Ubiquiti and GPL: When companies use GPL against each other, our community loses
sfconservancy.org
sfconservancy.org
What are good alternatives?
At the same time if you want something more customer friendly simply search for "mesh system" (all major brands have one).
MikroTik is cheap but lacking on the software and UI side. There are lots of complaints about RouterOS and SwitchOS on forums. I will be getting a 10gb switch for my backbone in the near future due to price.
I have top to bottom UniFi gear in my house and a family vacation home. I also use UniFi protect which is their video option. Tons of PoE APs, switches, and cameras available. Setting up dynaDns, home VPN, subnets, and automatic updates are a breeze with UniFi.
If you have specific questions I’d love to answer it.
P.S. Zero affiliation to them.
Repeaters are put where your signal is already low (not right to the router's antenna). This means they will just repeat signal that is already low, and the further you get from repeater itself the signal will get even worse.
Ie. You put repeater where your signal is at 50%. When you stand near it with your phone, it will show full wifi, but it will be just at 50% of the original one. Then you move away from repeater and you see that your signal is at 50%, which in reality means it's just 25% of the original... so yea, that sucks.
Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code.
The mentioned GPL in the article is v2, so lifting from there, the valid parts are probably:
> a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
> b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/principles.htm...
That's a simple copyright violation (making and distributing copies without a valid license to do so), and since Conservancy represents copyright holders (some of the developers) whose copyright has been violated, they have standing to sue.
I guess the exception would be malice or misrepresentation, e.g. faking you are a customer in order to download the firmware, or hacking servers and grabbing stuff. In that case the vendor is not wilfully distributing, and hence not subject to GPL terms.
In the case of extracting firmware, though, one might run afoul of anti-reverse-engineering provisions in laws like DMCA.
https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0....
All you have to do is click on "GPL Archive" on the download page for the firmware.
I wanted to download the archive for Unifi nanoHD, the GPL archive is mentioned in the download blurb, but there's no link to it and the normal download shows classic proprietary EULA, including no reverse engineering.
They seem to be skirting their requirements in not providing the full git repository for the GPL portions which might be a bit of a gray area but AFAIK the GPLv2 stipulates "The source code for a work means the preferred form of the work for making modifications to it." which I would think would encompass the git repo as well but IANAL.
In the past they also refused to provide the source code for their modified version of uboot claiming some nebulous security reasons but that stopped a little while back.
> c. i. Certain software included in, distributed with or downloaded in connection with the Software may comprise third party proprietary software products that are subject to separate license terms (“Third Party Software”). All such Third Party Software may include software or software components that are derived, in whole or in part, from software that is distributed as free software, open source software or under similar licensing or distribution models (“Open Source Software,” together with Third Party Software, “External Software”).
> c. ii. Your use of External Software is subject in all cases to the applicable licenses from the External Software provider, which shall take precedence over the rights and restrictions granted in this EULA solely with respect to such External Software.
So they've just bundled the GPL software along with the not, and you can freely use the GPL'd software within the context of what the GPL allows.
They don't represent users, they represent copyright holders. A copyright holder does not need to buy a violating product in order to enforce their copyright.
GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
Which is the same thing. The only way to "claim breach of GPL" is to enforce copyright. These companies have no right to use the respective copyrighted software without a license, and as they are not using it under the terms of the GPL, they have no right to use it at all, which is why their use of the software is a violation of copyright.
> GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
They wouldn't be. But they are still in violation of copyright, so they better do what the copyright holder demands to rectify that situation if they don't want to be sued over that copyright violation.
They are distributing software that they don't own the copyright to, and as they are violating the GPL by not providing the source or a valid offer to provide the source on request with the software, they have voided their rigfhts under the GPL as well, so they are illegaly distributing that software. The copyright owners therefore probably could get their products pulled from the shelves to stop that copyright violation. Instead of doing that, the copyright owners are offering them the option to reinstate their rights under the GPL if they provide them with a copy of the source code they would have to provide their customers under the GPL and get compliant with the terms of the GPL.
The GPL does not actually force anyone to give out source code. The GPLv2 requires to either give out source code to customers, or to give customers a written offer (valid for anyone, not just customers). It is this optional offer, which, being a promise, forces the giving out of source code to anyone in possession of this offer. Failure to honor such an offer is probably not a GPL violation, but a simple breach of contract/promise.
If no such offer was given, then the GPLv2 was violated, full stop. The Conservancy had really no need to ask for source code, since the GPLv2 violation occurred when no offer nor source code was given to customers. The fact that the Conservancy did offer the violators a way out by asking for source code is a pure nicety on their part, since they really didn’t have to.
you left out an important word after "offer":
> a written offer, valid for at least three ...
So it's not just requiring an offer be made, it's requiring a offer being made which is valid (with certain conditions)
If you make an offer you have no intention of honouring, surely that's not a valid offer?
They seem to have plenty of GPL sources available for download when you grab the firmware (and without having a device to test, it may actually include the source code with itself), so it seems they do offer up this source code. (The firmware download does come with a EULA, but the EULA specifically spells out it only applies to the proprietary bits, and not GPL and other Open Source software.)
So it seems that the claim "Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points..." needs more information before we can be certain that it is correct.
[0] https://www.ui.com/download/edgemax/default/default/edgeswit...
Therefore, the source code has to be either a) shipped with the product (it obviously wasn’t) or b) available upon request as specified in a written offer, which must be shipped with the product. If neither option a) nor b) was used, Ubiquiti unambiguously violated the GPLv2, and has no defense.
It is also part of a list of 'or' options. You can abide by one of the other options and not need to adhere to this one.
Yes, it’s one of a list of alternatives. The GPLv1 and GPLv2 sole applicable alternative to the written offer is to send the source code together with the compiled code; i.e. to all customers, in the box. Which they presumably didn’t do, so I don’t know why you bring it up.
(GPLv3 adds the allowable alternative to point to a web page or similar where the source code may be downloaded. I.e. you don’t have to waste money by shipping a CD, you can just print the URL on a note or in the manual. But this was the GPLv2, not v3, so it’s not applicable here, nor has anyone said that any such URL was provided.)
My point is that the op commented:
> No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
...and I am agreeing to this position, against fuzzyh. Specifically "anyone" != "any third party" != "any third party... unless you've abided by a) or b), which don't require distribution to 'anyone' either."
That’s correct, in case they actually ship the source code with the hardware, they’re complying. I very much doubt they do that. As such, option b) comes into play.
The GPL FAQ is very clear on the point that "any third party" means exactly that: Anyone that gets a hold of the offer (which you’re required to provide, otherwise probably also a violation) can request the source code.
https://web.archive.org/web/20170430232455/http://libertybsd...
and
https://web.archive.org/web/20161209121359/http://libertybsd...
These specific issues have been resolved...