Sky D-Link router and GPL violation (was Re: Selling device but retaining ownership of the firmware?)

[Mark Valentine]

On 7 December 2011 09:18, Neil Brown <neil at neilzone.co.uk> wrote:
> I think you need to appreciate that your reading is not
> necessarily right.  Could it be that you start from the position of wanting
> a particular result, and are unintentionally bending the words of the
> licence, or reading in extra words, to obtain that result?
>
> I mean no criticism by this, but I'm trying to explain that there is no one
> common interpretation of this document - mine is no more wrong or right than
> yours, but I arrive at a very different result through the same process, of
> simply reading the words on the page.

I did try hard in editing my excerpt from Section 3 to use strict
parsing of the language and pure, unbiased logic to end up with what I
did.

Mathematical rigour _should_ trump expert legalese every time!
(Though I'm not claiming perfect rigour, just doing the best I can.)

The only result I want is to avoid commercial entities weaselling out
of their obligations.  My original interest in the Sky firmware
sources doesn't even go as far as needing to rebuild it, and still
wouldn't if they actually enabled me to.  In fact we still haven't
learned whether Sky are going to be a problem in this regard (my
contact is off shift mid-week).

Neither am I a particular fan of the GPL itself (as a developer I will
chose a more permissive licence every time, where I have the choice),
but I do fully support those who choose to use it for the purpose it
was designed for.

> I can certainly see why you get to where you do, and appreciate the
> arguments that you make in support - but I just cannot convince myself
> that a court would hold the same, given the wording on the page.

I have no experience of how a court works (thankfully!), but it is my
hope that on a good day and with a bit of thought, I (or anyone with
sufficient subject knowledge, specifically _not_ requiring extensive
legal training), could overcome the limitations in my expressiveness
to show to a reasonably well informed group of people the veracity of
my case.  If in the end, given reasonable chance to correct my
mistakes, I'm still making less sense than the chap making the other
case, I'll admit defeat.  I will not admit defeat if it's clear to me
that the chap making the other case is just picking holes in mine
without his case making any more sense than mine.  I would hope that a
court would use at least similar principles.

> [Nor is this a case of a lawyer out to de-tooth the GPL - I just happen to
> be qualifed as a lawyer.]

I for one am most grateful to you for taking the time to share your
expertise and contribute your input (I grudgingly admit that our
society's laws have long become so complex that it takes extensive
study to get to grips with just a subset; I just wish that we could
optimise more everyday law cases not to require every last subtlety to
be wrung out [or at least that's my outsider's view of one aspect that
seems to be going wrong], but my unrealistic implementation involves
keeping just the "good" judges and lawyers and sacking all the rest...
:-).

>> If the distributor does not provide everything necessary (in the
>> preferred form) to compile and _install_ the covered software, how can
>> this be seen as satisfying the terms of the licence?
>
> The wording is "scripts used to control compilation and installation of the
> executable." The only point on which we seem to differ is whether an object
> referenced in the script, which performs a task required for the
> installation of the code on the product in question, must be included.

If it's required to complete the compilation and installation, I'm
still not seeing how you satisfy the licence without including it.

Believe me, I'm studying your input, and other relevant sources, over
and over trying to see if I can make it all gel into something I can
admit defeat over!

> Evidence, other than "you say / I say" is limited. When Stallamn commented
> on the reasons to upgrade to GNU GPL 3, one of the reasons was "One major
> danger that GPLv3 will block is tivoization."
> (http://gplv3.fsf.org/rms-why.html) Circumstantial, but this would seem to
> support the position that it is *not* restricted / blocked under GNU GPL
> 2.0, since it was simply not envisaged when the licence was drafted.
>
> Similarly, the GPL FAQ's say, in terms of tivoisation, that "The
> manufacturers comply with GPLv2 by giving you the source code, but you still
> don't have the freedom to modify the software you're using. We call this
> practice tivoization." The distribution of the source without the ability to
> reinstall modified / unsigned code does not, in the view of the author of
> the FAQ, mean that the manufacturer does not comply. The FAQ goes on to say,
> in effect, that this is fixed in GPL 3.0:
> http://www.gnu.org/licenses/gpl-faq.html#Tivoization

Further supporting this view is a passage at
<http://fsfe.org/projects/gplv3/tokyo-rms-transcript#tivoisation>
where RMS is quoted as saying:

  "...as far as I know, the Tivo company does obey GPL version 2. They provide
   the users with source code and the users can then modify it and
compile it and
   then install it in the Tivo. That's where the trouble begins
because the Tivo will
   not run modified versions, [...]

However, I'm going to go so far as to say that I believe RMS to be
mistaken here (OK, not _mistaken_, given his leading qualification!),
for the following simple reason.

The first definition of "install" I find at
<http://www.thefreedictionary.com/install> is "to connect or set in
position and prepare for use", and they give the specific example
"installed software on my computer".

"Installing an executable" is _not_ necessarily the same thing as
"copying a binary".  The use of an executable is to be executed (run).
 To prepare it for use (in the TiVo case) would imply signing it in
order to allow it to run, and (presumably) setting the execute
permissions.

Furthermore, an "installation" method involving creating a signed
firmware image without a key doesn't even permit the "copy the binary
to the target system" part, so we're not even talking the same thing
as "tivoization" in our larger discussion (in particular, still not
obeying GPLv2 in accordance with the RMS quote above).

I've also thought further about the question of whether a signing key
can be implied to be part of the "scripts used to control compilation
and installation of the executable".

The dictionaries are a little less helpful here.
<http://www.thefreedictionary.com/script> has it as "a simple program
in a utility language or an application's proprietary language", but
that doesn't really cover our context (e.g. a makefile isn't generally
considered a program).  Rather, the GPL seems to use it to refer it to
the _input_ (or directions) to programs such as the compiler (and
make) covered under "components of the operating system" sentence.  In
this case it's more like the definition of a script as a choreography,
"run these programs with these inputs to compile and install the
binary form of the work".  The source files, header files, makefiles
and signing keys are all equally inputs in this regard.

> (n.b.: I do not treat the FAQs as authoritative, since they are just the
> views of the FSF and not necessarily those of any particular licensor, so I
> paste them here to be treated with the same caution (to my way of thinking)
> as any other opinion on the matter.)

Agreed.

> I don't think that this will solve the logical disjunct which you observe,
> that a licence designed to give freedom does not go as far as to actually
> facilitate this freedom in all circumstances. However, I do not believe that
> the document is perfect (certainly not from a legal drafting point of view),
> and think that it has become outdated with changes in approach by
> manufacturers - this is one of the reasons why the document has evolved to
> version 3, to deal with new concerns and problems.

Do you accept this "logical disjunct" as real, or just "observed"?

In one sense, neither our natural languages nor our legal systems can
be said to have any chance of not being continually "outdated" in the
face of technical advances.  However, I give them credit for being
sufficiently evolved as to be able be adapted just fine "as is" to
many more changes than many people might think.  Part of our problem
is the introduced complexity over time due to excessing "tweaking",
and not enough simplification (an over-engineered system can and
should be streamlined at a suitable opportunity).

I feel that it would be wrong just to give up on GPLv2, since there is
so much software covered by this version which it is not practical to
re-license under GPLv3, and is deserving of the intended protection of
GPLv2.  The commercial entities can't be allowed to just have it for
nothing.  (Hmm, I sound as if I'm going all Occupy GPLv2. :-)

It's good that the GPLv3 leaves less "wiggling room", but we must deal
with less refined/tweaked documents the best we can to ensure a fair
outcome.

>> If you attempt to invalidate one sentence inconvenient to you
>
> In the interests of ongoing discussion, can we try to avoid constructs such
> as this, please? I appreciate that my view differs with yours, but my
> intention is merely to explain what I consider why I think I have a logical
> and rational basis for that view.

I apologise for the poor wording.  By "you" I meant any person trying
to make the opposite case, or "not me", but still it doesn't help my
case for using "pure logical interpretation" if I use emotive
phrasing, oops...

I hope I've done a better job with this response (further apologies if
I haven't).

Cheers,

Mark.