Some Notes on the GPL

Without inserting myself into an internet argument, I’d like to address some basic misunderstandings of the GPL at the root of Lefty’s recent post about Microsoft and my colleague Bradley Kuhn. On his blog, Lefty chides Bradley for referring to Microsoft as violators of the GPL. He makes two basic mistakes about GPLv2, and since this isn’t the first time I’ve heard such views, I’m going to address them each here. I’m not going to take a position on whether Microsoft violated, and I’m not going to insult anybody, so hopefully this post will be taken in the spirit in which it is offered.

In Lefty’s view of GPLv2, distributing GPL-licensed code without source and without a written offer for source is not a violation until a distributee asks for source and is denied. This view is faulty. The license describes conditions under which distributing is permitted. As soon as distribution occurs in the absence of satisfaction of those conditions, the license (and underlying copyright) is violated. In other words, violation occurs at the moment of unauthorized distribution. It is true that violators are often given time to come into compliance with the license before public accusations are thrown around, but that’s a courtesy, not a requirement.

If Microsoft distributed without source and without a written offer, it violated at the moment of distribution. Anybody (including me and, apparently, Lefty) who wants to live in a world where later compliance cures an earlier violation, should push for adoption of GPLv3, which has a very carefully constructed cure provision:

Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.

The second misunderstanding is also important. According to Lefty’s reading of GPLv2, when a distributee in receipt of a written offer is denied requested source, the distributee has a cause of action against the distributor. This is not the case. GPLv2 is not a contract, and distributees are not third-party beneficiaries of the license. The license gives them no rights. After all, it is not their copyright at stake. Rather, it is the upstream developer who has a complaint: her code was copied without permission. This is why GPL-enforcement claims are brought by developers (e.g. Harald Welte and FSF) and not users.

With those two clarifications (and the note that I like Lefty quite a bit), I return you all to your regularly scheduled flame war.

RSS feed


Comment by Lefty
2009-07-28 14:35:20

You’re making my case for me, James.

Yes, the “upstream developer” is the one who has a complaint, potentially, about Microsoft’s compliance issues” around the notification. No such upstream developer, nor such a complaint from one, has been produced. Bradley Kuhn’s not the upstream developer, and neither are any of the folks who seem to be busily claiming a “violation” here on behalf of works they had no hand in writing.

Harald, in contrast, is the copyright holder on iptables, which is why he’s been able to successfully bring GPL violation claims to court in Germany.

Bradley can claim “violation” all he wants, but he has no standing for such a claim, and it’s—I continue to believe—irresponsible for him to be making one, particularly when it runs completely contrary to the usual community practices of giving folks who’ve got compliance issues an opportunity to correct them first (as always attempts to do).

Microsoft corrected their compliance issues when they were brought to their attention; they did so fully, and in a timely way. The widespread assumptions of perfidy (“Never ascribe to malice…”, “Honi soit qui mal y pense”, etc.) and the cries of “violation!” from parties without standing to say that are intended to punish good behavior, it seems.

Why are we singling out one organization for such special treatment?

Palm was “in violation” for a while for not making the GPL-ed sources used in the Pre immediately available. I don’t see Bradley making public statements about that, however, and I don’t see a lot of claims about it on the web.

It’s “just an oversight” when Palm doesn’t provide sources at all, but a “violation” when Microsoft neglects to include a notice?

Comment by James Vasile
2009-07-28 14:52:25


To be clear, the upstream dev is the only one with a legal case for violation. But even in the absence of her complaint, the violation still exists. Unauthorized distribution is unauthorized as soon as it happens, regardless of who ultimately has legal remedies as a result of that distribution.

Bradley doesn’t have standing to sue Microsoft, true. But he’s not suing. He’s simply pointing out the violation, which one can do in the absence of a suit.

I’m not arguing whether or not Bradley is being a churl. I’m making two points: (1) unauthorized distribution is a license violation even in the absence of copyright-holder accusations; and (2) only copyright holders can sue in the event of unauthorized distribution.

As for palm, see here.

Comment by Lefty
2009-07-28 15:10:55

Okay, but we’re talking about a “violation” in a thoroughly metaphysical, “if I drive 95 in a 55 and there’s absolutely no one around to witness it, then have I broken a law?”, sort of sense here.

There may have been “unauthorized distribution”, but if no one was really aware of it (other than Stephen Hemminger, Greg K-H, and some engineers and lawyers within Microsoft) prior to its being corrected, what’s one to do? Complain that it got corrected?

That’s what Bradley seems to be doing here; at the very least, he’s certainly taking the stance that “one should never ascribe to error what could be attributed to malice”, and I don’t believe that’s the way we normally operate.

I’m certainly not arguing that we shouldn’t call out compliance issues (and I’m trying to distinguish between the metaphysical and the actual “violation” with this terminology) and hold companies to correcting them, aggressively if need be. I don’t disagree with your posting on Palm in that sense.

But to be leading the catcalling of “violation!” after the fact, after the issue has been corrected, seems to me as though it might not be the very best way to persuade organizations that they’ll be welcomed into free and open source development, if they’re currently contemplating it.

Good behavior, it seems, is not good enough, at least not for Bradley: if your good behavior demonstrates that you behaved badly, even when the “good behavior” is specifically intended to correct or ameliorate that “bad behavior”, it’s the bad behavior you get raked over the coals in the press for. I’d say it reflects badly on the SFLC’s even-handedness.

Seems totally counterproductive to me, all in all. Aren’t there real, at-the-present-moment, proven GPL violators for Bradley to chase after, rather than scolding Microsoft for having made the sensible decision to do thing Our Way? Surely, Harald must have a few names.

Comment by James Vasile
2009-07-28 15:23:59


I’m not much for metaphysics. Violations happen in the real world. They are legal realities, even if they are abstract. If you do 95 in a 55, then, yes, that is a traffic violation. Violations go undetected and unaddressed every day, but they are still violations.

Where you disagree with Bradley is not on whether there was a violation. You disagree on whether to berate Microsoft on the topic. I am not taking a position on that. I just wanted to clarify people’s thinking about the GPL.

Comment by Lefty
2009-07-28 15:49:49

I’d actually disagree with you on the traffic violation thing—I’d contend that not only didn’t I “violate” a “law”, but actively assert that there’s no evidence whatsoever to support a claim to the contrary—but I think we have different views on how the law and reality intersect here…

And that’s a very metaphysical discussion…

Comment by James Vasile
2009-07-28 15:54:53

Glad to see our disagreement clarified and relegated to the plane of metaphysics! Next time you’re in NYC, let’s get a beer and we can talk about strategies for convincing companies like MS and Palm to adopt our tech and respect our licenses.

Comment by Lefty
2009-07-28 18:18:42

James, you might find Jo Shields’ comments in Stephen Hemminger’s blog of interest.

It seems that Microsoft’s drivers were structured the way the Nvidia’s and ATI’s proprietary drivers have been.

Are we still in “violation” here?

Comment by James Vasile
2009-07-28 20:10:43

As I mentioned, I’m not taking a position on whether Microsoft violated. Aside from correcting the two errors I mentioned in my post, I don’t have a dog in your fight.

Comment by Lefty
2009-07-28 20:41:34

Fair enough.

Comment by makomk
2009-07-29 11:55:59

“Bradley can claim “violation” all he wants, but he has no standing for such a claim, and it’s—I continue to believe—irresponsible for him to be making one”

Now that is amusing, given that I last came across you claiming “sexism” when you in fact have no standing since you are not actually female[1]. In what was arguably a fairly irresponsible fashion, too, and certainly contrary to good practices of giving the person in question a chance to correct their action[2].

On a more serious note, I had no *idea* that so many of your common or garden anti-feminist arguments were specific examples of something generalisable to beyond the various -isms until I encountered Mono and Microsoft advocacy. It’s really quite bizarre. Probably shouldn’t be; there’s nothing new under the sun, after all, and they had to have come from somewhere originally.

[1] I don’t actually buy this argument myself, for various reasons, but judging GPL violations while not owning the copyright is certainly far, far simpler to get right than judging sexism while male.
[2] Actually, this is a bit of a stretch – the free software community doesn’t have any sort of standard practice for dealing with sexism. If it did, that would probably be worth considering, though. Being accused of sexism, especially publicly, seems to put people’s backs up and make dealing with the issue harder.

Comment by Lefty
2009-07-29 13:11:20

Sorry, James: makomk here, frustrated in his efforts to rant in my journal, Matthew Garret’s journal,,, and a variety of other places—only to find himself consistently told to “get lost”—seems intent on bringing himself wherever I happen to be with off-topic silliness.

Comment by James Vasile
2009-07-29 13:16:36

No worries. I don’t actually know how to ban anybody (and I have no time to RTFM), so I guess he’s found his safe space to spout off!

Comment by James Vasile
2009-07-29 13:15:27

makomk, this isn’t the right forum for addressing Lefty’s life of gleeful sin.

Still, I’m all for open discussion about the ways our community fails to support and recognize the contributions of women, so if you have something positive to say on that topic, go for it.

Comment by makomk
2009-07-29 15:51:24

James Vasile: that’s a difficult question, and the problems extend well beyond the community itself. IIRC, there’s a sort of “thinning down effect” – a minority of the people who take computer science courses are female, an even smaller proportion of those who go on to program seriously are, and the proportion amongst open source developers is smaller still. This is consistent with sexism at every level, and I don’t see any sort of easy solution.

For a few brief seconds, I hoped the RMS thing was a sign that the community had made real, substantial progress on some of the underlying issues. Alas, no, though it does seem to have made some progress. Unless, of course, the pornification of presentations is a new trend, in which case it may actually have taken a step back at the same time. Bleh.

Besides, other people have far more interesting things to say than I possibly could – for example – and in terms of stand-out efforts, I’m particularly impressed by Dreamwidth, which is majority-female in terms of the number of programmers.

(In more on-topic matters that I can’t post on Lefty’s blog, he’s also wrong to say that “If Bradley hasn’t received a copy of the Hyper-V drivers, from Microsoft, through legitimate channels, he’s got no standing to be requesting sources”. If you go for the “giving source on request” option, the GPL requires you to give the source to any third party that asks for it. Basically, his entire understanding of the GPL is dodgy. I also ran across this earlier, when he banned someone from his blog for – correctly – claiming that the GPL is “Its either all of us, or none of us”, the purpose of section 7.)

Also, I have only a loose idea what’s going on in the community these days, and I’m not sure I want to know more. It kinda scares me in general, especially the Mono advocacy stuff.

Comment by James Vasile
2009-07-29 16:03:06


The thinning down effect is a red herring. Even accounting for there being more men in software dev than women, the free world is doing an abysmal job. See here.

I have no solutions to offer, but I do believe things start with a conversation that correctly describes the present condition. In too many places, I hear either denial or its cousin, a reference to this thinning effect. It’s time for the free world to admit it: We’re bad at recruiting and recognizing and supporting women.

I hope we’re getting better at it, but there is not currently any way to defend the position that there is nothing more we can/need to do.

Comment by makomk
2009-07-30 03:33:28

James Vasile: oh yes, the free software world is definitely much worse than proprietary software when it comes to the percentage of women programmers. It’s still far from obvious what to do about it; just removing the sexism from the community, while a necessary (though very hard) step, seems unlikely to work on its own.

Firstly, even with the sexism gone, the fact that the community is almost entirely male is likely to put female contributors off in itself; this is something of a chicken and egg problem. The obvious way to do something about that is to make a special effort to attract, welcome and support female developers *without being creepy about it*. The question, though, is how?

Secondly, developing software for the sake of it (rather than for a paycheck) is seen as a particularly geeky thing to do, and this is gendered as something male by society at large. While this is true of professional software development too, to a certain extent, I don’t think it’s quite as bad there.


Sorry, the comment form is closed at this time.