Conservancy/website
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Copyleft Compliance: Minor rewrite of strategy & firmware liberation

Browse source 
This rewrite should improve the stand-alone nature of these documents
and allow for better integration with other summary text and
announcements on the website.

Note that they have now drifted heavily from the original formulation
of the items as grant proposals.
This commit is contained in:
Bradley M. Kuhn 2020-07-17 13:11:46 -07:00
parent a8710b4b9f
commit 46c50ec0b1
1 changed files with 79 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

160
www/conservancy/static/copyleft-compliance/enforcement-strategy.html
View file

@ -5,15 +5,14 @@
<h1 id="software-freedom-conservancy-proposal-for-gpl-enforcement-grant">History and Future Strategy</h1>
<p>The Software Freedom Conservancy is a 501(c)(3) non-profit charity
registered in New York. Founded in 2006, Conservancy helps people take control
of their computing by growing the software freedom movement, supporting
community-driven alternatives to proprietary software, and defending free
software with practical initiatives. Conservancy accomplishes these goals
with various initiatives including fiscal sponsorship, licensing and project
governance policy, and public advocacy. Some of Conservancy's most important
licensing policy work involves defending and upholding the rights of
software users and consumers under copyleft licenses, such as the GPL.</p>
<p>As existing donors and supporters know, the Software Freedom Conservancy
is a 501(c)(3) non-profit charity registered in New York, and Conservancy
helps people take control of their computing by growing the software
freedom movement, supporting community-driven alternatives to proprietary
software, and defending free software with practical initiatives.
Conservancy accomplishes these goals with various initiatives, including
defending and upholding the rights of software users and consumers under
copyleft licenses, such as the GPL.</p>
<h2 id="brief-history-of-user-focused-gpl-enforcement">Brief History of
User-Focused GPL Enforcement</h2>
@ -23,28 +22,28 @@
mainstream, and wireless routers for home use had flooded the market
earlier in the year. By June
2003, <a href="https://hardware.slashdot.org/story/03/06/08/1749217/is-linksys-violating-the-GPL">the
general public knew that Linksys (a division of Cisco) was violating the
GPL</a> on their WRT54G model wireless routers. Hobbyists discovered
(rather easily) that Linux, BusyBox and many GNU programs were included in
the router, but Linksys and Cisco had failed to provide source code or any
offer for source code to its customers.</p>
general public knew that Linksys (a division of Cisco) was violating the
GPL</a> on their WRT54G model wireless routers. Hobbyists discovered
(rather easily) that Linux and BusyBox were included in the router, but
Linksys and Cisco had failed to provide source code or any offer for source
code to its customers.</p>
<p>A coalition formed made up of organizations and individuals — including
Erik Andersen (major contributor to and former leader of the BusyBox
project) and Harald Welte (major contributor to Linux’s netfilter
subsystem) — to enforce the
GPL. <a href="https://sfconservancy.org/about/staff/#bkuhn">Bradley
M. Kuhn</a>, who is now Conservancy’s Policy Analyst and
Hacker-in-Residence, led and coordinated that coalition when he was
Executive Director of the FSF. By early 2004, this coalition, through the
M. Kuhn</a>, who is now Conservancy’s Policy Analyst and
Hacker-in-Residence, led and coordinated that coalition (when he was
Executive Director of the FSF). By early 2004, this coalition, through the
process of GPL enforcement, compelled Linksys to release an
almost-GPL-compliant source release for the
WRT54G. A <a href="https://openwrt.org/about/history">group of volunteers
quickly built a new project, called OpenWRT</a> based on that source
quickly built a new project, called OpenWRT</a> based on that source
release. In the years that have followed, OpenWRT has been ported to almost
every major wireless router product. Now, more than 15 years later, the
every major wireless router product. Now, more than 15 years later, the
OpenWRT project routinely utilizes GPL source releases to build, improve
and port OpenWRT. The project has also joined coalitions to fight the FCC
and port OpenWRT. The project has also joined coalitions to fight the FCC
to ensure that consumers have and deserve rights to install modified
firmwares on their devices and that such hobbyist improvements are no
threat to spectrum regulation.</p>
@ -58,12 +57,12 @@
create hardware that fully supports OpenWRT’s features and improvements
(such as dealing
with <a href="https://openwrt.org/docs/guide-user/network/traffic-shaping/sqm">the
dreaded “bufferbloat” bugs</a>). This interplay between the hobbyist
dreaded “bufferbloat” bugs</a>). This interplay between the hobbyist
community and for-profit ventures promotes innovation in
technology. Without both permission <em>and</em> the ability to build and
modify the software on their devices, the hobbyist community
shrinks. Eventually, instead of encouraging people to experiment with their
devices, hobbyists are limited by the oft-arbitrary manufacturer-imposed
shrinks. Without intervention to assure companies respect the hobbyist
community, hobbyists are limited by the oft-arbitrary manufacturer-imposed
restraints in the OEM firmware. OpenWRT saved the wireless router market
from this disaster; we seek to help other embedded electronic subindustries
avoid that fate. The authors of GPL’d software chose that license so its
@ -87,8 +86,8 @@
firmware that works on that era of Samsung televisions and allows consumers
to modify and upgrade their firmware using FOSS.</p>
<p>Harald Welte also continued his efforts during the early and mid-2000s
after the Linksys enforcement through
<p>Harald Welte also continued his efforts during the early and mid-2000s,
after the Linksys enforcement, through
his <a href="https://gpl-violations.org/">gpl-violations.org
project</a>. Harald successfully sued many companies (mostly in the
wireless router industry) in Germany to achieve compliance and yield source
@ -97,25 +96,25 @@
<h2 id="importance-of-linux-enforcement-specifically">Importance of Linux Enforcement Specifically</h2>
<p>In recent years, embedded systems technology has expanded beyond wireless
routers to so-called “Internet of Things” devices designed for connectivity
with other devices in the home and to the “Cloud”. Consumer electronics
companies now feature and differentiate products based on Internet
connectivity, and related services. Conservancy has seen Linux-based
firmwares on refrigerators, baby monitors, virtual assistants, soundbars,
doorbells, home security cameras, police body cameras, cars, AV receivers,
and televisions.</p>
routers to so-called “Internet of Things” (IoT) devices designed for
connectivity with other devices in the home and to the “Cloud”. Consumer
electronics companies now feature and differentiate products based on
Internet connectivity and related services. Conservancy has seen
Linux-based firmwares on refrigerators, baby monitors, virtual assistants,
soundbars, doorbells, home security cameras, police body cameras, cars, AV
receivers, and televisions.</p>
<p>This wide deployment of general purpose computers into mundane household
devices raises profound privacy and consumer rights
<p>This wide deployment of general purpose computers into
mundane household devices raises profound privacy and consumer rights
implications. <a href="https://www.nytimes.com/2019/12/15/us/Hacked-ring-home-security-cameras.html">Home</a> <a href="https://www.washingtonpost.com/technology/2019/01/23/family-says-hacked-nest-camera-warned-them-north-korean-missile-attack/">security</a> <a href="https://www.npr.org/sections/thetwo-way/2018/06/05/617196788/s-c-mom-says-baby-monitor-was-hacked-experts-say-many-devices-are-vulnerable">cameras</a> <a href="https://www.cnn.com/2019/12/12/tech/ring-security-camera-hacker-harassed-girl-trnd/index.html">are</a> <a href="https://abc7.com/baby-monitor-hack-leads-to-kidnap-scare/4931822/">routinely</a> <a href="https://www.bbc.com/news/av/uk-44117337/security-footage-viewed-by-thousands">compromised</a>
— invading the privacy and security of individual homes. Even when
companies succeed in keeping out third parties, consumers
are <a href="https://www.theguardian.com/technology/2019/aug/29/ring-amazon-police-partnership-social-media-neighbor">pressured
by camera makers</a> to automatically upload their videos to local
by camera makers</a> to automatically upload their videos to local
police. Televisions
routinely <a href="https://techcrunch.com/2019/01/07/vizio-settlement-moves-forward/">spy
on consumers for the purposes of marketing and massive data
collection</a>.</p>
on consumers for the purposes of marketing and massive data
collection</a>.</p>
<p>There is one overarching irony to this growing dystopia: nearly all these
devices are based primarily on software licensed under the GPL: most
@ -159,21 +158,22 @@
examine, modify and experiment with software in their own devices. Those
hobbyists became the professional embedded device developers of today!
Theoretically, the advent of the “Internet of Things” — with its many
devices that run Linux — should give opportunities for young hobbyists to
quickly explore and improve the devices they depend on in their every day
lives. Yet, that’s rarely possible in reality. To ensure that both current
and future hobbyists can practically modify their Linux-based devices, we
must enforce Linux’s license. With public awareness that their devices can
be improved, the desire for learning will increase, and will embolden the
curiosity of newcomers of all ages and backgrounds. The practical benefits
of this virtuous cycle are immediately apparent. With technological
experimentation, people are encouraged to try new things, learn how their
devices work, and perhaps create whole new types of devices and
technologies that no one has even dreamed of before.</p>
devices that run Linux — <em>should</em> give opportunities for young
hobbyists to quickly explore and improve the devices they depend on in
their every day lives. Yet, that’s rarely possible in reality. To ensure
that both current and future hobbyists can practically modify their
Linux-based devices, we must enforce Linux’s license. With public awareness
that their devices can be improved, the desire for learning will increase,
and will embolden the curiosity of newcomers of all ages and
backgrounds. The practical benefits of this virtuous cycle are immediately
apparent. With technological experimentation, people are encouraged to try
new things, learn how their devices work, and perhaps create whole new
types of devices and technologies that no one has even dreamed of
before.</p>
<p>“Internet of Things” firmware should never rely on one vendor — even the
vendor of the hardware itself. This centralized approach is brittle and
inevitably leads to invasions of the public’s privacy and loss of control of their
<p>IoT firmware should never rely on one vendor — even the vendor of the
hardware itself. This centralized approach is brittle and inevitably leads
to invasions of the public’s privacy and loss of control of their
technology. Conservancy’s GPL enforcement work is part of the puzzle that
ensures users can choose who their devices connect to, and how they
connect. Everyone deserves control over their own computing — from their
@ -212,24 +212,23 @@
goodwill. After the BusyBox lawsuit settled, we observed a slow move toward
intentional non-compliance throughout the embedded electronics
industry. Companies use delay and “hardball” pre-litigation tactics to
drain the limited resources available for enforcement, which we faced for
example
in <a href="https://sfconservancy.org/copyleft-compliance/vmware-lawsuit-links.html">the
VMware violation</a>. While VMware ultimately complied with the GPL, they
drain the limited resources available for enforcement, which we faced (for
example) in <a href="/copyleft-compliance/vmware-lawsuit-links.html">the
VMware violation</a>. While VMware ultimately complied with the GPL, they
did so by reengineering the product and removing Linux from it — and only
after the product was nearing end-of-life.</p>
<p>Conservancy has recently completed an evaluation of the industry’s use of
Linux in embedded products. Our findings are disheartening and require
action. Across the entire industry, most major manufacturers almost flaunt
their failure to comply with the GPL. In our private negotiations, pursuant
to
our <a href="https://sfconservancy.org/copyleft-compliance/principles.html">Principles
of Community-Oriented GPL Enforcement</a>, GPL violators stall, avoid,
action. Across the entire industry, most major manufacturers almost flaunt
their failure to comply with the GPL. In our private negotiations,
pursuant to
our <a href="/copyleft-compliance/principles.html">Principles
of Community-Oriented GPL Enforcement</a>, GPL violators stall, avoid,
delay and generally refuse to comply with the GPL. Their disdain for the
rights of their customers is often palpable. Their attitude is almost
universal: “if you think we’re really violating the GPL, then go ahead and
sue us. Otherwise, you’re our lowest priority.”</p>
rights of their customers is often palpable. Their attitude is almost
universal: <q>if you think we’re really violating the GPL, then go ahead and
sue us. Otherwise, you’re our lowest priority</q>.</p>
<h2 id="conservancys-plan-for-action">Conservancy’s Plan For Action</h2>
@ -239,7 +238,7 @@
<h3 id="litigation">Litigation</h3>
<p>Conservancy has many violation matters that we have pursued during the
last year where we expect compliance is impossible without litigation. We
last year where we expect compliance is impossible without litigation. We
are poised to select — from among the many violations in the embedded
electronics space — a representative example and take action in USA courts
against a violator who has failed to properly provide source code
@ -254,28 +253,27 @@
<p>Conservancy, after years of analyzing its successes and failures of
previous GPL compliance litigation, has developed — in conjunction with
litigation counsel over the last year — new approaches to litigation
strategy. We believe this will bring to fruition the promise of copyleft: a
license that assures the rights and software freedoms of hobbyists who seek
full control and modifiability of devices they own. With the benefit of
this grant, Conservancy plans to accelerate these plans in 2020 and to keep
the public informed at every stage of the process.</p>
strategy. We believe this will bring to fruition the promise of copyleft:
a license that assures the rights and software freedoms of hobbyists who
seek full control and modifiability of devices they own. With the benefit
of this grant, Conservancy plans to accelerate these plans in 2020 and to
keep the public informed at every stage of the process.</p>
<h3 id="persistent-non-litigation-enforcement">Persistent Non-Litigation Enforcement</h3>
<p>While we will seek damages to cover our reasonable costs of this work, we
do not expect that any recovery in litigation can fully fund the broad base
of work necessary to ensure compliance and the software freedom it
brings. Conservancy is the primary charitable watchdog of
GPL compliance for Linux-based devices. We seek to use litigation as a tool
in a broader course of action to continue our work in this regard. We
expect and welcome that the high profile nature of litigation will inspire
more device owners to report violations to us. We expect we’ll learn about
classes of devices we previously had no idea contained Linux, and we’ll
begin our diligent and unrelenting work to achieve software freedom for the
owners of those devices. We will also build more partnerships across the
technology sector and consumer rights organizations to highlight the
benefit of copyleft to not just hobbyists, but the entire general
public.</p>
of work necessary to ensure compliance and the software freedom it brings.
Conservancy is the primary charitable watchdog of GPL compliance for
Linux-based devices. We seek to use litigation as a tool in a broader
course of action to continue our work in this regard. We expect and
welcome that the high profile nature of litigation will inspire more device
owners to report violations to us. We expect we’ll learn about classes of
devices we previously had no idea contained Linux, and we’ll begin our
diligent and unrelenting work to achieve software freedom for the owners of
those devices. We will also build more partnerships across the technology
sector and consumer rights organizations to highlight the benefit of
copyleft to not just hobbyists, but the entire general public.</p>
<h3 id="alternative-firmware-project">Alternative Firmware Project</h3>