An especially novel aspect of this lawsuit, quoting the press release:
> This approach makes it the first legal case that focuses on the rights of individual consumers as third-party beneficiaries of the GPL.
> “That’s what makes this litigation unique and historic in terms of defending consumer rights,” says Karen M. Sandler, the organization’s executive director.
In the past, GPL enforcement has been a cause of action brought by the copyright holder. This suit is on behalf of users, as beneficiaries of the GPL. If this suit is successful, it'll no longer be necessary to prove sufficient standing as a copyright holder of GPLed code in order to enforce the license; it'll suffice to show that you're a user who wishes to make use of the rights provided under the license.
Gplv2 violations are widespread, we need much much more enforcement and more copyleft software, and this could be a huge win. Free software's main purpose should not be to be proprietarized, too much of it now is a group effort among companies to more efficiently lure users to trade their freedom for functionality.
If this strategy becomes validated by this case, it means that any organisation can bring GPL compliance lawsuits. Hopefully that leads to companies noting their increased potential for liability by multiple less scrupulous actors than SFC and spontaneously coming into compliance.
>"If this suit is successful, it'll no longer be necessary to prove sufficient standing as a copyright holder of GPLed code in order to enforce the license;"
Would such a decision have any usefulness outside of California? This specific lawsuit is filed in a California state court, against a California defendant.
Presumably the suit is federal because it’s a copyright case. So, yeah, it would have some significance within the 9th circuit until the appeals shake out.
> not only do multiple copies of the Linux kernel appear in the firmware, other GPL’d and LGPL’d programs were found, including U-Boot, bash, gawk, tar, glibc, and ffmpeg.
The copyright for bash, gawk, tar, and glibc is owned by the Free Software Foundation. The FSF requires copyright assignment on contributions specifically so that they can enforce the GPL. So, if the FSF is unwilling to participate in the case, then that would say something very bad about the state of the FSF (or the state of their relationship with Conservancy--perhaps the FSF would prefer to mount their own case separately?). However, I don't believe that to be the case.
It is my understanding that Conservancy holds the copyright on parts of the Linux kernel, and is authorized to represent several other copyright holders of the kernel. They should be able to enforce the GPL for the kernel without getting anyone else involved.
So to me, this reads as Conservancy intentionally avoiding involving the copyright holders and going for a different strategy, in order to establish precedent and strengthen the GPL. And if that fails, then they could presumably fall back to filing a second lawsuit from the traditional copyright holder perspective. But I would have liked to see this called out and explained explicitly in the press materials, because I'm having to read between the lines here.
Generally speaking, GPL can't be enforced by users due to selftermination clause. And when GPL terminates itself, you can't enforce it. For user enforcement we need a license that doesn't terminate itself.
---
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
Note that for quite a while Conservancy has (and more recently[1] many other copyright holders have) publicly documented that they extend GPLv3's cure provision to their otherwise-GPLv2-licensed code.
There are kernel copyright holders who have not consented to this and when you violate the GPL your license to the parts of the code that they own is terminated per the vanilla GPLv2. But the copyrights which Conservancy represents have the cure provision.
This looks to be a major change in the legal strategy behind GPL. In the past the focus has been on copyright claims by copyright holders, but as recent cases has shown in Germany and France, those has faced some rather strange setbacks. Germany don't seem to want to recognize copyright holders that only contributed a part of a larger work, which is basically all copyright holders for larger FOSS projects. In France they seems to define GPL as being under contract law and not under copyright law.
In this new case, the SFC is arguing a case in the context of third-party beneficiary which is under contract law and not copyright law. It seems like a bit of an long-shot, but if won it could mean a major change in interpreting GPL as a contract rather than a copyright license. I would guess that it also would change their strategy in other countries if won.
It seems strange to me that they'd adopt this strategy in the U.S. because of past failures in other countries. Gplv2 makes pretty clear it's a copyright license, so I see no reason it would be interpreted under contract law in the U.S., and as a layperson it seems unlikely that SFC would have standing in this case. Has a third party beneficiary ever been held to have standing in a copyright case?
It is strange, but I have seen in novel court cases where cases in other countries are used as an example. It is possible that they want the court to either confirm that GPL should be treated as a copyright license and not a contract, or that GPL can be seen as a contract in which users has a third-party beneficiary role. When they have that ruling they can use it as an example in countries where a gpl case has yet to be tested. It is also possible that they simply are testing something new when other approaches have failed.
According to the press kit, the case is claimed to be unique.
Not a lawyer. A copyright license is a written agreement not dissimilar from a contract.
However, validating the contract usually doesn't come up, because the violator needs the agreement to be valid to avoid copyright infringement.
> Because the GPL does not require any promises in return from licensees, it does not need contract enforcement in order to work. A GPL licensor doesn't say in the event of trouble "But, judge, the licensee promised me he wouldn't do what he's doing now." The licensor plaintiff says 'Judge, the defendant is redistributing my copyrighted work without permission.' The defendant can then either agree that he has no permission, in which case he loses, or assert that his permission is the GPL, in which case he must show that he is obeying its terms. A defendant cannot simultaneously assert that the GPL is valid permission for his distribution and also assert that it is not a valid copyright license, which is why defendants do not 'challenge' the GPL.
However, I believe only the copyright holder can sue for copyright infringement, so this case is instead taking that oft-skipped step of validating the contract so it can further claim SFC is a party of the contract. Infringement cases also have specific rules about damages, which can make it hard to actually get the infringer to do anything when you give the software away for free. IMO the "specific performance" seems likely to be granted if they win the case on contract grounds.
A copyright license is a contract, no? Copyright law can't govern enforcement of license, it only determines whether the author has the right to apply license, for being an author, but the actual meat of the license is subject to contract law.
Paragraphs 37 and 38 list the relevant software packages. Strangely the PDF is a scan. The OCR / embedded text isn't complete so there are some parts missing below...
37. Among the computer programs that comprise SmartCast are a number of programs
15 subject to the GPLv2:
(a) The Linux kernel. A kernel is the heart of an operating system, which all
computerized devices, like smart TV s, require in order to function. The Linux kernel is one of
the most popular operating system kernels.
(b) alsa-utils, which is a suite of programs that assist and manage ALSA, Linux's
audio subsystem.
(c) GNU bash, which is a " shell," a program that allows users to interface with the
operating system and is required for most operating systems.
(d) GNU awk, which is a popular scripting language with many uses.
(e) bluez, which is a suite of programs that assist and manage Bluetooth for Linux ased devices.
(f) BusyBox, which is a popular "thin footprint" suite of utilities for Linux.
(g) coreutils, which is a popular suite of utilities for Linux, with a larger "footprint"
than BusyBox
38. Among the computer programs that comprise SmartCast are a number of programs subject to the LGPLv2.1:
(a) The GNU C Library, which is a library of resources that allows Linux users to
program in the popular C and C++ programming languages. It would be required for any Linux14 based operating system that wished to take advantage of these popular programming languages.
(b)
(c)
(d)
hardware.
(e)
ffmpeg, which is a suite of libraries for handling audio, video, and multimedia.
glib, which is a library that facilitates programming in C.
DirectFB, which is a library that allows Linux-based systems to work with video
libasound, which is a library that helps third-party programs interact with ALSA,
Linux's audio subsystem.
(f) libelf, which is a library for reading and modifying binary files.
(g)
(h)
file systems.
(i)
libgcrypt, which is a C programming library of encryption functions and utilities.
libmount, which is a library that helps third-party programs interact with Linux
libnl, which is a suite of libraries related to using netlink, a popular network
communication protocol.
(j) selinux libraries, which help third-party programs interact with selinux.
(k) systemd, which is a large system that manages, organizes and handles shutdown
and restarting of system services on a Linux-based system.
Irrelevant, but (a) is technically incorrect. 'computerized devices, like smart TV s', do not necessarily require an "operating system" in order to function. If you removed the comma between 'devices' and 'like', then I think this would be correct.
I need to reboot my Vizio TV weekly through a hidden system menu to fix audio desync issues. Simply power cycling from the remote does not work, as far as I can tell that's a sleep mode. Absolutely terrible device and I will not be going back to Vizio in the future.
Yes absolutely. You would be redistributing the software with the TV. That said, I can't imagine anyone would actually file a lawsuit in a situation like this.
More worrying is whether Costco and Walmart could be sued under this theory. Vizio sells very few TVs directly.
This comment is pretty much entirely wrong due to first sale considerations, as a neighbor comment points out. It’s also a good cautionary tale for understanding your legal obligations regarding software licensing from an Internet comment.
For the purposes of only this context, in which we are deliberating who is infringing on the GPL software blah blah, Vizio sells all of their televisions directly. The act happens when Vizio is paid for the product and never again. With very few exceptions, everyone with a stake in the software on that television loses their rights completely once the television is legally sold to a distributor. Nobody from then on is liable for the licensing structure of the software; in the eyes of the (American) law, the television is now a “thing” to dispose of as you wish and no more. That is impactful to both trademark and copyright law but doesn’t necessarily speak to, say, reverse engineering (i.e., DMCA).
The scenarios you’re describing aren’t hypothetical and routinely happen in commerce, and they are well-trodden ground legally. If they went the way you’re theorizing, too, you’d never be able to legally sell or loan a book to a friend. Your ability to do that is the exact subject you’re discussing.
If you didn't get any proper license notice from the seller or the vendor, I'm pretty sure you're not responsible. There's just no simple way to find out if GPL-ed software is running inside a commercial device. Even worse, most vendors simply disallow analyzing their software in the first place.
Even if the argument could be made, there would be no practical way to enforce it. It’s not like Disney is breathing down my neck if I “redistribute” their IP by getting paid $50 to dress up in a Mickey Mouse costume for a kids birthday party.
> Disney is breathing down my neck if I “redistribute” their IP by getting paid $50 to dress up in a Mickey Mouse costume for a kids birthday party.
If they find out about it they will. Trademark law requires that they do. I know of a few that have gotten warnings about such things - they stopped doing it on the warning and so it didn't go farther.
That sounds like a possibility in a not so distant future. Do not forget that paying a murky intermediary just to perform popular songs was unheard of some 60 years ago.
Wouldn’t that fall under the first-sale doctrine? Once a copy is created, it is legal to sell that copy. It is the act of copying itself which might not fulfill the obligations of the license and might therefore break copyright law. I.e. it is the factory making TVs which is at fault here, not people re-selling TVs.
As I understand neither running code nor selling an object containing copyrighted material is prohibited by copyright law, so unless you needed a license to that code for some other reason you probably haven't agreed to the contract at all and can't violate it.
While I'm in favor of this, it makes me question somewhat the potential unintended consequences of something like this, in that it makes shipping actual hardware devices with actual software on the device even less appealing.
That is, if I provide a SaaS platform, my understanding is that even if I use all types of GPL code to run my service, as long as I don't "ship" the code for that service to end users (which is like 99% of all SaaS products when it comes to backend services), I don't need to share my code.
But if I release a hardware product and by definition I need to ship that code to end-users, then I do need to share my code. Just seems to be an incentive to make more and more stuff "subscription based" with a backend service. Though, due to other economic incentives businesses want to do that anyway, so perhaps my point is moot.
It just drives more companies to be more careful about their license. My company has for years banned any GPL3 code on devices we ship. If GPL2 is suddenly found more restrictive than we expected we will ban that too. FreeBSD/NetBSD will be the winner there, along with other projects. We don't contribute much, but we already consider license before we contribute back - and if we can't get GPL code we will make the changes needed to BSD code. Most of our changes will be contributed back - only changes that are actually things that matter to us will be withheld and those are not part of open source projects to anyway)
The point of copyleft licenses is to make it hard to make proprietary software and easy to make free software. It sounds like they're working as intended.
My understanding is that this suit is partly on the grounds of Visio not releasing modifications to copylefted code. The MPL and LGPL have the same requirements; is not being able to use LGPL, GPL, AGPL, MPL, or CeCILL-licensed software really harder than compliance?
Stories like this just make me all the more convinced that the right approach is to make software a commoditized complement of a service; software is not as scarce a resource as labor.
that's why i am a huge fan of the AGPL - prevents this from happening.
If you leverage your product with open source, there must be some sort of contribution back - either you pay the creators of the open source with a license fee, or re-contribute your own efforts via source code release.
That's rather unlikely. Even if you had all the source code, not just the GPL parts, and were able to build and package the firmware in a way the TV would be able to accept, they're probably using some form of build signing to prevent that.
But if you want to use Kodi, you likely already have some kind of media server, so something like Jellyfin/Emby/Plex wouldn't be too much more work and is definitely within the realm of possibility. SmartCast apps are just websites and Vizio gives you a companion JavaScript library for interacting with the TV and getting commands from the remote that could be bolted onto Jellyfin/whatever. Documentation is likely only available to big developers under an NDA, but the API is not exactly difficult to figure out (I can't give any further details due to an NDA completely urelated to Vizio :D)
Readit News
> This approach makes it the first legal case that focuses on the rights of individual consumers as third-party beneficiaries of the GPL.
> “That’s what makes this litigation unique and historic in terms of defending consumer rights,” says Karen M. Sandler, the organization’s executive director.
In the past, GPL enforcement has been a cause of action brought by the copyright holder. This suit is on behalf of users, as beneficiaries of the GPL. If this suit is successful, it'll no longer be necessary to prove sufficient standing as a copyright holder of GPLed code in order to enforce the license; it'll suffice to show that you're a user who wishes to make use of the rights provided under the license.
Often they don't have more functionality, just actual marketing and discoverability.
Would such a decision have any usefulness outside of California? This specific lawsuit is filed in a California state court, against a California defendant.
/not a lawyer
Deleted Comment
The linked press kit says:
> not only do multiple copies of the Linux kernel appear in the firmware, other GPL’d and LGPL’d programs were found, including U-Boot, bash, gawk, tar, glibc, and ffmpeg.
The copyright for bash, gawk, tar, and glibc is owned by the Free Software Foundation. The FSF requires copyright assignment on contributions specifically so that they can enforce the GPL. So, if the FSF is unwilling to participate in the case, then that would say something very bad about the state of the FSF (or the state of their relationship with Conservancy--perhaps the FSF would prefer to mount their own case separately?). However, I don't believe that to be the case.
It is my understanding that Conservancy holds the copyright on parts of the Linux kernel, and is authorized to represent several other copyright holders of the kernel. They should be able to enforce the GPL for the kernel without getting anyone else involved.
So to me, this reads as Conservancy intentionally avoiding involving the copyright holders and going for a different strategy, in order to establish precedent and strengthen the GPL. And if that fails, then they could presumably fall back to filing a second lawsuit from the traditional copyright holder perspective. But I would have liked to see this called out and explained explicitly in the press materials, because I'm having to read between the lines here.
---
You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).There are kernel copyright holders who have not consented to this and when you violate the GPL your license to the parts of the code that they own is terminated per the vanilla GPLv2. But the copyrights which Conservancy represents have the cure provision.
[1]: discussion at the time: https://news.ycombinator.com/item?id=16628301 (2018)
"You can't sue us because we don't have a license!"
I imagine that would make a following case by the actual copyright holders really easy to win.
Deleted Comment
Deleted Comment
California is a pretty good jurisdiction to litigate pro-consumer suits.
In this new case, the SFC is arguing a case in the context of third-party beneficiary which is under contract law and not copyright law. It seems like a bit of an long-shot, but if won it could mean a major change in interpreting GPL as a contract rather than a copyright license. I would guess that it also would change their strategy in other countries if won.
According to the press kit, the case is claimed to be unique.
However, validating the contract usually doesn't come up, because the violator needs the agreement to be valid to avoid copyright infringement.
> Because the GPL does not require any promises in return from licensees, it does not need contract enforcement in order to work. A GPL licensor doesn't say in the event of trouble "But, judge, the licensee promised me he wouldn't do what he's doing now." The licensor plaintiff says 'Judge, the defendant is redistributing my copyrighted work without permission.' The defendant can then either agree that he has no permission, in which case he loses, or assert that his permission is the GPL, in which case he must show that he is obeying its terms. A defendant cannot simultaneously assert that the GPL is valid permission for his distribution and also assert that it is not a valid copyright license, which is why defendants do not 'challenge' the GPL.
https://lwn.net/Articles/61292/
However, I believe only the copyright holder can sue for copyright infringement, so this case is instead taking that oft-skipped step of validating the contract so it can further claim SFC is a party of the contract. Infringement cases also have specific rules about damages, which can make it hard to actually get the infringer to do anything when you give the software away for free. IMO the "specific performance" seems likely to be granted if they win the case on contract grounds.
There was another recent case where they seemed to rule the GPL could be enforced as a contract, but I'm not familiar: https://www.theregister.com/2017/05/13/gnu_gpl_enforceable_c...
https://sfconservancy.org/docs/conservancy-v-vizio-original-...
Press kit:
https://shoestring.agency/wp-content/uploads/2021/10/SFC_Pre...
https://sfconservancy.org/docs/conservancy-v-vizio-original-...
Paragraphs 37 and 38 list the relevant software packages. Strangely the PDF is a scan. The OCR / embedded text isn't complete so there are some parts missing below...
37. Among the computer programs that comprise SmartCast are a number of programs 15 subject to the GPLv2:
(a) The Linux kernel. A kernel is the heart of an operating system, which all computerized devices, like smart TV s, require in order to function. The Linux kernel is one of the most popular operating system kernels.
(b) alsa-utils, which is a suite of programs that assist and manage ALSA, Linux's audio subsystem.
(c) GNU bash, which is a " shell," a program that allows users to interface with the operating system and is required for most operating systems.
(d) GNU awk, which is a popular scripting language with many uses.
(e) bluez, which is a suite of programs that assist and manage Bluetooth for Linux ased devices.
(f) BusyBox, which is a popular "thin footprint" suite of utilities for Linux.
(g) coreutils, which is a popular suite of utilities for Linux, with a larger "footprint" than BusyBox
38. Among the computer programs that comprise SmartCast are a number of programs subject to the LGPLv2.1:
(a) The GNU C Library, which is a library of resources that allows Linux users to program in the popular C and C++ programming languages. It would be required for any Linux14 based operating system that wished to take advantage of these popular programming languages.
(b)
(c)
(d) hardware.
(e) ffmpeg, which is a suite of libraries for handling audio, video, and multimedia. glib, which is a library that facilitates programming in C. DirectFB, which is a library that allows Linux-based systems to work with video libasound, which is a library that helps third-party programs interact with ALSA, Linux's audio subsystem.
(f) libelf, which is a library for reading and modifying binary files.
(g)
(h) file systems.
(i) libgcrypt, which is a C programming library of encryption functions and utilities. libmount, which is a library that helps third-party programs interact with Linux libnl, which is a suite of libraries related to using netlink, a popular network communication protocol.
(j) selinux libraries, which help third-party programs interact with selinux.
(k) systemd, which is a large system that manages, organizes and handles shutdown and restarting of system services on a Linux-based system.
Basically anything IoT more advanced than a thermometer seems to be running Linux.
I shouldn't be surprised if it was alsa alone. Shall we instead ssh into our tv to kill and restart pulse?
More worrying is whether Costco and Walmart could be sued under this theory. Vizio sells very few TVs directly.
For the purposes of only this context, in which we are deliberating who is infringing on the GPL software blah blah, Vizio sells all of their televisions directly. The act happens when Vizio is paid for the product and never again. With very few exceptions, everyone with a stake in the software on that television loses their rights completely once the television is legally sold to a distributor. Nobody from then on is liable for the licensing structure of the software; in the eyes of the (American) law, the television is now a “thing” to dispose of as you wish and no more. That is impactful to both trademark and copyright law but doesn’t necessarily speak to, say, reverse engineering (i.e., DMCA).
The scenarios you’re describing aren’t hypothetical and routinely happen in commerce, and they are well-trodden ground legally. If they went the way you’re theorizing, too, you’d never be able to legally sell or loan a book to a friend. Your ability to do that is the exact subject you’re discussing.
If they find out about it they will. Trademark law requires that they do. I know of a few that have gotten warnings about such things - they stopped doing it on the warning and so it didn't go farther.
That is, if I provide a SaaS platform, my understanding is that even if I use all types of GPL code to run my service, as long as I don't "ship" the code for that service to end users (which is like 99% of all SaaS products when it comes to backend services), I don't need to share my code.
But if I release a hardware product and by definition I need to ship that code to end-users, then I do need to share my code. Just seems to be an incentive to make more and more stuff "subscription based" with a backend service. Though, due to other economic incentives businesses want to do that anyway, so perhaps my point is moot.
My understanding is that this suit is partly on the grounds of Visio not releasing modifications to copylefted code. The MPL and LGPL have the same requirements; is not being able to use LGPL, GPL, AGPL, MPL, or CeCILL-licensed software really harder than compliance?
Stories like this just make me all the more convinced that the right approach is to make software a commoditized complement of a service; software is not as scarce a resource as labor.
If you leverage your product with open source, there must be some sort of contribution back - either you pay the creators of the open source with a license fee, or re-contribute your own efforts via source code release.
there shouldn't be free lunches.
Now, I don't see AGPL becoming widespread personally, but this is essentially its reason for existing.
But if you want to use Kodi, you likely already have some kind of media server, so something like Jellyfin/Emby/Plex wouldn't be too much more work and is definitely within the realm of possibility. SmartCast apps are just websites and Vizio gives you a companion JavaScript library for interacting with the TV and getting commands from the remote that could be bolted onto Jellyfin/whatever. Documentation is likely only available to big developers under an NDA, but the API is not exactly difficult to figure out (I can't give any further details due to an NDA completely urelated to Vizio :D)