Oops: Android contains directly copied Java code, strengthening Oracle’s case | Hacker News Reader

Oops: Android contains directly copied Java code, strengthening Oracle’s case

engadget.com

165 pointsshawndumas96 comments

For what it's worth, this still at least looks like it's mostly code from test frameworks, which doesn't necessarily even run on an Android device itself. So it could likely be dropped from the source distributions without compromising the functionality of any device. (Distributing it would still have been infringement --- but a lot more easily remedied than it might have been otherwise.)

Specifically, if we look at the PDFs from the original source here:

  http://fosspatents.blogspot.com/2011/01/new-evidence-supports-oracles-case.html

six of the seven Android files are in subpackages of "org.apache.harmony.security.tests". The Android version of Mueller's example number six, strangely, has no package declaration at all, but the name of the class (PolicyNodeImpl) at least is the same as one that has been identified as unit test code the last time it came up in this connection.

(BTW, the "org.apache.harmony" package prefix doesn't necessarily mean that the ASF ever distributed the particular file in question; that PolicyNodeImpl.java file was distributed by Google with an Apache Harmony package declaration, but had never been distributed by the ASF itself.)

About the files with the Oracle copyright header, it seems to be on some remote tree that I can't even browse. Can you opine on whether it was ever actually shipped?

This is the most important post in this thread. It looks like they created their own "conformance tests", in some cases using the Java implementation as the baseline. On the scale of concerns, that is somewhere around 0.

Google should have done everything they could to buy Sun or at least buy the Java IP and Engineering team. Heck they could have bought them out fully and sold the uninteresting parts.

That would have been better for two reasons - Oracle is screwing up bad with the JCP and it's going to hurt Java - May be Google could have been a better steward. Secondly Google relies so much on Java not only for Android but also for many other things - it is almost idiotic not to buy the IP.

I guess they had their reasons to not pursue - I can't imagine what those were.

As I recall, IBM had an offer out for Sun, and Sun fell into Oracle's hands quite suddenly when IBM and Sun management couldn't agree on terms. It might be that Google was expecting that IBM would get Sun, and that they were OK with that, given IBM's generally more, shall we say, less frenzied approach toward monetizing its intellectual property...

Good point, Oracle paid $5.6 billion for Sun, Google could have afforded that, they just offered $6 billion for Groupon. OTOH, that seems like a lot of money to pay just for Java.

This is a movie plot notion of how M&A works. In reality, just because you have the assets on hand to buy another company, doesn't mean you can just go ahead and buy the company. First, you have to convince your own board, and then your public shareholders, that the acquisition makes long-term business sense.

Oracle bought Sun on a business model that saw them recouping the price of the acquisition not in proceeds from lawsuits but in shoe-leather sales to Oracle and Sun customers (which overlap intensely). Oracle already had the infrastructure to capitalize on that channel with Sun products.

Google had none of that. Had Google bought Sun, the first thing they could have expected would have been a shareholder revolt. The money isn't theirs to spend; it belongs, in large part, to Google's shareholders.

How much is Oracle suing Google for? If Oracle can get anywhere near $5.6 Billion from suing Google this could end up being one of the biggest tech blunders since AOL/TW.

but $6B wasn't a lot for coupons?

Perhaps Google used that $6B to buy 600M $20 Amazon gift cards from Living Social? Just to spite Groupon. 100% profit! :)

Groupon has 2000 employees, most of whom are sales reps. That's what Google was bidding on.

$3,000,000 per employee, most of whom are sales reps? They can get 2,000 employees for much cheaper than that. They were going after the user base and ridiculous profits.

It wasn't coupons, but a coupon business model.

It wasn't coupons, it was a sales team. Groupon has customer-facing sales down to a science, especially when compared to Google.

Somehow I think this lawsuit will cost Google somewhat less then the 8 billion dollars it would have required to buy Sun outright.

This is bad, but I still don't yet believe buying Sun would have been the better option.

Money in / Money out is the smaller picture. Having control over the Java IP, future direction, security from anybody suing you - that is priceless.

Not exactly priceless - the upside has to be worth more then the 5-7 billion spent for it to be worth it for Google.

Security from people suing you is probably the most compelling reason you gave here - I see no reason why Google would want to control Java IP and future direction when they can write all the software they need to in house to built on the Java platform to meet their needs.

So is 5-7 billion worth security for people suing you? I guess we'll see, but this is likely the biggest lawsuit related to Java they will ever face, and you can bet they won't make this same mistake again. Unless then pay out several billion dollars, which is unlikely given the tendency of these large technology firms to cross sue and settle with cross licensing agreements, I'd say Google's decision not be buy Sun is still sound at this time.

Just my two cents, I am watching just like the next person from the sidelines, this should be interesting.

Google does a fair bit of language and VM research - Go language, Python/LLVM and I think having Java in their pockets would give them a good amount of leverage - they don't have to rely on Oracle providing a updated JVM under favorable licensing terms for example - lot of Google Enterprise stuff is Java based. If tomorrow Oracle decides to go OpenSolaris route for OpenJDK - that would be bad for Google as they don't have their own "Java" VM.

But even if you just consider the suing part - this is potentially not just limited to Google but also their OHA members. So if Larry sues everyone in OHA and handset makers couldn't afford to pay what Larry asks - that could end up hurting Android.

It's more than that though. This article specifically says that HTC and Motorola have also been sued for patent infringement. Even if Google can afford to pay for these types of lawsuits, this could really hurt them strategically in working with telecoms and other vendors in the future. Anyone wanting to build a new tablet/phone will have to consider this as a huge risk. Could have much bigger strategic aspects than just the IP

Sun cost 5.6 billion after accounting for Sun's cash.

It would've been the better option for the rest of us though...I'd feel much more comfortable (even excited) with Google at Java's helm...

> Oracle is screwing up bad with the JCP and it's going to hurt Java

i was far from all this politics, but made a few google searches - is this about ASF leaving JCP? then, as far as i understood, these issues are all related, to Harmony, suing etc.

so maybe Java wouldn't be hurt? just specs would be changed more tyrannically...

(java my favorite language, don't make me sad :)

Direct source link: http://fosspatents.blogspot.com/2011/01/new-evidence-support...

Thank you. Maybe I'm blind, or something, but I sure couldn't find a link to the original source on the Engadget article page.

Actually Engadget are sticklers for attribution, when reblogging an article they sometimes have two links; both {Via} and up the chain to {Source}

It is hard to see it if you are not used to the page design. I do find the pages heavy on engadget. (which always cause problems when demoed on mobiles tee hee)

It's always been hard to find. I think it's intentional on Engadget's part. It's under the two paragraphs on text on the left hand side. It used to be colored differently and it actually was even harder to notice.

edit: yup, the version arn is referring to was the most annoying and hard to find IMO.

It used to be a small obscure text link labeled "Read". This is actually a big improvement (though certainly not ideal).

http://web.archive.org/web/20091028095024/http://www.engadge...

And they made the word "Source" right before the link an image (http://www.blogsmithmedia.com/www.engadget.com/media/post_la...), just in case search engines are smart enough to infer "authority" for topics by detecting reblogging (e.g., by analyzing surrounding text for words such as "source" etc).

Cheers. That's the first time I've seen black italic text mean "hyperlink".

From a quick look it definitely looks like copyright infringement, but in a non-critical area of Android. Google may end up paying a small fine over this, but it doesn't address Oracle's central claim that the Dalvik VM infringes their patents.

It doesn't matter whatever it's critical area or not... it's still copyright infringement.

It does matter if it doesn't address the claims of the case. Just because I copied your magazine article doesn't prove that I also copied your novel.

In case you don't know copyright infringement is part of the case (Exhibit J):

http://fosspatents.blogspot.com/2010/11/copyright-part-of-or...

http://docs.justia.com/cases/federal/district-courts/califor...

Thanks for those links. So from your perspective what matters more - the patent dispute on the virtual machine that all of Android runs on, or a copyright issue on 40-some code files?

I'm not even sure how core those files are to running Android - it looks like they could easily be replaced by Google with new code.

Actually, each act of copyright infringement can constitute 20k in statutory damages. Depending on the use of the directly copied documents, each install of android could be an act of infringement (I'm not sure of to what the documents pertain, so this may be completely off). With 300+k activations a day, assuming all documents pertain (which may be a large assumption), that adds up to $240,000,000,000 a day. That's a lot of money.

But these files don't run on devices and aren't even publicly available.

Virtual machine dispute matters more for survivability of Android, that goes without saying.

However, to me, copyright infringement matters a lot more... If someone is getting free code then at least they could respect the LICENSE.

It matters for determining damages, as well as how difficult it will be to replace the infringing code.

From a practical point of view, it is ~43 files out of how many? I think this means that someone got lazy and just copied a bunch of files. This is something that is worthy of a slap on the wrist at worst.

Unfortunately, I'm sure that now a few floors of lawyers are salivating at all the hours they're going to bill. In the end, the laywers will get a pile of money, oracle will gain some pocket change at google's expense, and the java community will be hurt the most.

Doesn't Oracle have better things to do? What do they gain from this?

This is something that is worthy of a slap on the wrist at worst.

Given the breadth of the infringement (making it open source w/ OEMs shipping tens of millions of devices based on it), the damages could be substantial.

What does Oracle have to gain from this? Money of course.

Unless Google has a good response to this, one thing I guarantee will happen is the engineer who checked in these files is going to be looking for a new job.

>OEMs shipping tens of millions of devices based on it

This is assuming it's a part of the code that actually makes it onto devices. Some of the other comments in this thread suggest they may be from a testing framework.

Doesn't matter if it makes it to devices or not. The code was checked into Android repository and was available for download. In other words, the code was made available. With a different license. That is illegal.

In which case the damages will likely be substanially lower :-)

Your comment leaks quite a bit of bias against Oracle. You'd be just as frustrated if someone violated licensing on a tiny part of your software, then relicensed it and gave it to OEMs for worldwide distribution. In fact, I'd wager that you'd be more frustrated, because you don't have the legal resources that Oracle does to go after it.

Sure, whatever opinion you have about Oracle might be valid, particularly with the way they're handling the JCP and OpenSolaris. Whatever. However, there is an underlying issue that is a bit bigger here, and the blog author is pointing that out in a reasonable fashion. It doesn't matter who is suing and who is sued; copyright infringement is copyright infringement.

You could make the argument that this isn't any of Oracle's business, but they absorbed everything about Sun: their IP, their liabilities, and so on. Sun was perhaps considering this action before Oracle bought them, and we'll never know.

What if the companies were reversed? Would you make the same remarks?

"...It doesn't matter who is suing and who is sued; copyright infringement is copyright infringement...."

One of the few positive things about our legal system is that it at least attempts to take "intent" and "proportionality" into account when making judgments.

Hopefully who ever makes decisions about this case will think about what was actually done. There's a world of difference between a hard-working team inadvertently cribbing a little code, and a large company gaining a massive strategic advantage by violating copyright on mission-critical source code.

"What if the companies were reversed? Would you make the same remarks"

Given google's reputation for being open, they're not likely to pursue a law suit like oracle just because there's money in it. The media outrage will hurt their reputation more than the monetary gain.

Oracle doesn't need money. License Oracle Database if you don't believe me.

It's silly to imply that Oracle brought this suit against Google just to score a few bucks, but easy to say when you dislike Oracle. The alternative, and very likely real reason for the suit, is that Oracle actually cares about its intellectual property and would prefer that Google not do what they will with it.

>The alternative, and very likely real reason for the suit, is that Oracle actually cares about its intellectual property and would prefer that Google not do what they will with it.

I think it's far more likely that Oracle has seen a way to get a slice of the Android pie, and the rapidly growing long-term revenue stream that it likely represents.

> and the rapidly growing long-term revenue stream that it likely represents.

Again, they don't need a long-term revenue stream. I'd wager that their revenue stream from Oracle Database and other products, as well as the long-term support contracts for those products, shadows Android in comparison. Bold, I know, but Oracle is widely, widely used in the enterprise sector. The salary for an Oracle DBA alone speaks volumes regarding this.

In your world, Oracle executives sit around and think: boy, we could score a small percentage of that Android market. It pales in comparison to what we can make off of enterprise customers, but that cash flow is definitely worth the negative publicity and community recoil!

Completely ridiculous.

Your comment is merely another angle of repetitive arguments attempting to make Oracle out to be the bad party for suing Google. While I dislike Oracle just as much as the next geek for their treatment of open-source products, they might actually have a point with this lawsuit. That's all I'm saying, and watching my karma swing around wildly for taking the middle ground instead of jumping on the anti-Oracle bandwagon is amusing.

Oracle does not, and never has cared about their reputation with the technical community. They care about their reputation with the people who actually buy their software.

The people who buy their software understand things like duty to shareholders, and Oracle has historically determined that exercises like this are part of that duty.

I never said I disliked oracle, I don't have any opinion of them since I don't use any of their products. However, I am implying that they don't have or depend on the same public reputation that google does. Google depends on its reputation to hire the best talent and anything that will make them look like the bad guys will turn away a lot of people good enough to be choosing which top company to work for.

About suing for money: The accumulation of patent in large companies is necessary because if they don't patent everything, someone else will and they'll be in trouble. But suing another big corporation "just to protect the patent" is mutually assured destruction because the company being sued has probably patented a lot of petty little things that the company suing is using and can counter sue. Unless there's a lot to gain, they don't because the only people that will get anything out of it is their patent lawyers.

Oracle does have a case against google, but saying that they're doing it just to protect their intellectual property is a bit naive.

I think it has a lot to do with the failure of Java ME.

I wonder if the code was copied before Google bought Android or after. And would they be able to just pay licensing to Oracle for the code?

I don't get one thing. I thought Java is supposedly open-source? How come there's proprietary source code? Or are these files part of a particular Java library developed by Sun that are not part of the Java that they open-sourced?

The issue is not with the open-source portion, it's with relicensing. The implication is that parts of the code that are in Android's Java implementation were copied outright and then relicensed to APL, which is not allowed--the original code is GPL, and must stay GPL, unless the original author decides to license it under a different license.

Also, the code was not copied from OpenJDK, but decompiled from an old proprietary version of Java.

Relicensing is also not allowed when something says PROPRIETARY / CONFIDENTIAL" and "DO NOT DISTRIBUTE" except by the code owner.

Relicensing is also not allowed when something doesn't ship with a license or doesn't explicitly allow relicensing.

Basically you can't do shit if it isn't explicitly allowed.

The timing is irrelevant. It's almost certain that when Google bought Android, they'd have taken on any legal liabilities that went with it. It's possible that the previous owners might have agreed to keep them but it would be very unusual for that to be the case.

As for could the just pay Oracle to license the code - they could have done at the time had Oracle, or Sun as it would have been at the time, agreed but they didn't. It would seem highly unlikely given that Oracle are currently suing them that they'd be willing to enter into such a license with Google now.

>The timing is irrelevant.

Not entirely; it might make a difference in how hard it is for Oracle to prove willful infringement (which increases the damages.

And even if it's irrelevant to the case, it's still an interesting question.

Agree it's an interesting question but I don't see how the timing impacts proof of whether it was wilful or not.

Google inherit everything the previous developer did including the intent or otherwise. It doesn't get to say "but we didn't know when we bought it", that's what due diligence and contacts are for.

(a) If Android, Inc., didn't have all the policies in place that larger companies do (e.g., code review), then it would have been easier for a naïve engineer to make the mistake. If so, it might actually not be willful.

(b) The longer ago it happened, the more likely it is that any evidence of how it happened has been lost. If so, even if it was willful, Oracle might have trouble proving it.

Unless I am mistaken, willful infringement applies to patents, whereas this only proves willful copyright infringement. Are the willful infringement clauses for copyright as well?

I think so; willful infringement triggers the triple-damages provisions.

So I'm guessing Google can't claim ignorance (i.e. did not check all code line by line for copyright material) when they bought Android as a defence statement?

Nope, that's what due diligence is for.

My guess is that the only out they'd have with this is if the purchase contract specified that any legal liability might remain with the previous owners but it's unusual to find anyone who will agree to that with a sale.

Google is damned about that bit either way.

The possibilities are that they did not perform proper due diligence on the code that they bought, which should have brought this to light (and a giant the size of google really should know how to do a code audit) (bad), the second possibility is that they did do proper due diligence, were aware of the provenance of this chunk of code and chose to ignore it (bad), the third is that the code got incorporated after the sale (bad).

There are no 'goods' here, the central question is if this is a part that is critical.

That said, I'm fairly sure that any large enough software project that has had contributions from large numbers of sources is subject to this kind of pollution, unless very strict measures are taken to avoid it.

Open-source code is still copyrighted.

Yes, unless you live in the US or similar and put it into the public domain.

Which has nothing to do with this situation.

Yes, sorry.

I think these are from the Java compliance test suite used to test that a Java implementation conforms to the specification. Sun had committed to releasing the compliance tests, but then dragged its feet and it never happened.

ZDNet and Ars refuted Florian's claims, but according to this Engadget update, it is still a violation:

http://www.engadget.com/2011/01/21/android-source-code-java-...

From Slashdot:

http://tech.slashdot.org/comments.pl?sid=1960862&cid=349...

"In Florian's paper, he points these out as Sun PROPRIETARY / CONFIDENTIAL. However, it looks like several of the sources come from Sun's mmademo, linked here [java2s.com]. In this rendition of the document, each source file's license is a permissive one by Sun (i.e., not proprietary / confidential)."

IE, the header in the distribution may read incorrectly that the files are SUN proprietary.

You could've fixed the "here" link for Hacker News. Why not replace the java2s.com with http://www.java2s.com/Open-Source/Java-Document/IDE-Netbeans...?

The source code the guy links to comes from Apache Harmony, so if anyone actually has committed copyright infringement it could well be the ASF as the source of the infringement. I wonder if Oracle would go after Apache as well.

Unless you supply specific links to code that you're sure is from Apache, you may want to read this:

https://blogs.apache.org/foundation/entry/read_beyond_the_he...

There was confusion about this when the first bits of code that were obviously Sun's implementations were found in Android code... However, according to Apache, Google slapped the Apache Harmony license into the headers themselves and the files were never really part of Harmony.

Given the legal complexity and politics involved Engadget shouldn't just echo the rhetoric of a notorious Microsoft lackey.

And the reporter is actually an ex-copyright and trademark attorney. So he does at least have rich domain knowledge in the law, and he has been following this case carefully.

I think yanw is wondering whether the author is only in Engadget's payroll or if there's another entity paying for his expertise after observing a consistent biased behavior.

BTW, I have no idea whether the author is or is not working for Microsoft.

Nilay Patel is almost certainly not. The classic Engadget site has really no one who is a Microsoft fan. The HD Engadget site does have some MS fans, largely because of Media Center.

Most of Engadget is accused of being an Apple fanboi site. Engadget's claim is that Apple just makes good products. I'm inclined to believe them. For the most part they seem really fair.

I believe Nilay (and Josh and Paul) all use Mac Books as their primary computer. And Nilay uses a Droid of some sort as his primary phone.

If they are on the MS payroll... MS needs their money back as they routinely slam MS. They slam MS so often, I think you'd even enjoy the site. :-)

> I think you'd even enjoy the site. :-)

Sadly, I have very little free time these days. I even gave up on Engadget's headline podcast...

When making such strong statements one should provide proof. Edit: I am referring to the parent.

Are you referring to Oracle, Engadget, or the parent commenter?

I remember reading about it on Techrights, for one source.

Isn't that boycott novell? IIRC that guy calls everyone who disagrees with him "Microsoft booster" so I'd take it at face value.

>Isn't that boycott novell?

Yea, it is the new name.

>IIRC that guy calls everyone who disagrees with him "Microsoft booster" so I'd take it at face value.

Yea, I do disagree with some of their claims. I just wanted to mention a source that I can think of off the top of my head to help readers.

Techrights cannot be called unbiased themselves...

It is easily verifiable by running JAD yourself.

Or downloading http://android.git.kernel.org/?p=platform/external/sonivox.g... and reviewing the Java source therein. That makes the blog author's claim verifiable in terms of it exists.

um, this isn't Slashdot. Feel free to address the issues in his analysis and comment on them.

The problem is we do not have the full story. For example, there is a certain clause of GPL2 that states if certain conditions are met that the full work does not have to be under GPL2 when a small portion may be under GPL2.

Plus, the aspect of when Java was GPL'd does that pertain to everything in the distribution or does at eh time Sun's disclaimers of some being not GPL'd hold legal weight pertaining to whether its a legal enforceable GPL license.

From GPL2:

"If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works."

Correct me if I'm wrong, but it doesn't mean that you can copy small portions of GPLed code as you wish and use them in your projects; it means that the original copyright holder for those small portions can apply any license to them, which means that by default all rights are reserved by the original author of those portions.

The other relevant section is also from part 2 of the GPL v2, In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

Neither section implies that including only a little GPL v2 code within your project is OK.

Seems in direct conflict with the "Don't be evil" company motto... unless google employees think IP theft isn't evil.

These days college students think that one person doing ten people's homework is "collaboration", so I can imagine a lazy Googler decompiling some Sun class files. "After all, they're only tests, not real code."

Yes this is bad for Java, but it's good for Python.

Reply on news.ycombinator.com