BMW and the GPL | Hacker News Reader

BMW and the GPL

shkspr.mobi

134 pointsedent43 comments

As far as I know, the original suggestion that there was a possible GPL problem was raised by Duncan Bayne on Lobsters. After his story got attention, BMW got back to him.[1]

Without making a big show of this, it would have been much more difficult to get BMW's attention. Duncan tried to contact legal but was refused.

The point of GPL compliance isn't to sue or to shame, but just that: to bring people to compliance. Even in the beginning of the GPL rms said to Eben, "I have a rule. You must never let a request for damages interfere with a settlement for compliance."[2] Legal action is an absolute last resort, usually when years of friendly negotiations fail. All GPL lawsuits I know of only took place after years of attempts to get compliance failed. Duncan just wanted compliance, not legal action.

---

[1] https://lobste.rs/s/uaa4db/bmw_refuses_to_abide_by_terms_of_...

[2] http://www.geof.net/research/2006/moglen-notes

What would have happened if, instead of raising it on lobsters, Bayne had emailed the address in the manual? (And if he doesn't own a BMW (or a written offer in accordance with the license), he's not in any position to be asking for the source code). Most likely he'd've received the source and there would've been no issue. The outrage-storm was extremely premature.

> he's not in any position to be asking for the source code

People keep repeating this, but I'm pretty convinced that clause 3b of GPLv2 says that the source code must be given to any third party, since 3a and 3c do not apply:

https://news.ycombinator.com/item?id=11218324

I agree. It's also possible, I presume, to hire a car for the day. You don't need to be the owner of the vehicle, surely?

The whole point of the GPL is to give you the right to fix or improve software you own. It would be extremely rude to reprogram a rental.

Depends. Would it be rude to inflate an under-inflated tire? Or to wash the windscreen? Or tighten a loose bolt somewhere?

I mean, you're right - it's impolite (and possibly dangerous) to reflash someone else's firmware. But considering the regular upgrade path for BMWs is to stick a USB stick into the car, I'm not sure how you can prevent it.

https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...

IMO modifying a car you don't own would seem to be illegal, no matter how easy or hard it is to do. You wouldn't go and start swapping out engine parts, would you? Why is ECU firmware any different?

"I made a few adjustments to your brake lines, and I improved your steering system -- I call it 'natural' steering because it works the opposite direction."

I'd think you'd really have to but only lawyers could say something legally convincing about this.

The intent of the "any third party" language is that someone who receives a copy under 3c can invoke the offer. The offer must be valid for him, but unless he received the written offer (e.g. by buying a second-hand BMW from someone who distributed the software in accordance with 3c) he has no real business taking it up (and while BMW must honour their offer if he happens to make the correct request, they have no obligation, legal or moral, to help him make the request the correct way).

No, that's not the intent. At all.

In fact, this is covered square on by the GPL faq:

http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO...

"What does “written offer valid for any third party” mean in GPLv2? Does that mean everyone in the world can get the source to any GPL'ed program no matter what? (#WhatDoesWrittenOfferValid)

If you choose to provide source through a written offer, then anybody who requests the source from you is entitled to receive it."

From your own link: "The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you." So yes, that is the intent.

Sigh. Look. they have bad grammar, but i'm telling you what the intent is. Please read the GPL compliance guide: https://www.softwarefreedom.org/resources/2008/compliance-gu...

The example valid offer: "... This offer is valid to anyone in receipt of this information."

"Second, note that the last line makes the offer valid to anyone who requests the source. This is because v2 § 3(b) requires that offers be “to give any third party” a copy of the Corresponding Source."

This changed in GPLv3, which specifically mentions people who possess the object code instead.

It was changed explicitly, see the rationale for the third discussion draft of the gplv3.

The legal implementation is that the offer must be valid for any third party, yes. But the intent is that the offer is for people who received it under 3c, and I have no problem with BMW only doing the bare legal minimum for anyone else.

"But the intent is that the offer is for people who received it under 3c,"

Citation requested on intent.

I have provided evidence this was not the intent, citing things like the draft rationale, etc for the license prepared by the people who made the license. Please provide your counter evidence.

You've already provided the citation! Once again, direct quote from your own link, http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO... : "The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you." (where "in that way" is referring to "When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer.", i.e. 3c).

He is in a position to be asking for source code. BMW did not " a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, "

or do something reasonably similar ( point people to the source code site from their car, etc). Instead, they made a written offer. Written offers must be valid to any third party. Not just to people you give binaries to:

"b) Accompany it with a written offer, valid for at least three years, to give any third party, ... a complete machine-readable copy of the corresponding source code"

(emph mine).

If he doesn't own BMW car, he didn't receive a written offer and can't really act on it.

You have to refer to actual written offer made to one of their customers. The argument that "I didn't see the written offer, but I believe it exists" doesn't seem very convincing.

edit: "own" is defined loosely here, you may ask a friend for a copy of the offer, or rent a car, or download it if someone publishes it on the Internet. But if you have never seen the offer, I'm pretty sure you're not in a position to enforce it.

As far as I know, the people who can enforce it are the copyright holders, if they have evidence that BMW isn't complying with the license. It's irrelevant whether they personally own or have used a BMW car.

If BMW (or anyone) has distributed the code in violation of its license then the copyright holders can sue. But there would have to be someone who's received a BMW car (i.e. distribution) for there to have been distribution in violation of the license.

> But there would have to be someone who's received a BMW car (i.e. distribution) for there to have been distribution in violation of the license.

This is a pretty trivial standard to meet. BMW sometimes sells multiple cars in one year.

Sure. So the question then becomes did they a) fail to include the required written offer with one of those cars or b) not honour that offer for any third party? And the answer to both of those is no.

"If he doesn't own BMW car, he didn't receive a written offer and can't really act on it. "

This is not correct ;-)

(i'll just point you at the other comment, rather than repeatedly quote the gpl compliance guide in multiple comments)

"Duncan tried to contact legal but was refused."

That's a little bit of a stretch of the scenario.

If I want to contact the Legal department of a multinational firm on a -legal matter- related to contract law and software licensing, I (or my lawyers) send a -letter- or at least email to the legal department.

I -don't- call Tier 1 Customer Tech Support for the vehicle, demand to be put through to legal, run off to the web and talk about how BMW stonewalled me.

I can almost never find that info.

Without sounding snarky, I searched "BMW Australia Head Office" and got the address, pretty quickly. Alternatively, the Contact page of their website had a section for "corporate" matters.

It's entirely reasonable for BMW to make this contact information easily available. BMW isn't a hapless victim here; they're a giant multinational conglomerate. They can afford to make it easy to find source code, and customer reps should know what to point to.

This shouldn't even require lawyers. The customer reps should be trained to point out where the source code is.

It was on Hacker News at the same time.

https://news.ycombinator.com/item?id=11214992

The original article said that he was pointed to a website where you could put in a VIN and get source code.

The GPL says that you must present a written offer executable by anyone. As long as their written offer describes how to get the software, and it works, they are fine. There is no requirement that they give the written offer to any random stranger who asks.

Furthermore the requirement for a VIN is very reasonable. The software is constantly changing, and without the VIN, how do they know what version to give you?

It was obvious at the start the BMW was in compliance. There was no actual story. Just a jerk who thought he was defending free software who was rude and managed to get a bunch of knee-jerk responses from the internet.

So what has been accomplished? We have "gotten BMW's attention", and wasted a bunch of people's time to verify that they were in compliance from the start. (Which I figured out from the original story, even if the person writing it didn't understand the GPL well enough to think it through.)

Just to clarify. After entering the VIN, you get the compiled firmware ready to flash.

There are no instructions on that page (or anywhere I could find on the BMW site) for how to get the source.

I've emailed the address in the license file, but I've not yet had a response.

> Here's the thing - contacting customer services like that was entirely the wrong approach. Customer services aren't trained for the 0.001% of people who might be interested in an esoteric matter of legal licensing. Crying foul because a minimum wage rep didn't understand an obscure technical reference is counter productive.

Damn straight. So provided opensource@bmw.com actually respond this should be sorted out: kudos for the author for being forthright about how this could have been handled better.

Or just push it on git hub once and be done with it for good.

> Customer services aren't trained for the 0.001% of people who might be interested in an esoteric matter of legal licensing.

Here's where I'd like to disagree. Of course customer service doesn't have to know about those esoteric issues. But customer service should notice when a request comes that's not their department. And if that's the case they should redirect it to someone who knows better.

This is not the personal fault of the person sitting at the customer service, but the structure in a company. They should be able to handle that.

I think you're underestimating the volume of stupid-and-crazy shit that CS reps have to deal with every day. Sorting out stupid-and-crazy from legitimate-but-not-my-department would be several full time jobs in itself.

You've touched on a larger issue that occurs to me often. Though your point is valid, my response to a company making the argument would be, "too bad." /They're/ the ones making billions in revenue by voluntarily accepting a business relationship with millions of customers. If you want the revenue from those millions of relationships, it's also your responsibility to manage your side of the bargain with those millions of relationships, that includes your legal (and many other) responsibilities. Is scaling to keep up with your responsibilities to millions of customers easy? No. However that's not the customer's problem.

And yet, they're making billions despite not doing what you say. So...

It would not be in the interest of 99.9% of your customer if you try to to satisfy those 0.1% of stupid-and-crazy customers. Because somebody would have to pay for it. And in this case it wasn't even a customer.

Whisper systems releases source code. BMW runs whisper systems OS. Where is the rub!?

Besides all of that: As already said BMW only needs to give you the source code if you are a car owner. If the car owner then puts the source code online it's fine.

This is not right. If they put it online and point you at it, at the time they ship, that's fine. Otherwise, it's going to be looked at as a written offer. In this case, it's a 100% clear written offer.

Written offers must be valid to all third parties.

http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO...

> This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.

So you still need to be in possession of the binaries. it is not any 3rd party, it is any third party who has possession of the binaries.

No. I understand why you may think it can be read that way. But i assure you it means "that means people who did not get binaries can still receive copies of the source code".

Please read the GPL compliance guides as well, which cover this in some detail (i quoted it for you in the other comment).

What you write would be correct for GPLv3, which uses the phrase, "accompanied by a written offer ... to give anyone who possesses the object code "

This was specifically changed in the third discussion draft of GPLv3 (see http://gplv3.fsf.org/gpl3-dd3-rationale.pdf) In any case, i assure you: if you try to restrict it to people who have binaries, various parties will take you to court for non-compliance :)

Lesson learned - don't touch GPLed software even with a long stick. Time to make FreeBSD gain mindshare instead of accepting GPLed linux which does the same thing!

Reply on news.ycombinator.com