Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership

Loophole in the GPL?

By eries in Culture
Thu Jul 13, 2000 at 05:03:28 PM EST
Tags: Software (all tags)

We recently ran into some licensing problems for a web-based open-source project. Since our project is an OO package written in PHP (a scripting language) the GPL does not quite apply. The GPL is designed to handle "binary redistribution" for software packages, but ours cannot be distributed in binary form. That means that someone could make a website out of a derivitive work and never have to open or disclose their code - an apparent violation of the spirit of the GPL. Now, we think it might be possible to modify the GPL to construe instances of a website sending HTML to be "executed" on a browser as redistribution (more on this later), but we don't really know how to go about it. Consequently, we are forced to try and find another license. We have looked at the Artistic and the APSL, but these are both pretty dubious. Has anyone else run into problems like this? We want to write to both the OSI and FSF and bring this to their attention, so we'd like to find out of others have run into the same situation. You can also check out this related discussion on the Sourceforge forums page.

IMHO, we need a way of defining, in cases like these, what constitutes a derived work. Clearly, things like your db password and content like graphics, logos, layout, etc. are not derived works. But how can we draw the line in the case of added functionality? How is this handled in more traditional content-delivery systems?

Is the HTML produced by our scripts just output? The more I think about it, the more I am convinced that the application that a user is running when they use our software is not just a series of HTML files. Those files, by themselves, are worthless. Instead, their usefulness depends on an awful lot of "state" - the state of the browser (cookies, javascript), the web server, other scripts which the browser has to reconnect to, and the data in the database. The HTML files are just one component of the general state that our app produces. If you construe this more nebuloous "state" as the "binary" application that our software produces, then distributing it to a user via a web server is a non-sourced distirbution, and hence forbidden by the GPL. What do you think? I have to believe that someone running a mod_x application with tons of users accessing it is redistributing it without the source, unless you believe that by clicking on "View Source" for this page you have somehow achieved access to the Scoop source.


Voxel dot net
o Managed Hosting
o VoxCAST Content Delivery
o Raw Infrastructure


Related Links
o Scoop
o a web-based open-source project
o related discussion
o Also by eries

Display: Sort:
Loophole in the GPL? | 39 comments (38 topical, 1 editorial, 0 hidden)
Loophole? (none / 0) (#1)
by Stargazer on Thu Jul 13, 2000 at 02:34:09 PM EST

I don't think so. It's not that there's an actual loophole in the language of the GPL. It's something simpler than that: the GPL simply was not designed to protect the freedom inherent in these types of programs. This is not really a problem with the GPL per se; rather, it's just not the right tool for the job.

This has been brought up before (3.70 / 3) (#2)
by iCEBaLM on Thu Jul 13, 2000 at 02:36:06 PM EST

This has been brought up before, the fact that Web Applications cannot be covered under the current GPL, I do belive the FSF are working on a solution to this, but as it sits this isn't really a "loophole" but an unforseen way of using applications which the FSF people didn't account for.

Now as for your question on whether the HTML your application generates is just output, the answer is "Yes". Your rationalizing extends your application to be part of the browser by taking account for the "state". The state is irrelevant really, the state is just a variable gotten from the output of another program (the browser) by ways of cookies, etc.

The browser is not part of your application, the browser merely impliments a platform that performs instructions which come from the output of your application, which is dependant on input from the browser. Inter-process communication at its finest. A database server is not part of scoop, even though its output is dependant on the input from the database, your application is not part of the browser for the same reason.

-- iCEBaLM

Re: This has been brought up before (4.00 / 2) (#3)
by eries on Thu Jul 13, 2000 at 02:44:46 PM EST

I completely agree with most of what you are saying. However, I think that by focusing too much on terms like "binary," the GPL needlessly limited itself to a small class of appplications, namely, those that happen to pass through a single source->assembly step. I happen to think that any case in which a user enables hundreds of other users to use a product should count as a distribution of that product. Otherwise, what's the difference between giving someone an applet on a CD and serving it to them via the web? Or is the essential difference just that the Java bytecode is executed directly by the client? But even in that case the bytecode goes through at least one (in many cases two) additional transformation steps.

So a java applet goes from source -> bytecode on the server and then bytecode -> native code (via the JVM) on the client. In my case, my app goes from source -> HTML on the server, and from HTML -> native code (via the Browser) on the client. Is that really such a stretch?
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]

Re: This has been brought up before (none / 0) (#20)
by Anonymous Hero on Thu Jul 13, 2000 at 10:33:49 PM EST

In my case, my app goes from source -> HTML on the server, and from HTML -> native code (via the Browser) on the client. Is that really such a stretch?

Actually, yes it is. HTML is not Turing Complete (discounting JavaScript hacks which generally provide very limited functionality anyway). Even in the case of Postscript documents (as Postscript is Turing Complete, IIRC), the language is being used primarily as a conduit for human-readable information, not as an implementation bed for program code.

As someone else pointed out, the problem is inherent in application servers in general. For instance, say I provide shell accounts to users. I install some GPL programs, and for whatever reason, I make site-specific changes to them. (For example, I might go embed our site's "help" email address in the usage info, and maybe some code to log usage so as to gauge program popularity.) Am I required to give these source code changes to my users? Particularly if I chmod 111 whatever.bin so that they can't read the binary itself, so I can't be construed as having distributed the binary to them?

Basically, the issue is "extending execution privileges" is not quite the same as "distributing a copy of some bits." The current GPL is built on the latter, and as another poster noted, GPL 3 may take care of the former.

--Joe (Mr Z on /.)

[ Parent ]
Re: This has been brought up before (none / 0) (#35)
by eries on Sat Jul 15, 2000 at 12:47:10 PM EST

There still are subtle but important differences. In the case of 'ls' or other UNIX tools, the output is directly human-usable. HTML output is _not_ human-readable, it has to be put through an extensive parsing and rendering loop first. Further, my code in particular generates Javascript and SQL as output, not just HTML. Surely the complexity of the output is a step above a simple extended execution of ls? What do you know about GPL3? Do you have a link? I'd be very interested to learn about it.
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
Re: This has been brought up before (5.00 / 1) (#9)
by mdxi on Thu Jul 13, 2000 at 05:19:47 PM EST

You're right, this has been brought up before, in the context of Application Service Providers, and IIRC the FSF is working on taking this into account in the GPL3. This isn't a loophole at all, it's an advance in technology which has created a way to run programs that was not forseeable when the GPL2 was written in 1991.

All of this is my opinion on the matter combined with recollection of things I've read. I do not work for the FSF and I do not speak for them.

[ Parent ]
my thoughts... (4.00 / 4) (#4)
by ramses0 on Thu Jul 13, 2000 at 02:59:05 PM EST

This is a bad story to post (it's never good to get "50 people who read half the GPL one time 3 years ago" talking together), but i voted +1 anyway, because this is an interesting ?problem? with the GPL.

First step: Read the GPL

Then post away ;^)=

I remember reading a discussion about this at /., and one of the comments really struck me as insightful- the gist of it was:

Yes, this might be a bug in the GPL, but if they use your code on a website, you still retain copyright to that code, and they are basically doing a "public performance" of your copyrighted work, so it might be possible to nail them for that.

The comment might be in this article, but i couldn't find it easily.

From my readings of the GPL, there are two major points to always remember:

  1. It is illegal to copy or use somebody else's program, no matter what!
    This is often overlooked, but if I put up a copy of "Hello World" on my website, you are not allowed to download and/or use that program. It is *my* program, I own the copyright on it, and if you want to use it, you need to talk to me.
  2. The GPL gives you the right to modify the program, use the program, and distribute the program. IF YOU BREAK THE GPL, YOU CANNOT MODIFY OR DISTRIBUTE THE PROGRAM! (sorry for using shout-caps)
    The GPL pretty much always allows you to {look at, modify, play with, etc... } the program for your own poersonal use, mostly because nobody can stop you from doing that anyway. But... if you give that program to somebody else, you need to follow the GPL, see below:

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

The real question is what constitutes a "derived work", and "executable form".

Take a look at the GNU license page for alternatives, but your best bet would be to release it under the GPL, and trust in the community to submit back changes to you. It's really the only way to go, since it's probably not worth your time and effort to search for every single individual violator of your product.

If you find somebody using your (modified?) software, then you can probably sic your lawyers on them and hope for the best. It would be my gut instinct that you would have a strong case for it.

Good luck, and may the source be with you ;^)=

[ rate all comments , for great justice | sell.com ]

help me understand (none / 0) (#5)
by madams on Thu Jul 13, 2000 at 03:02:48 PM EST

I'm not sure I understand the problem. I gathered from the the site at Sourceforge that Enzyme is a backend service. I would assume then, that the interface is HTML that interacts with the server via get and post. Is this correct? Is the client executing any code?

Mark Adams
"But pay no attention to anonymous charges, for they are a bad precedent and are not worthy of our age." - Trajan's reply to Pliny the Younger, 112 A.D.

Re: help me understand (5.00 / 1) (#6)
by madams on Thu Jul 13, 2000 at 03:16:23 PM EST

After reading eries's comment, I understand.

I don't consider interacting with a program through a web interface the redistribution of the server program. For example, I'm not running a copy as I submit this comment, although I would be if I were running Scoop on my server.

What it comes down to for me is individual use. I consider Rusty the person who is running Scoop, so whatever he does is covered by the GPL (let's forget that he is the original author for a moment), but the license for Scoop does not apply to me.

But your concern is still valid. What constitutes runnnig a program. For example, if I login to the my university's public server, and run ls, should I expect to be able to recieve the source code for it? How is this different from getting ls off a Linux CD and expecting the source code?

Or look at it like this. I am sitting at my friends computer and run ls. Should I expect the source code from my friend?

Of course not!, because my friend is not redistributing the program to me. I am just running his copy of it. Same goes for Scoop (I'm running Rusty's copy) and Enzyme (I'm running your copy).

Mark Adams
"But pay no attention to anonymous charges, for they are a bad precedent and are not worthy of our age." - Trajan's reply to Pliny the Younger, 112 A.D.
[ Parent ]

This got posted _over there_ (1.00 / 1) (#8)
by eries on Thu Jul 13, 2000 at 03:30:20 PM EST

I submitted this story to both K5 and that other site figuring that there was zero chance it could ever actually get posted to both. Well, what the hell do I know? It's up at this link

Now, whether this makes this story more or less likely to get modded up, I really have no idea!
Promoting open-source OO code reuse on the web: the Enzyme open-source project

Oh, no, a violation! Blahlbah.. (none / 0) (#10)
by Inoshiro on Thu Jul 13, 2000 at 05:29:07 PM EST

Please, read the licence before you assume there is a hole. Your argument seems to be that people are able to get the output of a program from a site that may be using modified software that is GPLed without any way to get at the source code.

2 b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

Putting things on the web sure seems like publishing to me. So if you are exercising your right to modify the program as specified in section 2 of the GNU public licence, and you are publishing it to the web, then the program is licenced under the GNU public licence. Failure to have a link to the source modifications is thus a violation of the GNU public nice, NOT A HOLE.

The next thing to do is go read the "What to do if you see a possible GPL violation" page on gnu.org. You might want to mail RMS in the future or consult a lawyer before posting things to aprox 1 million people who are sick of seeing "GNU hole found!" stories, too (sorry, it's true -- I am annoyed by people who fail to read and understand the GPL and who then think they've found a way through it).

PS: if this was actually not about what I said, egg on my face. The way you explain it in the post seemed to indicate to me that you were concered about people getting a GPL web program, and putting it on the server with modifications they made and NO distribution of the modifications, kinda like a "closed' GPL derived work.

[ イノシロ ]
Update.. (3.00 / 1) (#13)
by Inoshiro on Thu Jul 13, 2000 at 05:51:49 PM EST

I went and read all the replies about this on /. (at level +3 or higher), and think I've got a better idea of what you think is the loop hole.

You define the output of the program as the performance of the program. I, in my first reply, said that usage of it was distribution of it (because looking at the source code, chances are the HTML and PHP-related bits are tightly coupled, following my line of reasoning about publishing parts of the program). But the GNU public licence is about distribution, not performance. So you claiming there is a "hole" in the GPL for performance of a program is somewhat valid, because the GPL does not cover performances of the program.

If I setup a computer at a mall which showed Linux and Gnome, and people could walk up and play around a bit with it, without me having to worry about handing out software sources because I wasn't distributing anything at all. You want to look at a different type of licence which discusses limitations of performance. Microsft had "performance licencing" when it restricted NT 4 Workstation to 10 network connections at a time, and other companies have had per-seat licencing fees. You should also read the comments on /. (at +3 ;)) to get some responces to performance licencing (and why people hate it).

[ イノシロ ]
[ Parent ]
Re: Update.. (4.00 / 1) (#16)
by madams on Thu Jul 13, 2000 at 08:36:32 PM EST

The basic problem with "performance licensing" supposedly free software is that it reintroduces the idea that you own a license to use the software, rather than owning a copy of the software, and this certainly isn't in the spirit of the GPL.

Mark Adams
"But pay no attention to anonymous charges, for they are a bad precedent and are not worthy of our age." - Trajan's reply to Pliny the Younger, 112 A.D.
[ Parent ]

Re: Update.. (none / 0) (#36)
by Cironian on Sat Jul 15, 2000 at 02:05:49 PM EST

Well, you *dont* own the software. If you would, you wouldnt have to make your modifications available upon request. The BSD license comes much closer to giving full ownership in the software to someone if that really is what you are interested in.

[ Parent ]
Re: Update.. (none / 0) (#19)
by cesarb on Thu Jul 13, 2000 at 09:20:14 PM EST

The GPL depends on the copyright law.

If the copyright law says ¨you can´t do it¨, the GPL says ¨you can as long as you distribute the source¨.

If the copyright law doesn´t apply, the GPL has nothing to say.

If the copyright law is somehow destroyed or not valid anymore, the GPL turns into dead bytes.

[ Parent ]
Re: Update.. (none / 0) (#23)
by eries on Fri Jul 14, 2000 at 01:41:41 AM EST

The more I read the various comments on this topic, the more I am convinced that there needs to be some way of defining when "usage for internal/private purposes" of a web application gets transitioned into a re-distribution. I think it's clear that if only I and two of my friends use it, it's no big deal. But what about when 25000 random people come to my web site and _execute_ the software written by someone else? That's got to come close to redistribution. It would if we were talking about Java bytecode (or some other non-native format) instead of just HTML/JS right?
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
WRONG, your DEAD WRONG (none / 0) (#30)
by Alhazred on Fri Jul 14, 2000 at 01:04:59 PM EST

There is no violation of the GPL here. Suppose you write a program, FOOBAR, and it is GPL'ed. I take a copy of FOOBAR, put it on my machine, add a few patches, and run it. I'm NOT IN GPL VIOLATION because I have NOT redistributed anything. The provisions of the GPL only kick in when you redistribute or "publish". IMHO publishing would consist of distributing as printed source code, putting the binary on the net for download, etc. In other words the words "publish" and "distribute" mean essentially the same thing in common use. The distinction is that distributing really is a more ACTIVE thing, (ie I mail you a copy of the program) whereas publishing is a more PASSIVE thing (ie I put it on my FTP server and you can get it if you want).

Getting back to the hypothetical FOOBAR, if I now distribute FOOBAR I have to provide the source, complete with my patches. If I distribute OUTPUT from the program FOOBAR I am in no way shape or form bound by the GPL, data is data no matter how it was produced and the GPL has nothing to say about generated output of software covered by its license except for I believe a clause which actually DENIES it status under the license.

Thus the verdict is entirely clear. Under the GPL a web site may operate any web-based application they want, with any modifications they wish, and as long as they don't give away an actual copy of the software that you could install on another system, they have NO obligation to give up their mods to the code base.

This is really a feature of the GPL. What it says is that if I want to be a mean bastard and keep my mods to myself then I can do that, but I can't play with anyone else, I have to go stand in the corner like a bad little boy. Its definitely in keeping with the OSS spirit, don't ram things down people's throats, let them be as free as they can be without hurting anyone else or unfairly exploiting the work of others.

I will say though that I think ESR is right, the GPL would be pretty weak in a world where most code was run on central ASP servers. I just don't think its likely to happen all that soon.
That is not dead which may eternal lie And with strange aeons death itself may die.
[ Parent ]
Take a look at Sourceforge (none / 0) (#11)
by Anonymous Hero on Thu Jul 13, 2000 at 05:30:15 PM EST

What is wrong with the way that sourceforge is doing it? The entire service is GPL'ed (I think), and it's source is available as one of it's projects. I'm registered there, I'm a developer on one project, but I have no interest in getting a copy of the source code just because I use it. When it comes to distributing the project they do it the right way; just download a tarball from the project page.

Isn't this the same as Slashdot? I read it and enjoy the content (sometimes), but if I wanted to look at the code, I'd go over to slashcode.

Why not use a distribution system like this for Enzyme? If I want to use it as part of your services, CatalystRecruiting.com, I'd have no need for the source. But if I were interested in running my own service based on the enzyme code, I'd just grab it on the dev page that you have hosted on sourceforge. No, I wouldn't be forced to share my modifications to your code just by hosting a service. I'm not forced to share my modifications to any opensource project that I personally use. But if I were to want to redistribute my modified copies, then the GPL forces me to share the code.

Am I missing something here?

Re: Take a look at Sourceforge (none / 0) (#14)
by eries on Thu Jul 13, 2000 at 06:09:26 PM EST

Actually, Sourceforge is very concerned about this very problem, and have discussed these licensing issues with me at length. I think they are worried about someone creating a site (maybe called Shmorceforge) which would be a clone of SF but with some modifications. If that site makes a ton of money, they should at least have to release their modifications, right? That's the spirit of the GPL, as I see it.
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
Re: Take a look at Sourceforge (none / 0) (#15)
by Anonymous Hero on Thu Jul 13, 2000 at 06:42:57 PM EST

Oh, gotcha. I hadn't thought of it like that.

It does seem quite distasteful for the hypothetical jobhuntingfor31337hax0rs.com to make money from your code without giving back it's modifications.

I'm on the fence on this one. I'm not a GPL expert, and you've done a whole lot more homework than me.

If that site makes a ton of money, they should at least have to release their modifications, right? That's the spirit of the GPL, as I see it.

Do they? What if they use your code unmodified, and just have a better marketing team than you? The GPL doesn't protect us from that happening. Don't we all still benefit from the services provided by the great software you have gifted us with?

Should a net based back-up service release any modifications they have made to ext2? If they aren't redistributing the ext2 drivers, the GPL seems to say no. But, they are making money off a lot of other people's hard work, and seemingly stomping all over the altruistic goals of the GPL.

I don't have the answers, only more questions. This is a good debate eries, thanks for bringing it up in these forums.

[ Parent ]

Re: Take a look at Sourceforge (none / 0) (#22)
by eries on Thu Jul 13, 2000 at 11:46:31 PM EST

Thanks for the compliment. I think you are hitting on an important line, although exactly where to draw it I'm not sure. If there are people more 3l33t than me who want to use our software to make more money than we did, that's fine with me. I just want them to have to release their source to the same people they give "binary" access to. That's what the GPL is all about. It would be different if they used simply one or two modules from our package (and, in fact, we have already released several of these seperately under the GPL) - the question is what if they create a "derived work" kind of website. What then?
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
About /. (1.00 / 1) (#12)
by nuntius on Thu Jul 13, 2000 at 05:42:20 PM EST

I thought it was kinda funny... /. had a k5-level article for a change! ;-)

Copyright does not regulate use! (5.00 / 1) (#17)
by PresJPolk on Thu Jul 13, 2000 at 08:42:37 PM EST

Despite what certain companies like to write in their their End User License Agreements, copyright law regulates the distribution of copies of works, not the use of works.

If I'm running my code on some server, and widely distributing the output, where does the GPL matter? I'm not redistributing the GPL code, I'm only redistributing the output of the GPL code.

Think of it this way: If I set up a server, and allow people to telnet in and run a modified version of bash, would I be violating the GPL?

Re: Copyright does not regulate use! (none / 0) (#28)
by Simon Kinahan on Fri Jul 14, 2000 at 10:27:24 AM EST

Is the distinction between regulating distribution and usage all that clear ? I can license a copyrighted work on the basis that it will be used for a particular purpose, by refusing to sell it unless the conditions are agreed. If I'm prepared to go to the effort, I can do this with a legally binding contract instead of a stupid click/shrink-wrap one.


If you disagree, post, don't moderate
[ Parent ]
Re: Copyright does not regulate use! (none / 0) (#34)
by PresJPolk on Fri Jul 14, 2000 at 11:57:12 PM EST

Is the distinction between regulating distribution and usage all that clear ? I can license a copyrighted work on the basis that it will be used for a particular purpose, by refusing to sell it unless the conditions are agreed. If I'm prepared to go to the effort, I can do this with a legally binding contract instead of a stupid click/shrink-wrap one.

Right, you can. However, acceptance of the license becomes less clear.

Copyrighted works may not be distributed without permission. So, the distribution of a GPL'd, copyrighted work is to be considered acceptance of the license.

How is one to signal acceptance of a contract granting permission of use? Such contracts must normally be signed, as proof of use becomes harder.

[ Parent ]
running code is not the same thing as modifying th (4.00 / 1) (#18)
by Anonymous Hero on Thu Jul 13, 2000 at 09:12:09 PM EST

This seems way off to me.. just because you write a program using a GPL'ed tool doesn't mean it is a 'derived work'

If you compile a program with gcc, that doesn't mean your program must use the GPL.

If i use PHP to open a database and spit out some records, the information in my database is not automatically GPL-ed.

If this is the case, then surely anything created with, say, Java, would fall under Sun's Java licensing agreement - i.e. you can't modify the Java programs that you write and distribute them without getting Sun's approval.

This is clearly not the case, and would result in a chicken and egg situation - i can't write any code without Suns's permission, but how can i get Sun's permission if they have nothing to approve?

If you have modified the PHP interpreter, and are selling or otherwise distributing this modified interpreter in binary form, without making the full source of your changes available, then you are clearly in breach of the GPL, and you must make sources to the changes you have made available.

If you have simply written some libraries that interface with the standard PHP interpreter at runtime, this is just not an issue. Those libraries are yours, and you can license them however you want. Unless you have incorporated verbatim sourcecode from the PHP source, or other GPLed program.

Then, of course youre talking about a derived work.

Thats as i understand it, and in situations where you have self-modifying code/ code that generates code incorporating parts of itself then the issue becomes somewhat blurry.

However, running a web server using GPLed compilers/interpreters does not require you to publish the source to the programs that are run by the compilers/interpreters.

Read RMS (none / 0) (#21)
by Anonymous Hero on Thu Jul 13, 2000 at 11:26:57 PM EST

If you read RMS's writing he is constantly refering to the right to privacy. What you are experiencing is not a problem with the GPL, but one of the basic principals it was intended to uphold. I read a comment from RMS recently that the growth of ASPs could create problems with the appropriateness of the GPL. He didn't offer a clear way out of that problem, but said it was under investigation. I think its a tough one.

Re: Read RMS (none / 0) (#26)
by Kristopher Johnson on Fri Jul 14, 2000 at 09:13:12 AM EST

Can someone provide a link or reference to RMS's writings on the ASP issue?

[ Parent ]
Re: Read RMS (none / 0) (#33)
by lhand on Fri Jul 14, 2000 at 03:58:13 PM EST

Check the /. interview. Scroll down to Bruce Perens questions. He covers derivitive works and the unique problem with ASPs.

[ Parent ]
Re: Read RMS (none / 0) (#37)
by eries on Sun Jul 16, 2000 at 03:12:51 PM EST

Here are some links to RMS's writing on the subject. I think this one is particularly relevant (from http://www.gnu.org/copyleft/copyleft.html:

"The simplest way to make a program free is to put it in the public domain (18k characters), uncopyrighted. This allows people to share the program and their improvements, if they are so minded. But it also allows uncooperative people to convert the program into proprietary software (18k characters). They can make changes, many or few, and distribute the result as a proprietary product. People who receive the program in that modified form do not have the freedom that the original author gave them; the middleman has stripped it away.

"In the GNU project, our aim is to give all users the freedom to redistribute and change GNU software. If middlemen could strip off the freedom, we might have many users, but those users would not have freedom. So instead of putting GNU software in the public domain, we ``copyleft'' it. Copyleft says that anyone who redistributes the software, with or without changes, must pass along the freedom to further copy and change it. Copyleft guarantees that every user has freedom. "

What I'm after is the ability to prevent middlemen from stripping away freedoms during the distribution of a web-based app.
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]

Not just webapps (none / 0) (#24)
by swc on Fri Jul 14, 2000 at 02:45:47 AM EST

Consider this. I take a bunch of GPL'd software and make changes to it. Then I provide a "virtual desktop" service over vnc. Do I have to give out the changes? Nope. Why? Because I'm not distributing it.

The only thing I see possibly stoping this is that, as Inoshiro pointed out, the GPL says you must make source available if you "distribute or publish" the software. The question is - Am I "publishing" the software by letting other use it from their own computers over the net? Tough call.

Re: Not just webapps (none / 0) (#39)
by Foogle on Tue Sep 19, 2000 at 10:26:40 AM EST

It's not really a tough call. By no definition are you distributing or publishing the software. You're simply distributing and publishing it's output, which the GPL says is fine-and-dandy.

Bruce Perens has commented on this and said that it's an inadequacy of existing Open Source licenses, with regards to current Application Service Provider technology. Basically, my take on this is that the GPL (and possibly other OSS licenses) needs a rather large overhaul. Unfortunately, current version of software that've already been distributed under the current GPL will always be fair game for this sort of abuse.


"You can't shake the Devil's hand and say you're only kidding."
- They Might Be Giants
[ Parent ]

Perhaps I just don't get it, but... (none / 0) (#25)
by PrettyBoyTim on Fri Jul 14, 2000 at 03:17:48 AM EST

I presume the problem you've got here is that due to the project being written in PHP, the content and the code are mixed together in the same files. So that if someone wants to use it, they've got to change some of the files (that contain code between the <?php ?> marks) to make it relevant to their organisation.

I suggest you look at it like this: Only consider anything between <?php and ?> as code. Therefore whenever someone uses your program on someone else's server, you do not conisder the modified HTML that they've done as being derived form your code, and the parts that are generated inbetween the <?php and ?> are output, rather than the code itself. If they want to modify the php, that's fine, as long as it's only run on their servers. If they started trying to sell it, (without offering the source code for free) then you could accuse them of violations of the GPL.

Re: Perhaps I just don't get it, but... (none / 0) (#31)
by eries on Fri Jul 14, 2000 at 02:01:22 PM EST

No, that's not quite it. We actually use a dynamic (and OO) template system to separate code from HTML, so that's not a problem. The problem is that, according to many people, even if they make substantial changes to our code base, and set up a web site with it, since they are not distributing binaries to anyone, they do not have to release their changes, even if our code is covered under the GPL.
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
The core of the problem (4.00 / 1) (#27)
by gleef on Fri Jul 14, 2000 at 09:51:15 AM EST

OK, first off, the issue you are describing (the ability to make private modifications, provided you don't distribute privately modified binaries) is considered a feature of the GPL. It would be tough to come up with GPL modifications to get around that. So you need a new license (bleh, too many different licenses already).

It sounds like the key change you want from the GPL is: rather than requiring anyone receiving a binary distribution of the program to be given access to the code, you want a license that requires anyone using the program to be given access to the code, with the definition of use including accessing via a web browser.

If I were you, I'd ask the FSF for assistance in drafting the license, particularly since GPL-compatibilty would be a useful feature, and that's tough to do without either help or a minimalist license (eg. X-Consortium). Also see if they'd be interested in distributing the license via their website. Hopefully, this will minimise other people writing similar but incompatible licenses.

Re: The core of the problem (none / 0) (#32)
by eries on Fri Jul 14, 2000 at 02:03:00 PM EST

I have already written to RMS and the FSF about this, and am awaiting their reply. I happen to think that the key tenant of the GPL is that anyone who relies on a piece of software ought to own that software - own in the sense of having access to the source. That way, if the provider of the software ever vanishes, they can still update and modify the program at will. Why should this not apply to web applications?
Promoting open-source OO code reuse on the web: the Enzyme open-source project
[ Parent ]
ummm... (5.00 / 1) (#29)
by GreatUnknown on Fri Jul 14, 2000 at 11:59:59 AM EST

When you redistribute a PHP script, there is no binary form. PHP works by being interpreted command-by-command as it is being run. If a company redistributes a PHP script (the script, not the output), they ARE releasing the source. Under the terms of the GPL, if they modify the script, they do not have to release it. And for everyone who's saying that the output of the script (ie. the HTML produced) should be made public because the script that produced it is GPL'd, well thats like saying everything i type in vi should be made public, because that's GPL'd.

Re: ummm... (none / 0) (#38)
by Foogle on Tue Sep 19, 2000 at 10:22:22 AM EST

They aren't talking about distributing the actual PHP. They're saying that if you take an Open Source PHP script and alter it, and then *use* it on your website, you aren't required to submit your changes back to the community. The reason here is because the GPL only requires you to make your alterations GPL'ed *if* you redistribute. And since it's only running on your webservers, it's not being redistributed, even though the result of the program (the HTML code) is.


"You can't shake the Devil's hand and say you're only kidding."
- They Might Be Giants
[ Parent ]

Loophole in the GPL? | 39 comments (38 topical, 1 editorial, 0 hidden)
Display: Sort:


All trademarks and copyrights on this page are owned by their respective companies. The Rest © 2000 - Present Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
My heart's the long stairs.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories!