Hacker News Reader

Comment by bdowling | Hacker News Reader

Note that the court ordered the defendants to comply by removing the GPL code from their product, not to comply by publishing their source code. [0]

[0] https://www.dynamic.ooo/press/groundbreaking-acknowledgment-...

Edit: Link changed to press release w/ copy of court's order.

View on HN

Seems like that would incentivize companies to distribute (A)GPL software for MVPs, or longer than that, until they're forced to stop distributing the GPL software after losing lawsuits. There's no risk of losing their IP or products, they just need to change their dependencies if they get caught.

There is no open source license nor nations laws which I'm aware of where one may lose your own ip by illicitly comingling it with another's.

You may in some cases choose to do so if it is both possible to share your code under the same license and desirable to do so but you can never be forced to do so. Viral licensing is a fiction. You have always been able to simply rip out the offending code.

The reason not to borrow until you are caught is that you could likely have found permissively licensed code to do the job in the first place and ripping the old code out after the fact is more work than doing it right the first time. Furthermore in some jurisdictions you could face court costs or damages. More so yet if your infringement was willful.

The flip side of that is, you could make an open source product under a license like MIT, then later quietly (A)GPL it and hope a company updates to the newer version without checking the license, because how many people check the license for every single commit they fetch?

I don't know what the solution is but I'm guessing courts would consider any evidence of intent when making judgments.

> The flip side of that is, you could make an open source product under a license like MIT, then later quietly (A)GPL it and hope a company updates to the newer version without checking the license, because how many people check the license for every single commit they fetch?

Part of being a software engineer and developing software professionally is doing your due diligence and making sure that you understand and adhere to the licenses of the software you use and distribute.

The question is what happens when someone is already doing that, but the rug gets pulled out from underneath them unexpectedly (even intentionally). Humans are fallible; mistakes happen even when everyone tried their best to do their due diligence, especially around pitfalls. Claiming that a good software engineer would never fall in this trap is like claiming that a good software engineer would never write a bug.

Good doctors and drivers make mistakes, too, and they still face liability for those mistakes.

I think that if your company is large enough, you should have employees, or pay someone to, mirror your dependencies and automate license checks. There are projects that do the latter already[1][2]. You can loop your lawyers in if licenses change to ensure you don't violate them. If (A)GPL code still ships in proprietary products, that's a process problem that the company needs to solve.

[1] https://github.com/dhatim/python-license-check

[2] https://github.com/davglass/license-checker

The question isn't whether they should face liability or whether the company has problems to solve. The question is what specifically should the penalty be? If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it? That's what people here want, and I'm pointing out it has a flip side to it that doesn't seem to be considered.

There is no such situation possible. You can never be forced to release your code under a different license. That is merely one way to cure your infringement.

> If you happen to ship any GPL'd code at any point with your product, must it necessarily always follow that you should be forced to release the source to everything else you happened to ship along with it?

The only thing that gives you any right to ship the code is the license, and you must always comply with the terms of the license, so.. yes?

But here's the thing. GPL doesn't infect things that merely ship "along with it". For your entire software to be covered by GPL it must be a derivative work.

great, now we need to add a license checker CI step...

Several projects I'm on already have one:

https://creadur.apache.org/rat/

Granted, this focused on code within the project, not dependencies.

It's nothing new, and yes, checking licenses is a usual task to have on your CI setup.

Probably a good idea, yeah.

I guarantee you there are professionals doing "npm update" without checking if one of the hundreds of updated packages had a license change in an update.

That's OK, as long as they understand the issues and make an Informed Business Decision(TM) to accept the risk.

This sounds intentionally deceptive and doubt it would hold much weight.

How is it different from a company intentionally using GPL code until they get accused of copyright infringement? Both of them are deceptive, but both seem potentially quite hard to prove as such.

It’s different, because it’s not the same thing. I’m not defending either side here, just saying.. let’s keep the rhetoric out of the debate.

Rhetoric is the art of persuasion. It's not a flaw in communication which one should try and avoid; rather, it's a very useful set of skills to develop.

https://owl.purdue.edu/owl/general_writing/academic_writing/...

> It’s different, because it’s not the same thing. I’m not defending either side here, just saying.. let’s keep the rhetoric out of the debate.

I'm not sure what you're calling "rhetoric", and I'm not defending either side either. The point of an analogy isn't to give an identical situation, it's to draw a parallel. So far as I can see, it's the flip side of the same issue. I'm not seeing anyone make a compelling case (or really, any case) to the contrary.

They can still use the older code under the license that it came with (MIT).

That's not the question here. The question here is whether they should be compelled to release any code that they may have happened to distribute along with the GPL'd library that was previously under MIT, which would be what people here are asking for.

What you do is release the new code under GPL with major security fixes and sue if they backport.

A cunning plan! Until they just revert to the MIT licensed version.

Yes because the license was terminated when the violating party violated the license and then also ignored the notice asking them to come into compliance. So the right judgement is to cause GPL code to be removed from the product.

This is one of the things that GPLv3 fixes - there's a "self-healing" clause added.

From section 8 of GPLv3 ("Termination"):

> However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.

The new court ruling is already about the GPLv3 - the self-healing clause still allows a copyright holder to terminate the license of a violator if they choose to exercise part (a) of your quote after a notification of violation which meets the requirements to avoid part (b). I assume that the copyright holder chose this path because their notice requesting compliance was ignored.

What would you expect to happen otherwise? AFAIK this is exactly the same as happens in other court cases where the GPL has been tried.

T̶h̶a̶t̶'̶s̶ ̶n̶o̶t̶ ̶t̶r̶u̶e̶.̶ ̶Y̶o̶u̶r̶ ̶o̶w̶n̶ ̶l̶i̶n̶k̶ ̶c̶o̶n̶t̶r̶a̶d̶i̶c̶t̶s̶ ̶i̶t̶.̶ ̶T̶h̶e̶y̶ ̶a̶r̶e̶ ̶o̶r̶d̶e̶r̶e̶d̶ ̶t̶o̶ ̶"̶b̶r̶i̶n̶g̶ ̶t̶h̶e̶ ̶s̶o̶f̶t̶w̶a̶r̶e̶ ̶i̶n̶ ̶c̶o̶m̶p̶l̶i̶a̶n̶c̶e̶ ̶w̶i̶t̶h̶ ̶t̶h̶e̶ ̶l̶i̶c̶e̶n̶s̶e̶"̶.̶ ̶T̶h̶e̶y̶ ̶c̶a̶n̶ ̶d̶o̶ ̶t̶h̶a̶t̶ ̶b̶y̶ ̶r̶e̶m̶o̶v̶i̶n̶g̶ ̶t̶h̶e̶ ̶G̶P̶L̶ ̶c̶o̶m̶p̶o̶n̶e̶n̶t̶s̶,̶ ̶o̶r̶ ̶b̶y̶ ̶a̶d̶d̶i̶n̶g̶ ̶t̶h̶e̶ ̶a̶c̶k̶n̶o̶w̶l̶e̶d̶g̶e̶m̶e̶n̶t̶s̶ ̶t̶h̶a̶t̶ ̶G̶P̶L̶ ̶r̶e̶q̶u̶i̶r̶e̶s̶.̶

Don't mind me, just being a dummy :)

what he said is true, and therefore what you said is less than true.

the GPL requires source corresponding to distributed binaries be released. They distributed GPL binaries and they have not been required to release the source.

They are allowed to make future binaries which are not GPLed, but the users of the GPLed binaries have not had their right to see the source satisfied.

> ...the users of the GPLed binaries have not had their right to see the source satisfied.

That's the intent of the GPL (GPL v3 Preamble) but it's not an outcome that a license can guarantee. A copyright license can only be enforced using copyright law, and the remedies for copyright infringement are limited to monetary damages (actual or statutory). Sometimes the threat of a copyright infringement suit may compel an infringer to release their source code rather than be ordered to pay damages, but sometimes not.

That sounds like a very American thing to say. You're talking about Italian law here?

I'm not a lawyer, but how do software licenses differ from contracts and their stipulations? I'm under the impression that stipulations in legal contracts can be enforced by courts.

I'm not a lawyer, but I happen to know the answer to this under common law. Which is what applies to most of the USA (Louisiana being the exception), but doesn't apply to Italy. I have no idea about Italian law.

A common law contract requires an offer, acceptance, and consideration. That is, one side must offer the contract. The other must accept it. And each must have some potential gain from it (consideration). Both sides are then bound by the agreement. The agreement can be quite complicated, for example it may bind the parties to resolving disputes with binding arbitration.

A license is permission to do something under some conditions. If you break the license, you are without permission. The licensor can then pursue claims against you just as they could if no license ever existed. For example if you break a copyright license, the licensor can sue you for copyright infringement. But without an explicit agreement from you, they can't sue for anything else.

That's just how proprietary licenses prefer to work. Licenses can do anything contracts can do. Copyleft licenses can grant rights to your users, and if the court believes the rights were granted, it can enforce them.

Not according to lawyers that I've had long conversations about this with. This is just how the law works.

If you want to find a discussion of this topic by a lawyer, a good chunk of https://rosenlaw.com/wp-content/uploads/Taxonomy-of-Licenses... is on exactly this topic. The author of which specializes in open source licensing, and was the general counsel for the Open Software Institute.

You mean bare licenses? The author mentions many times there are other possibilities.

The article that btilly linked to is very good, but I think it over-emphasizes the possibility of interpreting open source licenses as contracts. You have to read pretty far and pay close attention to understand that most open source licenses will fail as contracts and that the GPL explicitly intends that result (pp. 65-66).

Some consequences: (1) the sole recourse for breach of license conditions will be to sue for copyright infringement, (2) only the copyright owner will have standing to sue, (i.e., an intermediate licensee or a user, who might have standing as a third-party beneficiary under a contract theory, will not), and (3) remedies will be limited to monetary damages.

I'm not a lawyer either, but I believe you are referring to specific performance [1], which is rarely required (at least in common law systems).

[1]: https://en.wikipedia.org/wiki/Specific_performance

I can't elaborate more than that, but I was under the impression that in some places software licenses can be enforced with contract law, and in other places with copyright law.

Thanks. A statement of the court's order was included in the "press release" link, not the link I originally posted. Link updated.

> The Judge, considering the articles 156 I.d.a. and 700 c.p.c.,

> Orders the defendants (Marco Poglie, Francesco Pesce and Nerds Farm Srl) to cease any use made available to the public, as well as any publications, of the software named E-addons for Elementor, if not after having eliminated every recurrence (exception made for a maximum amount of 500 lines) of the code included in the 1.9.5.2 version of Dynamic Content for Elementor, sub doc.2 produced by the Applicant, within seven days of the communication of this provision.

https://www.dynamic.ooo/press/groundbreaking-acknowledgment-...

Only for the record (and IANAL), the second reference (Art.700 Codice Procedura Civile) is only related to the possibility - pending immediate financial loss - to get an accelerated/quick judgement.

The decision lies on the first reference (Art. 156 Legge sul diritto d'Autore - Law on Author's rights), which is Legge 22 aprile 1941 n. 633:

http://www.interlex.it/testi/l41_633.htm

interestingly, the objects protected were originally literature, music, arts, architecture, theatre and photos/movies (and was later extended to include computer programs, television, etc.).

I don't understand the exception. Like less than 500 line chunks of GPL can stay? Or only chunks that are 500 or less must be removed in the time allowed?

From the italian version I understand max 500 lines of GPL code can stay... not sure about the reason, it can be quite a lot of code

Of course they are enforceable? They have been all along, how did the courts only find about it just now? Did they not get the memo like 20 years ago?

Courts regularly hold contracts unenforceable for various reasons. And the question of whether the license is a “contract” or something else also depends on jurisdiction. So no the legal enforceability of the GPL isn’t a priori obvious.

I meant to say, it is physically able to be enforced, therefore it is "enforceable", whether the law chooses to actually enforce it is another story.

I guess the headline should be "Italian Courts decide to enforce" rather than "Italian Courts find out [about this new thing they could choose to enforce called open source]"

(IANAL, etc.) My understanding is that in legal contexts, the term “unenforceable” doesn’t necessarily refer to things that can’t be physically enforced in reality (like “the undersigned agrees to think about a white elephant once per day”) but to things that, if enforced, would violate a pre-existing law or part of the jurisdiction’s constitution (or equivalent “meta-law”).

So if a country’s court decided that the owner of a piece of IP could license it to other people, but that they could not dictate the terms under which it would be redistributed (because that’s how “free speech” is interpreted in that country) then they would rule the GPL unenforceable in their country.

This seems unlikely in most countries, but until it actually gets tested in a given country’s courts, it cannot be 100% ruled out. Most companies think the risk of the GPL standing up is high enough that they don’t want to be the ones to test it, so they comply.

GPL only emulates abolition of copyright. If a country properly abolishes copyright, GPL has nothing more to do.

> GPL only emulates abolition of copyright. If a country properly abolishes copyright, GPL has nothing more to do.

I don’t understand your thinking. Currently you can use GPLed code in your derivative works, if you release your changes under the same license. If copyright were abolished you would be able to use any code, but have no requirement to release yours.

Maybe you mean to say that the MIT license emulates abolition of copyright? That’s still not really true, but it’s definitely closer to true.

No, being a permissive license, MIT license's purpose is to ensure proprietary software can abuse users through copyright.

You only know if something is legally solid when it is tested in court. The GPL has had very little testing, because violations are mostly secret, in China, or not worth suing over.

China should be able to do it just fine: after all copyleft is software communism.

Reply on news.ycombinator.com