An analysis of GPLed code in Thesis | Hacker News Reader

An analysis of GPLed code in Thesis

drewblas.com

54 pointsicey53 comments

Whether or not this means the ENTIRE Thesis codebase must be GPL’ed I can’t say

I can answer that. The quoted sentence is one of the biggest misunderstandings that developers make about the GPL. There is no obligation to make Thesis GPLed.

What's really happening rather, is that the author of Thesis is violating Wordpress's copyright. In order to fix the situation, they need to either stop using the copyrighted code, or reach some kind of agreement with the author of the code to obtain proper authorization. One way to obtain such authorization is by releasing their own code under GPL, but they could as well just negotiate a separate agreement.

GPL is not a virus that will force your code open without your consent.

GPL is not a virus that will force your code open without your consent.

In a lawsuit, could the copyright holder of a GPLed work force the opening of GPL-violating code as part of a GPL-violation settlement?

EDIT: I'm not a lawyer nor a student of the law. Presumably the copyright holder is entitled to some form of compensation, whether it's called a "settlement" or something else. Can the plaintiff dictate that the only form of compensation they will find sufficient is the defendant's release of the infringing code?

If it's a settlement, by definition, you are not forcing the other party, since they agree.

In my understanding, they could not, just as they could not force any other software pirate to do what they please.

It's just tht opening GPL-violating code is probably a cheaper alternative than paying damages (and as far as I know, there's a legal precedent for a GPL violator paying damages to the authors of the pirated code).

Alternatively, a GPL violator could negotiate a proprietary license for the same code from the author(s) of the GPLed code they used - it's questionable whether (a) you can hunt down all the authors, since open source licenses specifically enable collaborative development of software and (b) whether all the authors would agree to such a deal, especially after the company in question tried to pirate their code without giving anything back in return.

It could be part of a settlement (and I seem to remember a few cases where it has been in the past), but a settlement is an agreement between the two parties, nobody is "forced" to do anything.

> GPL is not a virus that will force your code open without your consent.

That would only be true if Thesis was not distributed to the public. Since it is and it has GPL'd code in it, it must be GPL'd itself.

Hypothetical: What happens if the agent that distributed the code to the public wasn't authorized to do so?

My view is that GPL infringements are no different than regular copyright infringements—the owner of the copyright is entitled to damages awarded by a court or an out of court settlement of some kind. This may or may not include GPL'ing the derivative work.

Wrong. Please read my original answer again carefully. You are falling in exactly the myth I'm trying to debunk.

Pretty damning.

I've generally agreed with theme authors that just interoperating with GPL software via its API is not enough to require your work to also be GPL'd, but when your theme or plugin contains whole sections of modified GPL code you've pretty much lost the argument.

This does settle the case as far as Thesis is concerned.

But, this still doesn't make it OK for Automattic to force all theme developers to move to GPL. As that guy rightly points out, by the same logic you should sue all closed source software on Linux that makes use of system calls.

The solution seems quite simple: If you don't like the GPL, don't develop themes for WordPress.

The solution is if you don't like GPL, don't copy GPL code from WordPress when you make your theme.

That's not at all simple. The corollary of that statement is "if you don't like the GPL, don't develop applications for GNU/Linux".

If you dislike it enough not to use any GPLed software, sure. The GPL specifically distinguishes between code running as part of the same "application" or not. In fact, the kernel itself has a clarification.

GCC itself is GPL, but its libraries (along with glibc) have an exception that permits linking against non-GPL software.

WordPress states explicitly that it considers the PHP portion of themes to be GPLed. Seems pretty simple to me.

WordPress states explicitly that it considers the PHP portion of themes to be GPLed.

That they consider it a derivative work is their -legal opinion-. Remember their license still doesn't supercede local laws and a court could invalidate Wordpress' legal opinion of what a derivative work is.

Furthermore, it doesn't matter what WordPress considers to be GPLed or not, what matters is what it says in the license.

Whether non-copied code imported via PHP's include() statement is covered by the GPL is up to the lawyers to decide, but personally, I'd say if your code explicitly calls GPL'd functions (as opposed to via a callback or so) or subclasses GPL'd classes, you're asking for trouble. If your code happily runs outside WordPress, you have a much better argument.

Linux has an exception at the top of its license specifically for that.[1]

   NOTE! This copyright does *not* cover user programs that use kernel
   services by normal system calls - this is merely considered normal use
   of the kernel, and does *not* fall under the heading of "derived work".

[1] http://github.com/mirrors/linux-2.6/blob/master/COPYING

Thanks. I didn't know this.

Assume for the sake of argument that such an exception is in fact needed. That is, assume that without such an exception programs running under the kernel would need to follow the kernel license.

Then there is still a problem with the exception. It only applies to code owned by the kernel developers. If I were to come along and contribute, say, a driver to the kernel, I'd have to agree tot he exception and license my driver as GPLv2 + exception. No problem.

But suppose as part of my driver, I needed some code for some data structure. I find that someone has already wrote such code and put it in a GPLv2 program. I'm using GPLv2, so I take their code and put it in my driver.

But wait! The author of that data structure code has not agreed to GPLv2 + exception. He's just released under GPLv2. I don't own the copyright, so can't relicense it under GPLv2 + exception.

If the kernel developers accept my driver, then the author of that data structure code could take action about people running non-GPL applications on Linux.

How careful are the kernel developers and maintainers about this? Do they make sure that anyone who contributes code, even indirectly, has agreed to allow the exception?

This in general is an issue with any code that uses a GPL + exceptions license, if the exception is actually needed. (Many feel that the Linux exception is NOT actually needed)

> Many feel that the Linux exception is NOT actually needed

Such a practice is used in other projects ... e.g. the GNU Classpath exception ... http://www.gnu.org/software/classpath/license.html

BTW ... a piece of software X is considered a derived work of some software Y, if X is dependent on Y for functioning and Y can't be replaced.

Linux may not need that exception for many user applications, but without it you're in gray area.

> BTW ... a piece of software X is considered a derived work of some software Y, if X is dependent on Y for functioning and Y can't be replaced.

The notion of a work "derived" from another work is a notion from GPL, not from copyright law. The copyright notion most closely corresponding to what GPL seems to mean by derived work is "derivative work".

Whether or not X is a derivative work of Y does not depend on whether or not Y can be replaced. For instance, if I sit down right now and write a Firefox plug-in, whether or not it is a derivative work of Firefox or not is not affected in any way by whether or not there is some other browser that also accepts Firefox plug-ins. The status of my plug-in depends entirely on the relationship of my code to Firefox's code. If I have copied copyrighted elements (literally or via adaption, translation, etc) from Firefox, mine is a derivative work of Firefix. If I have not copied copyrighted elements from Firefox, my work is not a derived work of Firefox.

A license is free to define whatever terms it wants, and require licensees to obey them. Hence, if I were to use GPL code in my plug-in, I would have to obey GPL, including going along with whatever rules they have on works "derived from" other works, however they define that.

However, if the author of software X is careful to stick within the limits of what copyright allows--he does not copy any copyrightable elements from Y, then the license of Y and whatever terms it defines are irrelevant to Y, at least as far as direct infringement goes. That is, X is safe from Y suing alleging that X violates Y's copyright.

If the people who actually use X and Y together would be violating Y's license, then Y could try to sue X for "contributory infringement". That's when party Z infringes Y's copyright, and party X is held to be responsible for causing or aiding that infringement.

A very important and basic fact about contributory infringement: there can be no contributory infringement without direct infringement. This pretty much rules out contributory infringement when Y is under an open source license, as almost all of these licenses allow Z to do whatever he wants on his own machine, include make derivative works that combine Y with non-free code. No direct infringement by Z means no possibility of contributory infringement by X.

Putting it all together, here's what I would recommend for someone writing some piece of software, X, that is meant to work with some other piece of software, Y, as a plug-in, enhancement, patch, wrapper, etc. Assume Y is under an open source license.

1. Look at the license of Y. Are you willing to use the same license for X? If the answer is yes, use that license. Go code. Don't worry about possibly copying code from Y. (Assuming Y is using an open source license, of course).

2. If you aren't willing to use the same license as Y, are you willing to use a license that is compatible with it? For instance, Y uses GPL and you are willing to use BSD. If yes, use a compatible license. Go code. Do not copy code from Y (directly or via translation, adaptation, etc). Go ahead and look at Y if you need to in order to figure out something.

3. If you are not willing to use a license that is compatible with Y's license, be careful. Do not copy any code from Y, directly or via translation, etc. Avoid looking at Y's code at all. If you need to know something, such as the interface to a function of Y, get it from the documentation. If the documentation isn't adequate, get somebody who is NOT going to work on X's code or design to look at Y and write a spec. Code from that spec.

What you are trying to do in #3 is to limit yourself to doing things that do not require permission from Y's copyright owner. If you can hit that zone, you have no copyright worries, and you can write X and release under whatever license you want.

Not needed because of this section I imagine - straight from GPLv2.

"However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

Even more damning, one of Thesis' developers just admitted to copying the code from WP:

http://ma.tt/2010/07/syn-thesis-1/#comment-481846 [source]

http://imgur.com/jNs7c.jpg [screen shot]

Chris could definitely make his business work by embracing the GPL rather than fighting it. Cut some sort of deal with Matt, accept code contributions to decrease development time and, generally, use Thesis to launch a million other non-GPL products.

He also seems worried about others stealing/selling his work, this is over-stated. Couldn't he just trademark the Thesis name to mitigate most of this risk? I would also bet that most of his customers would prefer buying the real thing over some unsupported knockoff. GPL or not, people who don't want to pay will find a way to get it for free.

I'm impressed. The author starts with this disclaimer:

> I’m not a lawyer, I’m a developer. My views here are my own and are based on TECHNICAL knowledge and experience with the GPL, not on the law (which astute observers will note often does not reflect real life)

I was not expecting much, therefore, in the way of accurate legal analysis, yet a couple paragraphs later he goes on to show the errors in the SFLCs analysis, and then goes on to correctly state what is required for something to be a derivative work, and then analyzes the theme in question to see if it is a derivative work.

If he had left off the disclaimer, and tossed in a couple of direct case citations in proper legal citation format (instead of just citing another blog that cited a major case), I'd have not guessed that he wasn't a copyright lawyer.

Hmmmph. Is PHP so different from C/C++/Fortran that it essentially transforms the GPL into the LGPL? If one compiles against the GNU scientific library, or writes a GUI frontend for GNU octave, the application is tainted. The FSF has also been explicit that one cannot get around this using shared libraries (hence the LGPL, where one can).

Now what about the user-generated content (e.g. blog post)? The content is mixed with the HTML from the GPL-covered work. Is it then also subject to the GPL?

I ask, because Bison is distributed under a modified GPL for this reason, and Gnu.org addresses the question with respect to Bison and to CMS templates.

"As it happens, Bison can also be used to develop non-free programs. This is because we decided to explicitly permit the use of the Bison standard parser program in Bison output files without restriction. We made the decision because there were other tools comparable to Bison which already permitted use for non-free programs."

- http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForN...

That document also addresses CMS templates specifically, stating that they basically shouldn't be GPL, for the same reason, as far as I can tell: "It is normally harmless to use copyleft on minor works, but templates are a special case, because they are combined with data provided by users of the application and the combination is distributed. So, we recommend that you license your templates under simple permissive terms."

- http://www.gnu.org/licenses/gpl-faq.html#WMS

Relatedly, I've been bothered by Drupal.org and the SFLC's stance that all Drupal modules and themes are GPL-covered for exactly this reason. [edit: for exactly the reason that the SFLC is claiming that Thesis is GPL]

It's going to be extremely hard to argue with that diff. The Thesis version is basically the same code with only some minor reformatting and additional comments.

It's actually a matter of proving it was copied and not written like that on account of, you know, good coding practice.

Right, otherwise we have moved into software-patent area (and correct me if I’m wrong, but there are no software patents that apply).

I agree there are really simple calls that just seem to use normal naming conventions, and is this the only section that has this potential issue?

http://ma.tt/2010/07/syn-thesis-1/#comments

Search for the third match of "Rick Beckman"

"I’m the one who contributed that particular chunk of code to Thesis. A lot of stuff in that particular file was done by me simply because at the time I didn’t know any better & I’m not sure if Chris & I had even discussed the GPL at that point or not."

If Chris were to release another version of Thesis that didn't use any GPL'ed code, would Thesis still have to be GPL'ed? What I'm asking is if Thesis is tainted forever by this copy-paste-refactor, or if he could "fix" the issue.

Thesis itself can be fixed by removing any infringing code, but the developer's reputation might be more difficult to repair.

Considering a few million dollars' worth of Thesis licenses have been sold in the last couple of years, we shouldn't be whipping out the Kleenex just yet :-)

"Thesis itself can be fixed by removing any infringing code, but the developer's reputation might be more difficult to repair."

Considering that he was already attacked when the guys from wordpress didn't even know if he was using code or not, I doubt it. Matt already stated that any themes or plugins fall under the GPL (even if you are only making function calls)

This is the Drupal Association's stance as well, and I think it has some side effects, that haven't been considered, with respect to content.

This is a better analysis than most, but it is unlikely that a court analyzing this would stop there. The court would probably use the Abstraction/Filtration/Comparison test.

Take the code, filter out the abstract concepts, the purely functional expression, and finally the short words and phrases in what was left. Some other courts would impose a further filter based on fair use and interoperability.

Take a look at the diff and apply some of those filters in your mind. After all those filters, I am unsure what, if anything, would be left.

EDIT: I had thought that this might be a case of parallel development, but Rick Beckman (former dev for Thesis) just posted that there was copy-paste from WordPress core - he did it. (http://ma.tt/2010/07/syn-thesis-1/#comments, Rick Beckman @8:41) Although that doesn't make it completely open-and-shut, it makes it significantly more likely that Matt/WP would prevail.

Makes it more likely that Matt/WP would prevail on what?

That Thesis infringes on WP copyright by using some GPL code, or that add-ons like themes are truly derivative works?

The article seems to confirm the former, but not the latter.

I just wanna point out that Matt Mullenweg used to have a much more logical, awesome, and superior stance before he decided to become Richard Stallman's apprentice.

http://ma.tt/2009/10/matt-qa-wordpress-gpl/#comment-469692

now he's commented on his own blog to confirm he's going to sue thesis: http://ma.tt/2010/07/syn-thesis-1/#comment-481725

I hope this thing doesn't get settled and goes to a judgment.

This would reduce the amount of rhetoric, since we'll finally get an idea of where a US court stands on parts of the GPL. Settlements don't provide any clarification.

It would be interesting to see if more projects go with GPL or switch to other licenses like the MIT or Apache license.

i agree. i am all ears since i have a book full of notes surrounding a large WP plugin project that i plan to sell.

I could be completely wrong here, but all the arguments I have seen from WP have to do with themes being derivative works, which is more of an idealogical argument of the GPL than anything else.

Does anyone know why Wordpress is so defensive over this though?

I think wordpress has an interest to have it all as free software, Matt's business are not built around selling themes their built around services anti spam, backup, etc

The themes are not WP software. They are contributions by theme developers and it should be up to them how the license it whatever WP might say. UNLESS they copy GPL'd code into their themes.

I guess I missed all the brew-ha-ha and build up. Am I mistaken, or can you sell GPL software legally? Even if his themes fall under GPL licensing which is somehow enforced, what difference does it make? (other than ideologically?)

The derivative work must be released under GPL code as well, and thesis isn't http://www.gnu.org/licenses/gpl.html

The is is whether themes are derivative works in the first place.

Because I could then take the PHP portion of his theme (nobody is claiming te HTML and CSS are GPL) and resell it or give it away for free.

I don't know how this theme is distributed, but I guess every buyer receives a copy of the theme's PHP. So they are distributing the source code along with the software, which is what the GPL requires...

Reply on news.ycombinator.com