Hacker News Reader

Comment by pwarner | Hacker News Reader

What's the benefit to Vizio in withhold the source? Wouldn't all their interesting custom code be outside the scope of the GPL?

View on HN

Maybe they have written some kernel modules which claim to be GPL licensed to be able to access all kernel APIs unimpeded? So it’s their interesting code infringing GPL.

Maybe they modified tools, kernel or some GPL licensed tool to work with their hardware, and don’t want to spill the beans?

Possibilities are endless.

Or drivers, possibly for devices / modules for which they are not at liberty to share the details (NDA).

Either way, such hiding should stop. There is no reason I should not be able to repair / upgrade / change the TV I bought however I wish, as long as I'm not harming others (RF). Even then, this should be my responsability.

Maybe their engineers were lazy or rushed by management, and didn't keep things organized, so GPL code, proprietary/internal code, potentially-patent-violating hardware documentation, and secret keys all got munged together, and they figured it would be cheaper to fight a lawsuit than to carefully untangle the terabytes of junk so they can hand over the relevant code without having their digital asses hanging out.

The possibilities are indeed endless.

It would cost them millons to find and package everything. This is assuming they have everything in source control and have nothing to hide (that is no code that isn't public anyway) sure you can do a git to tar.gz easy, but GNU is likely to demand the hash everything was built from which means people need to figure that out.

if they have a monorepo with non GPL code (which doesn't link to anything GPL) stripping it all out will cost a lot more.

It costs nowhere near that much to find all your third party dependencies. It's not pleasant work, to be sure, but it's not rocket science either.

Time adds up faster than you think. a few people double checking that it was done right...

I think for a case like this they would assign a low level employee to make a best effort attempt at this, probably taking some sources from GitHub to match the approximate version of what they released, maybe give it a good shot for a week or two. That would probably placate the SFC at least until they realize.

If they are lucky that works out and they can maybe get by with that and the cost would be in the mid tens of thousands. However if they get caught it will come out in court, the judge will not be impressed with a half hearted effort - so a million to defend in court, plus what they lose in court which could well be forcing all their code opened as GPL.

Remember, a small meeting will cost over $1000/hour when you add in all the time for each person in this. There will be several small meetings needed to decide on course of action. There is also the opportunity cost of the employees who are doing this (or just in the meetings) instead of something that more obviously brings value.

This 1000$ meeting assumes SV programmer salaries. I can assure you that many places in the world have much smaller salaries.

Also, they are already planning to go to court to prevent releasing any code, so finding a way to spend a few thousand dollars or even a few tens of thousands to avoid court entirely would be a no-brainer.

Going to court and saying "we made an effort to appease them but these people just want too much" is much better than going to court and saying "let's settle a new area of law to determine if this people have a right to sue us for very obviously ignoring the terms of this software license".

No one in these days of cyber attacks should be shipping unknown third party dependencies. How could you fix unknown dependencies in case of severe CVE's in them ? Unknown third party dependencies are a sign of utter amateur incompetence in product development.

Once you have all third party dependencies cataloged, licence compliance should just shake out in the wash.

Reply on news.ycombinator.com