Software Freedom Conservancy files GPL lawsuit against Vizio | Hacker News Reader

Software Freedom Conservancy files GPL lawsuit against Vizio

sfconservancy.org

347 pointsjra_samba115 comments

An especially novel aspect of this lawsuit, quoting the press release:

> This approach makes it the first legal case that focuses on the rights of individual consumers as third-party beneficiaries of the GPL.

> “That’s what makes this litigation unique and historic in terms of defending consumer rights,” says Karen M. Sandler, the organization’s executive director.

In the past, GPL enforcement has been a cause of action brought by the copyright holder. This suit is on behalf of users, as beneficiaries of the GPL. If this suit is successful, it'll no longer be necessary to prove sufficient standing as a copyright holder of GPLed code in order to enforce the license; it'll suffice to show that you're a user who wishes to make use of the rights provided under the license.

Gplv2 violations are widespread, we need much much more enforcement and more copyleft software, and this could be a huge win. Free software's main purpose should not be to be proprietarized, too much of it now is a group effort among companies to more efficiently lure users to trade their freedom for functionality.

It would be nice if perma-locked bootloaders were illegal.

That imho should be an extension of right-to-repair (and own/modify)

Not just nice, it would be a huge accomplishment. Imagine being able to resurrect (as in saving from a landfill) old tablets, phones and even smart TVs, or making new ones more usable and trustworthy by flashing a lighter OS that doesn't contain adware and spyware, and can be patched to solve bugs or implement new functions (including codecs) to give the product a longer life. Hardware manufacturers would absolutely hate such a scenario, which is why I'm pessimistic about that.

I think you're overestimating developer ability/willingness. There's a lot of hardware out there which could in theory have third-party firmware built for it, but which hasn't because it's just too niche for anyone to have bothered, or because there's insufficient public documentation.

Most smart TVs, for example, fall into both categories. There are simply too many models for a third-party firmware effort to take off, and documentation on the hardware used in these TVs is usually nonexistent. (And the hardware is often already stretched to its limits on the stock firmware -- implementing "new functions, including codecs" is likely to be impossible.)

There are many models of smart TVs, but they reuse components and software a lot. I remember rooting my Samsung TV with a universal exploit that worked across something like several years of models.

I think you're underestimating the tenacity of hobbyists. Some people hack every device they own, then release the software they wrote to do so; it only takes one or two of these people to write the drivers for a few dozen devices, and then they all run Debian.

Isn’t that the idea of the “TiVoisation” clause in the GPLv3? Basically, TiVo released their Linux derivative code, but you couldn’t actually flash your version. The problem is that Linus is staunchly against the GPLv3

At risk of making a gross oversimplification, sfconservancy seems to be pursuing the angle that GPLv2 _ALSO_ was intended to prevent tivoization. see e.g., https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... which refers heavily to pre-GPLv3 discussions about the topic.

"In GPL enforcement actions at the time, during our “complete, corresponding source (CCS) checks”, we verified that the source code was not only complete, but that it corresponded to the binaries on the vendors' devices, and that we could install modified versions of the software. This was a standard part of any check to verify GPLv2 compliance. Passing this check was required, then and now, by FSF and Conservancy before distribution rights are restored after a violation."

"That position was not controversial when I, along with then FSF counsel (Daniel Ravicher), taught it to lawyers in 2003 and 2004 on FSF's behalf. Nevertheless, today, many act as if this interpretation and intent of GPLv2§3¶2 is a recent and novel phenomena, rather than a long standing position held by all copyleft activists for at least 18 years. Today, most companies and lawyers argue (incorrectly, IMO) that users have no rights to reinstall their GPLv2'd software."

It’s not at all clear-cut to me. (IANAL.) If a cryptographic key is required, it’s not clear to me that that is either “source code” nor “script used to control compilation/installation”.

If you asked developers “is a certificate source code?”, I think most would say “No”. If you asked them “is a certificate a script?”, I think almost all would say “No”. If it’s not either of those things, I don’t know how the license terms (not the preamble) of GPLv2 would apply to prevent TiVo-isation.

Further, if it does apply, how has no one successfully sued TiVo over it?

The “script used to control compilation/installation” needs to actually work. If it can't work without a certificate, then it doesn't work without a certificate.

Isn't the problem that the code would work fine on a piece of hardware that doesn't perform the signature check, it's just you'd have to make that piece of hardware yourself?

This is apparently not how the license had historically been interpreted by everyone, at least before GPLv3 appeared.

The intended and historical interpretation seems to have been that as long as you're distributing a device running GPL software, you have to provide the source code for that GPL software along with working instructions about how to build, install and run those sources on the device.

This even goes back to the original motivation for creating the GPL in the first place: the desire to repair faulty software in a printer at MIT.

I have no idea if this provision has ever been tested in court.

To me “our code can’t run on TiVos” is basically a political statement along the lines of “it can’t be used for evil, or for nuclear weapons” and so on.

It’s certainly an option to license it that way but I think GPL 3 was mostly a mistake.

If you buy a new car at a dealership they can’t withhold the car keys as an optional extra.

The same applies here. If the script needs a key to work then that key is part of the script.

What TiVo did (disabling proprietary software when GPL software was modified) is allowed by GPLv2 and GPLv3 according to Bradley Kuhn of Software Freedom Conservancy.

https://events19.linuxfoundation.org/wp-content/uploads/2017...

This would be an absolutely crazy outcome if this turned out to be a result.

I think Vizio (who I have no love for) would get a HUGE number of opens source folks behind them.

We need to look at what developers believed GPLv2 required and what it did not.

The whole Tivo issue came about because GPLv2 does NOT require that a developer ALSO make it so that others can use HARDWARE they create any way they want. Linus (who is a major GPLv2 user) also was clear, he wanted folks to have to share software, but didn't want or care what they did with it - they could put it in a car (that was locked down from modification), they could put it in a motor controller (also locked to manage duty cycles), they could put it in a pacemaker (also locked for regulatory and safety reasons).

> The whole Tivo issue came about because GPLv2 does NOT require that a developer ALSO make it so that others can use HARDWARE they create any way they want.

This also used to be my understanding, but it is simply wrong. If you read the article posted by GP, from the lawyer who actually pursued the FSF's case against TiVo, the facts are different. TiVo started by bot providing source code at all, and then had some limitations in their published scripts showing how to install modified sources onto their device. This part was remediated by TiVo during these discussions - TiVo devices then and now allow you to install and run any Linux you want on them.

The one thing they also do that angered Stallman and was clearly not prohibited by the GPLv2 is that TiVo's proprietary userspace software uses hardware support to check whether the running kernel is cryptographically signed by themselves, and refuses to start if it is not. The OSS keeps running and has full access to the hardware.

Its interesting to note that the GPLv3 allows what TiVo did too, even though RMS didn't want that. Also interesting OTOH is that the LGPL seems to imply that a combined proprietary+LGPL work should continue to work after replacing the LGPL part.

https://events19.linuxfoundation.org/wp-content/uploads/2017...

> The problem is that Linus is staunchly against the GPLv3

No he isn't. He is unable to relicense the kernel. Whenever he's interviewed on the subject it is always in relation to kernel development. He doesn't control the copyright on the entire codebase and there are too many contributors, some dead, for anyone to get copyright assignment sorted out.

You are right that he can't unilaterally relicense the kernel and that it will likely never happen, but Linus is in fact against the GPLv3, see debconf 14 Q&A: https://youtu.be/5PmHRSeA2c8?t=2840

Would be nice if all corporate exploitation was illegal.

Perma-locked bootloaders can be made illegal, if they prevent you, the owner of the device, from patching a security hole in your device. In essence, it's a backdoor mechanism installed by the vendor.

> too much of it now is a group effort among companies to more efficiently lure users to trade their freedom for functionality

Often they don't have more functionality, just actual marketing and discoverability.

>"If this suit is successful, it'll no longer be necessary to prove sufficient standing as a copyright holder of GPLed code in order to enforce the license;"

Would such a decision have any usefulness outside of California? This specific lawsuit is filed in a California state court, against a California defendant.

/not a lawyer

Also not a lawyer, but can't you sue in California over any product sold in California?

Sure, if you live in California. (I think IANAL is a given because I don't think any lawyer is giving out legal advice on HN)

The Software Freedom Conservancy is based out of New York, and they are the plaintiffs here.

... and your point is?

The Software Freedom Conservancy is a business which can do business in many states and be subject to the jurisdiction of courts in all of them, unlike an individual, who can be resident in only one state. (And even then, an individual could also sue in California if the event being sued over - like a purchase or an accident - occurred in California)

Being a resident isn't really a requirement if at most all you need to do to bypass it is form a company anywhere.

nitpick: the Software Freedom Conservancy is a charity, not a business.

Charities are a form of business. I didn't say they were for-profit.

I believe a non-California defendant could move that suit into a federal court ("diversity jurisdiction" isn't it?)

But federal courts don't seem to put too much weight on how individual states interpreted a law -- hence my question.

(Same /not-a-lawyer as above)

If you have the money for lawyers you could always Thiel yourself a suitable plaintiff.

Presumably the suit is federal because it’s a copyright case. So, yeah, it would have some significance within the 9th circuit until the appeals shake out.

I can't see this succeeding because it would have some crazy implications in general.

Crazy positive implications for consumers.

California is a pretty good jurisdiction to litigate pro-consumer suits.

Genuily asking: what?

It means anyone can sue for breach of contract if they are a beneficiary in some way, even if they aren't one of the parties of the contract. If you make a deal with the government to provide free school meals and then they underpay you so you stop providing the meals, now every parent can sue you. Doesn't sound quite right.

I think it would be better to fix this by having the GPL explicitly grant standing to anyone receiving it. Not a lawyer though so no idea if you can just do that. Maybe not.

> It means anyone can sue for breach of contract if they are a beneficiary in some way, even if they aren't one of the parties of the contract. If you make a deal with the government to provide free school meals and then they underpay you so you stop providing the meals, now every parent can sue you. Doesn't sound quite right.

If you stop providing the meals due to the government's breach of contract, it seems pretty obvious to me that the court would either dismiss the case (possibly with prejudice) and direct the plaintiff to sue the appropriate party, or that the case would be suspended until you and/or the government are done suing each other pending the outcome(s) of the other case(s).

Were none of the contributors to the original software willing to participate in the conservatory's case?

That's a good question.

The linked press kit says:

> not only do multiple copies of the Linux kernel appear in the firmware, other GPL’d and LGPL’d programs were found, including U-Boot, bash, gawk, tar, glibc, and ffmpeg.

The copyright for bash, gawk, tar, and glibc is owned by the Free Software Foundation. The FSF requires copyright assignment on contributions specifically so that they can enforce the GPL. So, if the FSF is unwilling to participate in the case, then that would say something very bad about the state of the FSF (or the state of their relationship with Conservancy--perhaps the FSF would prefer to mount their own case separately?). However, I don't believe that to be the case.

It is my understanding that Conservancy holds the copyright on parts of the Linux kernel, and is authorized to represent several other copyright holders of the kernel. They should be able to enforce the GPL for the kernel without getting anyone else involved.

So to me, this reads as Conservancy intentionally avoiding involving the copyright holders and going for a different strategy, in order to establish precedent and strengthen the GPL. And if that fails, then they could presumably fall back to filing a second lawsuit from the traditional copyright holder perspective. But I would have liked to see this called out and explained explicitly in the press materials, because I'm having to read between the lines here.

I'd be surprised if Conservancy holds kernel copyrights directly, but I agree they can represent holders, as I think they have with e.g. Christoph Hellwig vs. VMWare.

Prepare to be surprised :-).

https://sfconservancy.org/copyleft-compliance/

Oh, I may have misunderstood you there, apologies if so. Conservancy can handle compliance and enforcement activities on behalf of more than a dozen Linux copyright holders, but I don't actually know if they hold the copyrights. Sorry if I misunderstood.

> but I don't actually know if they hold the copyrights

According to the page you linked, they do:

> In addition, some developers have directly assigned their copyrights on Linux to Conservancy, so Conservancy also enforces the GPL on Linux via its own copyrights in Linux.

If this strategy becomes validated by this case, it means that any organisation can bring GPL compliance lawsuits. Hopefully that leads to companies noting their increased potential for liability by multiple less scrupulous actors than SFC and spontaneously coming into compliance.

The alternative is that they will decide that GPL software is not worth the legal risk, and ban its use.

They already do that; their loss.

Generally speaking, GPL can't be enforced by users due to selftermination clause. And when GPL terminates itself, you can't enforce it. For user enforcement we need a license that doesn't terminate itself.

---

  8. Termination.

You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).

I guess the interesting thing here is if they are willing to use that as an argument.

"You can't sue us because we don't have a license!"

I imagine that would make a following case by the actual copyright holders really easy to win.

Unless it was the actual copyright holders who raised the original case, in which case I think double jeopardy applies.

Note that for quite a while Conservancy has (and more recently[1] many other copyright holders have) publicly documented that they extend GPLv3's cure provision to their otherwise-GPLv2-licensed code.

There are kernel copyright holders who have not consented to this and when you violate the GPL your license to the parts of the code that they own is terminated per the vanilla GPLv2. But the copyrights which Conservancy represents have the cure provision.

[1]: discussion at the time: https://news.ycombinator.com/item?id=16628301 (2018)

This looks to be a major change in the legal strategy behind GPL. In the past the focus has been on copyright claims by copyright holders, but as recent cases has shown in Germany and France, those has faced some rather strange setbacks. Germany don't seem to want to recognize copyright holders that only contributed a part of a larger work, which is basically all copyright holders for larger FOSS projects. In France they seems to define GPL as being under contract law and not under copyright law.

In this new case, the SFC is arguing a case in the context of third-party beneficiary which is under contract law and not copyright law. It seems like a bit of an long-shot, but if won it could mean a major change in interpreting GPL as a contract rather than a copyright license. I would guess that it also would change their strategy in other countries if won.

It seems strange to me that they'd adopt this strategy in the U.S. because of past failures in other countries. Gplv2 makes pretty clear it's a copyright license, so I see no reason it would be interpreted under contract law in the U.S., and as a layperson it seems unlikely that SFC would have standing in this case. Has a third party beneficiary ever been held to have standing in a copyright case?

It is strange, but I have seen in novel court cases where cases in other countries are used as an example. It is possible that they want the court to either confirm that GPL should be treated as a copyright license and not a contract, or that GPL can be seen as a contract in which users has a third-party beneficiary role. When they have that ruling they can use it as an example in countries where a gpl case has yet to be tested. It is also possible that they simply are testing something new when other approaches have failed.

According to the press kit, the case is claimed to be unique.

> I have seen in novel court cases where cases in other countries are used as an example

Do you mean novel court cases in the U.S. referencing cases from other countries? My impression was the U.S. was loath to base legal decisions on those from other countries (with the exception of British common law from before U.S. independence). Contrast this to Europe where the EU has adopted common European courts. It would be less surprising if you were talking about European courts cross-referencing each other.

I just don't know why they'd choose this strategy, except as a hail mary to create a new standing doctrine for software license. Has suing on behalf of the copyright holders proven insufficient in the U.S.?

> It is strange, but I have seen in novel court cases where cases in other countries are used as an example.

AIUI, it's relatively common in common law jurisdictions as a form of persuasive precedent[1] (I'm most familiar with England and Wales, where it has been noted "[c]ases decided in other jurisdictions can, if properly used, be a valuable source of law in this jurisdiction"). Though non-binding, the jurisdictions are based on (broadly) the same legal principles, so in areas where common law (as opposed to statue) predominates, a ruling in a comparable jurisdiction may suggest that similar findings would be true in the current jurisdiction, even if it hasn't formally been decided by a higher court.

As such, it can be illustrative to examine the reasoning of a rational, out of jurisdiction court and see how it would map to the current jurisdiction. If the necessary legal principles are applicable in the current jurisdiction, it would suggest a similar decision would be reached, but if something specific to this jurisdiction interrupts the chain of reasoning, it suggests local courts must come to a different decision, and may indicate how the ruling must be modified. As another example, if the reasonableness of a person's actions must be examined, a competent, rational court supporting similar actions in an adjacent jurisdiction may add strength to an argument that the person's actions were reasonable.

There is a brief discussion on the use of foreign caselaw by the House of Lords (predecessor to the Supreme Court) at [3].

[1] https://en.wikipedia.org/wiki/Precedent#Persuasive_effect_of...

[2] https://web.archive.org/web/20110204002153/http://www.hmcour...

[3] https://web.archive.org/web/20191025182334/https://www.loc.g...

Not a lawyer. A copyright license is a written agreement not dissimilar from a contract.

However, validating the contract usually doesn't come up, because the violator needs the agreement to be valid to avoid copyright infringement.

> Because the GPL does not require any promises in return from licensees, it does not need contract enforcement in order to work. A GPL licensor doesn't say in the event of trouble "But, judge, the licensee promised me he wouldn't do what he's doing now." The licensor plaintiff says 'Judge, the defendant is redistributing my copyrighted work without permission.' The defendant can then either agree that he has no permission, in which case he loses, or assert that his permission is the GPL, in which case he must show that he is obeying its terms. A defendant cannot simultaneously assert that the GPL is valid permission for his distribution and also assert that it is not a valid copyright license, which is why defendants do not 'challenge' the GPL.

https://lwn.net/Articles/61292/

However, I believe only the copyright holder can sue for copyright infringement, so this case is instead taking that oft-skipped step of validating the contract so it can further claim SFC is a party of the contract. Infringement cases also have specific rules about damages, which can make it hard to actually get the infringer to do anything when you give the software away for free. IMO the "specific performance" seems likely to be granted if they win the case on contract grounds.

There was another recent case where they seemed to rule the GPL could be enforced as a contract, but I'm not familiar: https://www.theregister.com/2017/05/13/gnu_gpl_enforceable_c...

> A copyright license is a written agreement not dissimilar from a contract.

Neither a copyright license nor a contract needs to be a written agreement, except in special cases, and a copyright license either is a contract or is a gratuitous license.

> because the violator needs the agreement to be valid to avoid copyright infringement.

Not in US law if the use would be within an exception like free use, even if it is purportedly prohibited by the license (which, if the license were a valid contract, would prohibit the conduct even if it was free use without the contract being in place.)

SFC also represent a coalition of Linux kernel developers, so they could have (also?) gone the traditional route.

A copyright license is a contract, no? Copyright law can't govern enforcement of license, it only determines whether the author has the right to apply license, for being an author, but the actual meat of the license is subject to contract law.

Do you have a link to the German case?

Full legal text of the complaint:

https://sfconservancy.org/docs/conservancy-v-vizio-original-...

Press kit:

https://shoestring.agency/wp-content/uploads/2021/10/SFC_Pre...

Full legal text of the complaint:

https://sfconservancy.org/docs/conservancy-v-vizio-original-...

Paragraphs 37 and 38 list the relevant software packages. Strangely the PDF is a scan. The OCR / embedded text isn't complete so there are some parts missing below...

37. Among the computer programs that comprise SmartCast are a number of programs 15 subject to the GPLv2:

(a) The Linux kernel. A kernel is the heart of an operating system, which all computerized devices, like smart TV s, require in order to function. The Linux kernel is one of the most popular operating system kernels.

(b) alsa-utils, which is a suite of programs that assist and manage ALSA, Linux's audio subsystem.

(c) GNU bash, which is a " shell," a program that allows users to interface with the operating system and is required for most operating systems.

(d) GNU awk, which is a popular scripting language with many uses.

(e) bluez, which is a suite of programs that assist and manage Bluetooth for Linux ased devices.

(f) BusyBox, which is a popular "thin footprint" suite of utilities for Linux.

(g) coreutils, which is a popular suite of utilities for Linux, with a larger "footprint" than BusyBox

38. Among the computer programs that comprise SmartCast are a number of programs subject to the LGPLv2.1:

(a) The GNU C Library, which is a library of resources that allows Linux users to program in the popular C and C++ programming languages. It would be required for any Linux14 based operating system that wished to take advantage of these popular programming languages.

(b)

(c)

(d) hardware.

(e) ffmpeg, which is a suite of libraries for handling audio, video, and multimedia. glib, which is a library that facilitates programming in C. DirectFB, which is a library that allows Linux-based systems to work with video libasound, which is a library that helps third-party programs interact with ALSA, Linux's audio subsystem.

(f) libelf, which is a library for reading and modifying binary files.

(g)

(h) file systems.

(i) libgcrypt, which is a C programming library of encryption functions and utilities. libmount, which is a library that helps third-party programs interact with Linux libnl, which is a suite of libraries related to using netlink, a popular network communication protocol.

(j) selinux libraries, which help third-party programs interact with selinux.

(k) systemd, which is a large system that manages, organizes and handles shutdown and restarting of system services on a Linux-based system.

Good point that Linux kernel is GPL - how can companies sell products with an embedded Linux then? They don't seem to be publishing sources.

Basically anything IoT more advanced than a thermometer seems to be running Linux.

The Software Freedom Conservancy has a page on exactly this:

https://sfconservancy.org/copyleft-compliance/firmware-liber...

Technically the GPLv2 only requires you to provide source on request from someone who received the binaries, it doesn't require companies to proactively publish it. I think the GPLv3 changes this slightly

GPLv2 requires you to either proactively provide the source or proactively provide a written offer to provide source on request to any third party (section 3 of the GPLv2) - simply distributing binaries without including either source or an offer is technically a breach of license.

Reacting to requests is not sufficient, you have to inform the recipient that they actually are entitled to make those requests and provide a promise that those requests will be honored.

Back around 2012 my company was preparing an embedded system. The day the license was added one of our tester found the section about sending $5 to whatever address to get that source code. He sent the letter with his $5 and it came back return to sender. Even though this was an internal only release (most of the functions weren't even written yet) our lawyers made us go through the entire recall process to replace all the code the testers were working with - to show good faith just in case something more happened.

They only need to provide the sources for the kernel, not the software running on top of the kernel. Usually they do publish the source for their kernel somewhere on their website in my experience (although they don't always provide a direct link to it on the product).

It’s because they know Linus doesn’t care about software freedom[1] and it’s difficult to find kernel devs willing to sue when they know the boss doesn’t want them to.

[1] e.g. when TiVo violated the GPL he let them, because apparently they found a loophole. When FSF closed the loophole definitively in GPLv3 he refused to adopt it. Also he grumbles about Nvidia but he was the one who created the weird loophole that “some parts of the kernel aren’t gpl” specifically to allow them to violate GPL so Linux could have their drivers.

The Software Freedom Conservancy represents a coalition of Linux kernel developers who are willing to sue despite Linus' opinions.

[1] is incorrect, what TiVo did (disabling the proprietary software on your device when you modify the GPL software) is allowed even by GPLv3, even though RMS did want to prevent the possibility of that. Also, the requirement to allow software reinstall is there even in GPLv2.

https://events19.linuxfoundation.org/wp-content/uploads/2017... https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...

> Also, the requirement to allow software reinstall is there even in GPLv2.

>> a key reason that the GPLv2 was created, is the software freedom to reinstall a modified version.

Would that mean e.g. Apple is breaking the GPL by including GPLv2 components in iOS and not letting me reinstall modified versions of those components on my iPhone?

Which GPL components are there in iOS?

I don’t know, but System Presences > General > About > Legal contains copies of GPLv2.

Edit: Ohhh, I think they might all be lgpl. Or, one is for libstdc++ but it mentions some special exemption?

> Would that mean e.g. Apple is breaking the GPL by including GPLv2 components in iOS and not letting me reinstall modified versions of those components on my iPhone?

If Apple were including GPLv2 components in iOS, yes. Why do you think all the Apple userland is based on BSD?

It’s scanned because those are the filed copied (with signatures), not the (literal) preprint.

Irrelevant, but (a) is technically incorrect. 'computerized devices, like smart TV s', do not necessarily require an "operating system" in order to function. If you removed the comma between 'devices' and 'like', then I think this would be correct.

You would think that if Vizio was hijacking code from GPL'd sources, their firmware on TVs would be better.

As the old saying goes, you can write bad code in any language or on top of any libraries. SmartCast is sooooo slow.

I need to reboot my Vizio TV weekly through a hidden system menu to fix audio desync issues. Simply power cycling from the remote does not work, as far as I can tell that's a sleep mode. Absolutely terrible device and I will not be going back to Vizio in the future.

They're still using pulseaudio and not pipewire?

Why would a TV be shipping beta software?

I shouldn't be surprised if it was alsa alone. Shall we instead ssh into our tv to kill and restart pulse?

Are you suggesting that GPL'd code is intrinsically better than code licenced under other licences? Do you have any numbers on this?

Question: if I sell my old Visio TV that violates the GPL, am I now also in violation of the license since I’m redistributing it?

Even if the argument could be made, there would be no practical way to enforce it. It’s not like Disney is breathing down my neck if I “redistribute” their IP by getting paid $50 to dress up in a Mickey Mouse costume for a kids birthday party.

> Disney is breathing down my neck if I “redistribute” their IP by getting paid $50 to dress up in a Mickey Mouse costume for a kids birthday party.

If they find out about it they will. Trademark law requires that they do. I know of a few that have gotten warnings about such things - they stopped doing it on the warning and so it didn't go farther.

If you're advertising such services and Disney catches wind of this, they will do their best to shut this service down.

That’s trademarks, not copyright. You’re not making a copy of the costume.

That sounds like a possibility in a not so distant future. Do not forget that paying a murky intermediary just to perform popular songs was unheard of some 60 years ago.

As I understand neither running code nor selling an object containing copyrighted material is prohibited by copyright law, so unless you needed a license to that code for some other reason you probably haven't agreed to the contract at all and can't violate it.

Yes absolutely. You would be redistributing the software with the TV. That said, I can't imagine anyone would actually file a lawsuit in a situation like this.

More worrying is whether Costco and Walmart could be sued under this theory. Vizio sells very few TVs directly.

This comment is pretty much entirely wrong due to first sale considerations, as a neighbor comment points out. It’s also a good cautionary tale for understanding your legal obligations regarding software licensing from an Internet comment.

For the purposes of only this context, in which we are deliberating who is infringing on the GPL software blah blah, Vizio sells all of their televisions directly. The act happens when Vizio is paid for the product and never again. With very few exceptions, everyone with a stake in the software on that television loses their rights completely once the television is legally sold to a distributor. Nobody from then on is liable for the licensing structure of the software; in the eyes of the (American) law, the television is now a “thing” to dispose of as you wish and no more. That is impactful to both trademark and copyright law but doesn’t necessarily speak to, say, reverse engineering (i.e., DMCA).

The scenarios you’re describing aren’t hypothetical and routinely happen in commerce, and they are well-trodden ground legally. If they went the way you’re theorizing, too, you’d never be able to legally sell or loan a book to a friend. Your ability to do that is the exact subject you’re discussing.

There is no "first sale" for a non-transferrable software license -- even when you get it as a part of a physical good. You are confusing licensing with copyright, which is a different thing entirely.

When the second sale occurs, the seller must still obey the terms of the software license, which means the seller must give the end-user a full license which includes the ability to demand the source.

If it were otherwise, the GPL would be meaningless. Instead of the many BusyBox lawsuits, the companies could have "sold" their boxes, "bought" them back, then had no GPL obligations.

Lastly, without the GPL you have no software license and have no right to run the software.

If you didn't get any proper license notice from the seller or the vendor, I'm pretty sure you're not responsible. There's just no simple way to find out if GPL-ed software is running inside a commercial device. Even worse, most vendors simply disallow analyzing their software in the first place.

Wouldn’t that fall under the first-sale doctrine? Once a copy is created, it is legal to sell that copy. It is the act of copying itself which might not fulfill the obligations of the license and might therefore break copyright law. I.e. it is the factory making TVs which is at fault here, not people re-selling TVs.

Every time I fast-read this as Software Freedom Conspiracy. I would probably love such a conspiracy to exist though :-)

While I'm in favor of this, it makes me question somewhat the potential unintended consequences of something like this, in that it makes shipping actual hardware devices with actual software on the device even less appealing.

That is, if I provide a SaaS platform, my understanding is that even if I use all types of GPL code to run my service, as long as I don't "ship" the code for that service to end users (which is like 99% of all SaaS products when it comes to backend services), I don't need to share my code.

But if I release a hardware product and by definition I need to ship that code to end-users, then I do need to share my code. Just seems to be an incentive to make more and more stuff "subscription based" with a backend service. Though, due to other economic incentives businesses want to do that anyway, so perhaps my point is moot.

I think the response of advocates would be that the solution is for more people to use AGPL, which would fix that "loophole".

Now, I don't see AGPL becoming widespread personally, but this is essentially its reason for existing.

It just drives more companies to be more careful about their license. My company has for years banned any GPL3 code on devices we ship. If GPL2 is suddenly found more restrictive than we expected we will ban that too. FreeBSD/NetBSD will be the winner there, along with other projects. We don't contribute much, but we already consider license before we contribute back - and if we can't get GPL code we will make the changes needed to BSD code. Most of our changes will be contributed back - only changes that are actually things that matter to us will be withheld and those are not part of open source projects to anyway)

The point of copyleft licenses is to make it hard to make proprietary software and easy to make free software. It sounds like they're working as intended.

My understanding is that this suit is partly on the grounds of Visio not releasing modifications to copylefted code. The MPL and LGPL have the same requirements; is not being able to use LGPL, GPL, AGPL, MPL, or CeCILL-licensed software really harder than compliance?

Stories like this just make me all the more convinced that the right approach is to make software a commoditized complement of a service; software is not as scarce a resource as labor.

A large amount of free software is developed by companies. If they stop it hurts us all.

Like I said, companies are free to use a more sustainable model that doesn't require artificial scarcity: they can provide services to reflect the fact that copies of software are not a scarce resource, while labor is.

It's not our duty to keep old business models alive. We shouldn't try to appease companies so they do what we like; they're the ones who should adapt to our needs.

Yes, exactly. This is how companies react.

that's why i am a huge fan of the AGPL - prevents this from happening.

If you leverage your product with open source, there must be some sort of contribution back - either you pay the creators of the open source with a license fee, or re-contribute your own efforts via source code release.

there shouldn't be free lunches.

I wonder if Kodi will be able to run on Vizio TVs if the lawsuit succeeds and all the code gets released and upstreamed.

That's rather unlikely. Even if you had all the source code, not just the GPL parts, and were able to build and package the firmware in a way the TV would be able to accept, they're probably using some form of build signing to prevent that.

But if you want to use Kodi, you likely already have some kind of media server, so something like Jellyfin/Emby/Plex wouldn't be too much more work and is definitely within the realm of possibility. SmartCast apps are just websites and Vizio gives you a companion JavaScript library for interacting with the TV and getting commands from the remote that could be bolted onto Jellyfin/whatever. Documentation is likely only available to big developers under an NDA, but the API is not exactly difficult to figure out (I can't give any further details due to an NDA completely urelated to Vizio :D)

I thought copyright in GPLv2 kicks in once someone is linking? I saw Linux Kernel, bash, awk mentioned; but if these were compiled into binary assets without any code from the TV, then isn't Vizio entitled to sell these TVs without disclosing their own source code?

Nobody's asking for Vizio's code, just the modifications to GPL software (e.g. kconfig, non-upstream kernel modules, etc.)

No, the GPL always kicks in once you distribute binaries without providing a way to obtain their sources.

It's kinda simple for the most part. If you distribute binaries of a GPLd software product, you are obligated to distribute/make available the corresponding sources (and inform recipient that the sources are available). print it on a slip of paper, hide it in an obscure menu item, make it a click through, but something constituting "informing" should happen. It doesn't matter if you made a derivative work of the source code or not. If you ship binaries, you should ship the source too.

Hmm, there are some allegations of insider trading by the Visio CTO on LWN:

https://lwn.net/Articles/873359/

I don't think GPL compliance is worth quitting your job (or being pushed out) over.

So Visio TVs run systemd, I wonder which distro they are based on? Yocto?

Reply on news.ycombinator.com