[SGVLUG] An interesting (I hope) GPL question

[Dustin Laurence]

On Mon, Apr 17, 2006 at 07:09:16PM -0700, Emerson, Tom wrote:

> > -----Original Message----- Of Dustin Laurence
> > 
> > Not quite.  You have the option (section 3(a)) of shipping 
> > both together [...]  It is when you 
> > use option 3(b) and don't accompany the binary with source 
> > initially that you must offer to supply source code by mail 
> > (3(c) doesn't apply in this case because it is his own software).
> 
> Hmmm... I maintain the end result is that recipients are entitled to the
> source so long as they legally obtained the original binary [though it
> might be tough to prove someone "stole" a GPL program]

I am still not sure precisely what you are arguing, but if it is what I
suspect I don't see how you can support it from the licence.  Maybe I
misunderstand.  I think you've actually hit upon a little-remarked-on
quirk of the GPL that in practice *everyone* ignores.

If I use option 3(a) (we'll say this is for some component under someone
else's copyright, to make it clear that I must comply with the GPL
myself--the copyright holder obviously need not), I comply with the GPL
and need not (and inevitably *WILL NOT*) make any offer to send code by
mail (I hate snail mail so much that the chances that I'd actually use
the GPL for a personal project are *ZERO* if this were not the case).
Now alpha (to make sure this is distinct from your example) downloads
the binary but not the source, or installs the binary and then throws
away the disk with source, as is his right.

Now beta asks alpha for a copy.  At this point, alpha obviously cannot
use option 3(a) because he does not have the source code, and cannot use
3(c) because there is no prior offer from me to pass along.  He also
can't use 3(b) unless he knows he can get the source (from me or
another) at a later time, quickly enough to satisfy any request he may
receive.  If he can do this then the situation isn't interesting, so
let's say that in the mean time I've either lost interest in the project
and taken the code off the server or that I'm selling the binary/source
only in a bundle, as 3(a) allows.  So in fact alpha cannot use 3(b)
either (unless he makes a fraudlent offer, which I do not suppose).

One of two things is now true: either (I) alpha does *NOT* have the
legal right to distribute the software (he can *always* use it without
restriction himself, just as the licence says), or (II) he can pass on
the binary he has without source, and beta has no way to get the source
unless he either purchases the binary from me or receives it from a
third party.  In any case, at least one copy must have been purchased
from me, since that is the only way the source could "escape" into the
wild.  But not more than one copy need be purchased either, if the first
person to purchase it puts the source out for download and re-builds and
distributes a binary as well.  What is clearly *NOT* the case is what I
thought you were arguing, that beta had the right to demand the source
from me.  I think the licence is very clear that this is not the case.

I think the simple answer is that alpha does not have the legal right to
distribute the binary!  This seems to be the plain sense of the licence,
and the only reason it seems surprising is that in practice nearly
everyone disregards it (but probably not as often as they disregard the
changelog requirement of 2(a) ).

I think the reason is that in practice the system is almost never harmed
by enforcing this; it is only necessary in the rare cases where someone
behaves very badly.  But technically I suspect that it is always a
licence violation.  I think it would be very hard to allow this
"officially" without also creating a huge hole for abuse.  (I can think
of trivial ways to abuse it otherwise.  I could, say, sell *one* copy of
$(OPEN_SOURCE_PROJECT) to $(EVIL_COMPANY) for ten million dollars using
option 3(a), then I go out of business as I promised them--orally over
dinner, so there is no evidence of any conspiracy.  Then they discard
the source code, and then legally distribute binary copies of the OS.
Presto, $(OPEN_SOURCE_PROJECT) has been taken proprietary.)  So the
solution is to make this behavior technically illegal but only enforce
it when genuine abuse is occuring.

I have a vague memory of reading something about this that came to the
same conclusion, but I'd forgotten it long ago.

Also c.f. the ugly case of sveasoft, whose business model pushes as
close to this limit as they can (and given that the've made threats of
violence, quite possibly crosses the legal line).

> > > ... but does it also compel you to release copies 
> > > of the code to "anyone who just plain asks for it"?
> > 
> > I believe so:
> > 
> > http://www.gnu.org/licenses/gpl-faq.html#WhatDoesWrittenOfferValid
> > 
> > The reason is transitivity (if A gives B the binary but B 
> > doesn't as for the source, then B gives the binary to C, C 
>            ^
> [I think you meant "ask" here]

Yes.

> > must still be able to get the source, which has to be from 
> > A).  Since there isn't an easy general way for A to know if C 
> > has the binary A must just give the source to anyone who asks 
> > and pays the distribution costs.
> 
> This is the slippery slope item.  The wording of the FAQ answer starts
> out by saying "...anyone who has the offer is entitled to take you up on
> it", but doesn't define "who has the offer".

Why does it need to be defined?  I think you're inventing a concept of
"proper" offering that doesn't exist, or at the very least is infeasible
to enforce.  If you exercise 3(b), I think you must in practice supply
the software to *anyone* who asks.  And since you're allowed to recoup
your costs, this shouldn't be an undue burden (if you count your labor
costs, as you should, then at worst you hire one or more people to do
nothing but mail out source code and charge the entire salary, staffing,
and recruitment costs for this, so your net cost is still zero).

> ...In your example, and as
> you point out, "A" doesn't know if "C" was properly "offered" the
> software.  I'm maintaining that "B" would be the responsible party, but
> that in turn rests upon how it was originally distributed to B.

If I follow you, I think you're inventing this based on assumptions that
can't be supported from the licence.  The licence may not *actually* be
what you think it *ought to be*.

> Going back to the earlier part of your answer, the wording of section 3
> seems to imply that if you distribute the binary AND source (clause 3a),
> you are exempt from downlines asking for the source [i.e., because you
> gave a copy of the source initially, you DON'T have to give a "written
> offer" (3b), and further, without a written offer, "B" cannot use clause
> 3c since there is no offer to "pass along"]

I entirely agree.

> ...Of course, this doesn't
> stop B from "making up" the claim he was given a written offer,

Nuts.  B can say what he likes, but it means nothing unless B can prove
it in a court of law (since he'd have to sue me, then the burden of
proof must rest with him).  If he can't then he can pay my legal costs
for his idiotic lawsuit.

This has nothing to do with the GPL--anyone can make up anything they
like, this is true for any legal situation whatsoever.  For example, I
can claim you offered to buy me a pony last St. Crispin's day and then
reneged on the promise.  Do you lose sleep at night worrying that I will
do so? :-)

> ...(or of
> interpreting the wording of the GPL itself to imply that said offer was
> made)

This is the same as the previous.  Of course you can argue any idiotic
legal theory you like, but this is always true of everything.  Some
cretin recently claimed in court that the GPL amounted to restraint of
trade or something, see Groklaw for details.  He went down in flames
like a moth at a candlestick party.  Doesn't make too many of use lose
sleep though, and doesn't change anything.

> ...Nor does this stop D (who doesn't have a copy at all) from
> claiming he received said offer from C, who would have legitimately
> received the offer from B and could therefore pass it along.

> [Whether or not B should honor D's claim is another matter entirely...]

Unless I've lost my way in this discussion, I think he must.  Even if
your idea of a "legitimate" offer is valid, then who is going to go to
court over it?  It's cheaper and easier to send out the code at D's cost
than to walk down the hall to ask Legal about it or even to write a
letter questioning D's claim.  And there is no harm, given that the code
is going to be "out there" if anyone wants it to be.

> > ... The thinking must be that 
> > this isn't a problem for anyone (A is getting paid for the cost of
> > distribution) unless they are up to no good.
> 
> Ahhh, but the 'up to no good' part makes this difficult.  Say for
> instance the cost of developing the software is $1,000 and you're fairly
> certain the market is for 10 copies.  In an attempt to be fair to all,
> you decide to try and sell 10 copies for $100 each in order to recoup
> your expenses.

That amounts to being "up to no good" according to the author of the
GPL, and why do you expect that the GPL would necessarily be friendly to
this case?  What you described is the case for proprietary software,
nothing more or less.  I think the problem is that you're starting with
the assumption that the GPL must support this business model somehow.
In fact, I think it's main purpose is to forbid it.  According to
Richard Stallman, this is emphatically *NOT* "fair to all."

Remember, that the GPL in practice reduces the price of information to
the cost of copying, which is tiny these days.  The GPL makes it
infeasible to charge "secrecy rent," which is what you're describing.
What it does *NOT* do is reduce the cost of service.  So if you want to
use the GPL in the situation you describe, you must change your business
model, not try to make the GPL say something it doesn't.

For example, you could go to the ten potential customers and offer them
a contract--they will pay you $(BOUNTY) upon receipt of the software if
completed in the next $(TERM) years and meets $(SPECS).  If you get
enough takers, you begin coding.  Now you're charging for a service
(writing the software), not information (the completed software).

Or, if you can't afford to work now for money later, you could work on a
"half up front" basis or something.  The point is, to really be viable
you have to charge for service, because the GPL intentionally has the
effect of eliminating the charge for information, even if it technically
allows it.

It does this in a way that is probably more effective than Stallman
imagined, given that the public net happened after the GPL was first
released.

> ...  Technically, then, you
> could charge $100 for the source, but what will likely happen is that 3
> or 4 people would buy the original and distribute them "for free" to the
> other 6 or 7 people interested in the program.

Yes.  The GPL is *designed* to make sure this happens.  Why are you
trying to find a way that it doesn't do this?  If you find it, I'm quite
sure that Eben Moglen will make sure the loophole is closed in the next
revision!

> ...Of those that got a free copy, approximately zero are even remotely
> interested in the source, and even fewer are interested in the source
> when they find it costs as much as the program.

So what?  The GPL is designed to ensure that you can't charge secrecy
rent, not to ensure that you can only charge secrecy rent "when it's
fair" (by someone's notion of fair).

> Yes, this is a rather constrained example, but the end result is that
> "A" suffers a loss because those that got it for free aren't likely to
> pay for the source either.

The GPL isn't written to ensure that A can make a living selling
software, you know. :-)  It's designed to forbid or simply make
uneconomic certain behaviors, and if A wants to engage in those
behaviors the licence author certainly *HOPED* that he woud suffer a
loss.  In fact way back when Stallman speculated that programmers
(including presumably himself) would net less under a GPL model of
fee-for-service, but he didn't think that changed the moral issue.  I
believe he even pointed out that there is no more an inherent right to
make a living selling software than there is to make a living selling
buggy whips, or "protection."

The fact rarely quoted in this context is that proprietary software
development is *also* very risky and tough.  Most software companies
fail, but somehow this isn't attributed to their business model unless
that model happens to be based on Open Source.  Funny thing. :-)

> (actually, "putting the source on a website" doesn't meet the definition
> of "providing access to the source" unless the binary is on the same
> web/ftp server, but that's a minor point)

I assumed that the person doing it could also read the licence and
ensure that he was in compliance with the details without my help. :-)

> > Anyone who doesn't like that shouldn't use the GPL 
> > in the first place.
> 
> Well, that *is* the part my brother-in-law doesn't like, and most likely
> the reason he will avoid using the GPL for this project.

Well, that's fine.  It's better IMO for someone to *NOT* use the GPL
than to try to find an odd corner case and abuse it.  If the market
really matters then it's better for someone who likes the GPL to cut the
feet out from under the proprietary vendors than to try to get them to
grudgingly toe the line on something they don't believe in.

> ...However, this
> semi-hypothetical question is just that -- it doesn't accurately reflect
> his particular situation, but it is close enough to get some good
> discussion going where he can decide if the GPL will cover him or not.

I assume that he cares nothing for the idea of Free Software and this is
a strictly economic decision.  In that case I can't see why he would use
the GPL unless he hopes to develop a community of people who will share
in the development.  That is the great business advantage of the
GPL--everyone can share, and the GPL (unlike the BSD licence) ensures
that it is fair because you can't make a proprietary fork.  Thus, it
enforces a truce that everyone will share enhancements and no one will
be able to compete based on a different version of the software.  (I
think of it as the "never again" licence for people who remember the
unix wars.)  Done correctly, this is *much* less expensive than
proprietary development.  But perhaps conditions are not right for his
software project.

Also, if you do this pretty soon lots of other people have copyrighted
code in your project, and now you don't even have the option to
re-licence yourself unless you get their cooperation (better make it in
writing) or re-write the code.  I trust the FSF on this point and would
not hesitate to execute a copyright assignment to the FSF for a GNU
project, but I wouldn't assign to too many other people.

> > He has the right to redistribute 
> > for free or for money provided he meets one of the provisions 
> > of section 3. If he chooses option 3(a), nobody can compel him 
> > to distribute the source later.
> 
> Agreed, and I think this is the best option for someone with limited
> resources for making "machine readable" code [i.e., no CD burner.  Of
> course, this begs the question of how he got it out to the customer in
> the first place, but there are ways...]

I have a CD burner, but would not even consider anything that would
obligate me to put stuff in the mail. :-)  Not usually, anyway.

> Also agreed -- my example was that "A" did receive the source initially,
> thus satisfying 3a from you (the author); by choosing to further
> distribute the binary, he must take on the responsibility (and resulting
> costs) of distributing the source.

Then I think the problem is your unstated assumption that A has the
right to redistribute at all.  Can you find anything in the licence
itself (as opposed to a vague feeling that "of course he can") that
supports this?  I can't, though I admit I didn't read all the way
through looking.  Section 3 doesn't seem to permit it though.

> > Or, *if* A is *not* selling it 
> > and received it in binary form, he may use option 3(c) and 
> > simply pass on the offer he was given.
>  
> I don't see how the issue of "selling" vs. "not selling" makes any
> difference here (unless you're using "in exchange for money" as a basis
> of determining "commercial" vs. "non commercial" distribution, but I can
> think of ways where it can be "commercially distributed" for zero
> dollars [promotional items given to a LUG for use as door prizes]

I was simply referring the non-commercial clause of 3(c).  I don't know
the precise legal definition and don't care.  We can just stipulate that
it is met, whatever it is, and discuss from there.

> In any case, my example was: 
> 
>    *you* sell something to A, complete w/source code
>    A sells it to C, C declines the offered source code
>    C gives it to B 
>    so who does B get the source from?

No one, but then C violated the licence in redistributing so B has no
reasonable expection that anyone will give it to him in the first place.
If B wants to benefit from the GPL he needs to find a GPL-compliant way
to get a copy.

> [of course, B probably doesn't want the source since he has what he
> wanted in the first place -- a working version of your program without
> paying for it...]

This is why the lack of binary distribution rights doesn't really matter
anyway.  Very few people actually want to distribute, and those that do
can easily comply in practice.  At worse, they just email each other,
put together a pool, and collectively purchase one legal copy.  The GPL
intentionally allows this, as it ensures that the market won't bear
secrecy rent.

Sveasoft tries to game this worse than any of your suggestions; IIRC
they try to "watermark" each binary, IIRC, and if "your" copy escapes
into the wild they cancel that licence so you can't do it again.  I
think this may be just barely GPL compliant.  They could and probably do
also cancel your licence if you request source code, and that's probably
just barely legal too as long as they comply with the request.

None of that matters; in practice I think the existing GPL still works
"well enough" to forbid secrecy rent, and of course in the Sveasoft case
a different person simply can do the release each time.  This could fail
for super-small markets, but then if so few people care that there are
only ten potential customers perhaps it doesn't in practice matter.
American Law is probably grossly unfair to Beings Of Pure Energy, but
in practice who cares? :-)

Here is a post describing more or less your situation:

http://zgp.org/pipermail/linux-elitists/2001-April/002230.html

Dustin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://www.sgvlug.net/pipermail/sgvlug/attachments/20060418/7a980b04/attachment-0001.bin