Onyx is violating the Linux kernel's license, refuses to release source code

https://old.reddit.com/r/Onyx_Boox/comments/hk7d5v/onyx_is_violating_the_linux_kernels_license/

by Lammy • 6 years ago

326 93 6 years ago

old.reddit.com

applecrazy• 6 years ago

Seeing how this is a company in China, how would the legalities work?

yjftsjthsd-h• 6 years ago

I believe the wronged party in such cases can ask to have imports banned.

floatingatoll2• 6 years ago

https://heathermeeker.com/2018/04/30/first-gpl-case-in-china...

As the link warns, this is a secondhand translation, and my summary is thirdhand. Do your own reading, especially in the original language, if able.

The general point here is that the Chinese legal system declared that the GPL legalese is OK, but that judges have the power to evaluate it in context of the case and retain the authority to override the legalese when it results in inappropriate outcomes.

In this specific ruling, the judges ruled that bundling ('aggregation') of GPLv3 and unlicensed code did not infect the unlicensed code with the GPLv3, resulting in a loss for the defendant.

If Onyx is bundling GPLv3 code with non-GPLv3 code, based on this single case, they are not required to disclose the source of the non-GPLv3 code that is aggregated with the GPLv3 code. If they have also/instead modified GPLv3 code, then they would probably be required to publish the source for the works derived from GPLv3 code.

The usual arguments here are that modifying a bundle of GPLv3 code to include non-GPLv3 code is itself a 'derivative work' of GPLv3 code, or that the GPLv3 specifies that such bundling shall result in the bundled code being forcibly licensed under GPLv3. The Chinese court apparently did not accept this line of reasoning.

YMMV, IANYL

anticensor3• 6 years ago

The lesson here is if you want non-severability provision to work, you need to make the licence restrictions also binding for the original author (full reciprocity). Similar cases will also arise in Europe.

CuriousSkeptic• 6 years ago

I think you have a few details wrong.

Firstly (a minor detail) I don’t think GPL requires you to “publish” source code per se. Just make sure that every recipient of a binary copy can also receive the source code.

But more importantly, the license doesn’t “infect” things. In no way can you be forced to license your code according GPL. Failure to comply with the GPL simply means the license isn’t applicable and the situation reverts back to normal copyright rules.

beojan• 6 years ago

That's interesting. The GPL actually includes language specifically permitting aggregation like this:

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

redtexture• 6 years ago

Possibly via:

Import halt via complaint in appropriate US Customs regulatory regime and / or court, about infringement of intellectual property. This can embargo a company's product nationally in the US, and gets the attention of the producer.

Not quite on topic:

Stopping Infringing Products From China: Section 337 Cases. By Bill Perry - China Law Blog -- August 22, 2016 https://www.chinalawblog.com/2016/08/stopping-infringing-pro...

pabs3• 6 years ago

US Customs halt has had the desired effect in GPL compliance cases before:

https://mjg59.livejournal.com/126865.html https://lwn.net/Articles/404450/ http://mjg59.livejournal.com/132810.html

colejohnson66• 6 years ago

This was a problem with Creality in the 3d printing world two years back. They used Marlin - a program for the embedded micros used in them - which is licensed under the GNU GPLv3+. Creality refused to release their contributions until they were convinced by Naomi Wu (Sexy Cyborg) that the community would actually refuse to purchase from them unless they did, which they probably would’ve.

https://hackaday.com/2018/08/27/gpl-violations-cost-creality...

artsyca3• 6 years ago

I seriously can't believe how short sighted people can be. That's bad business.

I worked at a big bank too, you'd think they would understand about investment? No. They simply leeched off open source in the same way.

uyrdjdurfurhdh• 6 years ago

It's this actually short sighted though? I feel like the 'companies are exploiting open source' dialogue always ignores how wildly miniscule the risks often are for the company. Creality might have lost a US distributor but is the US their primary market and were they unable to find another distributor?

Don't get me won't, I'm not happy about the state of affairs, but banks are usually pretty risk averse (or more accurately, their risk portfolio is catastrophe averse). If an org like a bank doesn't care it seems like a sign that open source either needs some better teeth or it needs to accept that its role in the ecosystem is changing. We might see some short term success calling out bad actors but if there's enough of them to put on a whole play then it seems more useful to focus on why they're all able to book a theatre so easily.

user59944612• 6 years ago

I worked at a bank too. There is a list of software and libraries approved for usage. GPL cannot make it to the list because the license is the first thing that's verified when requesting to add a new library.

I always wondered what would happen if some developers used some GPL lib and shipped to customers and it was noticed and caused the company to be sued. Would all the developers be fired on the spot and the software undone?

oceanghost• 6 years ago

Monoprice was guilty of this for a number of years... as I suspect Lerdge is as well, they encrypt their firmware and bootloader, and there's just no reaosn for it.

Teknoman117• 6 years ago

This kind of behavior is one of the things that kills me about grsecurity. They're completely abusing the spirit of the GPLv2 license but are probably following the letter of it.

If you choose to exercise your GPLv2 rights, your contract with them is terminated and you will receive no further security updates (considering this is a security product, it makes it pretty useless to you). You are then blacklisted from doing business with them ever again.

andreareina• 6 years ago

Bruce Perens argues[1] that this is a penalty for exercising your rights under the GPL and therefore violates section 6[2]: "You may not impose any further restrictions on the recipients' exercise of the rights granted herein"

[1] https://perens.com/2017/06/28/warning-grsecurity-potential-c...

[2] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

st1ck• 6 years ago

Open Source Security (company behind grsecurity) sued him for that post, but the case got dismissed and looks like OSS has to pay his legal fees:

https://www.digitalmunition.me/maker-of-linux-patch-batch-gr...

tzs• 6 years ago

He argues contributory infringement and breach of contract, but he really only goes into the breach of contract theory.

I'm more curious about the contributory infringement theory. You cannot have contributory infringement without there being a direct infringement by someone else for the contributory infringer to have contributed to. I don't see offhand who would be the direct infringer whose infringement Grsecurity is contributing to.

sanxiyn• 6 years ago

After you are blacklisted, can't you still get security updates from other grsecurity subscribers? I suppose grsecurity could also blacklist any subscribers sharing to blacklisted people, but how could they possibly enforce this, if your friendly subscriber doesn't tell?

opus132• 6 years ago

The "obvious solution" would surely be for grsecurity's customers to band together into a cartel to put an end to this pretty unpleasant behaviour?

arp2424• 6 years ago

According to the Reddit thread linked in this thread, no one has ever been blacklisted:

We have in fact never had to terminate a relationship with any customer of ours. We build trusted relationships with our customers, so any talk of "threats" or anything else is simply completely fabricated (as you obviously noted, anyone repeating such claims has no evidence whatsoever for them).

elliekelly• 6 years ago

If someone chooses to exercise those rights does grsecurity comply? Or just terminate the contract and ignore all further communication?

staticassertion3• 6 years ago

From the reddit thread I linked elsewhere (https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_...):

There is no restriction or prohibition, correct. In fact, we are far more lenient than other companies when it comes to our policies. We have in fact never had to terminate a relationship with any customer of ours.
We're generally only concerned with fraudulent customers who would lie during the quoting process with the intent to cause damage to the business by intentionally reposting all updates received online. Obviously, they have the right under the GPL to do that (the fraudulent representation notwithstanding), but we also obviously have the right to refuse future business with them. As noted by the lawyer in the link above, that right has been repeatedly reaffirmed by the US Supreme Court. It's not controversial whatsoever.

crazypython• 6 years ago

GPL protects the rights of users. It does not protect the rights of creators.

staticassertion3• 6 years ago

https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_...

Brad goes into this here. Grsecurity has written extensively about this.

Read the links to their site where they go even further into detail.

Grsecurity is not violating any license. There are multiple quotes from authorities on the matter in that link. If they were, so would Redhat, Canonical, etc.

jasondclinton• 6 years ago

Wow, that post is so ad hominem that it makes him less credible. Is this how he usually responds?

c-c-c-c-c2• 6 years ago

They release their firmware updates on their page, packaged with upx. Someone could enjoy decompressing it https://onyxboox.com/firmware

adielsa• 6 years ago

Their is no source code there. Decompress wont bring it back to soirce code state

c-c-c-c-c2• 6 years ago

Download it, unpack it, patch it to enable ssh, ssh into the machine, monitor internet traffic and see if its doing anything fishy.

rjzzleep• 6 years ago

I've said this elsewhere. But I genuinely don't think that they know what the gpl means. Maybe someone could approach them in Chinese preferably directly to the company instead of the forum minion. The forum minion always responds with the same answer to any question that is asked. That person gives the same answer to a quick switch option between the notes and library app.

Usually what happens in the onyx customer forum is that a person asks for something. The forum minion says it's been forwarded and being worked on and then the cycle repeats until one of the customers gets pissed and starts threats.

ralph84• 6 years ago

They know what it means. It means a copyright holder of the Linux kernel would have to sue them in China. Good luck with that.

davidgerard• 6 years ago

If the software is embedded, they can be sued elsewhere. Like that time BusyBox sued over the GPL and won ... a pile of TVs! http://www.groklaw.net/article.php?story=20100803132055210

ballenf• 6 years ago

Could users of the product also be sued by a Linux contributor?

If you can’t go after them, going after their customers would kill their business.

But this approach seems too cute to be feasible even on the long shot that the GPL would allow it.

newacct583• 6 years ago

You can sue them anywhere the devices are available. Obviously the remedy is going to have to be within the jurisdiction of the particular court, but you could block imports or receive damages in any nation to which they ship.

arp2424• 6 years ago

Why solve matters with lawyers if you don't need to? If there's a failure of understanding, possibly due to language issues as the previous commenter suggested, then trying to establish a dialogue and trying to explain the matter to them would be a far easier (and cheaper!) option for everyone, regardless of locality.

It doesn't help that the GPL is not an easy document to read by the way :-/

coldtea• 6 years ago

I've said this elsewhere. But I genuinely don't think that they know what the gpl means.

Unless it can be enforced, it means absolutely nothing more than a wish...

numpad0• 6 years ago

They fear they might be breaching some NDA by fulfilling GPL contractural obligations.

That’s what’s in violators’ minds. NDA and multi million lawsuits like they are doing anything.

rimutaka• 6 years ago

I have just updated their Wikipedia page with a mention of the incident. Let's see how long it will take for someone to take it down https://en.wikipedia.org/w/index.php?title=Onyx_Boox&action=...

leijurv• 6 years ago

I've obliged.

djeiasbsbo• 6 years ago

It was removed because you apparently didn't quote/provide a reliable source... Looks like you quoted a reddit comment?

maitredusoi• 6 years ago

That is where MIT license is largely superior to GPL, you know what you are buying for... ;) GPL put enforcement without the cops to maintain it ;) With MIT, everyone is free to do whatever they want. In a way GPL recreate (unnecessary) bureaucraty, where MIT generate pure liberty.

zelphirkalt• 6 years ago

So, in which way is the result any better?

toyg• 6 years ago

Ah, the freedom of business to exploit free labor! How do we long for that!

nikita2206• 6 years ago

So, wtf is Onyx and how does it violate GPLv2?

sirn• 6 years ago

Onyx is a manufacturer of Android-based e-Ink tablet/e-Reader.

input_sh• 6 years ago

To answer the second part of your question, if you modify code released under GPL, you need a way to provide a machine-readable copy of your modifications to your users.

So, it doesn't need to be publicly available (as in, you and me are not Onyx users, therefore we don't need to have access to it), just to its users. Screenshot shows their user requesting it and being denied the request, hence, GPL violation.

https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc...

EE84M3i• 6 years ago

if you modify code released under GPL

_and distribute it_

Running it server-side is fine. That's what the AGPL addresses.

If you modify GPL code and only use it yourself without distributing it, you never have to give anyone else access to the modifications.

mindB• 6 years ago

Unfortunately this has been going at least as long as I've been aware of Onyx Boox products. E.g. https://www.mobileread.com/forums/showthread.php?t=277431. It's by no means an isolated incident.

ChrisMarshallNY4• 6 years ago

I tend to license my stuff MIT. That’s mostly because I don’t want to deal with legal agita. It helps to avoid people suing me because the hammer they stole from me bends their screws.

We basically live in a digital kleptocracy. Everyone steals from everyone. I tend not to, but that’s because I’m a complete control freak, and have a hard time letting go.

I think that decompilers are so good, these days, and the use of intermediate steps like LLVM, mean that people won’t have much difficulty figuring out what’s going on, under the hood. With the financial incentives, it is quite possible to hire top-notch folks to implement, and even improve the work.

Also, I don’t think anything I do is so great that I want to hide how I do it. In fact, I see people do stuff in more clever fashion all the time. My own advantage is in how I do stuff, and it would be great if folks copied it. I don’t think many would. It’s a pain, and is only efficient once it becomes habit.

Go ahead and steal my stuff. Get rich. I doubt my stuff will be the “secret” to your success. My only hope is that, if you do use it, there might be a tiny piece of high-quality software in there. I do feel as if we should all strive to do the best quality work possible, and take some personal pride in our craft.

I don’t mind that going viral, and I don’t think a license will affect that.

stefan_• 6 years ago

It's not about you, it's about the user.

ChrisMarshallNY4• 6 years ago

Yup. That's what I said. The user can benefit from my work.

Seriously. Why was what I wrote bad?

I just put enough legal fig leaf on to make sure I don't get sued for anything, do the very best work I can, and put it out there, for all to use.

I literally wrote a post, encouraging people to open-source their software, and I led by example; not decree, which is usually the best way to proceed.

Is the MIT license a bad license? If so, why?

I have found that if I make it GPL, then a lot of folks won't use it. I want people to use my stuff. I think it's good stuff, and can benefit users, by being a high-quality component.

I think I do have one GPL project; an ffmpeg wrapper that uses the GPL H.264 codec. I could probably get away with not licensing it GPL, but why bother? It's not gonna save the world. I suspect no one will have much of a use for it, anyway.

weinzierl• 6 years ago

This is not unusual, there are many cases of GPL violations out there and if someone puts energy into them they are solved. Harald Welte and gpl-violations.org [1] have been doing good work for many, many years in this regard.

From their about page:

"By June 2006, the project has hit the magic "100 cases finished" mark, at an exciting equal "100% legal success" mark. Every GPL infringement that we started to enforce was resolved in a legal success, either in-court or out of court."

gpl-violations.org is in an extraordinary good position to help when it comes to GPL violations in the Linux kernel, because they work closely with some kernel developers that "[..] have transferred their rights in a fiduciary license agreement to enable the successful gpl-violations.org project [..]"

Their website looks a little bit outdated but from what I understood from a talk that Harald Welte gave last year[2], they are still active. If someone wants to report the Onyx case you can do it at license-violation@gpl-violations.org but be prepared to provide solid information[2].

[1] https://gpl-violations.org

[2] https://www.luga.de/static/LIT-2019/events/84.html

[3] https://gpl-violations.org/helping/.

fierarul• 6 years ago

Not sure what Onyx is but my first though was about the System76 system https://system76.com/laptops/oryx

Turns out that one is called Oryx

thekyle• 6 years ago

Onyx makes eInk tablets. I was actually thinking of buying one earlier this year, but not after this.

Onyx is violating the Linux kernel's license, refuses to release source code

Related Stories