Open Source—Avoiding Common Pitfalls

Open Source Software:
Avoiding Common Pitfalls
September 22, 2015
© 2015 Kronenberger Rosenfeld, LLP

Agenda
What is Open Source?
Quick Overview of Intellectual Property
Dimensions of Open Source Licenses
Common Open Source Licenses
Open Source in Court
Pitfalls
Proactive Compliance
Conclusion
Q&A

The Open Source Definition by the
Open Source Initiative:
10 paragraphs
The Free Software Definition by the
Free Software Foundation:
4 pages

• Open source
• Public domain
• Free software
• FOSS
• FLOSS
• GPL
• BSD
???
• Copyright
• Copyleft
• Software freedom

“Open source software is software that can
be freely used, changed, and shared
(in modified or unmodified form) by anyone.”
Free of charge
Published source code
Varying restrictions on commercial use

Quick Overview of
Intellectual Property (IP)
Kind Protects Laws
Patent Technological inventions Federal
Copyright Expression Federal
Trademark Signals of source Federal and State
Trade Secrets
Information that is valuable
because it is secret
Mostly State

How IP Protects Software
Kind Protects Laws
Trade Secrets
Mostly State

How IP Protects Open Source Software
Kind Protects Laws
Trade Secrets
Mostly State

How Copyright Protects Software
• By default, copyright law excludes others
from using creative works.
• An author must expressly allow you to use a
work.
• In software, permission is granted with a
license.

What is a License?
• Contract
• Allows use of IP (copyrighted source code)
• Imposes conditions

Proprietary Software vs. Open Source
Proprietary Software Open Source
High price tag Free
Strong warranties No warranties
Support provided No support
Black box – no source code Source code provided
No modifications or
reverse engineering
Modifications encouraged
No sublicensing Sublicensing with conditions
Express patent license Patent treatment varies by license

Dimensions of Open Source Licenses
• Copyleft
Your code must be under the same license
• Notice
Must include notice and a copy of the license
• Source code disclosure
Must include a copy of your source code
• Sublicensing
Can you grant downstream licenses?
• Patent license
Some give express patent license
(GPLv2 is silent!)

Copyleft
Requires that you MUST share modifications.
“You must cause any work that you distribute or
publish, that in whole or in part contains or is
derived from the Program or any part thereof, to
be licensed as a whole at no charge to all third
parties under the terms of this License.”
—GPL v2 § 2

Spectrum of
Open Source Licenses
Copyleft Permissive
Public
domain
GPL, Affero GPL, LGPL
Mozilla Public License
BSD
MIT
Apache
CC0

Common Open Source Licenses
GPL BSD MIT Apache
v2 v3
Notice Y Y Y Y Y
Source Code Y Y N N N
Sublicense Y Y Y Y Y
Copyleft Y Y N N N
Patent
License
? Y ? ? Y

The GPL
• 1989
– Berlin Wall falls
– GPL 1.0
• 1991
– Gulf War
– Soviet Union Dissolves
– GPL 2.0
• 1993
– Mosaic graphical web browser released
• 2007
– GPL 3.0

BSD (3-clause)
Copyright (c) <YEAR>, <OWNER>
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list
of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or other
materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Notice
No
endorsement
Disclaimers

BSD (2-clause)
Copyright (c) <YEAR>, <OWNER>
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list
of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or other
materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Notice
No
endorsement
Disclaimers

More Obscure Licenses
DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
Version 2, December 2004
Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>
Everyone is permitted to copy and distribute verbatim or modified
copies of this license document, and changing it is allowed as long
as the name is changed.
DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. You just DO WHAT THE FUCK YOU WANT TO.
/*
* ----------------------------------------------------------------------------
* "THE BEER-WARE LICENSE" (Revision 42):
* <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you
* can do whatever you want with this stuff. If we meet some day, and you think
* this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
* ----------------------------------------------------------------------------
*/
1,089 items in Wikipedia
305 items in Wikipedia

Notable Open Source Cases
• Jacobsen v. Katzer
Open source licenses are enforceable
• BusyBox cases
GPL violations by embedded developers
• Linksys: Free Software Foundation, Inc. v. Cisco
Systems, Inc.
GPL violation in routers
Settlement: $ donations to FSF + open source
compliance director
• XimpleWare Corp. v. Versata Software, Inc.
GPL violation in enterprise software
• VMWare case (Germany)
Mixed proprietary/GPL Linux kernel

Jacobsen v. Katzer
535 F.3d 1373 (Fed. Cir. 2008)
• Software: Jacobsen’s Java Model Railroad
Interface
• License: Artistic License
• Violations:
– No attribution
– Copyright notices removed
• Lower court: Breach of contract, but no copyright
infringement, so no injunction
• Court of Appeals:
– Violation of open source license is copyright
infringement.
– Upheld validity of public licenses
– “Copyright holders who engage in open source
licensing have the right to control the modification
and distribution of copyrighted material.”

BusyBox cases
• 7 cases filed in 2007–09
• Software: BusyBox utilities for embedded
systems
• License: GPL v2
• Plaintiffs: Two developers
• Defendants: Device makers
• Outcomes:
– Several settlements, including payments to
developers
– Default judgment, injunction, and treble
statutory damages against Westinghouse

Linksys Case
Free Software Foundation, Inc. v. Cisco Systems, Inc.
• Plaintiff: Free Software Foundation
• Software: GNU C Library, GCC compiler, etc.
• Licenses: GPL v2, LGPL
• Alleged infringement:
– Modified code in router firmware binaries
– Failure to provide source code
• Filed December 2008
• Settled May 2009
– “Free Software Director” position created
– Source code published
– Payment to Free Software Foundation

XimpleWare v. Versata
• Plaintiff: Small California software company
• Defendant: Versata Software
• License: GPL v2
• Alleged Infringement:
– Removal of copyright notices
– Non-copyleft sublicensing
• Other issues: Three patents
(asserted in companion patent case)
• Preliminary injunction barely denied in
copyright case
• Settled in early 2015

VMWare Case
• Plaintiff: Christoph Hellwig, Linux kernel
contributor
• Defendant: VMWare
• Currently pending in Germany
• Alleged infringement:
– Mixing GPL v2 and proprietary code
– Failing to release source code

Common Pitfalls
• “I found this code on the web. I can use it,
right?”
• “This code is open source, that means I can
do whatever I want with it, right?”
• “I’ll be okay under the fair use doctrine, right?”
• “No open source” clauses

“I found this code on the web.
I can use it, right?”
Source: Open source license usage on GitHub.com (March 9, 2015)
https://github.com/blog/1964-open-source-license-usage-on-github-com

“I found this code on the web.
I can use it, right?”
• Not all “code on the web” is open source.
• All open source is not the same.
• Look for explicit licensing information—do not
assume anything.
• When in doubt, ask the author.
• Without a license, you do not have
permission to copy a copyrighted work!

“This code is open source, that means I
can do whatever I want with it, right?”
• Open source licenses have strings attached.
(Lawyers call them terms and conditions.)
• Notice requirements are easy to mess up.

“This code is open source, that means I
can do whatever I want with it, right?”
http://www.law360.com/articles/486925/ximpleware-says-versata-sold-300m-in-stolen-software

“I’ll be okay under the
fair use doctrine, right?”
• Probably not.
• The fair use doctrine is probably not what you
think it is.
• The scope of protection is narrow.
• It exists only in the US.
• How it is applied is unpredictable and
very fact-specific.
• Recent case law says fair use is a right, not
an affirmative defense. (Lenz)

“I’ll be okay under the
fair use doctrine, right?”
§ 107. Limitations on exclusive rights: Fair use
Notwithstanding the provisions of sections 106 and 106A, the fair
use of a copyrighted work, including such use by reproduction in
copies or phonorecords or by any other means specified by that
section, for purposes such as criticism, comment, news reporting,
teaching (including multiple copies for classroom use), scholarship,
or research, is not an infringement of copyright. In determining
whether the use made of a work in any particular case is a fair use
the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is
of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the
copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the
copyrighted work.
The fact that a work is unpublished shall not itself bar a finding of fair
use if such finding is made upon consideration of all the above
factors.
17 U.S.C. § 107: https://www.law.cornell.edu/uscode/text/17/107

Enterprise Deals:
“No Open Source” Clauses
• Context: Big companies buying software from
vendors
• Concern: Unknown obligations, i.e., copyleft

“[VendorCo] hereby warrants that the Software
contains no open source code and that it will not
provide any open source software as part of its
Services or Software.”
Enterprise Deals:

“No open source. No software, code and/or
firmware delivered by [VendorCo] to [BigCo] will
contain any Works licensed under a license
agreement that requires that derivative works of
such Works be provided to the licensor or
recipient of such derivative works with a right of
use, redistribution or modification.”
Enterprise Deals:

Open Source Audits
• Identify components in a code base
• Deep dependency tracing
• License identification
• Identify known security vulnerabilities in packages
When
• Due diligence
(financing, acquisition)
• Enterprise software sales
(e.g., warranting no copyleft)

Scanning Tools
• Black Duck (proprietary)
• FOSSology (open source: GPL v2)
• Palamida

Bigtime Compliance
https://www.blackducksoftware.com/audits/open-source-audits
https://www.blackducksoftware.com/products/black-duck-suite/protex/black-duck-code-label

Standardization of License Information
• Software Package Data Exchange
• Working group under the Linux Foundation
• “a standard format for communicating the
components, licenses and copyrights
associated with a software package”
– Toward a “bill of materials” for software
• Maintains a large license list
http://spdx.org/licenses/
®

Conclusions
• Open source software is everywhere…
And that’s great!
• Open source licenses are enforceable.
• There are important differences between the
major licenses.
• There is a lot of dangerous unlicensed code
on the web.
• Fair use is probably not what you think it is
(and doesn’t exist outside the US).
• Proactive compliance efforts can pay off.

Thank you!
https://github.com/anseljh
@krinternetlaw
@anseljh
Ansel Halliburton
KRONENBERGER ROSENFELD, LLP
(415) 955–1155 Ext. 122
ansel@krinternetlaw.com
https://krinternetlaw.com
October 4:
IP Basics
Evergreen Valley College
San Jose, CA
https://www.siliconvalley-
codecamp.com/Session/2015/
ip-basics

Linux Foundation
• Open Source Compliance Publications
http://www.linuxfoundation.org/publications/compliance
• Open Source Compliance Templates
http://www.linuxfoundation.org/programs/legal/compliance/templates

Books
• Open (Source) for Business: A Practical
Guide to Open Source Software Licensing
by Heather Meeker (2015)
• Intellectual Property and Open Source:
A Practical Guide to Protecting Code
by Van Lindberg (2008)
• Open Source Licensing: Software Freedom
and Intellectual Property Law
by Lawrence Rosen (2004)

Future of Open Source Survey
• 55%: “Open source delivers superior security”
• 58%: “Open source affords the greatest ability to scale”
• “78% of companies run on open source”
• “Less than 3% don’t use [open source] in any way”
http://www.slideshare.net/blackducksoftware/2015-
future-of-open-source-survey-results
Developer hoodie

Attributions
• The Open Source Initiative logo is a trademark of the Open
Source Initiative.
http://opensource.org/trademark-guidelines#Publications
• Tux drawing by Larry Ewing, Simon Budig and Anja Gerwinski
https://commons.wikimedia.org/wiki/File:Tux.svg
• Router by Evan-Amos (public domain)
https://en.wikipedia.org/wiki/Linksys#/media/File:Linksys-
Wireless-G-Router.jpg
• Macbook Pro photo by Jeff Geerling (CC-BY)
http://www.flickr.com/photos/lifeisaprayer/3346288138/
• “Samsung Galaxy S6” photo by Kārlis Dambrāns (CC-BY)
https://www.flickr.com/photos/janitors/16660301626/
• BMW 435i M Sport (F32) interior” by Yahya S. (CC-BY)
https://www.flickr.com/photos/128326674@N06/16721598404/
• Beer mug by Nicubunu (public domain)
https://openclipart.org/detail/14854/beer-mug

Attributions
• “Percentage of repositories licensed” chart by Ben Balter at
GitHub
https://github.com/blog/1964-open-source-license-usage-on-
github-com
• “Stop sign” photo by “Kt Ann” on Flickr (CC-BY)
https://www.flickr.com/photos/54409200@N04/5070012761/
• Black Duck images by Black Duck Software
https://www.blackducksoftware.com/audits/open-source-
audits
https://www.blackducksoftware.com/products/black-duck-
suite/protex/black-duck-code-label
• The SPDX logo is a trademark of the Linux Foundation.
http://www.linuxfoundation.org/about/linux-foundation-
trademark-usage-guidelines

Open Source—Avoiding Common Pitfalls

Recommended

More Related Content

What's hot (10)

Similar to Open Source—Avoiding Common Pitfalls (20)

Recently uploaded (20)

Open Source—Avoiding Common Pitfalls

Editor's Notes