Sign in to follow this  
Hodgman

LGPL on a closed platform

Recommended Posts

Hodgman    51345
Lets say I found out that *company name* was shipping products that dynamically link to LGPL libraries in the following form: * The platform is completely closed -- the product cannot ever be modified (well, at least not without breaking several physical and logical DRM systems). * There *may* be a copy of the license and an offer for the source included in the distribution, but I don't know because the platform is closed. Does this violate the LGPL? And if so, what should I do about it?

Share this post


Link to post
Share on other sites
Trapper Zoid    1370
I was under the understanding that to use the LGPL you had to provide a method to be able to use updated versions of the libraries. That's why you either needed to provide dynamic linking or static linking with your own object code for recompilation. So this does sound like a violation to me.

For your second question, what you should do about it depends on what you want to do and your relationship with the company [smile]. If you're associated with the company, I'd be giving stern warnings as soon as I heard about the idea of using the LGPL for this. But if you're wanting to call the company out, I'd recommend contacting the owner of the copyright of the LGPLed library as they're the ones who've got the leverage.

Share this post


Link to post
Share on other sites
Hodgman    51345
Quote:
Original post by Trapper Zoid
I was under the understanding that to use the LGPL you had to provide a method to be able to use updated versions of the libraries.
Yeah that's what I thought too, but the legalese says the application "will operate properly with a modified version of the Library" -- which is true in this case. The app will work with a modified version, there's just no way for the end-user to get their modified version onto the platform...

Share this post


Link to post
Share on other sites
frob    44978
Quote:
Does this violate the LGPL?
Ultimately this question is up to judges.

Like the others, I believe this falls within the scope of the LGPL, but nothing prevents the copyright holders from suing and asserting that it does violate the terms. Based on that lawsuit, a judge may ultimately decide which side of the line this falls. Without such a lawsuit, we can only speculate.
Quote:
And if so, what should I do about it?
Are you a copyright holder, or the potential infringer, or an outsider?

If you are a copyright holder, you have the option of taking action against them, starting with friendly phone calls and potentially ending with a multi-bajillion dollar lawsuit. Be sure to talk with a team of competent IP lawyers before doing anything, since you'll need to know a whole lot about the IP rights and about the details of the implementation which we don't know.

If you are the potential infringer, you should talk with your IP legal experts about the possibility of it being a violation, the risks of lawsuits (regardless of it being an actual violation), the risks and costs for the various available avenues, the risks and costs of obtaining a different license from the copyright holder, the risks and costs of developing a replacement library, etc.

If you are an outsider, you can choose to do nothing, or you can choose to notify the copyright holders.

Share this post


Link to post
Share on other sites
cbenoi1    484
The following paragraph taken from http://www.gnu.org/licenses/gpl-faq.html might shed further light into the matter:

Quote:

What is tivoization? How does GPLv3 prevent it?
Some devices utilize free software that can be upgraded, but are designed so that users are not allowed to modify that software. There are lots of different ways to do this; for example, sometimes the hardware checksums the software that is installed, and shuts down if it doesn't match an expected signature. The manufacturers comply with GPLv2 by giving you the source code, but you still don't have the freedom to modify the software you're using. We call this practice tivoization.

When people distribute User Products that include software under GPLv3, section 6 requires that they provide you with information necessary to modify that software. User Products is a term specially defined in the license; examples of User Products include portable music players, digital video recorders, and home security systems.


-cb

Share this post


Link to post
Share on other sites
Hodgman    51345
Quote:
Original post by cbenoi1
The following paragraph taken from http://www.gnu.org/licenses/gpl-faq.html might shed further light into the matter:

*snip*
So it's not a LGPL v2 violation, but it may well be a LGPL v3 violation? -- The DRM in this case *does* prevent the platform from working if the checksum fails and (obviously) instructions are not supplied on how to circumvent this behaviour.

Is v3 "opt in", or can a v2 license automatically be upgraded to v3 without notice?

[EDIT] I need to read this license in more detail, Wikipedia seems to say that tivoization is ok if you only give the software to other businesses:
Quote:
In the third and fourth discussion drafts of GPLv3, released March 28, 2007 and May 31, 2007 respectively, the anti-tivoization clause was limited so as not to apply when the software is distributed to a business.[9] Thus, medical devices and voting machines would not be covered. Linus Torvalds has said he is "pretty pleased" with the new draft and its stance on DRM.[10]

The final, official GPLv3 was published on June 29, 2007 with no major changes in respect to tivoization relative to the fourth draft.

[EDIT2]
This seems strange to me, but it seems that if you make it non-editable, then you aren't forced to tell people how to edit it.
Quote:
But [the requirement to supply installation/modification instructions] does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).

Share this post


Link to post
Share on other sites
frob    44978
Quote:
Original post by Hodgman
Quote:
Original post by cbenoi1
The following paragraph taken from http://www.gnu.org/licenses/gpl-faq.html might shed further light into the matter:

*snip*
So it's not a LGPL v2 violation, but it may well be a LGPL v3 violation?
Note that those comments were specific to the GPL, not the LGPL.

LGPLv3 waives several restrictions of the GPL, including Anti-Circumvention clauses.


As was mentioned above, this only matters if you are the copyright holder or if you are the one who is distributing the devices. In both cases, you should consult an actual IP lawyer. If you aren't either of them, then you should either do nothing or send a report to the copyright owner.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this