Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
If this question is about what we are supposed to do if someone is breaking the terms of a software license, I would like to know how I can know if some is doing so.
Suppose that I'm writing a software with a GPL license. It is a copyleft license. It is not allowed to use the code in a non-free licence. But, in practice, if someone uses this code in a non-open source software, how can I detect that?
There may be a number of ways, but there is no guarantee.
If you have enough certainty, you could start a legal case and ask for sources to be disclosed. This in fact happened in the SCO case.
If you can reverse-engineer the code, and show that it has non-trivial code that is exactly like yours, that would help. Whether it would convince a judge and a jury is another matter. Note that reverse engineering someone else's code may be illegal.
You could also have inside information from the people who were involved in using your code in a non-open environment - whistleblowers or snitches, depending on where you stand on the issue.
And you could look for behaviours that are characteristic for your code, although this is unlikely to be successful. As a wild example, you could put an Easter egg in your code and see if it shows up with the code from the license-breaker as well. This is tricky, however, as the nature of open source is that easter eggs are easier to find and remove.
Practically speaking, in general, you can't.
By 'in general', I mean, 'you are part of the 99.99% of people who post up something with a FLOSS license.' You will have some users scattered all over creation. You will have no visibility into what they do. You may well have someone who uses your code in violation of the license.
If you are in the unusual .01% (numbers invented) you have created something with tremendous impact on the marketplace, like MySQL or Linux or the like. In which case, you might end up noticing some inappropriate use. See, for example, BusyBox.
The detection mechanism here is not technical. How could it be? Starting from the source, a bad actor can remove anything you leave in place to try to detect usage. Rather, it depends on (a) wide usage, and (b) conspicuousness, such as, well, a shell.
If you post some clever image analysis algorithm, and someone adapts it and incorporates it inappropriately, you have very limited means of noticing.
You generally cannot practically detect (most) license violations -since detecting such violations is labor intensive-, in particular if you are a small entity (or a single person); e.g. you won't be able to detect that some obscure Chinese hardware manufacturer is modifying your GPL code and putting it (without publishing the modification) in some firmware.
If you did detect a license violation, you might have hard time to stop it (e.g. you might need to go to a trial and give a proof -or at least a legitimate & persuasive explanation- of that violation).
On the other hand, a big corporation probably won't risk such violation. Some former disgruntled employee might denounce that, and the bad publicity would be very harmful.
Some organizations are motivated and powerful enough to detect such violations (e.g. http://gpl-violations.org/ which is currently nonreachable, or perhaps the FSF). There is even some French startup (I forgot its name, the founders are from INRIA) which has developed some (proprietary) tools to scan executables -e.g. searching message strings & symbol names in them and matching them against a database- to find such violations (and license incompatibilities).
