Delve Labs forks the now Non-Free WPScan WordPress vulnerability scanner

https://www.delvelabs.ca/robbed-gunpoint/

by initnull • 12 years ago

24 12 12 years ago

tshtf• 12 years ago

What's the issue?

1. Delve Labs has commercial scanners (https://www.delvelabs.ca/warden-scanner/ and https://www.delvelabs.ca/warden-pro/) which bundle wpscan.

2. Delve Labs chose not to pay for the commercial license for wpscan (https://github.com/wpscanteam/wpscan)

3. Delve Labs clearly falls under the "Commercialization" clause of the new wpscan license

It seems to me like commercial products that take a free ride on dual-licensed GPL products should just pay the fee.

RRRA2• 12 years ago

Except that is the AGPL not the GPL which allows you to run free software as a service.

Also, a commercialization clause (that is probably incompatible with the GPL) is not the same as a dual licence.

stgraber2• 12 years ago

Correct, a commercialization clause is clearly incompatible with the GPL as is mentioned in their FAQ: http://www.gnu.org/licenses/gpl-faq.html#NoMilitary

So short of proper dual-licensing (which this isn't), that clause isn't valid.

harwoodr2• 12 years ago

Software that a commercial entity decides it would like to use under a closed sourced license - sure that's when a dual-license is applicable.

GPL software that a commercial entity releases their source code modifications - that's still GPL. You can't say commercial uses aren't allowed under the GPL.

Forking the codebase from before the license change? Yep, allowable under the GPL...

Seems like a lot of ranting/raving over hurt feelings...

p89522• 12 years ago

It seems more like:

1. Delve Labs has commercial scanners which bundle but do not link with WPScan.

2. WPScan, previously licensed under the GPL, introduce a commercialization clause in addition to the GPL.

Side Note. WPScan may not have the right to do this because they do not use copyright attribution. Without this they need permission from everyone who has ever contributed code to their project.

3. WPScan demand money from Delve Labs.

4. Delve Labs make a fork from a point before WPScan introduced the commercialization clause. They keep this version licensed under the GPL.

harwoodr2• 12 years ago

Yep. I think the WPScan guy doesn't understand how the GPL works... and seems to think that having a "wrapper" around it for commercial/non-commercial somehow lets him circumvent the GPL intent.

Forking the code from before the license change is an excellent way to keep free software free - and yes, I think he'll have to get permission from every prior contributor before he can legally change the license.

RRRA2• 12 years ago

See this comment where they list all the (probably unaware) contributors:

https://www.delvelabs.ca/robbed-gunpoint/#comment-1811325060

xj9• 12 years ago

What's the point of non-commercial GPL? I'm not a hard line copyleft guy, but I don't understand why you would make something "open source" when its really freeware.

p89522• 12 years ago

Indeed, not to mention the GPL explicitly forbids this[1].

The point of the GPL is to fight for the rights of the user, no matter if that user is a single hacker wanting to tinker with the code or a giant multinational wanting to use it for $$$.

1. https://www.gnu.org/licenses/gpl-faq.html#NoMilitary

th0br0• 12 years ago

Just looking at the list of contributors, I'm wondering whether they got permission from each of those to relicense the codebase. (Did they do that when they "non-commercialized" their vulnerability db? Can't really find a notion of that in the issue #435)

EDIT: Just saw their "6. Contributions" clause... IANAL but I don't think that that is enforcable, esp. not without having a CLA.

belorn• 12 years ago

There has been some recent changes to the license of wpscan, which is not obvious from reading the article.

Initially, wpscan was licensed purely under gplv3.

On 26 Sep 2014, the 2.5 release of wpscan changed the license to a self-described dual-license scheme where noncommercial could still use GPLv3, and commercial use had to use a commercial license. GPLv3 permits you to remove any addition constraints, so license text and projects intent clearly conflicts.

Yesterday the license was changed again to a newly created license called WPScan Public Source License. It is similar to Creative Commons Non-Commercial which is commonly defined as non-free, non-open-source license. It is incompatible with all version of GPL.

stgraber2• 12 years ago

Right and it seems unlikely that either license change happened with consent from all contributors up to that point, so as the project doesn't have a CLA and the copyright of the individual contributions remains with their original author, those relicensing weren't legal.

Delve Labs forks the now Non-Free WPScan WordPress vulnerability scanner

Related Stories