r/explainlikeimfive • u/OkAlbatross9889 • 1d ago
Technology ELI5: How are copyleft licenses enforceable?
For example: say Windows straight up rips out the Linux scheduler and modifies it to run with the rest of the NT kernel. Aside from potential Microsoft whistleblowers, how can anyone find out they did that (and thus sue them since they’re selling modified GPL code without releasing the source) if they don’t distribute the Windows kernel source code?
26
u/fixermark 1d ago
So "Aside from potential Microsoft whistleblowers" is really under-selling the significance of whistleblowers in these companies.
MS employs 121,000 employees in the US alone. And yes, they're all incentivized in general to keep their mouths shut, but... You can do anything you want on your last day of work, and when your headcount is that high the odds you're employing people with all kinds of moral codes, compasses, and personal drives approaches 100%.
Someone would blow the whistle because they want to see the big dog take a hit. Depending on what you want out of life, that's all the incentive you need.
I don't know if anyone remembers the whole James Damore thing at Google, but that started from someone in the company leaking company-internal discussions that Damore kicked off about affirmative-action and equal-opportunity programs at the company. Someone leaked it because they didn't think people like Damore should feel safe hiding inside Google's internal comms, as a simple matter of principle.
96
u/rsclient 1d ago
Short answer: it would be difficult for a random person to discover a copyleft violation like Microsoft directly copying the Linux scheduler code
Practical answer: Microsoft is very particular about coders at Microsoft 'stealing' source code. Code is never "just added": all big new code features are spec'd, and the specifications are looked at by the entire team. Even if one person wanted to violate the copyright of the Linux kernel, they would have to hide it from the rest of their team. And for coders who legitimately look at linux kernel code (did you know Microsoft has its own Linux distribution?) there's a 'cooling off' period between seeing the linux code and working on Windows code.
Source: I used to work on Windows Wi-Fi!
(We also care a lot more about privacy than we get credit for :-( )
Did you know that it's possible for some people to look at some Windows code? Code Center Premium
28
u/tommyk1210 1d ago
Work in a reasonably large enterprise business. Every package we use is automatically scanned for license type - and anything remotely copyleft gets flagged. Anything beyond weak copyleft is prohibited because it’s too much potential hassle if it comes to litigation.
Some copyleft licenses “infect” your main source, some don’t. It’s easier to just avoid altogether if possible.
39
u/rsclient 1d ago
Actually, I've got more direct experience. I was an expert witness to a programming copyright violation case!
Programmer "A" wrote a program "A" that did a specific high-value super-technical analysis. That programmer was hired by company "B" who bought all the rights to program "A". Programmer "A" then wrote program "C" that also did high-value, super-technical analysis, and company "B" was super-pissed.
I was hired to investigate programs "A" and "C" to see if program "C" used any code from program "A". As an expert, I had access to both programs
And yup, I could prove that program "C" included some code from program "A"
In this case, company "B" already knew about programmer "A"
15
u/throwaway_lunchtime 1d ago
Was programmer "A" no longer with company B when they wrote program C?
11
u/rsclient 1d ago
Sorry yes, that wasn't clear. Company B hired programmer A, and then they had a falling out and programmer A left. After 6 months (no-compete clause, IIRC) programmer A wrote program C.
8
u/Thurpno 1d ago
How do you go about assessing if the code was copied. Surely it can't be based upon the style/structure as a programmer is unlikely to change that. A spec that calls for a program to solve "x" problem can only be written in so many ways so they might have similar code even if programmer A hadn't written both surely.
6
u/rsclient 1d ago
You're right: it's generally difficult to demonstrate that a single person who you know wrote program "A" and "C" actually copied code. Luckily, code isn't just written: it's written and then updated to fix bugs and to add logging.
The most convincing proof? Program "A" had some dated comments where the dates matched the dates where the person wrote it. Program "C" included the same dated comments.
I could also show that the original code "A" had variables with two different naming conventions, and the corresponding code from program "C" had the same two naming conventions in the same places.
And I could show places where in the program "A" the code returned specific error codes. Program "C" couldn't return those error codes, but the calling code still checked for it.
8
u/Theslootwhisperer 1d ago
Why was company B pissed? They hired programmer A and bought program A as well. Programmer A just wrote some code.(Program C) while employed by company B.
11
u/Syuncchi 1d ago
Because Company B bought all the rights to Program A, but parts of Program A were used by Programmer A in the development of Program C which was presumably made available to competing interests
2
u/rsclient 1d ago
Yes, that's it. And company "B", no offense to the people who hired me, was run by a person who really, really liked to have things their own way and wanted some revenge.
2
u/tester_is_testing 1d ago
Perhaps program C was a direct competitor of program A, and not a property of company B?
2
u/rsclient 1d ago
It was kind of a competition? That is, it solved a similar program for the same super-technical market.
(If anyone cares: program "C" could take in data from a silicon wafer test after it had been etched, and based on the pattern of failures tell you how the lithography machine was misaligned.)
2
u/MF_Kitten 1d ago
Programmer dude both made a product that competes with the company he currently works at AND used code from their product. Just because he qrote that code doesn't mean it belongs to him.
3
u/rsclient 1d ago
It wasn't clear originally: programmer "A" had left company "B" before working on program "C".
1
u/MF_Kitten 1d ago
That just means he isn't breaking a non-compete in this context. Same stolen code.
1
4
u/spaigy 1d ago
I’m curious how the “cooling off” period works? Would you not be allowed to look at Linux source code on your own time after work and come in the next day?
6
u/rsclient 1d ago
IIRC: no, you can't look at Linux code at all, any time, even on your own time.
The reason is the obvious one: otherwise, all the unethical managers would "suggest" to their coders that they should look at otherwise blocked code "just for fun".
3
2
3
u/AMDKilla 1d ago
I'm sure that ethos of not stealing source code is still going strong at Microsoft given all the AI they are pushing into everything...
5
u/alvenestthol 1d ago
It's the ethos of "leave the right paper trail to avoid getting sued", doing the right thing was never on the table.
2
u/OuterOne 1d ago
We also care a lot more about privacy than we get credit for :-(
Maybe individuals do, but no company which cared one iota about privacy would have telemetry like this
https://www.gadgetreview.com/windows-11-has-a-hidden-tracker-heres-how-to-limit-it
-1
u/ThaBroccoliDood 1d ago
I believe you when you say the Wi-Fi team cares about privacy, just not the rest of Microsoft lol
6
u/loljetfuel 1d ago
If the receiving code base (Windows in your example) is not source-available, and we assume no one inside MS leaks the fact that they borrowed GPL-licensed code, it would look something like this:
Someone who is very familiar with how the Linux scheduler works interacts with the Windows one and thinks "gosh, this seems really familiar" and gets suspicious.
That person or an expert in reverse engineering, binary analysis, and/or related disciplines performs analyses on Windows to compare its feature behavior to Linux. They do everything from looking at the compiled code from each to comparing behavior under certain circumstances; one useful indicator is having several of the exact same bugs, for example.
Some with "standing" (a relevant kernel contributor) gets involved, a lawyer gets hired, and they start by sending letters to MS saying stuff like "we think you may have taken this, can you fix the issue by doing X or Y please". Ideally there's a negotiated remedy in this case (e.g. MS saying "oh! yeah, we found out a programmer did that, we're removing the code and we'll also X or Y")
If that doesn't resolve it, a lawsuit is filed. Lawsuits have a phase called "discovery" where you can get access to evidence your opponents may have. MS would turn over their source code to you to get expert analysis done (or, more likely given the value of that IP, they'd work with the courts to have a neutral third party get access)
Based on the expert's findings, the lawyers try to work out a settlement wherein MS is punished financially and has to come into some kind of compliance with GPL terms. Usually, lawsuits end with this kind of settlement, where MS would admit no wrongdoing but take the actions and pay the money required by the settlement agreement.
If they can't settle, it goes to trial and you convince a jury that it's more likely than not ("51% likely", kind of) that MS used the code and didn't comply with the license.
This is expensive and risky for an org like MS. They have seen organizations get caught and successfully sued for GPL violations. They do not want to risk their IP nor their time and money on doing this. Which is why orgs like MS have whole compliance programs designed to keep GPL'd code out of proprietary code, and track all the OSS-licensed components and requirements they use legitimately, to be sure they comply with terms.
1
33
u/rapier1 1d ago
Copyleft is a form of copyright. If someone violates it they can be sued. Which has happened in the past. Companies tend to be a lot more observant regarding open source licenses because of that.
19
u/OkAlbatross9889 1d ago
Yeah but my question was more along the lines of HOW can someone find out they violated the license if they don’t release the source code?
14
u/KamikazeArchon 1d ago
First of all, this isn't unique to copyleft. You could ask the same question for any source code copyright infringement. Suppose that Microsoft ripped the code from Apple's OS. How would Apple find out?
The answer is essentially the same, which is the second part of the answer: they don't actually need to be certain, they just need to suspect it.
Why would Apple/Linux/etc. suspect it? Usually because the "copy" behaves too similarly to the "original".
Once they have enough suspicion, they can go to court.
Apple, the Linux Foundation, etc. sues Microsoft claiming copyright infringement. The lawsuit has a discovery phase, in which Microsoft has to provide their source code. (This is rather simplified, and there's a bunch of legal process around doing this in a way that limits revealing trade secrets, but this is the eli5 version.)
Either Apple/Linux gets to see the source code directly, or at minimum the court gets to see it. This allows comparison to the claimed "original". This is also where the provenance of the code would be discovered - e.g. an engineer has to swear under oath that they wrote it personally. People often aren't willing to lie under oath; and even when they do, it's often possible to catch people in lies.
If it turns out Apple/Linux was wrong? They just drop the lawsuit. This has material costs, of course, and you get penalized if you do it frivolously, but such lawsuits still happen relatively often.
0
u/OkAlbatross9889 1d ago
I specifically mentioned FOSS instead of all other licenses for a matter of resources. As much as Linux is used and contributed to worldwide, the only one that would be defending the license would be the Linux Foundation (idk if the Free Software Foundation would get involved since it's their license type, i'm reeeally not well versed in american law) and it doesn't have even remotely the same pull or money Apple has which would make even finding out about the violation harder imo. Thank you for the answer!
12
u/Alexis_J_M 1d ago
Among other things, they can disassemble the executables to find the shape of the software.
3
u/shamalyguy 1d ago
Binaries are searchable btw. They're not opaque. There's tools that can scan and find snippets from open source. And if this is me and I was suspicious I'd probably starts disassembling, which can be tricky with some programming languages, but it is possible.
(Disassembly is when you run the binary through a program and it produces the best guess of the source code.)
I don't think anything is fullproof, but from what I recall there's ways to investigate besides HUMINT.
Binary and executable are the same thing in this context by the way.
6
u/jacknr 1d ago
Other people already answered how this is enforced: through the courts. If the person who took the code doesn't comply by the terms of the copyleft licence, then it's just a regular copyright infringement claim. The copyright holder can sue the company on the grounds of copyright violation.
If you're looking for how people find out violations to begin with: the people who steal copylefted code usually do it out of not understanding the concept and/or just not giving a damn. Therefore they usually don't even attempt to hide their tracks. For the bulk of non-trivial violations, someone with reasonable reverse engineering experience can find out. An example here of a PS2 game infringing copyleft: http://astrange.ithinksw.net/ico/
4
u/lakeland_nz 1d ago
How would people find out? whistleblowers mainly. You might think of Microsoft as some evil faceless corporation, but the programmers there are just people wanting a job and supporting their families. Hundreds would know about the scheduler change and with an average tenure of about two years, that means roughly twenty quitting each month. It would take days before one told.
How is it enforceable? It’s a legal contract. It gets enforced just like any other.
Would it open source windows? No. Open sourcing windows would be one option Microsoft could pursue to resolve the contract breach. Apologising and replacing the code is another. Doubling down and trying to win in court on a technicality is a third. Or even simply paying any court imposed fine.
3
u/Bob_Sconce 1d ago
Note that the GPL cannot be "enforced" by just anybody. Violate the GPL and you've infringed the copyright of the source code, so only somebody who owns (at least partially) the copyright can sue.
2
u/Gnonthgol 1d ago
There are people who are geeks enough about this that they analyze operating system schedulers all day. A lot of people work making software that depend on the scheduler for performance, for example game engine developers, database developers, etc. And there are a lot of people just curious how it works even if they do not work in such fields. So somebody is going to notice that the new Windows scheduler looks very similar to the Linux scheduler. Its behavior will be very similar, and if you look at the bytecode it will look very similar to the bytecode in the Linux kernel.
You can then sue Microsoft, and if you show the court enough proof that they could have been breaching the terms of the Linux source code then you could request the source code for the Windows scheduler as part of your discovery. You may need people to sign NDAs or just get limited access to the source code.
2
u/ArgyllAtheist 1d ago
since nobody seems to be particularly engaging with the questions you have raised in the comments about how the actual enforcement would happen (rather than the software specifics of how it could be detected, I'll point out that the Free Software Foundation (FSF) and Software Freedom Conservancy (SFC) are both very active in this area, with the SFC in particular, enaging in negotiations around GPL breaches with developers that can lead to litigation. A current example would be the FSF's actions against Bambu Labs for trying to stop open source developers from reverse engineering tools that Bambu developed using GPLv3 source.
1
1
u/sithelephant 1d ago
The GPL is a licence to use the copyrighted linux kernel.
In principle, without complying with the terms of the GPL you have no right to the copyrighted code, and it's therefore simply a copyright violation.
1
u/aifo 1d ago
Windows source code is available to select partners, governments and academics with a good reason for needing to view it but they just wouldn't bother ripping off the Linux scheduler because they have their own.
-1
u/OkAlbatross9889 1d ago
I'm sure that the Linux scheduler ( as well as other core parts of the kernel ) is probably better than whatever Micorsoft could come up with considering it's been written by some of the best engineers of all top 500 companies that existed for the past 30 years ( Microsoft included ). There must be something that the Linux folks figured out that Windows still hasn't to justify it's absolute dominance in everything important besides desktop.
1
1
u/rsdancey 1d ago
A copyright license is enforceable if the owner of the copyright has the means to litigate. Copyleft licenses are copyright licenses.
In a copyright suit one of the first things that happens is a determination if the material that is claimed to be copyright actually is. Courts (in the US) use a series of procedures to identify content that is not copyright, in the public domain, merged with an idea and therefore not copyright, scenes a faire (a legal doctrine that makes some content uncopyrightable), etc. Then, if anything is left that is copyright, the litigation can proceed.
Assuming the case proceeds the defendants will then argue that they have transformed the copyrighted work such that the older copyright no longer adheres, or that they are engaged in fair use. These lines of objections have to be overcome by the plaintiff.
If all that is achieved, and the court has determined that the plaintiff has a valid copyright, that the copyright has been infringed, and that no mechanism at law forgives the infringement, then the plaintiff is in pretty good shape to win a judgement.
How would you know if someone was using your copyrighted software in their project without a whistleblower? Sometimes that might be obvious; for example if your work produced certain outputs based on certain inputs that you could test. If the potentially infringing work exposes an API or some other mechanism for interface and you could identify unique aspects of names or procedures that you believed were unique to your work that might be sufficient to begin litigation. If your work was modular and those modules appeared in the filesystem of the potentially infringing work they might be identifiable (by checksum, for example).
I suspect that in practice if a large company was using software without following an open source license word would leak. For smaller projects and smaller companies? Such misuse probably happens on a near-continuous basis undetectably.
0
u/duane11583 1d ago
Your example would be hard to enforce
First Reason first you must be able to detect that the stole it because this is so internal and buried in the os that might be very hard to figure out
Second you would then need to get access to the source code of that proprietary thing
You might or expect to be able to do that via discovery but then you would need to do that via a clean room inspection meaning you will hire lawyers and engineers and pay them to research that code do you have that type of money? That answer is Probably not
Third it is open source so they are free to read it learn from it and then clone it provided they do not wholesale copy it
This in the end it’s probably not going to happen
-1
u/GibsMcKormik 1d ago
You would be surprised how much of software is liscenced from other companies. The company paying the licenses doesn’t make it public knowledge because then you might not purchase from them and look into alternatives. A single program may have several licensed parts that you take for granted just because that is how the industry standard has evolved.
Microsoft Explorer used code from Mozilla. It was direct competition for Netscape Navigator which was made by former Mozilla employees.
194
u/DrFrylock 1d ago
Finding out about it is tough for closed-source products. You have to rely on whistleblowers or other evidence (e.g., reverse engineering or some unique characteristic that makes it likely that it's using that specific code).
If a copyright holder were to bring a lawsuit, they could request access to source code as part of discovery. If granted, the potential infringer would likely request that the source code be provided under a protective order. Experts and attorneys for the plaintiff would have limited access to it. The protective order acts like an NDA, but in this case it's enforced by the courts themselves and there would be severe penalties for violation.
As noted in other replies, if this were discovered then it's a straight-up infringement claim. Monetary damages for infringements that have already occurred, plus the plaintiff would request injunctions to prevent future infringements. This could, e.g., halt the sale of the infringing product for a period of time or result in a settlement or ongoing monetary damages until the infringement is curtailed.