BMW Australia Refusing to Comply with Terms of GNU Public License

https://gist.github.com/duncan-bayne/fc3213d4a0eabb70bb1e

by jordigh • 10 years ago

534 209 10 years ago

gist.github.com

jwildeboer• 10 years ago

History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite.

Hand this over to the Free Software Conservancy or the SFLC. And that should have been the first step.

Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm

coldpie2• 10 years ago

Yeah, it's pretty clear the suit has no idea what they're talking about. I don't know if SFC operates in Australia, but probably they could get some attention from the US division of BMW.

Speaking of which, the SFC is currently running a fundraiser. If GPL enforcement is important to you, please consider signing up for a recurring donation. http://sfconservancy.org/

ryao2• 10 years ago

Are there any organizations that pursue GPL violations that would stick to clear-cut cases of GPL violations where there is strong concensus among OSS developers that violations have occurred like the BMW case?

For full disclosure, I am one of the ZoL developers. I believe that ZoL can prevent certain types of storage related failures that other production solutions do not, including those on systems intended to keep people alive. My desire to see that has required that I make an effort to understand what the GPL permits and what it restricts. So far, my talks with lawyers have suggested that my (and others') work in ZoL is legally alright under copyright law.

The SFC considers easy access to ZoL binaries to complicate their arguments in certain GPL enforcement cases and rather than accept that reality to the benefit of the wider community, the SFC has opted to claim that ZoL binaries as distributed by Canonical are themselves a GPL violation. While I want to see the BMW case litigated, wanting to see GPL violations litigated and contributing to an organization that calls any use of OSS a GPL violation whenever it perceives the possibility of a court agreeing that claim to make litigation of certain cases of actual violations slightly easier are two different things.

matt40772• 10 years ago

I think that argument may have used to make sense in the 90ies when open source was new and was trying to establish itself, mostly with a dream of "Linux on every desktop".

Now it has found its market and the ecosystem as a whole really couldn't give a damn if BMW is kind enough to use OSS or not.

jackhack• 10 years ago

Respectfully, I don't think this is about 'kindness.' This is about BMW, a commercial entity, respecting the legal rights of the property creators as owners. The license agreement is clear, and certain actions must take place if BMW chooses to benefit from use of the software. BMW is free to NOT use the software if they feel these restrictions are too severe.

Or am I missing something?

cnvogel• 10 years ago

I don't see any shame and blame yet. The only thing these emails show is the claim by BMW that no software not developed or fully owned by BMW is running on their cars infotainment system.

A shame and blame game would start when one analyzes the software updates, is able to prove that the above statement is a lie, and make a big fuzz about it. This would BMW fear loosing their face and be counter productive, I fully agree.

jMyles• 10 years ago

History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite.

Is this true?

cookiecaper• 10 years ago

I disagree. The fact is that large companies like this are never open to "civil discourse and cooperative solutions" when it comes to copyright, trademark, or other intellectual property matters. BMW will see no reason to comply with the GPL. The only thing a big company responds to on such issues, other than bona fide legal action, is negative press. I think it'll be difficult to manufacture some over the technicalities of copyright compliance, but can't blame OP for trying and not wasting his time trying to navigate the corporate copyright labyrinth.

Source: I have a C&D from a Fortune 500 alleging that I violated some intangible rights. Their argument is weak, but I don't have the millions of dollars every lawyer I've talked to has said I'll need to see the case through (tens of thousands to even get started). I've spent 6 months trying to navigate their corporate structure and get in front of someone who matters. Everyone just tells me to sod off, with varying degrees of politeness. I have not yet been able to locate someone in the company who actually seems willing to have any discussion, and their law firm is obviously not open to this since their instructions were to shut me down. I'm considering the alternatives I have, and wondering if it's time to try to work the media and attempt to get some movement from them that way (though I don't really think this will work, it's becoming the only option).

godzillabrennus2• 10 years ago

Post your story online and use something like thunderclap to get more awareness through your network.

lucb1e9• 10 years ago

History has proven over and over again that naming and shaming works miracles. Companies that turned a blind eye and were completely unreachable suddenly turned active and kind just to save their reputation. Going to or even just threatening to go to the media, I know from experience, is indeed productive.

I am really curious where you got the idea that it's counter productive. Asking the conservancy to clean up this dirty work is expensive and takes forever.

leereeves• 10 years ago

Sometimes shaming works, sometimes it doesn't, and sometimes the mob is misinformed and crucifies an innocent.

akamaka• 10 years ago

The problem is when random people from the internet start unwarranted attacks over GPL violations when the problem can be dealt with constructively.

The example that pops into my head is the time when some kid start working on a mod to the Quake 3D engine that was possibly in violation of a free software license. Instead of just reporting it to the copyright holder (id Software), they engaged in a campaign of harassment until John Carmack himself came out and told them to stop. It was some seriously shameful shit.

Public shaming should be one of the last steps to take. Maybe before starting a lawsuit, or maybe after, that's up for debate, but certainly after other avenues have been exhausted.

TelmoMenezes• 10 years ago

History has proven over and over again that this kind of public shame and blame approach doesn't help in any way, quite the opposite.

Can you please provide some evidence for this statement?

Now that the bridges are burning, BMW will be far less open to civil discussion and cooperative solutions. Well done. #sarcasm

Depends on what your goal is. If your goal is to obtain the source code in this specific instance, and if you don't care about the efforts of open source contributors, then I guess it would make sense to privately "discuss" and "cooperate" with BMW.

On the other hand, if you want to scare companies into not stealing other people's work in the future, then I think naming and shaming is a reasonable strategy.

This is a clear case of rationalization about rules not applying to the powerful. Surely you would not expect BMW to care about "burning bridges" and value "cooperation" and "discussion" with you had they caught you stealing their IP.

dmm• 10 years ago

What GPL licensed software are they actually infringing upon? The linked post[1] says they found mentions of systemd, but does the firmware actually contain a linux kernel? I don't see anything that looks like a kernel in the file listing.

Also if the firmware is properly signed delivering it over http shouldn't matter, right?

[1] https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...

noselasd• 10 years ago

The specific update here is just a delta update, and doesn't contain the entire firmware. But it does contain shared libraries built for running on a linux system, so it stands to reason there's linux kernel running somewhere there.

(On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux)

cynix• 10 years ago

(On that note - have someone sent a similar request to Tesla - they've at least semi-officially said they're running Linux)

Yes, people have sent requests to Tesla, and they continue to ignore these requests to this day. See http://www.teslamotorsclub.com/archive/index.php/t-10748.htm...

dTal3• 10 years ago

semi-officially said they're running Linux

The Model S was independently confirmed to be running Linux 2 years ago:

http://www.teslamotorsclub.com/showthread.php/28185-Successf...

lucaspiller• 10 years ago

Apparently Mini (also made by BMW) has a similar update structure, and that runs QNX, so it's likely this does too:

http://rene.rebe.de/2013-03-31/mini-connected-runs-qnx/

m00dy• 10 years ago

check sum and signing are different methodologies.

Matthias247• 10 years ago

It's indeed a Linux system, and probably one of the first that BMW brought into market. It might also use GENIVI software components, which is an alliance for automotive linux software.

The carmakers are typically developing multiple systems in parallel by different suppliers. And even if they look similar from a customer perspective they might have been developed completely seperatly.

Namidairo• 10 years ago

A little bit of digging shows a 2014 BMW i3 claiming to run 2.6.32-28 in it's licences section.(STLinux)

However on the other hand there are numerous references of it having Tegra in media too...

sjwright2• 10 years ago

I suspect that modern BMWs have a multitude of interconnected computers potentially running different kernels. It wouldn't surprise me if different systems are running entirely different architectures.

_Codemonkeyism• 10 years ago

Poor customer support agent.

strictnein3• 10 years ago

I'm confused here. Where is the evidence that they've modified GPL'd software, which they are then distributing, and are refusing to distribute the source code for their modifications?

nailer• 10 years ago

Where is the evidence that they've modified GPL'd software

There's a Linux kernel and systemd in the 'i3'. See the links in the first few sentences of the article.

which they are then distributing

BMW is a Bayerische Motor Work, a car company that distributes cars

and are refusing to distribute the source code for their modifications?

The letters from BMW to the people asking for a copy of the source, stating they are refusing to distribute the source code for their modifications, linked to in the article.

strictnein3• 10 years ago

I read that, but isn't this is the lowest type of "violation" there is? People are just wanting them to host the source code that is already available in about a billion locations then?

My question still stands, is there evidence that they're modifying GPL'd code and then not distributing that code?

tome• 10 years ago

Not sure if this was the key part of your question, but they don't need to have modified it, they only need to have distributed it.

sudhirj• 10 years ago

Is it a violation if they don't modify Linux itself? So if I make a device that runs Linux and my application binary, am I required to make my application code public?

lucb1e9• 10 years ago

In that case, it shouldn't be a problem to point to Linux' code repository right?

ocschwar2• 10 years ago

And it won't be. But cut their public relations staff some slack. They can't tell Richard Stallman from Gregory Rasputin, and before saying or doing anything they're going to be bringing themselves up to speed on what the GPL is. No need to get rage-y just yet.

pyb• 10 years ago

It would not be a violation in this case.

iajrz3• 10 years ago

It is if they don't redist the kernel code they're using - if it's GPL'd, and you redistribute the binaries, you acquire the responsibility to redist the source.

cjbprime• 10 years ago

Yes, it actually is. People saying it isn't haven't read the license. :)

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

throwaway1252• 10 years ago

I think you might have misread the gp. gp asked

am I required to make my application code public?

tw04• 10 years ago

You wouldn't need to release the source to the app, just the underlying linux bits that are covered by GPL.

throwaway1252• 10 years ago

You are not required to make your application public as it is not considered a derivative of the linux kernel. If you distribute the device you are required to provide your customers with the source code to the running linux kernel.

The exact details depend on multiple factors (are you linking to libraries? Are they considered system libraries?) and if you are actually thinking of doing this you should invest some time in investigating this, and probably in consulting a lawyer.

Note that this is all based on my layman's understanding of the law and the license, and I'm definitely not a lawyer.

pjc502• 10 years ago

You're not required to make the application code public if it doesn't link against any GPL code. If it's just the equivalent of a Docker image containing a distro + your app, then all you have to do is distribute the source for the Linux parts of the image.

antocv2• 10 years ago

Has anyone ever seen GPL being encorced in any country?

Wont this end with BWM uploading a tar.gz of a kernel found on kernel.org and call it a good working day?

Have seen it happen too many times, and in most countries the user has no claim on the license/copyright.

So unless I contributed/own some copyright found in exact Linux kernel version/other software used by a distributor, and buy their stuff, there is zilch I can do.

Which also means, you are free to sell/and break GPL software/license and as long as you dont upset somebody who owns the copyright to it, you're good to go.

luso_brazilian• 10 years ago

Yes, and actually on BMW home country, Germany. The summary can be read at this old Slashdot submission [1] from 2005 but the gist of it is that

Harald Welte of the netfilter/iptables core team sought to enjoin Sitecom from distributing its WL-122 router, which used netfilter's GPL'd code, without also providing the source code and a copy of the GPL, as that license requires

and

The Munich Court granted Welte a preliminary injunction [2] and then upheld that injunction [3][4]

I believe there are other instances of GPL being upheld in courts around the world and this one should be only one of many examples.

GPL is not even necessary in these cases, in the absence of the (GP) license it reverts to the default copyright rules, with all rights of copy and distribution being at the hands of the copyright holders (save for Fair use and other exceptions).

A company that would try to argue that GPL is not a valid license in court would actually be admitting in court that they are distributing the software without a license from the copyright holders all along.

[1] Munich Court Again Enforces GPL: http://news.slashdot.org/story/05/04/14/2024258/munich-court...

[2] Preliminary injunction: http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=...

[3] Injunction upheld: http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=...

[4] Court's decision in English (pdf): http://www.jbb.de/judgment_dc_munich_gpl.pdf

darkr• 10 years ago

Yup, I can remember several companies settling and being forced to comply for violations of busybox GPL'd code in the US off the top of my head - Verizon, Extreme Networks and Xterasys. There are likely quite a few other examples of GPL being successfully enforced.

antocv2• 10 years ago

Wow refreshing good news(?), did not know about that. Awesome.

davidgerard2• 10 years ago

Has anyone ever seen GPL being encorced in any country?

... yes? Lots and lots.

There's a prominent case involving VMware versus Christoph Hellwig on right now: http://laforge.gnumonks.org/blog/20160225-vmware-gpl/

One manufacturer violation ended up with Busybox/SFC awarded a pile of the violating televisions ... http://arstechnica.com/information-technology/2010/08/court-...

realkitkat• 10 years ago

Here are some example cases that have ended up to courts of law [linksys][busybox][fortinet][vmware]. [linksys] http://tinyurl.com/l9zd7qo [busybox] http://arstechnica.com/information-technology/2010/08/court-... [fortinet] http://gpl-violations.org/news/20050414-fortinet/ [vmware] https://sfconservancy.org/copyleft-compliance/vmware-lawsuit...

castis• 10 years ago

What is the worst-case scenario for an entity that refuses to comply?

Kiro5• 10 years ago

Probably not much and that's why I don't put any licenses on my stuff.

Tyr42• 10 years ago

Refusing to put a licence on your code does stop people from using it. If you really don't care, just slap a MIT license on it and be done with it, no one will bother you afterwards.

umanwizard2• 10 years ago

So, you release code but don't let anyone use it? Because that's the legal effect of not putting licenses on your stuff.

godzillabrennus2• 10 years ago

I'm not a lawyer but I'd expect that if they lose in court they stand to be liable for damages that will far exceed compliance costs. It's in their best interest to just work toward compliance now.

bryanlarsen• 10 years ago

Worst case scenario is that a court issues an injunction halting distribution of the infringing product. This has happened in the past: https://news.ycombinator.com/item?id=11217620

fauria• 10 years ago

Harald Welte founded gpl-violations (http://gpl-violations.org/about/) 12 years ago. The have been offline for some time, but it looks like they plan to continue with their activities this year: "Actual GPL enforcement activity is expected to resume at some point in 2016." Maybe they can help sorting this out.

rattray• 10 years ago

Worth noting that the BMW people in the thread are in customer support, not legal.

SyneRyder4• 10 years ago

Looking through the user's Github account, they have a history of contacting customer support representatives of companies and threatening to post the transcripts to Hacker News if their specific legal concerns are not addressed:

https://gist.github.com/duncan-bayne/74d6e38c506000982237

pjc502• 10 years ago

How else can one get in touch with a megacorp?

Manishearth2• 10 years ago

Additionally, the emails are phrased more like a request than an indication of a legal requirement. I doubt the customer service rep knows what the GPL is, and won't get someone who does know involved until the fact that it's a legal matter is mentioned somewhere.

The fact that there was no further back-and-forth makes me suspect that the guy behind the email just wants to make a spectacle :/

SyneRyder4• 10 years ago

Google could have helped here:

BMW Car IT: Open Source http://www.bmw-carit.com/open-source/

I'll take a guess based on the filename "ConnStarter" in the BMW firmware that ConnMann is the primary GPL'd software. As the BMW site says: "The ConnMan project provides a daemon for managing internet connections within embedded devices running the Linux operating system.... ConnMan is available under the terms of the GPL v2."

http://www.bmw-carit.com/open-source/connman.php

You can download the source if you like.

jmiserez2• 10 years ago

The linked site may be useful, but where on that site did you find a download link for the specific software version (including modifications) used? All I see is a generic link to ConnMan's project website. I don't think that suffices?

knd775• 10 years ago

This was linked from the project website

http://git.kernel.org/cgit/network/connman/connman.git/

edit Never mind, I misunderstood your comment

SyneRyder4• 10 years ago

I think BMW would argue that contributing their modifications directly to the ConnMan Git repository for others to use would suffice. You can find a list of BMW's commits to the ConnMan project here (Daniel Wagner seems to be the main developer from BMW Car IT working on it):

http://git.kernel.org/cgit/network/connman/connman.git/log/?...

jolux• 10 years ago

pretty sure it's this: http://www.magnetimarelli.com/excellence/technological-excel...

can't find the source for it though.

greydius• 10 years ago

Please correct me if I'm wrong. I thought the GPL only required providing the source code to the purchasers of the product. (Who can then redestribute it if they'd like.) I didn't think it meant that if you use GPL code in your product, then you are obligated to make your code available to everyone.

voxic112• 10 years ago

You are required to distribute the source code to anyone you distribute binaries to. So if for instance their binaries were available to the public then they would also have to make their source code available to the public. It seems in this case they released a patch to their software and made the patch available to the public.

13of40• 10 years ago

If I sell a computer with Linux on it, and I bundle on my own application that's compiled to run on Linux, am I required to make the source code for that application available?

In this case, if they just have an unmodified copy of Linux to provide the run-time environment for their nav system or whatever, and the nav system itself is an application on top of it, I don't know if it follows that they need to release the source for their nav system.

kazinator2• 10 years ago

If I sell some device with an upgradable firmware (which contains GPLed materials), I can allow users to download upgrades from my site without putting them through hoops to prove that they own the hardware. Yet if they ask for the source code, then I can put them through the hoops: convince me that you're actually one of my users, then you can have it.

And it's not because users who don't have my hardware cannot use the firmware. In fact, users of hardware which is not mine could potentially be users of the firmware. If a competitor clones my hardware, so that the firmware runs on it, the users of that cloned hardware can benefit from the upgrades that I provide, because I don't validate that they are using the genuine hardware.

I don't have to provide the cloned firmware with free upgrades and all to the users of the competing hardware, and in fact, I am not offering those upgrades to the users of that hardware. It just so happens that they are able to help themselves to it because it accessible (for the sake of the utmost convenience to genuine users). That is not the same thing as it being distributed to the entire public.

Just because something is accessible to the public doesn't mean that it's being offered to the public. Distribution requires some kind of offer. An accidental leak is not distribution, for example.

xvedejas• 10 years ago

Well, two things: first, they have to provide source to everyone (regardless of whether they bought the product or not) if they are releasing the product at all. Secondly, if they are statically linking with GPL-licensed code, or otherwise make modifications to the code, the additional code must also be released under the same license, and the code for that must therefore also be made available.

nordsieck• 10 years ago

"3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

That is not true. As long as they choose option A, they only have to distribute it to customers.

DannyBee2• 10 years ago

So, as two people said, you have to give source to who you give binaries to.

But it's stronger than that. You either have to ship them source accompanying the binary, put the source next to a place that has the binaries, or make a written offer.

Since they haven't done #1, they probably have to make a written offer. I don't see one :)

tzs3• 10 years ago

If you distribute GPL source code with your product, then that is correct. You do not have to give the code to people who have not purchased your product, but your purchasers can give away the code.

If you distribute GPL object or executable code with your product, then, briefly, you have to either distribute the source code with the product, or if you have to make the source available for three years to anyone who requests it for no more than your cost of distributing the source.

See my longer post for more details: https://news.ycombinator.com/item?id=11218324

anonbanker3• 10 years ago

If I am the author of the GPL'd product you're using, I do not have to purchase your product to compel you to release the source code. I can revoke your right to use the product (including your modifications to it) should you not honor the terms.

rewqfdsa• 10 years ago

Good. I'm sick of people walking over copyleft licenses generally. It's only because of copyleft that there exists a pro-sharing social norm in the software development community. If you kick down the GPL, the norm will shift back toward proprietary software everywhere. You, young developer, have no idea just how shitty a world that is.

OJFord2• 10 years ago

It seems to me less like refusal to comply with the terms of GPL, and more like denial that they use GPLed code.

    > I have confirmed with our technical department who
    > advised that ... the usage rights agreement states that
    > the software is protected by copyright and BMW is the
    > sole owner... it is not subject to the requirements of a
    > "Public" licence

That may or may not be the case, but to me that doesn't say "yeah we use, na you can't have it".

goerz4• 10 years ago

It seems to me that they're not distributing any software (i.e., the product is a car, not software), which means licensing doesn't come into play. It would be akin to someone finding out that I'm privately using (and maybe modifying) GPL software, and then demand that I make the source code available to them. Only in GPLv3, the issue of selling a product that uses GPL software internally is addressed. The situation changes of course once they make the software itself accessible to third parties, in which case they'd also have to supply the source code.

ceejayoz• 10 years ago

If that were the case, you could get around the GPL by claiming to sell CDs, thumbdrives, or zip files. Including software in your hardware product is undeniably distributing that software, IMO.

goerz4• 10 years ago

I disagree. If you sell me a CD with software on it, I have the software. If you sell me a car that runs a software internally, I have a car, but not the software. The car, unlike the CD, is not a container for the software. In fact, there is no trivial or intended way to get the software out of the car. As I said, GPLv3 addresses this explicitly, but with GPLv2 the license just doesn't apply. Then again, lots of people strongly dislike GPLv3, possibly exactly for this reason.

hhjkjhkjhhlkj• 10 years ago

If the car has the software then they are distributing the software

st3v3r5• 10 years ago

"It seems to me that they're not distributing any software (i.e., the product is a car, not software)"

The car is running software. They're distributing the car, therefore they're distributing software.

famerr6• 10 years ago

So it is strange for me even if I understand GPL. Does it means all the network routers running custom linux have to provide sources of entire modification? I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists).

zmmmmm3• 10 years ago

No. There is a boundary between the "kernel" which is strictly GPL and the "user" operating system which is (in its interaction with the kernel) based on LGPL and weaker libraries. So these routers have to distribute changes they make to the kernel, yes, but not any and everything that runs on the router.

famerr6• 10 years ago

Makes sense, thank you for explanation.

rbanffy2• 10 years ago

Does it means all the network routers running custom linux have to provide sources of entire modification?

Yes.

I assume if we want companies to make use of linux on a wide level, there should be the ways to overcome this problem(if exists)

What problem? Making the source code of the programs you distribute to your clients available is not a problem - it's an obligation you agreed with when you used the GPL'ed program as a basis for your own.

You could do like Sony, who used *BSD on the PS4.

famerr6• 10 years ago

Good point, thank you.

st3v3r5• 10 years ago

What's the problem?

famerr6• 10 years ago

First is security, if current asset based on linux is vulnerable and you make it public consequences are obvious. Or even your system is vulnerable itself because of modifications. Or 0day that will reveal afterwards. And your product is based on embedded systems. I understand it's your choice, but it holds the development.

Second is competitive advantage. If you have to release modified system, that you use in your product on day 0, when you started, it interfere your business. Again it's your choice, but it could hold the development. So reasonable alternative would be good.

famerr6• 10 years ago

But it's much better if comment by zmmmmm is correct and it only touches kernel modifications.

charonn0• 10 years ago

Does it means all the network routers running custom linux have to provide sources of entire modification?

That's pretty much what happened to Linksys.

[1] http://www.wi-fiplanet.com/tutorials/article.php/3562391/The...

zmmmmm3• 10 years ago

To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code. If he does then included with the car should be an offer for how to access the GPL source code. He should have followed that (or clearly stated that he could not locate it in his email). The requirement for him to enter the VIN to access the source code does not seem unreasonable since they are only required to distribute source code to customers, and he has simply emailed them out of the blue asking them to give him the source without any proof that he's a customer. The statement about BMW being the "sole owner" is probably concerning proprietary parts of the software that may not be subject to GPL at all. It is probably way beyond the skills of some random customer service rep to distinguish the subtleties of those kind of things.

This kind of interaction actually looks to me to be counter to the spirit under which the Free Software Foundation tries to administer the GPL - which is that they work cooperatively to help companies comply rather than try to trick them into legal hot water. I agree with the FSF approach and I don't think this sort of PR ambush type tactic is helpful in promoting the use of free software.

ratboy666• 10 years ago

No, the offer for source must be to anyone -- the supply of a binary may be limited. BMW cannot be the "sole owner" of the copyright -- even if they own the part they wrote, they must still supply source for the GPL parts.

qznc2• 10 years ago

"the GPL requires you to make the modified source code available to the program's users"

Source: https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc...

BMW does not have to provide the sources to everybody. Only to its users.

edit: tzs also has a point. Hm?

tzs3• 10 years ago

To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code.

(All section references below are to GPLv2, since that is what the Linux kernel uses)

Section 3 governs distribution of object or executable code. Section 3 gives these requirements:

BMW is distributing commercially and they did not receive the program in object or executable form, so option "c" is out.

They are not distributing the source code with their cars, so option "a" is out.

That leaves option "b", which requires them to give the code to any third party that requests it, at no more than their cost of performing a source distribution.

zmmmmm3• 10 years ago

That leaves option "b", which requires them to give the code to any third party that requests it,

That's very interesting wording that I wasn't aware of. It still seems to me like it is a reasonable interpretation that only the customer could request it (the "offer" is to the customer, the distribution is to the third party). So, having bought the car, I could say "Please send the source code to my friend Fred". However my understanding is that the long held general interpretation of the GPL has always been that you only get standing to request the source code if you actually received the GPL code yourself.

mrb• 10 years ago

"They are not distributing the source code with their cars, so option "a" is out"

I disagree. BMW currently offers the source code as a download on their website if a customer provides his 7-digit VIN, so this is them fulfilling the requirement that they must "accompany [the car] with the complete corresponding machine-readable source code". It is all in the meaning of "accompany it": giving the source code physically along with the keys when you purchase the car, or offering a source code download link. I would argue that either option is compliant with the GPL, so to me it seems BMW is in the right.

Edit: s/IBM/BMW/

btilly2• 10 years ago

Read option B more carefully.

The requirement is NOT that you have to give out source code to anyone who asks. It is that the written offer you give out can be used by anyone. Did BMW hand out a written offer with the car that says how to get source code? If so, then it is fine if that offer requires you to enter a piece of information like a VIN.

BMW is under no obligation to hand out written offers to random strangers. You'll have to find someone who bought a car to get an offer.

Now why would BMW set things up this way? Well it is unlikely that all cars have the same exact source code. So without the VIN, BMW doesn't even know which copy to give you! So what are they going to do when someone shows up, is rude, clearly doesn't have the offer in hand, and then demands source code? Apparently they are going to tell him that he needs a VIN.

dTal3• 10 years ago

I agree the VIN thing is a red herring. Seems to me the bigger problem is this (emphasis mine):

"I have confirmed with our technical department who advised that to access the software download site the BMW Customer must provide the 7 digit VIN and accept the usage rights agreement. Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence."

They're denying that their software is even GPL and imposing extra restrictions on use. That's a problem, if it does indeed include GPL code.

tremon4• 10 years ago

it is very dubious whether he has any standing to request the source code

That may be, but this tidbit is somewhat alarming to me:

[the user must] accept the usage rights agreement. Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner

There's two red flags here for me:

- asserting copyright through an EULA

- additional "licensing" requirements for obtaining the source code

duncan_bayne2• 10 years ago

I only tweeted the refusal after several verbal attempts to speak to someone in legal. My preferred approach - as it was when I dealt with Telstra over a similar issues - is to find the right person and sort things out with them.

BMW Australia, however, were quite hostile, refused to let me speak to anyone in legal, and told me verbally that I'd have to sue them in order for them to release the code to their customers.

I'm much less inclined to spend time resolving things smoothly and quietly at that point.

stusmall• 10 years ago

I've gotten the same response from a company when requesting kernel source before. What is the best source for help in dealing this? I reached out to GNU but got no response. I know the kernel isn't their project but didn't know where else to turn.

genericacct• 10 years ago

Frankly: given recent news (hacked jeeps, software used to cheat on emission tests) I think it is time to _require_ _all_ software used on vehicles that transit on public roads to be open sourced and available to the public. (for independent testing and verification in the name of public safety)

lucb1e9• 10 years ago

Vehicles aren't the only things running software that might need verifying. Far from it. While I wholeheartedly agree that it would be an amazing step, I also fear the huge backlash from the car and IT industry. Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so).

Of course Windows 10 wouldn't have to be open source just because Windows is older than 20 years, but Windows 95 would be.

Anyway, that is just one of the many possible ways. I just think we should be weary of people stuck in the old ways and not limit the move to just cars.

Qwertious• 10 years ago

"Perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code)"

The term you're looking for is "source-available", which means precisely that the source code is available for viewing, and does not imply anything about conditions or lack of.

cyphar10• 10 years ago

Doing this more gradual probably works better, perhaps requiring open source (I'm not talking freedom of modification or redistributing or anything yet, just viewing source code) for software older than x years (like the patent model a bit, 20 years or so).

In that case, the car software is still proprietary software so you've gained very little from making the source code public. If a vulnerability is found, you can't write a patch for it and you have to wait for BMW to "get around to you". Car software should be free software upfront.

benwerd• 10 years ago

Or at the very least, available to the safety testers! https://medium.com/building-an-open-startup/untestable-unsaf...

boobsbr• 10 years ago

I think this problem is impossible to solve, and it's the same on faced by electronic voting.

How can you guarantee that the software running in the car is the same one provided by the car manufacturer?

A more detailed explanation:

You can't guarantee that software provided by the manufacturer and the dump you could retrieve from the car – through an API call, or through forceful means – are the same as the one which is running in the car because you can't know what's going on the silicon inside epoxy packaging of the myriad of chips in the board

Even if the hardware is completely open sourced, the manufacturer could use a different/modified microprocessor packaged/labeled/branded just like the one specified in the schematics, so that it could internally store and run the shady code from the manufacturer, while giving you a perfectly legit and signed dump as the one provided by the manufacturer.

Although I do agree that opening the software and hardware to public scrutiny would be a massive improvement on the actual situation.

wepple• 10 years ago

I don't think it's impossible. Manufacturers should provide the software for audit and assessment. Car tinkerers[1] can usually quite easily pull various firmwares directly off chip, and if the two diverge in a significant way the car company will have a LOT of explaining to do.

[1] http://opengarages.org/handbook/

nathan_long• 10 years ago

it could internally store and run the shady code from the manufacturer, while giving you a perfectly legit and signed dump as the one provided by the manufacturer.

If you had the right to replace it with your own copy, you could make it blink lights in morse code at various points in the software to prove it was executing your code. Of course they could still do sneaky things, but it would be harder.

dognotdog• 10 years ago

At this point in time, having the software available would do more harm than good, considering that 90% (or more) of software development in the auto industry seems to be done by electrical or mechanical engineers with little to no training in software development, and even less knowledge about security and vulnerabilities.

The auto industry does have a plethora of coding standards and software processes, but not enough institutional knowledge and foresight to produce secure software for connected devices. The fact that it hasn't been too catastrophic so far is more a testament to the technical limitations of the bus systems and ECUs than real security, but that is rapidly changing with the advanced hardware being put in cars today.

y04nn• 10 years ago

At least their update binaries are unencrypted, which allow us to see what they are using. If some of you want to have a look: The article: https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-softw...

Direct link to the binary: http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07...

kazinator2• 10 years ago

Misleading title; it looks more like they in fact refuse to acknowledge at all that some of the code is someone else's.

Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence [sic]

I.e. "This is all our software; there is no third-party GPL stuff in it, so we need not comply with any such license."

sargun• 10 years ago

Tesla still continues to violate the GPL as well - https://forums.teslamotors.com/forum/forums/gpl-sources.

yeukhon• 10 years ago

This topic is getting dull every time on HN. Someone has to argue about GPL, free software vs proprietary software.

outworlder• 10 years ago

This is ridiculous. So now, any John Doe can contact customer support of any company, then publicly shame them for not getting the response they want? Aren't there organizations with the sole purpose of investigating Free Software license violations, with access to actual lawyers? Where's the email thread of such correspondence?

This sounds like a child crying mommy. Oh, and while I usually approve attempts at breaking the way-too-serious corporate speak, smileys seem to detract from the gravity of the issue being discussed.

Can we get responsible people to handle this, please? Like the Free Software Foundation? Not a flash mob on the internet. This is counter-productive.

duncan_bayne2• 10 years ago

Duncan here. I'm the one who contacted BMW to ask about source code availability. I don't own one of the BMWs in question, but the chap who wrote the original article investigating the update contents did.

I've since been contacted by someone clueful from BMW Germany, and have put him in touch with the car owner. They are working together to determine what needs to be done for BMW to be compliant.

tl;dr: It looks like it's all going to be sorted out amicably.

BMW Australia Refusing to Comply with Terms of GNU Public License

Related Stories