Josh Triplett: Free Software Optimist
byon December 18, 2018
This is part of our ongoing series on generous matching donors. With roots in the Debian community and a contributor to a number of free software projects, Josh is a passionate software freedom advocate. Working at a large company involved in free software has brought Josh a deep understanding if the issues concerning the corporate use of open source. Josh and several other outstanding individuals are joining Private Internet Access and a big anonymous donor in offering $90K in matching funds to Conservancy for our continued work to provide both support for important free software and a clear voice in favor of community-driven licensing and governance practices.
Deb: What's the most exciting thing you've seen recently in free software?
The Rust project. It's the first language with a credible ability to replace C anywhere you can use C, while providing all the features of a modern programming language and many pioneering innovations not yet seen elsewhere. And it's the most welcoming and energizing community I've ever been part of; it's an absolute joy to work with Rust and help it grow. Rust gives me so much hope for the future of computing.
Deb: Do you have a favorite Conservancy project and/or one that is indispensable to your own work?
Conservancy is home to so many incredible projects that it's hard to choose. I love Reproducible Builds and Outreachy, and the ways in which they continue to change the world. Reproducible Builds represents one of those ideas where the goal seems obvious and yet the execution requires an incredible and pervasive effort across the industry, and the people working on it have done an amazing job. Outreachy brings so many people into computing, provides wonderful opportunities, and in the process helps show projects how to be more inclusive. And QEMU and Git are both incredibly useful for me.
Deb: What do you hope to see Conservancy accomplish in the next five years?
Josh: I'd encourage many more projects to make Conservancy their home. The best time to join a foundation is before you need one, and Conservancy is the best possible home for almost any Free Software project. Apart from that, I'd love to see Conservancy succeed in its ongoing GPL compliance efforts, as well as continuing its many behind-the-scenes efforts to improve industry practices around FOSS. And Conservancy serves as the shining example of principles and good stewardship among FOSS foundations. I've seen what Conservancy can do at their current size; I'd love to see what Conservancy could do with more resources.
Deb: Anything else you'd like to add?
I'm thrilled to be able to sponsor Conservancy with this donation matching campaign. Please consider becoming a Conservancy supporter.
Check if your employer offers donation matching as well, which can make your donation twice as effective. And if you can, use a bit of your social capital within your employer to get them to support the home of so many projects you and they depend on regularly.
And if you have a Free Software project with more than one maintainer, consider joining Conservancy.
Matthew Garrett: Software Freedom Activist
byon December 13, 2018
This is part of our ongoing series on generous matching donors. Matthew Garrett is a security-focused developer and software freedom activist who received a Free Software Award for his work on Secure Boot, UEFI and the linux kernel in 2014. If you are not worried about the security of practically all your devices, it is only because you haven't seen Matthew speak about low-level vulnerabilities. Matthew and several other outstanding individuals are joining Private Internet Access and a big anonymous donor in offering $90K in matching funds to Conservancy for our continued work to provide both support for important free software and a clear voice in favor of community-driven licensing and governance practices.
Deb: What's the most worrying thing you've seen recently in free software?
Matthew: I'm concerned about the perception that it's impossible for development of free software to be financially self supporting, and that the only way to handle this is to develop new licenses that forbid certain use cases. There's a real problem where individual developers are left with little reward for developing code that giant commercial enterprises depend on, but we're largely seeing this push come from venture capital firms who just want a larger return on their investment. The free software community needs to come up with an answer to this that doesn't involve trying to extort money out of companies in order for them to be able to legally exercise the freedoms that free software should guarantee, but I don't know what that answer is yet.
Deb: What do you think non-profits are uniquely positioned to accomplish in free software?
Matthew: Non-profits are part of the solution to the above. Free software needs to be supported in order to prosper - and that means that someone needs to be able to provide resources to free software projects without being motivated by whether or not they can profit from the exercise. Conservancy is an example of an organisation that provides resources to and reduces friction for a number of free software projects, and it's hard to imagine a for-profit entity being able to achieve the same.
Deb: Is there a free software project that you wish existed but (as far as you know) no one has started working on?
Matthew: I'd love to see a free software TV stack. The majority of modern TVs run Linux, but there's no realistic way to replace most of the vendor provided code. The ability to provide a full featured, user controlled experience that improved upon the functionality provided by the manufacturer would be an amazing way to increase awareness of the power of free software, while also reducing the amount of personal information that users are currently giving up (frequently without even knowing what they're giving up!)
Deb: What do you hope to see Conservancy accomplish in the next five years?
Matthew: I'd love to see more projects under the Conservancy umbrella and for Conservancy to be a strong representative voice that can push back against the profit-oriented arguments against free software that are becoming louder.
Please take a minute to help Conservancy continue to spread the good news about free software and meet this exciting year-end match, today!
Matthew Garrett "You're not even a wiki" is available under a CC BY-SA 4.0 license, from Wikipedia by tef.
Copyleft Conf Venue Announced!
byon December 12, 2018
We are excited to announce the venue we'll be using for Copyleft Conf. The one day event will take place in downtown Brussels at DigitYser, Boulevard d’Anvers 40, 1000 Bruxelles. The venue is a bit northeast of Grande Place. Participants can choose to walk, take the train to the Yser stop or use one of Brussels' many buses.
The first ever Copyleft Conf is happening in Brussels on February 4th, aka the Monday after FOSDEM. This event will provide a friendly and safe place for discussion of all aspects of copyleft -- developers, strategists, enforcement organizations, scholars and critics are all welcome.
The event starts at 9:30am and will finish at 6pm.We'll be providing coffee throughout the day and lunch for those who pre-register for the event. We will accommodate vegetarians and vegans and people with other dietary restrictions should get in touch with us. Registration will open in about a week, which should come pretty close to the date when we hope to have a preliminary schedule to share with you.
If you have questions about Copyleft Conf, including questions about attending, volunteering with or sponsoring, please email email@example.com
Copyleft compliance misconception #2: Anyone can easily fix the incomplete source releases that companies provide
byon December 11, 2018
This post is part of a series on copyleft compliance misconceptions. For our previous post, see Copyleft compliance misconception #1.
As Conservancy's FLOSS License Compliance Engineer, I receive many reports of copyleft noncompliance every week, and the people reporting them are often rightly concerned that the compliance issues are not fixed quickly. These issues often arise on devices such as media players, Android phones, broadband routers, and even vehicles. In each case there is some copylefted software that a user wishes to inspect or modify (which is their right, according to both the license and the morality of software freedom) but they are unable to, due to noncompliance. Usually, those who understand software observe noncompliance as a real-world, practical problem of incomplete (or entirely missing) source code and build information.
In the course of resolving these copyleft noncompliance incidents, Conservancy normally receives a candidate source release (or "CCS (Complete Corresponding Source) candidate") from the company whose device or product is out of compliance. You might think that it is a straight-forward task for us to then to bring that CCS candidate into compliance with a few fixes. Unfortunately, that is normally not the case. There are a variety of reasons for that, which no one can resolve themselves without assistance from the software distributor. I've outlined the most common problems here in hopes that companies (and others) who wish to do right and comply correctly with copyleft licenses can make their own fixes earlier -- ideally before shipping a product at all, but at the very least, quickly at the time they are first contacted about a compliance problem. Learning about these issues and being prepared before a compliance problem is found can make a big difference! For example, clauses like GPLv3§8, the Linux Kernel Enforcement Statement, and Red Hat's Cure Commitment have a very short window of 30 days to fix violations. It's rare these days that companies get their CCS in order in 30 days after a violation is reported, but following the advice below could definitely change that!
We don't stand on ceremony with regard to copyleft compliance; our goal in any copyleft enforcement action is to bring whatever of our own (meager) resources to bear to aid a company in producing compliant CCS. In an ideal world, we'd just provide patches or a list of fixes when receive the first "round" (as we call it) of CCS candidates.
Trying to do this, in fact, is a big part of my job. When I evaluate a candidate source release for correctness, I normally create a list of suggested fixes (often including patches the company can programmatically apply) alongside the list of issues that I send to the company if I find the source release is incomplete. I then send these lists to the company in the hope that they will take our suggestions and fix their source release.
However, the result of sending the list of issues and associated fixes seldom results in the company responding with a source release that is complete and correct (especially in the case of a first "round" check). Over the years, I've noticed the causes for this generally tend to fall into one of these categories:
A. The company believes they don't need to provide source that is derivative of and/or has been combined with work licensed under a strong copyleft license like GPL
Thankfully, this situation is relatively rare, but it is probably one of the more public causes for incomplete source that people are aware of (see, for example, Christoph Hellwig's case against VMware that Conservancy is supporting and (partially) funding). In this case, Conservancy has notified the company that their source release is missing source code for certain binary files that are derivative of a copylefted work. Normally this comes up with driver modules for the Linux kernel -- the company does not wish to release (or does not have, because their upstream failed to provide) the source code for a driver they are shipping, but the driver is clearly combined with Linux. We generally try to find out who provided the driver to the company to begin with, and then follow up with them to try and obtain the source code.
In this situation we are naturally blocked from achieving complete corresponding source, as part of the source is clearly missing and the company is refusing to provide it to us. Short of reverse engineering their driver, this is no way for Conservancy or anyone else, other than the authors of the proprietary driver, to provide a fix for this situation.
The best approach for companies in this situation is to assure at the time they source a product that no proprietary Linux modules are involved. Often, downstream companies don't invest the resources to hire their own engineer (or a third-party engineering service organization) to rebuild their Linux-based firmwares from scratch. We strongly recommend anyone building Linux-based products do this, as problems like this can easily be found before you make a deal with an upstream vendor. While in this negotiating phase, the vendor will want your business so you'll have a lot more power to get the upstream vendor to provide CCS and even to indemnify you down the road if there turns out to be a problem, as described in D, below.
Solving this problem admittedly needs more lead time than any of the others. Fortunately, there are many (and more common) situations that come up, and while they don't generate impasse, a basic approach of "planning ahead" can go a long way to avoid repeated attempts at compliance.
B. The company applies one or two of the fixes then sends back a new known-incomplete candidate
One of the most common causes of a company not correcting its source release in the first "round" of CCS checks is simply that they did not implement all of the fixes we provided to them. This wastes both their time and Conservancy's, since anyone reviewing that "round" needs to figure out which fixes they implemented and which they didn't, and then send back a new report to them highlighting the fixes that were already provided in the last report. Then the company needs to go back and (hopefully) implement more of the fixes to send yet another candidate back to Conservancy.
Conservancy has tried to determine why this cause of incomplete source is so common, but unfortunately few past violators are able to explain clearly why this occurs. We suspect that the number of fixes that a company needs to make feels overwhelming to them so they simply don't bother with most of them. Or perhaps they think we won't notice that they only implemented a few of the fixes; we have seen situations where individuals who complain about CCS to a violator often run out of time and patience seeking corrected CCS, so perhaps these companies have misunderstood that incomplete CCS to be satisfactory merely because the individual never followed up. In any case, we hope that by highlighting this problem in blog posts like this, it might become less of a problem in the future.
C. The company fixes all the issues we highlighted, but there are new issues in their candidate
This is perhaps the next most common cause of a company not providing a complete source release on their second try, but is less insidious. An example of where this might happen is when a source release clearly requires a cross-compiler in order to build, but the company does not specify which one (and the code makes it difficult for Conservancy to guess, so Conservancy can't attempt to use a potential cross-compiler itself). When the company does respond with the name of the cross-compiler they used (or the source and binaries of the cross-compiler itself), Conservancy often then finds a number of issues with the rest of the source that cause the build to fail even when the correct cross-compiler is used.
There are a range of other reasons for this (such as a component that now builds revealing that a dependent component never built properly to begin with), but all result in the same outcome: additional rounds of CCS checking that cause Conservancy and the company to expend significantly more time on trying to resolve the problem. Naturally, this problem is exacerbated when combined with B above, which we see much more often than we'd like.
D. The company is as frustrated as we are, but has been intimidated by their upstream.
We have some degree of sympathy for many violators we encounter, because we know their upstream vendors are the bad actors and they've been caught in the middle. By the time an embedded Linux electronics product makes it to the mass market -- when a user might purchase it and report a violation -- the name-brand vendor has made various complex business deals with one or more upstream vendors. Those upstream vendors often knowingly violated the GPL on Linux, but do not inform their customers about the presence of Linux, or the incompleteness of the firmware sources. Most downstream vendors never rebuild the main firmware; they develop a user-space application on top of it quickly and push it to market. When the violation is discovered, the main vendor is in a very weak negotiating position, and fears problems for future products. Many violators have lamented to us this difficult problem, but are confused about what to do about -- they simply become stuck in the middle sending us CCS candidates from an upstream vendor who has already decided to violate the GPL knowingly and willfully.
Conservancy has tried many creative solutions to this problem, including asking the violator to join us in informal or formal legal action against the bad actor. Sadly, few companies care enough about the GPL to take this stand, and we're often left with incomplete CCS and an indefinitely continuing GPL violation. This is what occurred with Tesla, which is why we applauded them for going public with this as they try to address their ongoing GPL violations of incomplete source.
It is extremely rare for me to find that a company has fixed all of the problems in their source release on the first attempt, even when I provide a complete list of all the problems and patches to fix each of them. That's why I wanted to highlight some of the causes for this that we normally see, both so that people using copylefted software in devices they've bought know what we're up against, and so that companies are aware of the common pitfalls and can correct their source releases accordingly.