There are many facets to the Sony BMG Rootkit situation that are worth pondering, but I have to admit that I’ve been intrigued by one particular facet of the recent fracas: Sony’s apparent use of open source application code in its digital rights management “worm”. As far as I can glean, part of the Sony Rootkit code comes from Mike Cheng’s Open Source project LAME, which is a “GPL’d” MP3 encoder. (GPL used to be “GNU Public License” but now means “General Public License”, as explained at Wikipedia)
Sony’s partner that built the rootkit is clearly in the wrong and violated the GPL license agreement under which LAME is released to the general public. That’s been implied in various articles (for example, Did Sony Rootkit Pluck from Open Source) but no-one that I’ve seen has come out and said that Sony was wrong, that its violated the license, and that Sony needs to make amends of some sort.
And so we come to another company, a smaller firm that also says that it misunderstood the General Public License to mean that the software was freely available to modify and alter as needed for a freeware product: Vbuzzer. If you pay attention to this weblog, you’ll have already read about my positive experiences with Vbuzzer, a VOIP solution for home and office (see VOIP for Small Business).
When Vbuzzer first made its free VOIP and instant messenger client available for download, part of the IM code apparently came from the Open Source Miranda IM project. You might think that it shouldn’t be a big deal to have a company distribute freeware based partially on an Open Source application, but you’d be wrong. The GPL license terms explicitly prohibit this use, as detailed in an exhaustive posting on the Miranda IM Developers Journal:
“You may copy and distribute verbatim copies of the Program�s source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.”
As is documented in the Miranda article, Vbuzzer didn’t do any of this, and quite frankly did some pretty dumb things instead, including stripping out the Miranda copyright and replacing it with their own. Violating the terms of the GPL mean that you cannot use the Open Source code in your product, as is also clearly stated in the GPL terms.
It’s worth pointing out that the GPL itself is quite long (I calculate it has just under 3000 words) and that companies violate the terms of the GPL all the time, sometimes through malice but mostly through misunderstandings. There are also a staggering number of different Open Source licenses too, each with its own nuances.
Sidenote: Years ago, when I contributed some software to the Open Source community, I rejected the GPL because I felt it was too complex and I didn’t like the uses it proscribed, feeling them unrealistic and a barrier to innovation. My opinion remains the same, though that’s a slightly different topic.
Which leads to my question: what does a company have to do to get back into the good graces of the Open Source community?
Consider Vbuzzer. The day after one of the Miranda IM Project team posted a note about Vbuzzer GPL violations, the team at Vbuzzer mailed the Miranda team the following message:
“As a first step, we have disabled the download link from vbuzzer website, so no new download will happen from now on. In the next few days we will remove Miranda from vbuzzer, then post the new version, then force every user to upgrade to the new version. We expect to finish all the steps in several days.”
The message from the Vbuzzer team continued with:
“Just to clarify the �new version� on my above text, it means the version without any Miranda codes. I’ve explained we had our own Internet Telephony client that can work independently, this is what I mean by “new version”. We understand that the we are voided the Miranda�s source and we will cease using it.”
I was impressed. The company, upon learning that it had violated the license terms of the Miranda IM software, turned on a dime, immediately stopping the distribution of the software in violation of the license terms and recoding the Vbuzzer program to sidestep the problem completely.
But Open Source people are unforgiving as a general rule, and rather than offer an olive branch to a company that so clearly was trying to correct its error and do the right thing, the response from the Miranda team was short and to the point:
“Hey, I�m sorry but that has voided your rights to Miranda�s source.”
It’s this intractability that I believe makes so much of the Open Source development problematic for the greater community of software developers and computer users.
This is all relatively old news, having happened a few months ago. At this point, I can only presume that the latest version of the Vbuzzer software is completely void of any Miranda IM code.
Just yesterday, however, the folk at Vbuzzer posted a note on the Miranda IM discussion boards explaining exactly what they’d done back in July of this year and ending with what seems like another attempt at establishing a healthy working relationship with the Miranda IM team:
“We are sorry for what has happened, we would contribute to Miranda’s further development in any ways we can. We have proposed to Miranda administrators a few possible to contribution, as well as [sent them] a draft file of the changes we’ve made to the software.”
Sony was out of line with its Rootkit DRM and its inclusion of some of the LAME code. Sony hasn’t demonstrated that it’s even aware of the problem and certainly there’s no indication I’ve seen that Sony realizes it committed a legal blunder or that it’s going to try and make the situation right.
Vbuzzer, on the other hand, is doing everything right. It made a mistake — a not-uncommon mistake — in how it interpreted the GPL license terms, and since then has made extraordinary efforts to remedy the situation, rewriting its code, changing the very nature of its software solution, and even offering to contribute to the further development of Miranda IM.
And yet I bet that the Miranda IM project team will spurn these offers and either completely ignore the Vbuzzer posting or reject their offer with a curt response.
I just don’t understand why.
It’s time for the Open Source community to recognize that the partnership with commercial software is what’s going to drive innovation and help us all reap the benefit of more sophisticated software and solutions.