Hacker News Reader

Comment by mrpippy | Hacker News Reader

5.7 dropped LGPLv2.1 as an option.

LGPLv3 includes the "anti-TiVoization" clauses which require that any device including the software must include an offer for not only the covered source code, but "Installation Information" allowing the end-user to replace the firmware on the device. Giving out this info is not something that a car company (or really any companies) want to provide.

It's unfortunate that a large car company doesn't want to buy a commercial license, but maybe they'll be forced into that once 5.6 becomes too old.

View on HN

Can you clarify how that differed from the previous open-source license?

I thought, prior to 5.6, you could go licenseless if you provided a way for the user to replace the (dynamically linked) Qt libraries with libraries of their own.

Was it just too nebulous before, and most companies just didn't offer a way to do this or buried it in some backdoor or something?

Yeah, I agree it's a shame that a lot of companies don't want to license up, but if you've seen what they want for a per-device fee these days you'd probably understand. I did a product in 2008 and it was maybe $1/unit, now it's an order of magnitude larger.

(my understanding, IANAL)

Yes, that's generally the spirit of both the LGPLv2.1 (5.6 and before) and LGPLv3 (5.7 and up). Link dynamically to the LGPL covered libraries, provide the source, and you're good.

But there's a commonly-used loophole: the LGPLv2.1 does not state that the user needs to be able to actually replace the covered library with their own built binary. In 1991/1999 this may have been assumed (given dynamic linking and desktop OSes), but for embedded devices and newer platforms it is not a given.

Digital signature verification can be used to prevent the user from loading their own firmware (the only way of replacing the LGPL libraries). This is why the GPLv3 added the anti-TiVoization clauses, requiring that installation instructions be provided with the source code, so the user can actually install the libraries onto the device.

Thanks for clearing that up.

I'm in final test on a 4.8-based product and actually put in a backdoor to replace the libraries...just to be safe and compliant. Guess the work isn't totally wasted.

Yeah, for a large company I would think the license would have been nothing compared to paying the lawyers to investigate the LGPL changes.

I think companies fear after they invest in a 5.7+ Qt stack, QtCompany can just ramp up their price after the initial contract runs out.

Yeah... A lawyer would never do that...

Reply on news.ycombinator.com