David Herron's Blog

Re: Concerns about GPL-licensed Java

In Concerns about GPL-licensed Java goes into some well known issues with copying code from one project to another.

The first concern, 1) When code is GPL, the license tends to infect things that aren’t intended to be GPL. is indeed why we chose the Classpath exception. It's so that the GPL-ness of the runtime classes do not pass along to programs that subclass the runtime classes.

Though an interesting conundrum came into mind ... suppose one vendor uses GPL for their Java runtime classes, and another does not. Or in Sun's case we're intending to distribute under the old binary license in some cases, and under the GPL in other cases. So, if someone compiles their program subclassing from a library that's not under GPL, and then runs their program under a different instantiation of the library that is under GPL, then what. Is that like crossing the streams in Ghostbusters and either the world ends or Xul appears from beyond the 10th dimension and we all end up running Firefox?

Anyway .. his second point is far more interesting and strange at the same time.

2) All of us who program in Java for a living refer to the JDK source code from time to time.

And, your point is... what? Well, his scenario is this:

Suppose one day, you read something from LinkedList and decide that you need a MappedList, so you copy some snippets from LinkedList into your MappedList class to create it.

And, congratulations he says, you've just now transferred the GPL to your program.

Uh huh, that's a problem? If you're going to be sloppy about where you get your code from, and the licenses that code is under, then you deserve whatever problem that befalls you.

I haven’t seen that Sun has adequately addressed this concern regarding the GPL. And just why is Sun supposed to fix this supposed problem with the GPL? Especially as it's not a problem at all.

Comments

• And that for someone who says to have been on the Eclipse legal board talking to big company lawyers?

  I find this part particularly hilarius as well:

  
  Even worse, if you read some clever algorithm somewhere in the JDK source code and then rewrite it in a similar manner in your own code, your own code might be considered a derivative work of the JDK, and thus come under the GPL.

  What? A derivative work even though you copied nothing from the original? As far as I know you still can't copyright IDEAS (althought patents are a whole other minefield).

  To quote from Rosenlaw & Einschlag (http://www.rosenlaw.com/lj19.htm) :

  The primary indication of whether a new program is a derivative work is whether the source code of the original program was used, modified, translated or otherwise changed in any way to create the new program. If not, then I would argue that there is not a derivative work.

  Posted by: quintesse on November 15, 2006 at 01:08 AM

• Here is how one Big Company lawyer explained it to me: Suppose I create an Eclipse plugin and license it under the GPL. Then you create an Eclipse distribution, bundling my plugin along with a whole lot of other plugins. Due to the viral nature of the GPL, the entire distribution must be released under the GPL, including all of the original Eclipse code that was originally released under the EPL. (This can’t be done legally today because the GPL and EPL are incompatible.)

  Yeah, Big Company lawyer is full of it.

  Distributing a plugin has jack to do with the rest of the software. Just because the plugin uses the EPL host environment and APIs doesn't mean that Eclipse now has to be GPL. That is like saying that because RedHat bundles Apache running on the Linux kernel, which is GPL that Apache has to be GPL, or because IBM packages gcc and other GNU stuff with AIX that AIX has to be GPL.

  Personally, I think the "classpath exception" is kinda crap anyway. It seems to me that is what the LGPL was there for in the first place -- the gcc vs glibc pairing and having java/javac GPL and rt.jar LGPL seems just fine to me.

  This is the same FUD that Microsoft tries to spew about the GPL all the time.

  Posted by: kebernet on November 15, 2006 at 08:07 AM

• This very same issue was brought up before by Kaffe and Classpath developers that were scared to look at Sun's source (prior to GPL) because of licensing issues. The tables have just been turned a bit. The question now becomes, should commercial engineers be afraid to look at the GPL code out of fear that they'll some how be influenced by the GPL base and as such force the GPL on their product. I think it's a fair question to ask.

  Posted by: rabbe on November 15, 2006 at 08:18 AM

• I think the second scenario is very implausible in a professional development environment, considering that none of the current licenses allow the code from the JDK to be cut, pasted and relicensed under a different author's name and terms, afaik .. neither does any BSD license, nor the Apache license, nor the Eclipse license, for the matter.

  It's a silly idea.

  Posted by: robilad on November 15, 2006 at 08:47 AM

• Hmm, if you copied something from LinkedList before, wouldn't your source become Sun property according to the SCSL?
  

  Posted by: tobega on November 15, 2006 at 08:50 AM

• @robilad

  well, I think it probably happens. If you peruse the bug database you will find developers whose workarounds appear to be cut and paste and alter the unalterable code. Im not sure what happens after that, but I don't have any doubts about it occuring. As to whether they insert the license from the mother code, Im somewhat dubious.

  leouser

  Posted by: leouser on November 15, 2006 at 08:59 AM

• rabbe: There is a certain difference ... the Kaffe/GNU Classpath folks had to try to make sure that their implementation is independent. Most commercial developers don't write JDK implementations, though. The concerns of someone writing an independent implementation of the JDK can not have much to do with them.

  kebernet: Some people beleve that lawyers are oracles of absolute truth. But, what many people seem to miss is that garbage in, garbage out holds there, as well. Don't blame it on the lawyer unless you know what information he was fed. ;)

  Posted by: robilad on November 15, 2006 at 09:06 AM

• @leouser: Oh, I have no doubt that people make mistakes wrt to license compliance to the letter all the time. It's in human nature to make mistakes.

  I just don't think that a place that's so concerned about the pedigree of the code that its commercial developers can not use GPLd code, would allow such developers to cut and paste and relicense code freely under any other license, either. It would a very silly policy for a professional development shop.

  David's singling out of the GPL as somehow exclusively preventing such use in a professional environment is misguided: the Eclipse license works in exactly the same way as other licenses, you can't just cut and paste Eclipse code around and relicense it as you see fit.

  Posted by: robilad on November 15, 2006 at 09:20 AM

• I don't know if Id call it a mistake, maybe more like willfully ignoring the license. :D

  leouser

  Posted by: leouser on November 15, 2006 at 09:29 AM

• robilad: I don't think that distinction you describe protects commercial developers at all. In the example David provides, he claims that someone who has studied GPL code and implements techniques comperable (not a cut and paste) to the code in question may have just created a derivative work. Is this true or not? I understand we're dealing with hypothetical situations. However, It's important for developers to know exactly what they can do and to know what risks they are taking by examining GPL code. Looking at Davids example of the mapped list, the only way that David could keep his source from becoming GPL would be to add his MappedList to the GPL JRE (FORK and/or contribution) and distribute it with his application. Once again is this correct?

  Posted by: rabbe on November 15, 2006 at 10:22 AM

• @rabbe: my point is that his concerns are not at all exclusive to the GPL, even though he presents them in that context. They come from a misunderstanding of how copyright laws and open source licenses work in general, rather than from the particular terms of a license. There is nothing wrong with that, of course, and I'm sure an event as significant as Sun's release of the JDK under GPL/GPL+classpath exception will result in a lot more interest among people not familiar with that class of licenses about their effects, and mechanisms. It's just important to separate the chaff from the wheat, the questions where the GPL is actually a relevant factor of the answer from those where it's not.

  As far as concerns about implementing similar techniques go, I'll just point out that David works on Eclipse, and Eclipse implements an Emacs emulation mode. Emacs is under the GPL, Eclipse is not, but no one objects to such reuse of ideas, or considers Eclipse to be derivative work of Emacs, or vice versa.

  As far as accidentally using works of others in your own works without following their terms and conditions, the simplest way to deal with such a problem in general is to stop using those works in your own works without following their terms and conditions. That, again, has nothing to do with the GPL, or any other open source license. There have been such mistakes at apache, for example, where someone checked in something GPLd. It was unsurprisingly simply fixed by removing that code, rather than relicensing all of apache code under the GPL.[1]

  [1] http://mail-archives.apache.org/mod_mbox/incubator-cvs/200403.mbox/%3C20040313055705.30528.qmail@minotaur.apache.org%3E

  Posted by: robilad on November 15, 2006 at 11:18 AM

• On the issue of a developer downloading the GPLed version and "accidentally" infecting his own application, yes, he's screwed himself. But it would still be nice if Sun made some attempt to avoid this kind of thing...probably just a warning on the GPLed download that says roughly "you better know what you're doing legally here. If not, download the other version".

  If Sun is going to offer Java developers the rope to hang themselves, a warning label would be nice.

  On the other hand, if it really is a matter of "take out the GPLed code if you're ever caught" as Dalibor suggests, I guess it's not a big issue.

  Posted by: atripp on November 15, 2006 at 11:43 AM

• @atripp: The GPL offers a pretty big stick against willful, commercial license violations, similarly to the other licenses Java is licensed under. The context of the discussion is accidental license violations, and I believe it's clear that they are two pairs of shoes, where different types of responses are appropriate.

  Posted by: robilad on November 15, 2006 at 12:01 PM

• Andy, one of my thoughts on making the posting is ... this standard you're proposing is different from the standard held up to every other GPL'd project. If you want to demand that Sun be extra careful about warning people, then why don't you also demand that of all the other projects that use the GPL?

  Posted by: robogeek on November 15, 2006 at 01:57 PM

• I don't know about a flag. When I first read this blog I thought that it would be good if there was a simple resource for developers to reference to get an idea about what happens to your code in X situation. I think the FAQ does an ok job explaining the CLASSPATH exception, so maybe that will be adequate. But for the newbie to license land, instead of sending them to a license to read right away give an interpretation of some things so that they can read it a little more competently. Id think the curious or fearful would like that.

  leouser

  Posted by: leouser on November 15, 2006 at 03:52 PM

• What you're all forgetting is that it hardly matters whether a lawsuit against you by someone wanting to have your code (which is what the GPL is all about, getting others to give them their code for free) is likely to succeed.
  The mere possibillity (and almost certainty given enough time) that such lawsuits will happen (or even be threatened) is enough to make many people take pause and reconsider their commitment to Java.
  Small companies can't afford to go to court, nor can they afford to loose their intellectual property. The financial consequences would quickly ruin them.
  Large companies are less worried about the cost of lawsuits as they are about the PR fallout, and would still not like to loose their IP.
  When that IP is security related (like your user authentication and authorisation systems, which generate your license keys for example) it gets even worse as now you're forced (on fear of loosing millions in lawyer fees at the very least) to release the one thing that slows or stops piracy of your systems to the people most likely to use it for piracy...
  We can thus expect many companies (and individuals) to either abandon Java completely or to by policy refuse to adopt any version newer than 1.5. It's the only way to stay reasonably secure.
  Personally that's what I'll do, I certainly will never lay eyes on a piece of GPL sourcecode. The risk of being accused of having learned from it and therefore applied GPL source to my own (not by copying verbatim but by remembering pieces and writing those down later, try to disprove that) is too high.
  The risk of forks being released, muddying the waters and making it impossible to rely on a classfile compiled on one machine working on any other is another factor to not adopt an open source version of Java. At least by sticking to an established version and requiring that version to be present on customers' machines you can be assured of something. When there are a thousand "Java 1.6" versions out there all over the net, each with a slightly different classfile format and language features (let alone standard API implementation differences) that's the end of it.

  Posted by: jwenting on November 16, 2006 at 01:47 AM

• Im trying to fathom what the risk would be for someone or a company who downloaded and used a version of Java with the other non-GPL license. If you aren't using or promoting you product with an GPLed Java, where is the risk? I can't see someone making a lawsuit against you because they think you used a GPL Java and didn't tell anyone. Why couldn't they do that today, "I think your using Linux and not telling anyone".

  leouser

  Posted by: leouser on November 16, 2006 at 06:48 AM

• @jwenting

  What I would actually like to know is how someone would PROVE that you looked at GPL code (you don't have to disprove anything, guys suing you have to offer the proof). But, judging from your level of fear and paranoia, I could advise two things, either actually read what Sun is telling on how they intend to prevent incompatible forks carrying Java name plus all of their stuff about commercial but free version they will continue to provide, or find some comfortable, extremely closed source environment similar to Java (it is not like there aren't any choices). And stay very alert, you NEVER know where evil GPL code snippets could show up, in the newspapers, your favourite web sites, on TV, someone could even read few bits on a radio....one can never be too careful.

  Posted by: selendic1 on November 16, 2006 at 10:40 AM

• Robogeek, You said "...is indeed why we chose the Classpath exception. It's so that the GPL-ness of the runtime classes do not pass along to programs that subclass the runtime classes."

  But the Classpath exception says "As a special exception, the copyright holders of this library give you permission to link this library with independent modules ... An independent module is a module which is not derived from or based on this library." On the other hand the GPL FAQ says "Subclassing is creating a derivative work." It appears to me that "derivative works" cannot be considered "independent module[s]"... how do you see getting around this?
  

  Posted by: randydeansmith on June 04, 2007 at 02:34 PM

This work is licensed under a Creative Commons License.