10

If this question is about what we are supposed to do if someone is breaking the terms of a software license, I would like to know how I can know if some is doing so.

Suppose that I'm writing a software with a GPL license. It is a copyleft license. It is not allowed to use the code in a non-free licence. But, in practice, if someone uses this code in a non-open source software, how can I detect that?

10

There may be a number of ways, but there is no guarantee.

If you have enough certainty, you could start a legal case and ask for sources to be disclosed. This in fact happened in the SCO case.

If you can reverse-engineer the code, and show that it has non-trivial code that is exactly like yours, that would help. Whether it would convince a judge and a jury is another matter. Note that reverse engineering someone else's code may be illegal.

You could also have inside information from the people who were involved in using your code in a non-open environment - whistleblowers or snitches, depending on where you stand on the issue.

And you could look for behaviours that are characteristic for your code, although this is unlikely to be successful. As a wild example, you could put an Easter egg in your code and see if it shows up with the code from the license-breaker as well. This is tricky, however, as the nature of open source is that easter eggs are easier to find and remove.

  • At what point was there certainty about anything in the SCO case? – Soong Aug 8 '15 at 10:28
  • 1
    @Soong: I think the demand to show the sources happened in the SCO case. – Mnementh Aug 8 '15 at 10:59
  • I haven't heard about SCO before. How ever, it looks that it was Unix system and Linux system. SCO attacked IBM (with Linux) to use code of Unix without paying the license. I suppose that it was open source, so easier to find what kind of code was used or not. When the code is not opened, it looks more difficult... Have you some examples where a free software developers have detected a non-allowed using on their code ? – Nairolf21 Aug 8 '15 at 11:42
  • 1
    @Nairolf21 The point of the example is if you have enough suspicion to be willing to file a lawsuit and get to discovery, you can force the alleged infringer to give you relevant portions of the source code. This is how you'd likely get the evidence to prove it in the actual trial. For an example, a Busybox dev sued Verizon for using it in routers without providing source (and dropped it when Verizon complied with the license) – cpast Aug 8 '15 at 15:11
  • @cpast How FOSS developer can have suspicion ? How, technically, suspicion can come ? S.L. Barth talked about Easter Egg, it can be a way. I presume that if you find a tricky bug in your software, and the bug is also present in a closed software, it can create suspicion. There is another way ? I don't think there is a lot of whistleblowers, what do you think ? – Nairolf21 Aug 8 '15 at 23:29
5

Practically speaking, in general, you can't.

By 'in general', I mean, 'you are part of the 99.99% of people who post up something with a FLOSS license.' You will have some users scattered all over creation. You will have no visibility into what they do. You may well have someone who uses your code in violation of the license.

If you are in the unusual .01% (numbers invented) you have created something with tremendous impact on the marketplace, like MySQL or Linux or the like. In which case, you might end up noticing some inappropriate use. See, for example, BusyBox.

The detection mechanism here is not technical. How could it be? Starting from the source, a bad actor can remove anything you leave in place to try to detect usage. Rather, it depends on (a) wide usage, and (b) conspicuousness, such as, well, a shell.

If you post some clever image analysis algorithm, and someone adapts it and incorporates it inappropriately, you have very limited means of noticing.

  • Ok, no technical way to detect that. So free licenses as GPL are protected by the law, but without any evidence, you can't do anything. – Nairolf21 Aug 8 '15 at 18:07
  • Just like book copyrights. Someone could repro your book and use it in all kinds of license-violating ways, but with a modicum of discretion you'd have no chance to catch up with them. Perhaps you'd care to edit your question to explain what practical problem you want to solve by enforcing your license? – bmargulies Aug 8 '15 at 18:08
  • I don't have a practical problem. I just want to know the free license are protected in practice. However, I have worked in a aircraft manufacturer, they have to success a quality examen of their code. A quality review is done by an independent company. And, but I'm not sure, that they use a parser to see if they use software that they are not allowed to use. Why something like that could not be generalized ? – Nairolf21 Aug 8 '15 at 18:15
  • 1
    Read up on 'Black Duck' which provides a service of scanning for people who want to comply. Remember, all of FLOSS is based on copyright law. No international conference sat down and tried to help you enforce your license. Legal systems came up with whatever they came up with for copyright, and then people apply it to software. – bmargulies Aug 8 '15 at 21:30
  • Yes, FLOSS is based on copyright law. But, in practice closed software are more protected because the code is closed. Nobody can know if a copyleft license code have been stolen. There is some software tools to struggle against plagiarism. That could be great if a software like that could be used (as Black Duck) to certify, before being sold, if commercial closed sources are using copyleft source code. – Nairolf21 Aug 8 '15 at 23:24
2

You generally cannot practically detect (most) license violations -since detecting such violations is labor intensive-, in particular if you are a small entity (or a single person); e.g. you won't be able to detect that some obscure Chinese hardware manufacturer is modifying your GPL code and putting it (without publishing the modification) in some firmware.

If you did detect a license violation, you might have hard time to stop it (e.g. you might need to go to a trial and give a proof -or at least a legitimate & persuasive explanation- of that violation).

On the other hand, a big corporation probably won't risk such violation. Some former disgruntled employee might denounce that, and the bad publicity would be very harmful.

Some organizations are motivated and powerful enough to detect such violations (e.g. http://gpl-violations.org/ which is currently nonreachable, or perhaps the FSF). There is even some French startup (I forgot its name, the founders are from INRIA) which has developed some (proprietary) tools to scan executables -e.g. searching message strings & symbol names in them and matching them against a database- to find such violations (and license incompatibilities).

  • This french tool looks great (especially if it scans executables) ! Badly, it's a proprietary tool.... Do you think you could remind the name of this tool one day ? – Nairolf21 Aug 12 '15 at 19:23
  • I am on vacation, so cant find it now ; perhaps I will edit my anwer when back home or at office and when I remember it. I listened to some talk at IRILL from them... IIRC, that startup is selling services (similar to software audits) – Basile Starynkevitch Aug 12 '15 at 19:26
  • That's okay. As I said, it's a theoretical question, I don't have a practice case to solve. So, yes, if you remember the name of this company, I would like to know. Thank you. – Nairolf21 Aug 12 '15 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.