Displaying posts tagged GPL
Compliance Feedback Sessions in 2017
byon January 13, 2017
While we continue our principled defense of copyleft software on behalf of developers who ask us to do it, Conservancy is committed to examining whether we’re doing things the best we we can. As we publicly promised, we’ve been running feedback sessions on GPL compliance to hear from everyone who is interested in our work.
Bradley conducted a session at Embedded Linux Conference Europe and Brett and I ran one at Linux Plumbers Conference. Both were informative and, honestly, reassuring. While there are some areas we can improve (as a free software organization, we know we can always improve!), our fundamental approach is sound and seems to be in line with what developers and other stakeholders would like us to be doing. Of course, we also have received some mixed messages. Some people strongly criticize us for not being aggressive enough, while others think our rhetoric is a little too strident. What’s been great is to have everything on the table and get people involved. As a public charity, we want to be sure that we are in fact acting in the public’s interest in everything we do.
We’ve got another feedback session scheduled next week at the Linux Kernel Miniconf at linux.conf.au on Monday afternoon. If you’re there I hope you’ll join us. I’ll also be facilitating a fishbowl discussion on GPL compliance at the Legal & Policy Miniconf Tuesday morning. Please let us know if you have any other suggestions for where we should hold more feedback sessions. We’ve been trying to strategically propose these sessions where they’ll be the most effective (we did propose a feedback session with an eye towards getting key corporate leadership feedback at the upcoming Open Source Leadership Summit, but the session was unfortunately not accepted). Other conferences we’ll be at this year include FOSDEM, Campus Party Brasil, SCaLE, LibrePlanet and OSCON. We’ll have a booth at most of these, so even if we don’t have a session please just stop by our booth and tell us what you think!
Lastly, I’d be remiss if I didn’t mention that there are only days left for us to earn our generous match from Private Internet Access. We’ve made great progress, but we’re only about 70% there! Please sign up as a Supporter - you’ll be donating to the support of our many member projects, copyleft defense, diversity work via Outreachy as well as the overall promotion and advocacy of free software. There’s still time for your donation to be amplified, but only if you sign up now!
Come see Conservancy at linux.conf.au 2017
byon December 5, 2016
Are you coming to linux.conf.au in January? So are we! We’re presenting a variety of sessions, so whether you’re just starting to learn about free and open source software, or a seasoned contributor who wants to hear about cutting-edge issues, we’ve got something for you.
On Thursday Karen and Bradley offer A Practical Guide to Compliance with the GNU GPL, a pragmatic tutorial on how to comply with the most popular FOSS license. The focus is on providing concrete actions you can take to comply. There’s something for everyone who works with GPL’ed software, whether you’re an upstream contributor, distributor, or lawyer.
On Friday Karen presents Surviving the Next 30 Years of Free Software. As the FOSS community matures and time marches on, we’re starting to see cases where a contributor passes away and a project has to work out legalities with their estate. Karen will explain the law in this area, and suggest next steps for projects and the broader community to make these transitions easier.
As part of the Kernel Miniconf, we’ll also run another feedback session about our GPL Compliance Project for Linux Developers. Just like the sessions at ELC EU and LPC, this is your opportunity to hear more about what the program does, how it works, ask questions, and offer ideas for improvement. All interested contributors are welcome to attend. We’ll announce schedule details as they’re available.
We’re looking forward to seeing everyone in Hobart!
Recap: GPL Compliance BoF at Linux Plumbers’ Conference
byon November 16, 2016
At the Linux Plumbers Conference a couple of weeks ago, Karen and I ran a Birds of a Feather session about our GPL Compliance Project for Linux Developers. It was a success by every measure. Approximately seventy people attended, and about twenty of them participated in the discussion, covering a wide variety of issues around compliance. The interactive and inclusive format was ideal for us to provide additional information and get feedback from a lot of interested people. Many thanks to the Linux Plumbers Organizing Committee for scheduling a slot for us to run this session.
We opened the discussion with a basic overview of the program: its history and mission, the structure of how we coordinate with Linux developers on our coalition, the typical flow of how we respond to a violation and work to help the distributor comply. We published the project agreement templates beforehand to facilitate the discussion. In the past, we heard people express concern that these agreements were private. We were happy to tackle that issue head-on, and I was glad to see several attendees download the template and review it during the session.
We also talked about how our work differs from some inappropriately aggressive enforcement efforts going on today—including Patrick McHardy's unfortunate enforcement lawsuits. One person rightly pointed out that less savvy distributors will often assume all GPL compliance is handled the same way. We discussed how Conservancy could emphasize the distinctions up front. We agree that's important; it's why we published our Principles of Community-Oriented GPL Enforcement, and why we were the first organization to publicly criticize McHardy's actions. Still, a new Linux distributor might not know about our principles, or understand that they specifically call on lawsuits only as a last resort. Based on this feedback, we plan to mention the Principles in our first correspondence about GPL compliance problems.
Our transparency in our methods and goals distinguishes Conservancy's compliance work from others'. There were several suggestions that we could take this further by publishing different numbers about how many cases we're handling, and different ways they've been resolved. To this end, Karen echoed the same point Bradley made at ELC EU that we only have the resources to pursue a relatively small percentage of the violation reports we receive. Because of this, publishing these numbers could de-anonymize active cases, which would contravene our compliance principles. Nonetheless, we will reexamine this issue to see if we could publish some numbers safely.
That discussion led to suggestions that volunteers could help us with technical compliance work, confirming violations and the completeness of source code. We've discussed that idea internally for many years. Even more than publishing numbers, engaging volunteers risks leaking information about violators to the public. Furthermore, we would need to vet and train volunteers, which we lack the resources to do now. If we received funding for this work, we could use that to plan and provide volunteer training, but there has been limited interest in funding community-oriented compliance initiatives.
Finally, we discussed different ways to make compliance work less necessary. We'd love to see more of this: as more distributors proactively come into compliance, we have more time to spend supporting our member projects and other initiatives. That's a big reason we helped write the Copyleft Guide, which helps distributors better understand the conditions and requirements of the GPL. The pristine source example, in particular, is designed to show step-by-step the process of verifying a complete, corresponding source release. There's certainly lots of great ideas for more work like this, and I think naming them in the BoF helped make some good connections between them.
Our thanks to everyone who attended and provided feedback. If you couldn't attend this BoF, don't worry. We'll be running similar sessions at other conferences over the next few months, and you can also provide feedback on our principles-discuss mailing list. We want to hear from as much of the community as possible, so if you have questions or comments about our Linux compliance work, we hope we'll hear from you soon.
Conservancy's First GPL Enforcement Feedback Session
byon October 27, 2016
As I mentioned in an earlier blog post, I had the privilege of attending Embedded Linux Conference Europe (ELC EU) and the OpenWrt Summit in Berlin, Germany earlier this month. I gave a talk (for which the video is available below) at the OpenWrt Summit. I also had the opportunity to host the first of many conference sessions seeking feedback and input from the Linux developer community about Conservancy's GPL Compliance Project for Linux Developers.
ELC EU has no “BoF Board” where you can post informal sessions. So, we scheduled the session by word of mouth over a lunch hour. We nevertheless got an good turnout (given that our session's main competition was eating food :) of about 15 people.
Most notably and excitingly, Harald Welte, well-known Netfilter developer and leader of gpl-violations.org, was able to attend. Harald talked about his work with gpl-violations.org enforcing his own copyrights in Linux, and explained why this was important work for users of the violating devices. He also pointed out that some of the companies that were sued during his most active period of gpl-violations.org are now regular upstream contributors.
Two people who work in the for-profit license compliance industry attended
as well. Some of the discussion focused on usual debates that charities
involved in compliance commonly have with the for-profit compliance
industry. Specifically, one of them asked
how much compliance is
enough, by percentage? I responded to his question on two axes.
First, I addressed the axis of
how many enforcement matters does the GPL
Compliance Program for Linux Developers do, by percentage of products
violating the GPL? There are, at any given time, hundreds of
documented GPL violating products, and our coalition works on only a tiny
percentage of those per year. It's a sad fact that only that tiny
percentage of the products that violate Linux are actually pursued to
On the other axis, I discussed the percentage on a per-product basis.
From that point of view, the question is really:
Is there a ‘close
enough to compliance’ that we can as a community accept and forget
about the remainder? From my point of view, we frequently compromise
anyway, since the GPL doesn't require someone to prepare code properly for
upstream contribution. Thus, we all often accept compliance once someone
completes the bare minimum of obligations literally written in the GPL, but
give us a source release that cannot easily be converted to an upstream
contribution. So, from that point of view, we're often accepting a
less-than-optimal outcome. The GPL by itself does not inspire upstreaming;
the other collaboration techniques that are enabled in our community
because of the GPL work to finish that job, and adherence to
the Principles assures
that process can work. Having many people who work with companies in
different ways assures that as a larger community, we try all the different
strategies to encourage participation, and inspire today's violators to
become tomorrow upstream contributors — as Harald mention has already
That same axis does include on rare but important compliance problem: when a violator is particularly savvy, and refuses to release very specific parts of their Linux code (as VMware did), even though the license requires it. In those cases, we certainly cannot and should not accept anything less than required compliance — lest companies begin holding back all the most interesting parts of the code that GPL requires them to produce. If that happened, the GPL would cease to function correctly for Linux.
After that part of the discussion, we turned to considerations of corporate contributors, and how they responded to enforcement. Wolfram Sang, one of the developers in Conservancy's coalition, spoke up on this point. He expressed that the focus on for-profit company contributions, and the achievements of those companies, seemed unduly prioritized by some in the community. As an independent contractor and individual developer, Wolfram believes that contributions from people like him are essential to a diverse developer base, that their opinions should be taken into account, and their achievements respected.
I found Wolfram's points particularly salient. My view is that Free Software development, including for Linux, succeeds because both powerful and wealthy entities and individuals contribute and collaborate together on equal footing. While companies have typically only enforce the GPL on their own copyrights for business reasons (e.g., there is at least one example of a major Linux-contributing company using GPL enforcement merely as a counter-punch in a patent lawsuit), individual developers who join Conservancy's coalition follow community principles and enforce to defend the rights of their users.
At the end of the session, I asked two developers who hadn't spoken during
the session, and who aren't members of Conservancy's coalition, their
opinion on how enforcement was historically carried out by
gpl-violations.org, and how it is currently carried out by Conservancy's
GPL Compliance Program for Linux Developers. Both responded with a simple
it seems like a good thing to do; keep doing
I finished up the session by inviting everyone to the join the principles-discuss list, where public discussion about GPL enforcement under the Principles has already begun. (Note: discussion about this specific feedback session can be found on the thread on the list that starts hereI also invited everyone to attend my talk, that took place an hour later at the OpenWrt Summit, which was co-located with ELC EU.
In that talk, I spoke about a specific example of community success in GPL enforcement. As explained on the OpenWrt history page, OpenWrt was initially made possible thanks to GPL enforcement done by BusyBox and Linux contributors in a coalition together. (Those who want to hear more about the connection between GPL enforcement and OpenWrt can view my talk.)
Since there weren't opportunities to promote impromptu sessions on-site, this event was a low-key (but still quite nice) start to Conservancy's planned year-long effort seeking feedback about GPL compliance and enforcement. Our next session is an official BoF session at Linux Plumbers Conference, scheduled for next Thursday 3 November at 18:00. It will be led by my colleagues Karen Sandler and Brett Smith.