Hacker News Reader

Comment by aidenn0 | Hacker News Reader

It is ridiculous that a linux company can so misunderstand copyright. GPL cannot compel you to open source your code or to give out security keys. They can seek damages against you if you violate the license.

As a more extreme example, lets say I have software with a license that requires you to punch yourself in the face in order to use it. If I find you've used it without punching yourself in the face; I can't compel you to punch yourself in the face, I can only collect monetary damages and get a court to forbid you from using my software anymore.

When you've tightly tied yourself to a single GPL product, it may be easier to just comply with the GPL than to switch to using non-GPL software, but a bootloader is hardly a tightly integrated part of an OS; they could release with grub 2 and switch to elflinux if it is determined that they were violating the GPL3 by not divulging their keys.

View on HN

Under common law, damages were all you could seek for violation of a contract[1], but under equity a court can order that the contract terms be honored. That's called "specific performance".

There are certain conditions under which specific performance is not an option. One of those is if it would cause undo hardship on the defendant. That would be sufficient to rule out a court ordering you to punch yourself in the face.

Offhand, I can't think of any of these conditions that would apply in the case of the GPLv3 requirement to disclose signing keys, and so don't see why specific performance would not be a possible outcome there.

[1] There is some question as to whether or not free and open source licenses should be treated as contracts in litigation, or if such cases should be treated as copyright infringement cases with the license only coming up as a possible defense.

In other words, just violate the license until you get caught? I don't understand what you are saying here.

If you violate the GPL license on code you are distributing, you can be legally compelled to stop distributing the code and pay damages to aggrieved parties. You cannot be compelled to fulfill arbitrary requirements of the license, like sharing private information, your own source code, punch yourself in the face, fly to the moon, or give up custody of your first-born child.

If you successfully argue that the GPL forms a contract (and I'm not sure if it does or not), you can argue for specific performance instead of damages.

There is one hook in the GPL that makes this a very dangerous game: if you are found to be in violation, you lose your rights given by the license until they are explicitly reinstated by the copyright holder. Just starting to comply with it is not enough. Depending on how the GRUB team wants to play this, this could get messy. Canonical loosing all rights to GRUB would be a fun case, especially when it comes to all the releases that still use GRUB.

See: http://www.softwarefreedom.org/resources/2008/compliance-gui... (5.2, Termination)

Also, as a Linux vendor, you really don't want to get caught violating the GPL voluntarily.

I have to question if any high profile development team has the balls to actually prevent Ubuntu from using their software. Ubuntu dropping your packages from a default install would have enough of an impact, but having them removed from the repos as well seems catastrophic.

Canonical is not really a small-time player in the Linux world.

Yes, but Canonical advocating GPL breaches and strong-arming a high-profile team into a standoff? Would any of the sides want the fallout of that?

My point was that it is not true that you can just pay up when convicted and continue as before if you are found to be in violation of the GPL.

That's true in all these discussions. You always have the option to simply stop selling your product, however for most companies that's probably a worse option than giving away the source code. I think that's why it's usually left out of the discussion.

It's like saying Americans will be forced to buy health insurance soon. They don't have to if they quit their job and keep their income below the poverty level, but that's not really a viable alternative for most, so "forced to buy health insurance" remains an accurate summary.

Even so, I doubt they want to pay damages either.

Yes, but then don't go on the record saying that if you shipped with grub 2 you could be compelled to divulge your keys, that's either a lie, or a misunderstanding of how copyright works.

I don't think it's a lie or a misunderstanding, but a reasonable summary of the situation. They shouldn't have to mention the "pay damages and stop shipping the software" alternative, since that is always an implicit possibility.

> GPL cannot compel you to open source your code or to give out security keys. They can seek damages against you if you violate the license.

FSF's stance on this seems to be different from yours.

Quoting from the blog post[1]:

>This fear is unfounded and based on a misunderstanding of GPLv3. We have not been able to come up with any scenario where Ubuntu would be forced to divulge a private signing key because a third-party computer manufacturer or distributor shipped Ubuntu on a Restricted Boot machine. In such situations, the computer distributor -- not Canonical or Ubuntu -- would be the one responsible for providing the information necessary for users to run modified versions of the software.

See the last line? So basically FSF is claiming that the private key must be divulged, just not by Ubuntu, but the OEM. What if the OEM is a Ubuntu partner? They would be in a bind, having to chose between divulging the key(and probably having it revoked when a rootkit starts using it) and throwing their OEM partner under the bus.

As you said, if the bootloader is easily replaceable with something with a more open license, why subject yourself to this possible headache?

[1] https://www.fsf.org/campaigns/secure-boot-vs-restricted-boot...

Reply on news.ycombinator.com