Leaked Samsung exFat driver relicensed as GPL

http://lists.gpl-violations.org/pipermail/legal/2013-July/004100.html

by synchronise • 13 years ago

164 192 13 years ago

lists.gpl-violations.org

kbar13• 13 years ago

the ways of the tin foil is strong with the repo's maintainer.

jezfromfuture• 13 years ago

Do you really think its worth saying this considering how much of the tinfoil conspiracy shit has become reality.....

thomasjames• 13 years ago

The title makes it sound as though this has been accepted into the Linux kernel when in fact it has not been. It is designed to work with the Linux kernel but it is in no way associated with Linux. FUD much?

synchronise• 13 years ago

I've updated the title to hopefully dispel any unintended interpretations.

gngeal• 13 years ago

Did Samsung, in fact, distribute the code in Android devices? If the answer is "yes", wouldn't that make it GPLd?

Nursie10• 13 years ago

Not necessarily, no. There is a long history of people releasing closed source drivers, particularly on embedded platforms.

So far as I can tell the kernel devs think it's harmful and A Bad Thing (TM), but not a violation.

Also as has been pointed out below, it wouldn't automatically make it GPL. It would make it in violation of GPL and releasing under GPL would fix the violation, but it wouldn't make it GPL.

zokier• 13 years ago

If the answer is "yes", wouldn't that make it GPLd?

No.

belorn3• 13 years ago

As the others have said, no it would not make it GPL.

However, the customers who bought such devices could try sue for feeling mislead as a customer. If Samsung ever used the word free, open, or even linux, they might be liable under false advertising consumer protection laws. Keyword here is might, and is likely to vary based on where you live.

If enough people did this, samsung would likely feeling pressured to relicense the necessary (sold) kernel modules as GPL.

bad_user2• 13 years ago

Licenses aren't applied automatically. What can happen is for Samsung to get sued for a violation of GPL and either be forced to license the code under GPL or pay damages.

nailer• 13 years ago

Is it possible that it was an accidental mistake, rather a deliberate attempt to spread 'Fear, Uncertainty and Doubt'?

Be Civil. See http://ycombinator.com/newsguidelines.html

nullc• 13 years ago

Part of the potency of FUD is that it's so easily believed and you'll seldom ever hear FUD from someone who doesn't personnel believe it. It shouldn't be a personal insult for someone to call out potential FUD when they see it.

fpgeek• 13 years ago

The github issue is amazing reading: https://github.com/rxrz/exfat-nofuse/issues/5

Normally you expect the copyright issues to be going in the other direction at gpl-violations, but kudos to them for noticing the problem and dealing with it quickly.

maaaats2• 13 years ago

Basically, I did microsoft's job, they even owe me money for the time I've spent fixing the code to work on modern kernels and "throwing the GPL tag on it".

Wow.

skore3• 13 years ago

Oh it gets better. I had to stop reading the thread on Phoronix out of fear that my brain would pop out of my head and leave for Portugal.

People with emotional insecurities are trying to make up something depressing and horrible, point a finger and make lots of noise.
For me it was just sad to see people complaining more often than being grateful or happy about something.
I hope they will patent and release a license on negative thinking.[0]

Actually, the entire Phoronix thread is an amazing display of incompetence.

Were do you assume "this source code is not under GPLv2"? Source of this please? This implementation (code) was on github, that says something to you? [1]

My mind is boggled so hard right now. This better be a conspiracy to discredit FOSS, otherwise I'm losing yet another piece of trust in human sanity.

[0] http://phoronix.com/forums/showthread.php?81642-Native-Linux... [1] http://phoronix.com/forums/showthread.php?81642-Native-Linux...

codgercoder• 13 years ago

GPL, and probably other licenses, were constructed to work with copyright law. Such cavalier dismissal (by rxrz) is disrespecting those who created the licenses, the legal system, and the open source community, at large. We live in the real world, not "The Matrix".

yareally5• 13 years ago

Sadly, this is a typical thing that goes on in the Android User development community. Lots of casual attitudes by hobbyists that modify the Linux Kernel and rattle off some sort of excuse for not posting their sources while distributing binary copies.

Others end up "relicensing" similar to the guy on github, thinking that because they changed a few lines of code, they can claim to own the license to the software now. I'd say that is probably much more prevalent since there's a general assumption by many that the license most Android based software uses, Apache 2.0 means "do whatever you want".

Even worse is the fact that many users in the community are also quick to defend them blindly because they know little of development and why following licenses matter (even after all the facts are laid out and explained).

Svip2• 13 years ago

Others end up "relicensing" similar to the guy on github, [...]

Hmmm...

https://github.com/rxrz/exfat-nofuse/issues/5#issuecomment-2... :

And I don't need any permissions from anybody, I'm a big girl.

Fun fact: Females also do stupid stuff.

jlgreco7• 13 years ago

The last point you raise is one of the reasons that I think the drive to bring as many "proverbial grandmothers" to Linux presents a very serious concern.

Imagine if Linux distros started getting treated like Android does? Android got those legions of "regular" users and participants that everybody seems to want and it is not a pretty scene because of it.

bxc892• 13 years ago

There are those of us who completely disagree with copyright law. How many years have been wasted on projects like Samba because of draconian copyright? Much simpler and cleaner to acquire the source.

reginaldjcooper3• 13 years ago

Wasting man-years on reimplementing software is not a large enough problem to decide that authors no longer have any rights with their product.

bradleyjg3• 13 years ago

If you disagree with it, you are free not to copyright your own works.

toble• 13 years ago

It's only natural to act defensively when someone abruptly turns up and accuses you of removing some comments from code.

If you talk to people who aren't licensing and legal enthusiasts, most don't have an interest in those topics.

scotty796• 13 years ago

What's wrong with disrespecting those who created the licenses, and the legal system? Maybe if we were disrespecting them sufficiently early on we wouldn't be in a mess we are currently in and the open source community wouldn't need to have a special name because it would be just called developer community?

We live in the real world, not "The Matrix". So why does it feel like it's the other way around? Why does it feel like we are living in a world pull over by our eyes by lawers that restricts sharing our creativity?

read_again6• 13 years ago

Property is an inherent human thing. Likewise, people want to be remunerated for their work. Hence copyright. If scarcity was non existent, then we wouldn't have that problem...

Actually, it would still be here: Van Gogh artwork is unique, and this can be expanded virtually to anything, including the shirt you are wearing, since you're the only one to wear it. You might see where this leads to. Scarcity can always be created artificially.

Anyway, you wouldn't want people to take your shirts away from you, and copyright holders may feel the same towards their work.

The second issue is fairness: if someone has to pay a certain amount to access copyrighted work, why others would not have to, under the same circumstances? Fairness is the motivating principle supporting the existence of the Law.

kawsper• 13 years ago

When the code is out there, is it possible that a third-party will modify the existing exFAT projects based on this "leak", and get them to work properly and out of userspace?

drrotmos• 13 years ago

It would be very bad if they do, since that would open the existing exFAT projects up to legal action.

Anyone who has read the Samsung code is "tainted" with the knowledge of Samsung's proprietary techniques which may be copyrighted, so those people may well introduce copyright violations into the code.

In clean-room reverse engineering projects, the people who are examining the system to be reverse engineered are never the same people that actually write the new clean code, thus avoiding the taint of proprietary knowledge.

ordinary• 13 years ago

Not just copyrighted. Microsoft claims a whole bunch of patents related to exFAT. This means you can't legally implement exFAT without a license to those patents, even if you've never even seen the Samsung code. This is the reason why exfat-fuse is not part of any large Linux distributions.

VLM2• 13 years ago

I'm highly curious about this from a strategic long term point, not a tactical individual issue. Who is rxrz? Before June 24th, he/she/it (it aka an alias) didn't exist on github.

If this is someones paid project (who's paying?) to disrupt exFAT work, its doing pretty well, only took about a month to possibly destroy the whole area of operation. Effective. Probably pretty cheap.

So, follow the money. Who benefits? Could they (or a subcontractor of a subcontractor, etc) be hiring someone to sabotage a project?

There's a critical matter of identity here. We're discussing this as if its a J random hacker individual scenario. It might not be, and there's no reason to suggest it goes either way. Also looking at the github record this individual has apparently never done anything else, and didn't "exist" until recently, which is ... odd.

This situation needs to be looked into. I would give it maybe 75% chance of pure cluelessness and flaming, and maybe 25% chance of being something... more complicated; or worse.

Dylan1680717• 13 years ago

The need for procedures like that is ridiculous. Why should you have to expensively prove beyond a shadow of a doubt that your code doesn't infringe?

foxhill2• 13 years ago

you know, it'd be interesting to see what the open source community could produce if we all took his approach to licences for a little while.

Nursie10• 13 years ago

A mess of lawsuits, withdrawn devices and shut down code repos most likely.

VLM2• 13 years ago

And no users.

Everywhere I've worked since the mid 90s, internal and external license compliancy enforcer-types have always left me and my stuff alone when I print out the DFSG and a couple of the DFSG compliant licenses, show them we run Debian, and at work only use Main not Non-Free. I've never had a "license compliancy audit" run longer than 30 minutes or so and maybe two dozen pieces of paper. Usually much less.

Its a measurable financial advantage of free software. You should see the labor and expense nightmare my proprietary coworkers have gone thru to "prove" they have the right to a copy of windows and office and other stuff. Its very expensive to use proprietary software legally at a business, and I'm not just talking about purchase price!

If I could no longer use free software because there no longer is any, I'd have to switch to something involving less legal risk. Unfortunately probably MS products, apple being a bit too rich for their blood. It would be a nightmare conversion, and a much higher TCO leading to longer term financial issues.

foxhill2• 13 years ago

i didn't necessarily mean for practical use, i just meant, what sort of finished (hah) product could come out at the end!

drdaeman• 13 years ago

Lawsuits aside... I guess a bunch of illegal-but-everyone-uses-them binary blobs of highly varying quality with some sources floating around.

Oh, we had that, that was called "pirated [Stallman forgive me] Windows". I believe I had leaked W2K sources burned on some old CD, if they're still readable...

ars2• 13 years ago

"Originally, it was either public domain or GPL."

He's claiming that this is actually GPL code that Samsung claimed as proprietary (which they can't do). Is he wrong?

Nursie10• 13 years ago

It's hard to tell - there doesn't seem to be any proof of this and in the case of leaked code I'd be wanting proof.

scotty796• 13 years ago

I think judge should force Samsung to release all the information they have on history of this code. After all Samsung is suspected of violating the license. Shouldn't they be able to prove copyright before they can claim it?

bxc892• 13 years ago

I agree with the actions of the repo maintainer.

Why should we play along with unjust copyright laws? GPL sheep are just part of the problem, creating their own nest of licensing woes everytime you touch their code.

icebraining3• 13 years ago

Even if you don't want to play along with copyright laws - and I can perfectly understand why one wouldn't - that's not a reason to deceive people by claiming the code to be GPL licensed and make them liable if they redistribute it.

If one wants to say "fuck copyright", putting a copyright license in the code is not the really the most appropriate way.

scotty796• 13 years ago

I think deception is a valid tool for creating chaos and chaos is a valid tool for bringing down systems.

Tehnix• 13 years ago

Obviously a troll account since it was created for the specific purpose of posting that comment (created 1 hour ago, posted 1 hour ago)...

mtgx• 13 years ago

Why not just use this?

http://linux.slashdot.org/story/13/01/23/2142213/open-source...

exDM69• 13 years ago

Apparently the Fuse-based driver hasn't got very good performance and is not quite production quality yet (according to the Phoronix article).

In addition, the person who put the leaked driver on GitHub seems to have a negative opinion on Fuse (in some of the forum threads where he's ranting), which does not seem to be based on facts.

ckozlowski• 13 years ago

There's a severe fault in rxrz's logic here, if I'm following this correctly:

"This code was originally under a Samsung proprietary license" Wrong.

exfat_version.h:/* - 2012.04.02 : P1 : Change Module License to Samsung Proprietary /

this is version p2. I could've technically stripped those comments and changed the version number to / - 2012.02.10 : Release Version 1.1.0 */ But I didn't. Originally, it was either public domain or GPL.

Nobody would've ever found out by the code alone, which version this actually is."

Let me pull out the key statement here:

"Originally, it was either public domain or GPL."

That's an assumption. Samsung placed a license on it, and rxrz assumes that prior to that, it must have been GPL or public domain. However, the driver was unknown and didn't exist prior to rxrz's release. It seems likely something could be classified as public domain when it was kept under lock and key.

My guess is, this was given a license when the code was finished and bundled for distribution. Assuming otherwise seems dangerous, in my opinion.

kristofferR2• 13 years ago

Samsung may not have intended it as such, but aren't all derivatives of GPL-licenced code also GPL by definition?

Nursie10• 13 years ago

The questions are - is it a derivative of GPL code, and if so have they distributed binaries?

I don't think drivers necessarily have to be derivative of GPL code (look at, for instance, nVidia's closed source drivers and lots of Android/ARM graphics drivers).

lucian1900• 13 years ago

Those are technically GPL violations, but kernel devs haven't (yet) complained much.

effn2• 13 years ago

No. The authors of GPL-licensed code has no say in how other people license their code they don't own the copyright on.

Derivatives of GPL-licensed code is either: 1. GPL-licensed 2. Illegal

If it's not explicitly 1 by the license on the derived work, it becomes 2. It is not automatically "forced" into category 1.

andreasvc• 13 years ago

By illegal you mean illegal to distribute. If Samsung used this code internally and it was leaked accidentally, they are not in violation of the GPL.

crististm2• 13 years ago

This is not such a gray area as you think. Search for the readline license and what that meant to clisp.

Hint: derivative work of a GPL code is GPL (although that was slightly different for clisp).

You are free not have GPL stamp on your code as long as you keep it to yourself. If you distribute it to a third party you are automatically bound by GPL.

crististm2• 13 years ago

If it's a derivative work of the Linux kernel (links to internal kernel API) it should be GPL. If Samsung distribute it to users then it should do that under GPL.

Samsung should be the first to relicense it.

regularfry5• 13 years ago

Morally you might be right. Legally it's a grey area, and practically it's almost certainly a no-go.

scotty796• 13 years ago

So basically company can take your gpld code, extend it, slap their license on the whole thing it and redistiribute binaries without the source code and nobody can slap the gpl back on where it should be because it's a gray area?

rquirk• 13 years ago

Isn't this is a general trend with Android/Cyanogenmod hackers? If you go on something like xda-developers then there's a sticky saying "please don't post GPL violations".

Early Cyanogen releases were fast and loose with redistribution of Google proprietary apps, which got the author in a spot of trouble IIRC. Right now the distribution of these ROMS is IMO pretty suspect - they include whole swathes of binary blobs that they really shouldn't be redistributing willy nilly. If you want the proprietary pieces that belong to the manufacturer of your phone, you should have to pull them off yourself. The ROM creators shouldn't be pulling these bits off of their phones and re-distributing them.

The fact that so many prebaked ROMs are distributed though megaupload-alikes is a bit of a giveaway as to the general philosophy of that community.

Supermighty• 13 years ago

Open source is awesome, yay! It's given Google, Samsung and android device manufactures a hugely successful platform that they would have otherwise had to build from the ground up. And how do they repay the community? Binary blobs. While staying true to the letter of the license they circumvent the spirit of it.

I don't condone GPL violations. I also don't care about distributing binary blobs. Without them there wouldn't be alternative android distros.

bad_user2• 13 years ago

Cyanogenmod ROMs aren't distributed with Google's apps anymore. If you want Google's Play store and Gmail, one needs to download and install a separate archive (I just did that yesterday :))

Of course, the distribution of that archive is still suspect. The licensing of those apps is the only leverage Google has for controlling the companies that distribute Android, like Samsung. It is meant for the likes of Samsung and HTC, not Cyanogenmod, which is why I think Google lets it be for now.

On the other hand if you want to use bare-bones Android, the biggest pain one experiences is the lack of Google Play. I can live without Gmail, I can live without Google Maps, but unfortunately most apps are only on Google Play, which is awkward, given that as a publisher with Android it isn't a big effort to publish apps on your own website, in addition to Google Play.

rst• 13 years ago

Unfortunately, bare-bones Android may get barer and more awkward over time, if they migrate more services from the core OS into "Google Play Services". As an example, the new geofencing APIs that they announced at the last Google I/O (intended to replace the buggy core "proximity alerts") are part of "Google Play Services", not the core OS --- and therefore not available on devices which aren't part of the Play borg.

(To be fair, their announced reason for this is that it gives them a way to make these APIs available on devices that aren't getting regular manufacturer updates. That said, I'm sure it hasn't escaped their attention that it also adds a point of differentiation between Play-enabled devices and, say, the Kindle Fire...)

cite: http://developer.android.com/training/location/geofencing.ht... (Note that step one in using this API is verifying that Play Services is installed.)

glogla• 13 years ago

There's f-droid [1], "app store" or rather an actual FOSS repository with Android apps. It doesn't have all the apps play store has, of course, but lot of interesting apps can be found there. (I'm currently addicted to Frozen Bubble)

[1] https://f-droid.org/

aroch3• 13 years ago

The fact that so many prebaked ROMs are distributed though megaupload-alikes is a bit of a giveaway as to the general philosophy of that community.

What? Hosting (relatively) large files, on services that can deliver those around the world at faster than dialup is now some how bad? So I suppose all those companies using CDNs are also horrible and despicable. I mean, how dare they use servers that are well connected!

jlgreco7• 13 years ago

Less fly-by-night-ish projects seem to have little trouble finding mirroring that 1) isn't shared by so much warez 2) doesn't make me visit a webpage and make me do a CAPTCHA, 3) doesn't blast me with shady as hell popups and advertising.

girvo2• 13 years ago

The ROM scene has always been a grey (verging on black) area when it comes to IP, however the enthusiast scene for the original WinMo and Android has helped the market in general.

There has always been a bit of a gentleman's agreement with the manufacturers that if we went too far, we'd be slapped back, but thankfully this has only happened a couple of times.

Indeed, the manufacturers themselves have been known to leak ROMS to the scene on purpose for various reasons. Sony even works directly with the hackers themselves.

josteink2• 13 years ago

The ROM scene has always been a grey (verging on black) area when it comes to IP

Speak for yourself.

There are two scenes: The binary modder scene, where people retro-fit vendor-created and provided firmware-images with their own modifications. Commonly referred to as "Photoshop ROMs". This scene is clearly grey at best.

However, there is another scene: The one based on AOSP source and derivates of it. This scene lives on Github and similar places where open source is shared and reused freely, as intended.

This is driven by serious developers and focus is on doing things cleanly, properly and reliably.

Most successful and widely deployed ROMs (like Cyanogenmod) are based on this scene, and there is nothing grey or remotely shady about it.

muyuu• 13 years ago

They are distributed in megaupload-alikes because that's the most convenient way to distribute big files with many requests.

That gives away nothing as to the general philosophy of that community.

giis• 13 years ago

latest commit says "Change Module License to Samsung Proprietary"

https://github.com/rxrz/exfat-nofuse/commit/dbf695748ab5e90a...

bjornsing4• 13 years ago

This is a quite interesting case from a legal standpoint. IANAL but my 5 cents are:

* If it's true that Samsung distributed this driver as part of the Linux kernel source code tree then it is arguably a derivative work of the Linux kernel.

* If so then these two sections of the GPL seem relevant:

4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.
6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

* I'm not absolutely sure what that means for rxrz. Section 6 seems to imply that rxrz may have a license to the driver, and that that license is indeed the GPL. On the other hand section 4 seems to imply that the redistribution to rxrz was "void". Does that mean rxrz does not have the rights under section 6?

If I where rxrz I would at least toy with this idea: a) wait for the DMCA take down notice, b) challenge it claiming to have a license under section 6 of the GPL and c) hope that Samsung does not have the nerve to go to court and risk a decision that would clarify that their license to the Linux kernel has been irreversibly revoked. :)

But where does that leave us concerning legality? Is it clear that what rxrz has done is illegal?

Nursie10• 13 years ago

> If it's true that Samsung distributed this driver as part of the Linux kernel source code tree then it is arguably a derivative work of the Linux kernel.

Did Samsung really distribute the source if it was published by accident by one employee?

Even if they did, it's under a proprietary license and it's not clear that proprietary kernel modules are necessarily derivative works, they are commonplace.

Even if they are derivative that may make Samsung in violation of the GPL but not actually make their code covered (these are be separate issues).

And even if they are in violation, this usually has to be challenged by a copyright holder, not simply by a recipient of the binaries. And that's if rxrv even received any binaries...

Section 6 is interesting there - "Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions."

I could see a lawyer arguing that the "Program" in clause 1 and 2 are the same, but if you distribute a work based on the Program the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program itself but not the work based on the Program, as that is not enumerated in clause 2.

And this is before we even get into the patent violations that any use of such code involves.

bjornsing4• 13 years ago

Even if they did, it's under a proprietary license and it's not clear that proprietary kernel modules are necessarily derivative works, they are commonplace.

True, proprietary kernel modules are commonplace, and not necessarily derivative works. But you very rarely see proprietary drivers "in-tree" (that is where the source code file is placed into the Linux kernel source code tree and built as part of the kernel build process). I remember reading an argument by Torvalds that any driver built in that way is a derivative work of the kernel (even if it is built into a module) but unfortunately I can't find it now.

Even if they are derivative that may make Samsung in violation of the GPL but not actually make their code covered (these are be separate issues).

Mmm... I'm not entirely sure... Normally I'm a "separate issues" kind of guy, but here I'm hesitating...

To make this interesting let's say Samsung has distributed to rxrz in binary form and that the driver is a derivative work. Then the driver is part of the Program distributed to rxrz under the GPL and Samsung has granted rxrz this right (as per section 1 of the GPLv2):

"You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program."

Isn't that exactly what rxrz has done? :) Why would rxrz not be allowed to argue that in court? I agree that normally the issues are separate, but in my mind the GPL ties them together in this case. I'm not saying that rxrz is right, but it's not entirely clear-cut to me.

scott_karana4• 13 years ago

If it's true that Samsung distributed this driver as part of the Linux kernel source code tree then it is arguably a derivative work of the Linux kernel.

Other companies use binary blobs in the Linux Kernel by using a GPL-compatible shim driver.

Samsung would be in violation of the GPL if they do not publish the source to the SHIM in a compatible license, but that would imply nothing about the binary blob.

Disclaimer: I'm not even sure whether they use the shim workaround in this case.

bjornsing4• 13 years ago

Usually that thin layer of source code is under a proprietary license as well. The main reason to have it is actually not legal but technical: distributing kernel modules in binary form (.ko) separately from the kernel itself is a pain in the arse (bordering on impossible) since they depend on the exact version of the kernel and in some cases even the build config (e.g. skbuff size may depend on #ifdefs).

Leaked Samsung exFat driver relicensed as GPL

Related Stories