Re: SFLC's GPL court enforcement -- track record

[Tim Smith]

In article <C9uhk.374$eg.324@fe119.usenetserver.com>,
 Hyman Rosen <hyrosen@mail.com> wrote:
> Rahul Dhesi wrote:
> > I think you folks are assuming that the GPL somehow gives you, the 
> > buyer of the router, the right to get source code from somewhere.
> 
> It does, unless the chain of GPL licensing is somehow broken,
> perhaps through the use of the First Sale Doctrine.

There are two cases to consider, as GPLv2 provides two options for the 
person distributing binaries (the same general considerations apply to 
GPLv3, and pretty much any other free software license):

1. Accompany the binary with the source, or

2. Accompany the binary with a written offer to provide source to anyone 
who asks for it, for at least three years.

Let's consider first software that is distributed under option #1.  I 
see two scenarios that are reasonably likely to become common where 
First Sale will lead to binaries in circulation with no one obligated to 
provide source.

1. Consumer buys a gadget that runs Linux.  The source is on a CD in the 
box.  Consumer doesn't give a damn about source and loses track of the 
CD.  Consumer sells the gadget on eBay.

Result: no one is obligated to provide the buyer with source.  The 
seller is covered by First Sale.  The original vendor completely 
satisfied their GPL obligation by including the source with the device 
when they sold it to the first consumer.

People are selling used Linux-based gadgets now

2. Company X makes a stand-alone box that has Linux in flash memory, and 
has an empty slot to install more flash memory.  The system is 
configured so that when it automatically mounts the filesystem on any 
flash memory inserted in the slot, and looks for "runme.sh" shell 
script, which it runs.  Company Y buys these boxes from X, an inserts 
into the slot flash memory that contains their proprietary applications 
that turn the box into a router, or a set-top box, or whatever.  X ships 
each box to Y with a CD containing the source.  Y takes the boxes, 
sticks a Y logo and model number sticker on it, and ships it to stores 
in Y labelled boxes with manuals in them.  Y doesn't give a damn about 
the source CDs and tosses them in the nearest landfill.  Consumers buy 
the boxes from stores.

Result: quite similar to the consumer gadget scenario, actually.  X 
satisfied their GPL obligation by shipping the source with the box.  
That qualifies them for branch #1 of the GPL options.  They are done.
Company Y has not modified the software or made copies.  All they've 
done is take the copies they have received, and redistributed those 
physical copies.  That puts them right smack dab in the middle of First 
Sale, so they aren't responsible for supplying source to the customer.

Note that these results change if the gadget maker (in scenario 1) or 
company X (in scenario 2) choose to go with option #2 from GPL, 
accompany the software with a written offer to provide source to anyone.  
The consumer selling on eBay, and company Y, are still covered by first 
sale.  But the eBay buyer, or buyer of Y's boxes, can now at least go 
back to the gadget maker or company X and ask for and receive source.  
(Well, if it is within three years...).

There are still practical problems in this case for the consumer, 
though.  Company Y has no obligation to tell the consumer that the box 
was made by company X.  Y might even consider this fact to be a trade 
secret.

So how likely are any of these scenarios?  The first, a consumer 
reselling a used gadget, is pretty likely.  People sell used Linux 
gadgets now, and that's only going to become more common as Linux 
becomes more popular as a gadget OS.  I think most gadget makers are 
going with GPL option #2 at the moment, so source should be available 
somewhere, but I think that's going to change.  Why opt for #2, which 
required you to deal with source distribution for at least three years, 
when you can go for option #1, and deal with your obligation 
immediately?  I'd go for #1 every time unless for some reason it was not 
feasible to ship source with the gadget.

How about the company X/company Y case?  I think there will be many 
companies playing the role of company X (I'd be surprised if there 
aren't already such boxes available to OEMs).  The big question here is 
will there be many companies in the roll of Y.  That is, companies who 
do not make any modifications to the box software, but just add their 
own applications?  And that don't bother to include the source CD?  If I 
were advising them, I'd tell them to include the source CD--even though 
they don't have to and are legally safe thanks to First Sale, it doesn't 
HURT them to include the source CD, and it will avoid ill will.  But I 
will not be surprised if a lot of Y's consider the box to be a black 
box, and pretty much ignore the source CD that comes with it.

Anyway, I think First Sale is going to become a big deal in the world of 
free software licensing.  I'm surprised how little discussion there has 
been of this.

-- 
--Tim Smith