TripleCheck

OpenRheinRuhr 2013

Wed, 06 Nov 2013 07:47:33 +0000

The OpenRheinRuhr is an open source event hosted in Germany.

Die OpenRheinRuhr ist eine Messe mit Kongress rund um das Thema "Freie Software". Die OpenRheinRuhr 2013 findet am 9. und 10. November 2013 im Rheinischen Industriemuseum in Oberhausen statt.

Entrance costs 5 Euros and is valid for the whole duration of the event during the 9th and 10th of November 2013.

More details at http://www.openrheinruhr.de/

Judge at 2014 SIIA CODiE awards

Thu, 10 Oct 2013 21:42:55 +0000

Well, first time that I’m nominated judge for a software award. SIIA (Software & Information Industry Association) has been nice enough to allow me performing such role.

Apart from this kind of task being something new to try out, there are some parts where I’m quite at ease in performing such as digging information through the Internet to evaluate different factors behind a software product and company. I’m not allowed to give details about what is going to be evaluated but it is an interesting topic and I’m quite sure that a lot can be learned.

If you’re interested to know more about the SIIA CODiE awards, you find the site at https://www.siia.net/codies/2014/

:-)

This topic was modified 2 hours, 33 minutes ago by Nuno Brito.
This topic was modified 2 hours, 32 minutes ago by Nuno Brito.

Click to reply and view full article

Ubucon 2013

Tue, 08 Oct 2013 22:14:14 +0000

The Ubuntu Conference in Germany takes place this week from the 11th to the 13th of October: http://ubucon.de/2013

I will be there to talk about about the distribution/licensing of open source software: http://ubucon.de/2013/programm#floss_licensing

The cost to attend the conference is 15 Euros and is enough for the three full days of activity.

If you drop a visit to the conference then you get a free coffee from me in return. I will (literally) bring a coffee machine for the event. So, no excuses are accepted. See you there! :)

Click to reply and view full article

49 shades of foolishness (one was too dark)

Sat, 28 Sep 2013 18:42:05 +0000

This text comes from a LOCKED topic (just like all the other ones in this Forum):

The text is made available to public for gathering feedback. If you think that something is wrong or missing, let’s discuss.

Comments, improvements and corrections are welcome.

The Forum is called:

TripleCheck news
News and discussions about open source licensing

The idea is seemingly that for comments, or discussions one needs to go to ANOTHER FORUM, aptly titled:

TripleCheck > Forum > Off topic >

My comment is that the Forum here should be named "TripleCheck news ONLY (for comments and discussions go to the TripleCheck Forum)".

Wonko

50 shades of GPL – “intimacy”

Sat, 28 Sep 2013 15:59:00 +0000

This text is part of a book entitled “50 shades of GPL” that I am writing from scratch. The goal is to describe the nuances, interpretations and perspectives behind the analysis of GPL compliance. It is written with focus on software developers writing closed-source software that would like to integrate or interact with GPL components. The text is made available to public for gathering feedback. If you think that something is wrong or missing, let’s discuss.

:)

Comments, improvements and corrections are welcome. Good opportunity to share your experiences too. I will be placing the name of the people behind each relevant contribution.

My thanks in advance!

————-
The concept of “intimacy” in GPL is likely one of the most controversial and ambiguous points of this license. It is not described in any of the GPL editions. However, “intimacy” is described directly on the Free Software Foundation website at the FAQ page:

“Mere aggregation of two programs means putting them side by side on the same CD-ROM or hard disk. We use this term in the case where they are separate programs, not parts of a single program. In this case, if one of the programs is covered by the GPL, it has no effect on the other program.

Combining two modules means connecting them together so that they form a single larger program. If either part is covered by the GPL, the whole combination must also be released under the GPL—if you can't, or won't, do that, you may not combine them.

What constitutes combining two parts into one program? This is a legal question, which ultimately judges will decide. We believe that a proper criterion depends both on the mechanism of communication (exec, pipes, rpc, function calls within a shared address space, etc.) and the semantics of the communication (what kinds of information are interchanged).

If the modules are included in the same executable file, they are definitely combined in one program. If modules are designed to run linked together in a shared address space, that almost surely means combining them into one program.

By contrast, pipes, sockets and command-line arguments are communication mechanisms normally used between two separate programs. So when they are used for communication, the modules normally are separate programs. But if the semantics of the communication are intimate enough, exchanging complex internal data structures, that too could be a basis to consider the two parts as combined into a larger program. ”

http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#MereAggregation

This FAQ entry is often used when defending the compliance or not of a given GPL component being used inside a closed-source product. It is stronger than the plain definition of linking to GPL component, this FAQ states the permission for a closed-source product to interact with a GPL component only up to a certain level.

What is the “value” of this level and how can we measure it? The value “depends”. Meaning that you will need to evaluate the context of everything involved and then do your best effort not to be caught red-handed in “intimate” interactions with GPL software.

How can we solve this problem?

As with any IPR matter you should start with your own investigation about the matter. As example, you can ask yourself the following questions:

1. Is GPL really the applicable license to this software?
2. Who are the authors, where is the website?
3. Since how long have these authors been developing the GPL software?
4. Is this GPL software associated to any commercial services/products/company?

The first question might sound redundant but what might happen sometimes is that any evaluation made in the past can sometimes induce everyone in error. Unless you have already checked the license terms in the past for the same product (and version) by yourself, you should really do this kind of check-up to be sure that no mistake exists.

When checking the applicable license terms, there are some simple methods that can be used:

1. Use a license database such as OpenLogic from http://olex.openlogic.com
2. Google for “abc license” where abc is the name of the software and look into the references
3. Look on the licenses mentioned on the public repository such as SourceForge or GoogleCode. Often also found on GitHub at the project introduction page
4. Look directly on the source code for the licensing information

These options should bring a wealth of information in regards to the applicable licenses. Hopefully they will all agree on the same direction about the license terms, if they don’t then this might indicate that at some point in time they have changed or that multiple licenses are applicable but only a few are referred. As a point of rule, you should be careful about the version number of the open source software. Per time the license version (and/or license terms) will change across different releases of the same software.

Once the license terms were confirmed. Time to learn about the authors and web references as mentioned on the questions 2 and 3 from our list, which by now you should have already visited to discover the license terms. There is usually a story to tell behind each open source product. Why there are people developing it; to whom it is intended; what problems and fights happened in the past. The merge of these details should bring to surface the reasons why the software exists in the first place. What you should be looking to understand is their vision about Free Software and how open they are to the idea of allowing the integration of their GPL’ed work inside a closed-source program.

If the GPL software is closely associated to a commercial exploration of any kind (say as e.g. MySQL), then the odds that the GPL author has a favorable understanding for “intimacy” that endorses the adoption of his software within a closed-source product will decline sharply.

For some software authors, “intimacy” is defined by “how far your closed-source system depends on my GPL software component”.

If your closed-source system has requirements (such as security) that are fulfilled exclusively by a GPL component, then exist grounds to effectively state that your system “depends” on GPL software even if no direct linking or connection exists because the principle of an “intimate” connection was proven.

This “intimacy” concept raises a fairly ambiguous situation. There are some possible options to consider:

a) Contact the author of the GPL component; explain the context where his work is being used inside your software product. Ask him if he considers your usage as compliant with the GPL terms of his work. Record the answer and include this justification on the final documentation

B) Remove the software component from your product, replace with an alternative way

c) Don’t contact the author, justify that no linking of any kind occurs and hope that nobody sends a letter one day complaining how you circumvented the spirit of Free Software

To ease understanding the above options, let’s go through the rationale behind each one.

Option a) opens the path to direct dialog with the author. It opens the way for the author to understand how you are using his software and to report back if he considers your usage as falling under the definition of derivative work or not.

The author’s opinion is important, don’t forget that only the IPR holder of the software (typically the author) can take you to a court of law for transgressing the GPL compliance. Therefore, his opinion on the matter should be seriously considered. Even without a legal process involved, it is this same author that will be feel impaired in case you do not incorporate his work in a correct manner. Therefore, do expect that this same author becomes the most vocal person demonstrating publicly his personal disagreement about your own understanding of GPL compliance. Given the impact of social media over the Internet, this might very well turn into a wild fire that burns your public credibility (either as a single person, company or group).

Option B) will likely become the least favorite option by the development team and management layers. It costs time, costs money and for the involved engineers will be truly disappointing to re-engineer something that was already solved before (and probably better) with open source software. This is the scenario where open source is a great match from a technical perspective but a risk too high to bear from a legal standpoint. Replacing the component brings losses to your side on a short term but solves a legal headache/risk on the longer term. Imagine the cost of ignoring this risk as more parts of the closed source system begin to depend on the open source component and the impact of this risk after the whole software is made available to the public or other companies.

This brings us to the last option c) that I personally don’t recommend because then your product becomes part of a “German roulette”. I’m introducing this term since Germany was the first country in the world where GPL has become admissible as a valid license agreement between two parties. The odds of escaping such a legal situation with GPL are pretty much the same as playing “Russian roulette”. Sometimes you might be lucky, suddenly you don’t.

Sticking to a plain justification that “it’s ok, it is not linked” will not suffice. Business people tend to neglect that they are dealing with “Free Software” and that this software is not really “free” to do whatever a business needs. It is necessary to understand the ethics and spirit behind this special kind of open source software, which is particularly designed not to make life any easier for those who pursue closed-source developments. If you’re closing your ears to all these things and repeating aloud several times “it is not linked”, “it is not linked”, “it is not linked”, “…”, then you will soon find yourself defending repeating these same arguments on a court of law where the judge won’t likely be so supportive of “business” goals.

TL;DR: Communication is key. If sufficient doubt exists, contact the software authors to get their opinion. If not possible, replace the software. If you ignore all these things then you risk serious problems in the future.

Click to reply and view full article

Open World Forum 2013 in Paris from 3rd to the 5th of October.

Sat, 28 Sep 2013 15:17:40 +0000

The first edition of the Open World Forum will happen next week in Paris between the 3rd and 5th of October.

Registration is free. I will be attending, hope to see you there as well.

The site can be found at http://www.openworldforum.org/en/

Click to reply and view full article

LinuxCon Europe

Sat, 14 Sep 2013 15:16:00 +0000

The next Linux conference in Europe will happen over the 21st to the 23rd of October 2013.

Besides the relevance of Linux as an operating system, it is interesting because SPDX will also be discussed there.

You find more info at http://events.linuxfoundation.org/events/linuxcon-europe/

View the full article

FrOSCon 8 conference (Germany)

Mon, 26 Aug 2013 13:34:35 +0000

Already passed the date (yesterday) but perhaps worth referring here to keep in mind for next year: http://www.froscon.de/en/home/

View the full article

Open Source and IP Terms on Kaggle competition

Mon, 26 Aug 2013 12:54:37 +0000

Participants on a kaggle competition placed plenty of questions in regards to IP and compliance. This discussion might useful to other engineers as well: http://www.gequest.com/c/flight2/forums/t/5320/open-source-and-ip-terms/29299#post29299

This topic was modified 3 weeks, 5 days ago by Nuno Brito.

View the full article

Feedback?

Sat, 24 Aug 2013 15:21:35 +0000

Hello,

If you have some time available then you are cordially invited to write some words of feedback about can be improved or changed.

Thanks!

View the full article

Tools of the trade

Thu, 22 Aug 2013 21:22:53 +0000

I will be updating this topic with some of the tools that I found handy when it comes to proceed with an analysis.

– TortoiseGIT, the simple® way of using GIT under Windows: http://code.google.com/p/msysgit/downloads/list?q=full+installer+official+git

– Notepad Plus: http://notepad-plus-plus.org/

This topic was modified 4 weeks, 1 day ago by Nuno Brito.

View the full article

Misc links

Wed, 21 Aug 2013 09:34:46 +0000

Sites
Software Freedom Conservancy: http://sfconservancy.org
FOSS patents: http://www.fosspatents.com/

People
George Greve: http://fsfe.org/about/greve/
Bruce Perens: http://perens.com/

License comparison charts
Antepedia: http://www.antepedia.com/pages/community.html
TLDRLegal: http://www.tldrlegal.com/

This topic was modified 1 month ago by Nuno Brito.
This topic was modified 3 weeks, 4 days ago by Nuno Brito.

View the full article

Contributor License Agreement – generator

Tue, 20 Aug 2013 13:41:04 +0000

The Harmony project that started a few years ago has resulted on a handy tool for generating Contributor License Agreements that allow the IPR owners of an open source project to accept contributions from other people, and still keep control over the software licensing.

You find this tool at http://selector.harmonyagreements.org/

If you need any help clarifying what this involves, just let me know.

View the full article

ICT 2013 conference

Sun, 18 Aug 2013 11:20:56 +0000

Between the 6th and the 8th of November Lithuania will host the EU gathering on the state of open source policies for the future. Below is the link for further details.

https://ec.europa.eu/digital-agenda/en/ict-2013-conference

View the full article

EU based open source projects

Fri, 16 Aug 2013 21:11:43 +0000

There exist a number of European projects being developed at this moment. Below are the links to find them.

MARKOS: http://www.markosproject.eu/
RISCOSS: http://www.riscoss.eu/bin/view/Main/
OSSMETER: http://www.ossmeter.eu/
PROSE: http://www.ict-prose.eu/

My favorite one so far is MARKOS, they are making available the source code and it is being built in Java.

What is your opinion?

View the full article

Differences between GPL and GPL with exceptions?

Fri, 16 Aug 2013 17:28:31 +0000

A question for the readers, do you know how to tell apart a software under GPL terms from the a software that is GPL + exceptions?

If you’re interested, we can talk about the differences that any developer should take into attention when using software under this licensing.

This topic was modified 1 month ago by Nuno Brito.

View the full article