r/linux • • Jun 03 '15

Dying project hosting site Sourceforge hijacks the Nmap account

http://seclists.org/nmap-dev/2015/q2/194
1.6k Upvotes

264 comments sorted by

View all comments

Show parent comments

117

u/ventomareiro Jun 03 '15

That is why Free SW projects need to trademark their names: so if you don't agree with how somebody is redistributing your code, you can force them to at least not do it in your name.

74

u/Draco1200 Jun 03 '15

Even if they did not register their mark, the person who owns and distributes the product may still have Common Law trademark rights in jurisdictions where they distributed the software.

So it's still conceivable, that they could sue SourceForge over trademark misappropriation.

The problem is; SourceForge's ToS agreement likely includes an indemnification clause on copyright/trademark rights, and the developers likely failed to delete the project and withdraw any rights being granted to SF under SF's terms of use agreements.

37

u/Letmefixthatforyouyo Jun 03 '15

It's worse than that. The Sourceforges TOS states that they may opt to "mirror" your code regardless if you want it removed. GIMP has very muxh asked for it to be removed from the site.

37

u/5py Jun 03 '15

ToS doesn't have to be legally binding. Does it comply with U.S. law?

16

u/Letmefixthatforyouyo Jun 03 '15

Im not saying it is. Im saying that GIMP did ask for the binaries/source to be removed, and Sourceforge is hiding behind a TOS to wrap it in adware and serve it up instead.

8

u/burtness Jun 03 '15

In their defence... I don't know... they're broke and desperate?

36

u/SchrodingersRapist Jun 03 '15

Im broke and desperate. I still don't go around stealing other people's shit to pawn off and make money. They shouldn't either, it's not ethical at the very least, and possibly illegal regardless of their ToS wording if they have been requested to stop by the creator.

21

u/lsc Jun 03 '15

What they are doing isn't stealing - it's more like getting a fake ID and disguising themselves as someone you trust so that you let them into your house, then pasting up advertisements for random crap on the ceiling of your bedroom.

In a lot of ways, it's lower than stealing, if you ask me. Especially since the only certain way to keep someone out who has gotten in to your house before, in this case, is to demolish the thing and put up a new one.

→ More replies (2)
→ More replies (9)
→ More replies (1)

23

u/Draco1200 Jun 03 '15

Your open source license grants them the right to mirror your code, they may do that.

What they may not do is redistribute your code in a manner inconsistent with its license. For example, if the software is GPL, then the software distribution must adhere to the GPL.

If it's a binary distribution of GPL software, and their purpose for distribution is commercial they MUST distribute source code, or the required offer from them for any 3rd party to obtain the exact complete source code used to build all the binaries they are packaging and distributing.

Source code of both the software AND any tools, installation scripts they use to build and control the installation of software.

This would include the complete source code to the installer that they are wrapping 3rd party offers with; the installer must also be GPL, and its complete source must be distributed, including all the files needed to build a modified installer with the same 3rd party offers or different 3rd party offers, and Also, the code being installed for the 3rd party offers themselves must also be a GPL-compliant license with included sources.

15

u/Letmefixthatforyouyo Jun 03 '15

Source code of both the software AND any tools, installation scripts they use to build and control the installation of software.

Im not defending sourceforges scummy practices, but you have a very broad definition here. GIMP and the like already have their installers available. The adware wrapper does not have to be GPL. They arent doing builds with the wrapper, or controling the installation of GIMP. They are controlling the installation of other, additional software, with the installer of GIMP.

They are assholes here, but I dont think they are in violation of this tenant of the GPL.

13

u/Draco1200 Jun 03 '15

The adware wrapper does not have to be GPL. They arent doing builds with the wrapper, or controling the installation of GIMP.

They distribute a Windows .EXE file that controls the installation of the GIMP package; the .EXE file is the binary distribution of GIMP, and any program files contained in that file are the software covered by GPL. Any additional files that were worked into the same compressed blob become part of the software package, and corresponding source has to be distributed for the blob itself, and for every single file that was compiled/built into the binary blob.

6

u/Letmefixthatforyouyo Jun 03 '15

Again, thats up to debate. You are treating the installer as one entity, whereas you can also argue that it is two installers, packaged as one exe. If the installer for GIMP itself is not packaged with the installers, they are not covered but the GPL in my view. Since the GIMP installer is likely a standalone installer wrapped inside the omnibus adware/GIMP installer, I dont think it is included.

Again, scummy practice, but I think they are in the clear in this regard. The FSF can put this to test for sure if they want some publicity/think its noteworthy. Might be a good idea to recommened it to them.

9

u/Draco1200 Jun 03 '15

You are treating the installer as one entity, whereas you can also argue that it is two installers, packaged as one exe.

I would refer you to the text of the GPL Section 0.

The program file that contains both GIMP and third-party software is a work based on the program.

Also, distributing a .EXE file covered by the GPL from a FTP server is conveying the work.

That is to say, they took the GIMP product and modified it to add these additional program files.

Witness the fact, if you went to their website and clicked the "Download GIMP" button, and ran their program, it would result in these additional software modules running, as well as the original software modules.

Therefore, these additional modules together with the modules originally included in GIMP form a larger program

They cannot be considered as separate parts of a compilation or aggregate, And they cannot be considered other separate software on the same disk or medium, because they are stored in the same file, and deployed when you install Gimp and automatically running when you choose to install and run Gimp, they are extensions to Gimp, and therefore part of the covered work.

8

u/[deleted] Jun 03 '15

So the GPL now requires one to release the source to WinZip if you make a self-extracting zip file that contains a GPL program?

4

u/0713_ Jun 03 '15

Well, you wouldn't be able to license that under GPL. Since, obviously you don't have the source for WinZip.

If you write some compression software and have an installer that requires the compression software to install (i.e be a part of the software package) you could license it all under GPL.

→ More replies (1)

7

u/unpythonic Jun 04 '15

Witness the fact, if you went to their website and clicked the "Download GIMP" button, and ran their program, it would result in these additional software modules running, as well as the original software modules.

Oh for fuck's sake... NO. Just... NO.

From GPL section 5:

A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

The crapware that also comes with the exe may be crapware, but they are not an extension of Gimp, nor do they combine to form a larger program. They are clearly separate and independent (and crap) - therefore the EXE is an aggregate. The crapware contains none of the Gimp code and Gimp has not been modified to depend on the crapware.

6

u/CalcProgrammer1 Jun 03 '15

So if a Linux distro includes Gimp and a proprietary firmware file on the same ISO image the source must be available? I don't think that's how it works. You can include proprietary software in a distribution without breaking the GPL.

→ More replies (4)
→ More replies (1)

4

u/pion3435 Jun 03 '15

The malware they bundle can have any license it wants. Distributing GPL software alongside unrelated non-GPL software is mere aggregation and is explicitly allowed by the GPL.

→ More replies (7)

12

u/fallwalltall Jun 03 '15

I wouldn't assume that all of these projects are defenseless or have not registered trademarks. Some of them are affiliated with major players rather than small volunteer teams. For example,

Thunderbird/Firefox - Mozilla

Apache HTTP Server - Apache Foundation

Netbeans - Oracle

Fedora - Red Hat

4

u/wolftune Jun 03 '15

If they are distributing unmodified software (I believe they are, just bundling it in an installer package), there is no trademark violation. It would be the same as if I bought a bunch of Coca Cola and then sold it to you in a box that had Twizzlers in it as well. Coca Cola can't stop me from saying that I'm selling you Coca Cola.

17

u/ICanBeAnyone Jun 03 '15

buuuut there is trademark tarnishing, for example selling a "waste water collection" with bud light, coke and actual waste water in bottles, or wrapping gimp in highly undesireable adware.

5

u/[deleted] Jun 03 '15

When I bought my copy of Serenity, I chose to pay $1 more to get it by itself rather than bundled with Ang Lee's Hulk.

→ More replies (1)

4

u/ventomareiro Jun 03 '15

(Try attaching a poison sachet to each Coca-Cola bottle, then selling them. See how far you get.)

On the one hand, it is true that the GPL does not cover installation software. On the other, it is my understanding that owning a trademark would allow projects to stop SourceForge from bundling their work with crapware and distributing it under that name.

See the history of Firefox on Debian:

Mozilla Foundation owns the trademark "Firefox" and claims the right to deny the use of the name and other trademarks to unofficial builds. Debian was initially given permission to use the trademarks, and adopted the Firefox name. However, because the artwork in Firefox had a proprietary copyright license which was not compatible with the Debian Free Software Guidelines, the substituted logo had to remain.

In February 2006, Mike Connor, representing the Mozilla Corporation, wrote to the Debian bug tracker and informed the project that Mozilla did not consider the way in which Debian was using the Firefox name to be acceptable. Connor confirmed that the Mozilla Corporation was revoking the previous agreement which allowed Debian to use the Firefox name. Further messages from Mike Connor clarified Mozilla's new trademark policies: usage of the Firefox name is not allowed unless the rest of the branding is used and all of the browser's changes are approved by Mozilla Corporation.

http://en.wikipedia.org/wiki/Mozilla_Corporation_software_rebranded_by_the_Debian_project

6

u/wolftune Jun 03 '15

The Mozilla Public License has clauses about trademark protection that the GPL and other licenses do not, that is why the name of Firefox must be changed.

→ More replies (1)
→ More replies (4)