Contractor had included GPL code, so Microsoft decides to publish its own source | Hacker News Reader

Contractor had included GPL code, so Microsoft decides to publish its own source

lawandlifesiliconvalley.com

18 pointsdctoedt40 comments

Weird how it gets spun as a 'danger of open source'.

It's simply being careless. If they have a review process and it did not catch this it can't be much of a review.

The really worrying thing here is not that a chunk of gpl'd code made it into the distribution but that apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight.

Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. And that becomes a "danger" in a businessman's model of the world because it is a clear and present danger to the health and survivability of their company.

> apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight

Microsoft, like most companies, has been hiring too many contractors instead of FTE. While this gets spun as a "contractor out of control" it isn't a contractor out of control, it is a business model out of control.

Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore.

How does this follow from anything? There's nothing about the GPL that says you can't sell your product. This has happened before; a Japanese game used Xvid a while back for its videos and included the GPL Xvid decoder in the binary (stupidly, since there are better LGPL equivalents anyways). They got called on it and released the source of the game--but did anyone care? I highly doubt that it hurt sales--everyone who was going to pay for it probably still paid for it, and everyone who was going to pirate it probably still pirated it.

There's nothing about the GPL that says you can't sell your product.

I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free.

That -- without any shadow of a doubt -- hurts sales (even if you "highly doubt it").

RedHat sells services, not software. That's why they can afford for CentOS to keep doing what they do.

I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free.

My entire point is that this isn't true. The aforementioned game released its source code--and nobody cared.

The GPL applies to code only--nothing else. If a game's source code is GPL, that doesn't give anyone permission to legally distribute the game--all the art and assets are still not GPL'd, only the binaries are. I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful.

And companies vastly overvalue their source code. They assume that since they spent $1m developing something that the source is worth $1m, when in reality there's probably nobody in the world who would pay a cent for their crappy code.

I don't see how one could possibly sanely think that I would find a copy of, say, Civilization 4 without models, textures, and sound to be useful.

Are you serious? It's a drop-in game engine. You could create a variation on Civilization 4 for the cost of your artists.

And you'd have to release it under that same license (or a GPL compliant license), which means that anybody can do the same thing to you. If you improved the engine in some way, there's nothing stopping the makers of the original game to take your improved version, bundle some resources with it (sound, graphics) and release a new and improved version of their game.

Which means that the original corporation won't participate (unless forced to by accidentally including GPL'd code) because there are a lot of very good reasons for a corporation to not share their source code (ie, competitive advantage), and we've come full circle.

I think the point is that engines are a commodity, artwork and game logic, motion capture & sound effects are not.

I wish this tired GPL counterpoint would be put to rest. If you provide the source code for your software, someone else will compile it and distribute a binary legally and for free.

FWIW, I contribute to an app that has been on the App Store for ~10 months now, been in the top 100 for its category since release and is open source (under a BSD license). We've had several people tell us that someone could do this very thing - compile the app and post it online for free - but it hasn't been done yet.

Of course, the app has been cracked and placed on other sites (and its technically legal since binary modifications/redistributions are allowed). But thats a different issue.

That would be because:

- The copied app (unlike on the free internet) couldn't be called "Colloquy" (or reference Colloquy in its tags) because Apple would forbid its distribution, and so discoverability is significantly reduced.

- It costs $99 to acquire an appstore developer certificate to work with Apple's DRM, reducing the chances of opportunistic behavior on behalf of users. I can't just check out your project and put it online.

Of course, the app has been cracked and placed on other sites (and its technically legal since binary modifications/redistributions are allowed). But thats a different issue.

Is it really a different issue? It seems like the only thing protecting you from unrestricted copying is Apple's DRM and control over the AppStore.

The copied app (unlike on the free internet) couldn't be called "Colloquy" (or reference Colloquy in its tags) because Apple would forbid its distribution, and so discoverability is significantly reduced.

Sadly, not completely true. It couldn't be called colloquy, but the I last time I looked (admittedly, a month or two ago,) two of the competing IRC clients in the app store mention Colloquy by name in their description and one of them also has "Colloquy" as one of their search terms.

Is it really a different issue? It seems like the only thing protecting you from unrestricted copying is Apple's DRM and control over the AppStore.

I don't see the difference between Apple creating some semblance of DRM in the app and developers having to do so on their own. A cracked app is a cracked app, regardless of the protection that was cracked.

One of the things that I love about the App Store is that I don't have to deal with keeping track serials. I buy the app, and it just works. If (when?) Apple were to allow people to put apps on their device without going through the App Store, serials may then become an issue.

I would not say this is "spun." Furthermore, from his bio, "I am the General Counsel, pro bono, of the Open Source Initiative."

My reaction to the HN title was "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)

> "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)

I solemnly promise that if that comes to pass you will be credited with planting the seed.

Now, does anybody have a way to get me on the windows team as a developer ?

Then they would simply remove the GPL code and push out an update. The GPL does not compel the release of source code - if they accidentally distribute a product that does not comply with the requirements of the included GPL software then they simply lose the right to distribute the GPL software at the copyright holder's discretion.

Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. The contractor would be toast (probably had an indemnification clause), MS wouldn't have been on the hook for that much even if the copyright holders of the GPL code sued for infringement, as it wasn't willful.

The GPL absolutely does not force them to do so. It cannot, as it is simply a copyright license. The GPL actually terminated as soon as MS distributed the code, since they weren't following it's rules.

I don't know if they have a formal agreement with the copyright owner, or if they're just following what is an accepted practice in opening the source, but technically GPL v2 cannot be "reactivated" on its own.

> Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code.

Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary and asks for the source.

Hmm, so I can give away copies of MS Office so long as I stop when someone points out it's copyright violation?

You would probably have to pay damages; see the ongoing drama of RIAA v. The Public for an example.

Don't tell anyone, but I really want to try this technique on Android. Cut-n-paste some GPL3 code from somewhere, get it accepted, wait for the binary using the code to be released, and then you can get root on your phone simply by sending a nastygram (as the GPL3 prohibits devices from locking out the user without their consent).

No more wasting time finding a security hole!

(Perhaps this has already been done!)

Such a trick only works if the code doesn't matter. For something as important as Android, Google would just remove the offending code. Also, all code coming into important projects like Android has to have someone to vouch for it, so perhaps Google could shift the blame to the submitter (who would have had to remove the GPLv3 notice before submitting the code).

Doesn't matter who they blame. Once the GPL3 code is in your hand, on the phone, they are stuck. Removing the code is fine, just like how they fix security holes that let you get root.

So, your idea of telling nobody is to post something on a forum that catches 40K uniques on a good day and has employees from that specific company as it's members ?

Something tells me you're not entirely serious ;)

Looking out for one class of problem makes it easier to inject other classes of problems.

Or they could just give me root on my fucking mp3 player.

Devious...

What bugs me about this closed stuff is that if they'd open it up it would get so much better faster. Hackable hardware seems such a no-brainer.

But then you wouldn't be able to sell three or four DRM'd YouTube-equivalent videos on your website.

(I am referring to Archos here. They can't give you root on your mp3 player for this reason, supposedly.)

They should be selling the hardware and make a profit on that.

There is a movement going of open source hardware but if the 'open source phone' is any indication it has a way to go before it will be competitive. What's in an archos anyway that makes it special ? (hardware wise)

They are, but they also want to have the option to sell my eyeballs to someone else in the future. (I won't be buying any more Archos products until I get root on my device. That is probably costing them more than they will ever make from ads... but every business has a right to self-destruct if they want to. I am hoping they see the light, because their hardware is very nice. But Sony used to make good hardware too, and then they tried the "DRM everything" approach, and now nobody even knows about Sony anymore.)

> Microsoft decides to publish its own source

"Decides"? The very gpl license forces them to do so, this headline basically says "Microsoft decides to respect the law". Nothing to see here.

Couldn't they have instead rewritten their code so that it didn't use the GPL-licensed code?

Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.

This is not correct; please stop upvoting mindless talking points. Nothing in the GPL or in copyright law compels infringers to divulge their source code.

Huh? You mean other than the fact that if they don't they're violating their agreement with the copyright holder of the GPL'd code?

They're violating the license, which means they no longer have the right to distribute the GPL'd code. In some cases, they may have to pay damages. However, in the US (laws may be different where you live), the violator can't be forced to divulge their source code; the author of the GPL'd code has no right to it.

An analogy might help; say I distribute CDs, with 6 songs I wrote and 6 songs by the Beatles, without a license. A judge can place an injunction to stop me. The copyright owner might seek damages. The judge might put me in jail/prison, if I continue infringement or don't pay. But they can't force me to give up the copyright on my songs, merely because they're distributed together.

You're wrong, by using the GPL you agree to abide by it and this means giving the source in case of redistribution of the binary, plane and simple. Many companies have been sued and forced to give the source, look it up.

Also, I don't know how just open sourcing the code is fine by the law. An example, If I stole money from a bank and then brought it all back the next day, and the bank had no net loss because it didn't do anything with the hard currency anyway, wouldn't I still be prosecuted? Not likening Microsoft's actions to stealing money here, it's just an example.

Not that it would do much in this case -- worst case, a judge places an injunction against Microsoft and they're not allowed to distribute the utility. The author would have a very hard time proving damages, since both the original code and utility are distributed for free.

Microsoft had four options:

1. Stop distributing the utility

2. Publish the utility's source code under the GPL

3. Arrange a separate licensing agreement with the owner of the GPL'd code

4. Remove the infringing code from their utility

Nothing about the GPL "forces" the infringer to divulge their code -- that's simply one available option.

> Nothing about the GPL "forces" the infringer to divulge their code -- that's simply one available option.

Wrong, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.

No, as soon as you publish your infringing app, your license to distribute the app is terminated. You are not forced to provide your source code, but you are forbidden from further distribution of the GPL part, even if you then publish your own source code as GPL.

If I remember well, in the GPL version 3 there is a mechanism so that if you publish an infringing app but then correct the infringement by publishing the whole source as GPL within a certain number of days, your license to distribute the app is not terminated.

Reply on news.ycombinator.com