Contractor had included GPL code, so Microsoft decides to publish its own source

http://lawandlifesiliconvalley.com/blog/?p=306

by dctoedt • 17 years ago

18 40 17 years ago

jacquesm6• 17 years ago

Weird how it gets spun as a 'danger of open source'.

It's simply being careless. If they have a review process and it did not catch this it can't be much of a review.

The really worrying thing here is not that a chunk of gpl'd code made it into the distribution but that apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight.

Tangurena• 17 years ago

Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore. And that becomes a "danger" in a businessman's model of the world because it is a clear and present danger to the health and survivability of their company.

> apparently subcontractors can put chunks of code in to microsofts main distributions without proper oversight

Microsoft, like most companies, has been hiring too many contractors instead of FTE. While this gets spun as a "contractor out of control" it isn't a contractor out of control, it is a business model out of control.

DarkShikari2• 17 years ago

Well, the "danger" is that if this is a money making product, it suddenly would become a money loser, as you won't be able to sell it anymore.

How does this follow from anything? There's nothing about the GPL that says you can't sell your product. This has happened before; a Japanese game used Xvid a while back for its videos and included the GPL Xvid decoder in the binary (stupidly, since there are better LGPL equivalents anyways). They got called on it and released the source of the game--but did anyone care? I highly doubt that it hurt sales--everyone who was going to pay for it probably still paid for it, and everyone who was going to pirate it probably still pirated it.

lanstein• 17 years ago

I would not say this is "spun." Furthermore, from his bio, "I am the General Counsel, pro bono, of the Open Source Initiative."

My reaction to the HN title was "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)

jacquesm6• 17 years ago

> "wow, imagine if someone came on the Windows team and 'accidentally' included GPLed code..." ;)

I solemnly promise that if that comes to pass you will be credited with planting the seed.

Now, does anybody have a way to get me on the windows team as a developer ?

shpxnvz• 17 years ago

Then they would simply remove the GPL code and push out an update. The GPL does not compel the release of source code - if they accidentally distribute a product that does not comply with the requirements of the included GPL software then they simply lose the right to distribute the GPL software at the copyright holder's discretion.

freetard5• 17 years ago

> Microsoft decides to publish its own source

"Decides"? The very gpl license forces them to do so, this headline basically says "Microsoft decides to respect the law". Nothing to see here.

jdale27• 17 years ago

Couldn't they have instead rewritten their code so that it didn't use the GPL-licensed code?

freetard5• 17 years ago

Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.

makmanalp• 17 years ago

Also, I don't know how just open sourcing the code is fine by the law. An example, If I stole money from a bank and then brought it all back the next day, and the bank had no net loss because it didn't do anything with the hard currency anyway, wouldn't I still be prosecuted? Not likening Microsoft's actions to stealing money here, it's just an example.

jmillikin5• 17 years ago

Not that it would do much in this case -- worst case, a judge places an injunction against Microsoft and they're not allowed to distribute the utility. The author would have a very hard time proving damages, since both the original code and utility are distributed for free.

jmillikin5• 17 years ago

Microsoft had four options:

1. Stop distributing the utility

2. Publish the utility's source code under the GPL

3. Arrange a separate licensing agreement with the owner of the GPL'd code

4. Remove the infringing code from their utility

Nothing about the GPL "forces" the infringer to divulge their code -- that's simply one available option.

freetard5• 17 years ago

> Nothing about the GPL "forces" the infringer to divulge their code -- that's simply one available option.

Wrong, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary.

kevinpet• 17 years ago

Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code. The contractor would be toast (probably had an indemnification clause), MS wouldn't have been on the hook for that much even if the copyright holders of the GPL code sued for infringement, as it wasn't willful.

The GPL absolutely does not force them to do so. It cannot, as it is simply a copyright license. The GPL actually terminated as soon as MS distributed the code, since they weren't following it's rules.

I don't know if they have a formal agreement with the copyright owner, or if they're just following what is an accepted practice in opening the source, but technically GPL v2 cannot be "reactivated" on its own.

freetard5• 17 years ago

> Microsoft could have quite legitimately just yanked the app until they could rewrite it without the GPL code.

Nope, as soon as you publish your app publically, you are forced to give the whole source code of that version of the app to anyone who downloaded the binary and asks for the source.

eli2• 17 years ago

Hmm, so I can give away copies of MS Office so long as I stop when someone points out it's copyright violation?

jmillikin5• 17 years ago

You would probably have to pay damages; see the ongoing drama of RIAA v. The Public for an example.

jrockway5• 17 years ago

Don't tell anyone, but I really want to try this technique on Android. Cut-n-paste some GPL3 code from somewhere, get it accepted, wait for the binary using the code to be released, and then you can get root on your phone simply by sending a nastygram (as the GPL3 prohibits devices from locking out the user without their consent).

No more wasting time finding a security hole!

(Perhaps this has already been done!)

wmf• 17 years ago

Such a trick only works if the code doesn't matter. For something as important as Android, Google would just remove the offending code. Also, all code coming into important projects like Android has to have someone to vouch for it, so perhaps Google could shift the blame to the submitter (who would have had to remove the GPLv3 notice before submitting the code).

jrockway5• 17 years ago

Doesn't matter who they blame. Once the GPL3 code is in your hand, on the phone, they are stuck. Removing the code is fine, just like how they fix security holes that let you get root.

jacquesm6• 17 years ago

So, your idea of telling nobody is to post something on a forum that catches 40K uniques on a good day and has employees from that specific company as it's members ?

Something tells me you're not entirely serious ;)

jrockway5• 17 years ago

Looking out for one class of problem makes it easier to inject other classes of problems.

Or they could just give me root on my fucking mp3 player.

Contractor had included GPL code, so Microsoft decides to publish its own source

Related Stories