found https://gpl-violations.org/news/ from another commentor but from there I count only 2 judgements and no mention of remedy.

Should be retitled. "pyrrhic victory might cover some of the legal costs"...

Naively, if a model is smart enough to spit / whitewash a bit of code, it is also smart enough to add attribution, isn't it? Wouldn't correct attribution be just a master prompt line away?

From what I can tell this is a judgment against some sort of government services provider. So the damages will just end up being paid by the citizens via taxation.

I don't think this is correct. The case was against Orange, which is a publicly traded company. I don't see how they could "invoice" it to their customers. Also, the service was rolled out ~14 years ago, I assume it was paid by this time. I guess they might increase the maintenance fee, though, to absorb this over time.

But, most importantly, it is not relevant. If an entity is found guilty, they are supposed to cover the damages, whoever they or their customers are. Even it turns out being covered from my taxes in a legitimate way, I am glad to pay for it - this is how the justice is served, and we all get to keep the healthy judiciary and executive process.

Doesn't this contradict EU law? Specifically this: https://joinup.ec.europa.eu/collection/eupl/news/why-viral-l...

I guess the fact that the software was also offered with a commercial license could be considered that it prejudices the legitimate interest of the author of the library. IANAL, but I think this might be a one-off (most GPL libraries do not have a commercial license alternative, so...).

Up Next: Ambulance chasers offering there services to GPL projects.. the hunt begins.

I don’t know… that’s kind of a negative way to see it. but I mean those auto DMCA takedown services already kind of do something like this right? Why shouldn’t IP violation checking as a service be a real thing that open developers can access? I think your framing of this is wrong. More empowerment and legal protection and enforcement for developers that underpin the ecosystem is a good thing.

€650,000

Surprised it's not mentioned already.

OpenAI recently fed everything on GitHub into a language model which will cheerfully reproduce GPL'd software without license or attribution.

I think that's the end of "free software" in the GPL sense. There is zero point to writing AGPL on a program if copying it into a language model and then back out into a text file without the license is a legitimate thing to do.

I can't imagine this being countered effectively by lawsuit. Microsoft has built a weapon that they can use to disassemble open source software, I think they'll take the legal side of that seriously enough that GPL will be a distant memory by the time the courts conclude in either direction.

People don't want to acknowledge it, because they deem that CoPilot and similar tools are too useful. I personally left the day CoPilot became GA. It's an open secret that xGPL licensed applications are fed into AI models, but opponents' voice is drowned under "We're doing something amazing, we don't need any permission. Plus, it's all fair use, anyway" choir.

This also important for Source Available (for your eyes only) licenses. People don't care about them either.

This whole AI thing is a boundless ethics violation in every category, yet people don't care, because "it's awesome!" for reasons I don't understand.

Addendum: The reason why OpenAI has a non-profit part is to allow them to claim that they do non-profit research, which fair-use doctrine requires to work.

As much as I agree with the conclusion (my AGPL code was stolen by OpenAI, as was a lot of other code), your logic is extreme. This is not good. A more reasoned argument is more convincing.

1. "Fair use"

It is fair use to use snippets of my code in other projects. AGPL doesn't change that. If I have a 3-line sort routine, and Copilot copies that verbatim, it's okay.

The place and reason Copilot is not okay is because I can ask it to spit out code which, in some versions, was almost verbatim code I wrote, and in others, a paraphrase. The same abstractions and high-level design I invented is copied by GPT.

It's like writing a book set in the Star Trek universe and (not as a parody), changing "Spock" to "Spork" and "Kirk" to "Dirk."

It's a problem for me because I compete with commercial systems, and chose the AGPL for very specific reasons: People have a right to know how their data is analyzed, and AGPL preserves that. Copilot allows companies to quickly replicate and whitewash my code.

If Microsoft uses a snippet in Windows -- e.g. a small use in an unrelated context, fair use clearly allows that. As much as I don't want my code stolen, degrading fair use would be the far greater evil.

2. "The reason why OpenAI has a non-profit part is to allow them to claim that they do non-profit research, which fair-use doctrine requires to work."

No, OpenAI was set up as a genuine, if ill-formed, non-profit. When it clearly became big $$$, bad people (likely breaking the law) formed a for-profit arm to personally profit from it. The non-profit arm is there for historical reasons.

Your statement is false, and there is ample historical record that what you're stating is not how it happened.

That's dangerous, since the wrong lessons would be drawn. The lesson this reiterates, which I learned many times the hard way, is that for non-profits, checks-and-balances matter. If you don't want your non-profit going south, this means everything -- licenses, corporate charter, bylaws, contracts, etc. -- need to be properly structured to act as a permanent network of checks-and-balances so the organization cannot go south even if bad people are involved, and that incentives are structured to support good behavior.

We do need a for-profit like the original OpenAI, but properly structured and resourced.

> It is fair use to use snippets of my code in other projects. AGPL doesn't change that. If I have a 3-line sort routine, and Copilot copies that verbatim, it's okay.

That depends. You may have a 30 line function which can be paper-worthy. I'm not supporting software patents, but reasonable attribution. If somebody uses my GPL licensed novel algorithm (which is a single function) to get unfair commercial advantage and doesn't adhere to the GPL license, can we say it's fair use? Example? See [0].

> It's a problem for me because I compete with commercial systems, and chose the AGPL for very specific reasons: People have a right to know how their data is analyzed, and AGPL preserves that. Copilot allows companies to quickly replicate and whitewash my code.

We're on the same page. I don't want my algorithms to be used by people verbatim w/o attribution or without proper license. Don't like the license? Reimplement it, paper is there.

> No, OpenAI was set up as a genuine, if ill-formed, non-profit. ... [snipped for brevity]

You're right. Let me rewrite my statement: "The reason why OpenAI keeps a non-profit part and has this convoluted many-company structure is to allow them to claim that they do non-profit research, which fair-use doctrine requires to work."

Hope that it's better now.

> Your statement is false, and there is ample historical record that what you're stating is not how it happened.

About OpenAI's structure, or GPL being fed to CoPilot? I didn't say anything about OpenAI's history AFAIK, but I have seen a tweet, containing a snapshot of an e-mail saying that "Copilot is indeed trained on every public repository on GitHub". The tweet is deleted later probably of threats. Just because of this tweet, I'm keeping this list [1].

Actually we're literally on the same page. Only difference is I keep my "plagiarism" threshold at "function" level, because they can contain some bigger magic than themselves, and you keep it at "design" level where the magic happens as a collection of functions + design.

This is probably due to different domains we operate in, in mine, a single function can affect accuracy and speed so much that it can be considered secret sauce. Welcome to HPC / Scientific Computing. :)

> We do need a for-profit like the original OpenAI, but properly structured and resourced.

When you do for-profit, fair use goes out of window. See [2].

[0]: https://journals.tubitak.gov.tr/elektrik/vol29/iss2/45/

[1]: https://notes.bayindirh.io/notes/Lists/Discussions+about+Art...

[2]: https://news.ycombinator.com/item?id=39188979

Nits:

> That depends. You may have a 30 line function which can be paper-worthy

We have no disagreement. That's why I gave a pretty generic 3-line function. 90% of the upside of ML tools for me, by the way, is generating very routine code, so there's not even too much friction yet. I can prototype a parser with e.g. 5 XML libraries I've never used in 15 minutes, which means I make better design choices.

> You're right. Let me rewrite my statement: "The reason why OpenAI keeps a non-profit part and has this convoluted many-company structure is to allow them to claim that they do non-profit research, which fair-use doctrine requires to work."

> Hope that it's better now.

Nope. It's not. The reason the non-profit part is around is right now, they're skirting the law. If it went away, they'd be very clearly committing fraud.

The non-profit received support from donors -- including from the government in the form of a tax waiver and the general public in the forms of non-financial support (such as positive buzz / articles / scientific work) -- based on a 501(c)3 registration and a belief it would act in the public interest.

The instant the 501(c)3 part went away, this would all be fraud. Everyone who helped make OpenAI successful, from the grad student who spoke about it glowingly at a conference to the federal government, would have been embezzled.

I feel bad about having supported them, and I bet others do too.

We have been conditioned for decades to allow an increasingly slippery slope of dubious behavior in the name of 'cool'

As a blanket statement? I don't think so. The reason we even think of anything as "dubious" now, is a moral compass, that has (at the large scale) been staggeringly readjusted for increased human well-being.

Cool, or convenient.

Cool, convenient and coins

It's also why these days I do not host any of my code on Github. Only then did I realize how much of an iron grip it has on the ecosystem. People expect Github Actions, Pull requests and well now people want to use CoPilot for all their work.

It is extremely worrying.

That's the "extend" part of the embrace, extend, extinguish game plan.

Me neither. I moved to Source Hut. I'll be restarting my work on my previous research and pondering on whether I should keep its code at a Forgejo instance buried under a VPN, until it's ready to release.

Same here, I moved to SourceHut. There are other alternatives that look much more like GitHub for those who like that (like Forgejo).

Or, like many IP lawyers, they don't believe it's a copyright violation. It will come down to the courts and legislatures.

Being non-profit, or non-commerciality in general, has relatively little to do with fair use.

It seems like we need a new licensing model to prevent AI from training on open source code?

That's useless. Only courts can help.

NYTimes is suing OpenAI because it siphoned paid articles and reproduced in verbatim.

That's basically the same thing it does to open source code, so if NYTimes wins, there might be some hope.

This should mean that all code written with the use of an LLM that was fed AGPL code must be released under the AGPL.

That makes sense to me. If you use GPL code to train your model, then everything that model produces is a derivative work of that GPL code.

If there's also MPL 1.1 licensed code in the training set then you end up in an impossible situation where you can't comply with both GPL and MPL 1.1 at the same time.

https://en.m.wikipedia.org/wiki/License_compatibility

This would be a fascinating argument to make in court.

It is difficult to see an argument that the output of a language model is not derived from the language model, other than people would prefer it wasn't.

But what is derivative? When does being derivative w.r.t. the GPL mean? Can I copy a function from a GPL’ed project? What if I rename the variables? What if I re-order some of the lines in an inconsequential way? This starts looking like the software patent problem, or the ship of Theseus.

> Can I copy a function from a GPL’ed project? What if I rename the variables? What if I re-order some of the lines in an inconsequential way?

All of these are GPL violations if it can be shown you looked at a GPL function while copying this.

On the other hand, if you came up with it on your own and it happened to look similar, then it's fine.

The entire model weight file is a "compiled GPL binary" and its partial outputs would be too. If we would follow GPL precedents, everything that the model generates would be.

If course you can copy a function from a GPL project. That's part of making a derived work. What with you deriving the function from the GPL project.

The violation is where you subsequently pass it off as a novel creation.

The output isn't derivative, the model weights are.

This is tricky, though, because that LLM was likely also fed code with a license incompatible with the AGPL. So in theory, that code (whether source or compiled) may not be distributed under any license at all.

Being hard to solve doesn't make a problem go away, though. This is a place where I'm somewhat curious where it ends up. Frankly I think the outcome is more interesting for artistic works (e.g. poetry or images) than practical ones like code, since current generations of AI seem so much better at the former. Still interesting either way.

The other thing is that a bunch of stuff it auto-completes is way below any reasonable threshold for a copyrightable work even it bit for bit reproduces code from a piece of AGPL software. There are also only a finite sane number of ways to implement basic data structures like single- and double-linked lists in common per language. If I lay claim to the copyright for all of them should that prohibit anyone else from implementing the data structure (without unreasonable contortions)?

Technically you can’t copyright it. Proving that is the issue

Why do you assume it's a legitimate thing to do? Nothing changed from a copyright perspective. You can copy a GPL file directly, or take a photo of it, then decode the JPG, OCR the bitmap and put the result in a file, or you can train a LLM to reproduce it. It's all the same, if a judge feels you've copied a substantial part of the file then it's an infringement.

The same way an LLM would generate that code without the license, another LLM could find that code and determine that it infringes. If anything, the emergence of LLM powered agents will empower the free software movement to find infringements.

The only way free software would "end", is if judges would not be able to enforce copyright, because for example the copyright infringement is obfuscated too much. For example if LLM powered agents are going to both generate and run the code without ever saving it to disk. We're not quite there yet.

If legimate, then failure. The precondition implies the postcondition.

I don't personally think running copyright material through a magic box that you write lots of pretty marketing about removes copyright. Much like running it through grep to delete the copyright notices doesn't remove the copyright. Or deleting the licence file from a fork.

Seems totally obvious to me, but only because I don't buy that there's an artificial intelligence composing code from scratch that just happens to have the same expletives in comments that the GPL code did.

I, nor anyone else in this thread believes that the copyright is removed from the output of the LLMs, in fact we're arguing quite the opposite.

Your point is obvious to everyone. The question is why do you think anyone else believes differently?

I'm inferring from people using GitHub copilot that they're using co-pilot. Reflexivity.

So either they believe it isn't a copyright erasure tool, or they believe it is and don't care, or they haven't formed a belief in either direction.

That case analysis looks complete to me.

It's funny how this topic seems to make people's brains and reading comprehension just switch off.

I can train a human (such as myself) to reproduce entire song lyrics, verbatim.

We have entire professions (musicians, actors) who develop this ability.

Is that, in your view, 'illegitimate' too?

Why or why not?

AFAIK, having humans recite copyrighted songs from memory and then performing it without permission is illegal in most jurisdictions.

However, copyright law seems to make a distinction between expression/implementation of an idea (which can be copyrighted), and the idea itself (which generally speaking, cannot be). This is why clean room implementation is a legally sanctioned protocol to copy functionality without running afoul of copyright law.

Whether the language model is copying the "expression" (or a particular implementation) of a computating function, or whether it is just somehow re-implementing it given user's instructions, is going to be an interesting debate, and I really doubt people who think it's one way or the other has actually understood the nuances.

I'm unsure what you're getting at, but when people sing copyright songs or act copyright plays that do, in fact, get a license. So yes, if you train a human on someone's copyright content I do expect you to have a license to it.

I'm sure you've heard of covers? Well every cover that is published affords a royalty to (at least) the original authors of both the lyrics and composition. The artist may get some money, depending on how the work was licensed.

It's legitimate because the law says what is and isn't legitimate.

LLMs/Copilot/etc. copying other people's code is not legitimate for precisely the same reason. But big and powerful beats small and week.

There's a youtuber that makes excellent videos about this topic. Here's a longer one, but the shorter ones covering particular lawsuits are great too:

https://www.youtube.com/watch?v=MAFUdIZnI5o

It doesn't really matter what my or anyone's view on it is, unless they're either a law maker or a judge.

People do not get sued for having abilities. They get sued for publishing copyrighted works. What tools they use to create or publish those works is not relevant.

The only interesting legal question in my opinion is wether the large language model itself can be considered a carrier of copyrighted information, like for example an encrypted DVD would be.

If you can come up with a prompt that itself does not contain substantial copyrighted information, and that prompt leads the model to come up with a substantial amount of copyrighted information, then in my opinion it's no different from an encrypted DVD, and as such would illegal to distribute without licensing. Also I believe it would be illegal to provide access to it over the web like OpenAI does.

IANAL, but I wouldn't hold stock in any company that publishes (access to) models that are easily goaded into producing substantial copyrighted information.

If you reproduce those songs and charge a subscription fee for anyone to use them you will be going to court. If you use samples of a song (which I think is much closer to an LLM) you will pay per sample use.

Also, comparing a human to a service that runs on billions of dollars of infrastructure is silly.

rather infamously, “it depends!”

https://variety.com/lists/song-copyright-infringement-cases-...

> I think that's the end of "free software" in the GPL sense. There is zero point to writing AGPL on a program if copying it into a language model and then back out into a text file without the license is a legitimate thing to do.

Why would you think this is 'legitimate'? Firstly, LLMs are not legal agents, only humans are, so any human caught doing this is violating the GPL, whether or not the creation of the LLM is legal or not. Bits have color

> Why would you think this is 'legitimate'?

They say "IF it is legitimate to do X, then ...". They don't say it is legitimate.

Sorry, to be clear, I am saying, regardless of whether it is legitimate to do X, it is still illegitimate to distribute copyrighted code intentionally without following the terms of the license.

I tend to agree with the parent: if it is legitimate to take copyrighted code, pass it through an LLM, output it in a new text file, and say "it doesn't have any copyright anymore because it was generated by an LLM", then copyright is essentially dead as a concept.

If copyright is dead, then no need for licenses anymore: anyway people can remove your copyright by laundering your code through an LLM.

Microsoft has indemnified customers who use its Copilot to generate code. If you use code generated by copilot and you're found to be in copyright violation, Microsoft will pay the fines for you.

"if a third party sues a commercial customer for copyright infringement for using Microsoft’s Copilots or the output they generate, we will defend the customer and pay the amount of any adverse judgments or settlements that result from the lawsuit, as long as the customer used the guardrails and content filters we have built into our products."

https://blogs.microsoft.com/on-the-issues/2023/09/07/copilot...

As this case shows, it takes over a decade to successfully litigate a pretty obvious copyright violation. So Microsoft feels quite confident in paying for you.

I disagree. Somewhere out there is an ambitious and voracious law firm just chomping at the bit for a chance at Microsoft’s or OpenAI’s billions. They will sue and the situation will get clarification.

They already started: https://githubcopilotlitigation.com/

Definitely. It'll take a decade or two and cost millions of dollars. Doesn't actually matter which side wins, GPL will no longer be a thing either way after that long. It's a spectacular play by Microsoft.

It's not mentioned because it's neither relevant to this article or true at all? As far as courts are concerned right now, LLMs are simply tools and all existing rules and procedures around copyright still apply: a human is liable for it's use, only the work and skill of a human is copyrightable, etc.

Nor are LLMs novel in any way when it comes to copyright violation. Microsoft is already rich enough they could ask developer(s) to reproduce a GPL code base but slightly different and then make an argument of coincidental, parallel thought. Or just pinky promise "we totally didn't steal this." Heck, it'd just be easier to copy and paste without license headers and then just run some basic human-readable obfuscation.

Furthermore, AI still isn't even close to being able to pull this off for even remotely complex projects. The context sizes are too small, the models aren't sophisticated enough, etc. They save time as an assistant, but novel output is extremely finicky and prone to errors. Getting a model that can be trusted to do what you're saying would be approaching AGI, in which case the economic ramifications are far more concerning than those on OSS.

Finally, how exactly would this "disassemble" OSS? The GPL has been violated for forever, especially behind closed doors. If this would kill it, the GPL is already dead and capitalism killed it. After all, if Microsoft - a company with a revenue stream larger than countries - decides to steal from virtually any OSS projext and the developers - a gaggle of volunteers with few liquid assets - try to take them to court, they're about to engage in a battle of attrition with legal fees. The legal system notoriously favors the rich, which is a far greater threat.

> The context sizes are too small, the models aren't sophisticated enough, etc.

Yeah, I wonder what GPL-ed code is actually infringed upon. I vividly remember the time Oracle claimed Google infringed their copyrights because they copied a couple small functions, and the tech community just laughed saying the functions were too trivial. (Mind you, Java was licensed under the GPL.)

People harping that the GPL is somehow more affected by LLMs is kind of misguided. If there is copyright infringement, then almost all other licenses would be infringed too, since the vast majority of OSS licenses require keeping the copyright notice at the very least.

And the enmity towards Microsoft, whose "fault" is just having acquired shares of OpenAI, as opposed to almost every other Big Tech company who also released LLMs (and obviously injested a lot of github code), feels like the early 2000s again.

Whether it violates the GPL aside, is there a need for a new license that explicitly forbids what OpenAI has done?

No, either this is fair use, so no license is required, or the current licences must be followed (including attribution which seems like the first thing that gets forgotten).

But if this is fair use, doesn't it mean that copyright is essentially dead? As in, LLMs are then a big copyright-laundering machine?

would such a license even be possiple?

Copilot does small-ish snippets. It does not recreate a whole project. I am on the fence about the morality, but it won't recreate elastic search for Amazon to resell as a service.

I find It fascinating to see the same-ish group of people arguing that "Algorithms cannot be patented" or "information wants to be free" or "free software, free access" and such, now turning 180° and demanding to control where, how and when information is used.

At the very least it's somewhat ironic. At worst it's plain hypocrite.

In the interest of best possible interpretation of the group argument;

Group A : "Information wants to be free and we shouldn't patent algorithms"

Group B : "If you want to use our corporate stuff, you must pay"

Group A : "If that is the route you choose, we will still not charge for our stuff but if you want to use it, you must share your changes"

Group B : "If we use this tool that generates code, trained on the code that Group A created, it doesn't count as Group A's code and we can ignore their rules"

Group A : "It does count as our code, please abide by the rules."

More interesting to me would be; If I trained a LLM on leaked MS sources and built an OS or Office suite. Would MS be ok with that?

The rules remains the same. If you reuse a significant amount of code as is, you are infringe copyright. If you internalized some new knowledge based on some code and come up with a new implementation.. this is how we human learn. This is expected. Why would it be different for llm?

> If I trained a LLM on leaked MS sources and built an OS or Office suite. Would MS be ok with that?

Why not?

If your implementation is serving back literal chunks of code, I'd presume not, and they can easily use copyright laws to punish you.

If your implementation uses that as "inspiration", It's hardly different from you reading that code and learning from it. Obviously, it's almost impossible to read the code, learn from it, and be 100% sure you'll never reproduce any of their code. Hence "clean room" teams and such.

It feels like you completely miss the point of copyleft licenses. They definitely do impose constraints. Saying "I believe that LLMs are abusing my license" is absolutely not hypocritical.

I'm not saying that saying that critique on LLMS who are abusing copyleft licences is hypocritical.

I'm saying that the arguments that define this "abuse" often are.

What I specifically find hypocritical, we cannot suddenly put restrictions on what clients may or may not access, read, store and see our content. "Only a human may access my content" is just as bad as these numerous attempts of DRM that "hollywood" has tried to force down on the web.

More practically: I have a blog, with a CC-SA licence on my content. If an LLM starts spewing my exact paragraphs and articles without the same license (the SA-part asks this), I'd be pissed and have a right to call it "abuse" and could quite easily take the company behind it to court (If I wanted to).

But when that LLM merely hashes, vectorifies, trains on, and stores copies of my content so that their project can mimic my tone of voice, ideas and other content, so be it: I find it immoral to impose restrictions on what, who, where and how my content is read. Because I find DRM and such immoral.

If I read your code, learn from it and later write something inspired and based on the knowledge I internalized, am I violating your license?

> OpenAI recently fed everything on GitHub into a language model which will cheerfully reproduce GPL'd software without license or attribution.

Currently, when does reproducing code become a violation of the GPL? If I see an interesting function in a project under the GPL, can I copy it? What if I rename the variables? Or what if I reimplement the function exactly? Approximately? Add perturbations Etc, etc. I get ship of Theseus vibes.

> OpenAI recently fed everything on GitHub into a language model which will cheerfully reproduce GPL'd software without license or attribution.

Can you give me a prompt that will do this? I'm a tad skeptical this is possible atm.

Use beginning text from https://www.gnu.org/licenses/gpl-3.0.txt

Tried few differently sized chunks of this. Couldn't reproduce.

> model which will cheerfully reproduce GPL'd software without license or attribution.

Can I get a citation for this? I have seen it produce code similar to GPL code for trivial things but never a direct reproduction.

The most common example for this is the fast inverse square root function from Quake engines. Start the function signature and the "auto-complete" will fill in the body implementing it.

https://codeium.com/blog/copilot-trains-on-gpl-codeium-does-...

> To prove that GitHub Copilot trains on non permissive licenses, we just disable any post-generation filters and see what GPL code we can generate with minimal context

This seems like a key line.

I can get my browser to output GPL code with a carefully crafted Google search query, and there might even be unlicensed use of GPL code in my browser itself. But as I understand it, as long as I don’t copy GPL code, I should be fine.

In this case they’ve disabled the GPL filter, and gotten GPL’d outputs. Fair enough. The question though: when the filter is on, can I trust it? Not sure!

Not to mention it seems like most of the blog posts and tweets about this are also very purposefully prompting to get GPL code.

Secondly, if you take this seriously you should already being doing some kind of static analysis to detect it because what if one of your employees copy/pastes some GPL code from somewhere?

It's practically a non issue that people are blowing out of proportion.

Ofcourse you can't trust it. It's trained on code from github repos, and, suprise, people copy paste GPL code all the time into their repo which they randomly chose a permissive license for when the repo was created.

> I think that's the end of "free software" in the GPL sense

If anything it's the end of OpenAI

Licenses is really a cancer that the open source world never needed.

If I release my code, it's with the license "do whatever the fuck you want". Otherwise I wouldn't release it.

There is a license for that, you know...

Yeah I know, and it should be the only option for open-source projects.

The rest is just bringing politics where it doesn't belong.

One does not need a license for public domain.

Reply on news.ycombinator.com