Episode 195: FOSSY 2023 With Denver Gingerich  ## Metadata - Author: [[Sustain]] - Full Title: Episode 195: FOSSY 2023 With Denver Gingerich - Category: #podcasts - URL: https://share.snipd.com/episode/d7e283a7-bb3d-4ef9-913e-61023098a7c1 ## Document Notes ## Highlights - **Visio GPL Violation Example** - Visio TV was sold with software but no corresponding source code. - Users couldn't fix their TVs as Visio did not comply with GPL's right to repair terms. Transcript: Speaker 2 I've noticed this. Okay. Let's follow a lawsuit on behalf of the consumers and also the creators of the code because we have no right to repair this work. Speaker 1 Exactly. I mean, the real big thing in the Visio case is the way that we're doing it. So, historically and conventionally, a lot of these GPL enforcement lawsuits have focused on copyright and are brought by copyright holders. So the people that write the software. And these people are obviously very important in free and open source software, but they're not the people who are directly harmed by people failing to comply with the license. In most cases, the harm being done is to those who are using the software who are receiving it out of compliance and then don't have the right to fix it, which generally far outnumber the Developers that originally created it. So for example, every time a Visio TV is sold, it's being provided without the complete corresponding source code. And if they provide an offer that is not being given the complete corresponding source when people ask. ([Time 0:05:40](https://share.snipd.com/snip/3e3b795f-dace-4d52-9da5-8c39546c63d4)) - **How Denver Became Director of Compliance** - Denver first got involved by reporting a GPL violation on an Insignia Blu-ray player. - This led to a lawsuit involving Best Buy and started his work at Conservancy. Transcript: Speaker 1 No, definitely. I work with lawyers, but I'm not a lawyer. So how did you end up in this role? So it was very fascinating, actually, because I was at a conference where I was living at the time in New York City. And I was listening to some other conversations around me. And I heard Bradley Kuhn talking to someone about a GPL violation. And I had recently received a Blu-ray player made by Insignia, which is the store brand of Best Buy. And I'd done a little bit of looking at it to see, oh, well, what's on here? Like, can I compile this and put it back on my TV or sorry, on my Blu-ray player? And then I, you know, I tried that and I found I couldn't. And so I told Bradley about this. And he said, wow, that's very important. We should do something about that. And he in fact did do something about that when software Freedom Conservancy did a lawsuit against a number of organizations, including Best Buy, as a result of the report that I gave Bradley, that was a part of it. And so from that, Bradley kind of understood the sort of work that I was interested in when I was able to do. And that's how I started working at software Freedom Conservancy in a very part-time role at that time, because software Freedom Conservancy is a small nonprofit with limited resources. So as Conservancy gets more resources, I can get more time. So I was very excited to be able to start working on that. And at the time, I was working primarily in finance. And that was not as, shall we say, so satisfying as working at software Freedom Conservancy. ([Time 0:07:00](https://share.snipd.com/snip/d0a2f5bb-0f68-4e85-95fa-69bde8870035)) - **XMPP License Safety Explained** - XMPP protocol is safe and free from licensing concerns due to its IETF standardized process. - The main licensing worry in protocols is hidden patents, but IETF tries to avoid that. Transcript: Speaker 1 I mean, usually those sorts of things are not necessarily software license issues. If it gets to that point, it's probably not a real protocol to begin with, would be my opinion anyway, or at least a real standard protocol. So I would say that XMPP, because of the way it's been been made through the IETF and their processes, it's very safe to use. There aren't any licensing concerns I would have with XMPP. I think with standards, the usual issue that people run into is that there's some hidden patented something in them, and that's a concern for them because you can't implement the standard Without maybe infringing on that patent. But in terms of what IETF does, they try very hard to make sure that's not the case, and I'm quite confident XMPP is not that. But of course, we never know for sure, because the patent system is broken in a lot of ways. ([Time 0:08:57](https://share.snipd.com/snip/92751b0e-ae58-4a88-93f4-d953336f05a1)) - **John Deere Right to Repair Issue** - John Deere uses open source software but restricts farmers' ability to repair their tractors. - Despite license terms, John Deere provides incomplete source code limiting right to repair. Transcript: Speaker 2 Take a company that's really, really bad at license compliance, or not license compliance, sorry, at closed software and not no right to repair. So John Deere, for instance, right? I don't have a Vizio TV. I'm probably never going to have a Vizio TV. I don't like TV. So I use my laptop to stream stuff and it works just fine. But I do contribute and take part in the massive experiment that we're doing right now, which is Big Ag, in the sense that I go buy food from my local large supermarket, which has probably Been sprayed with Glicefates and probably really crap, but comes from a large producer by someone who owns a tractor that they can't repair. Now, as the director of compliance at Software Free Conservancy, how would you even know whether John Deere or not is violating license agreements in the software that is using on its Machines? Speaker 1 Sure. So I mean, the first step is to see what software is being used on the tractors. And so fortunately, there are lots of people in the world who love tinkering on these things, and they know how to take a look at what's on these devices, poke at them in different ways To see what's in there. And so that's part of how we determined that they were indeed using the software. John Deere also at the time was providing an offer for source code on their webpage. I'm not sure if it's still there, but that was another way they offered to provide it to anyone in receipt of the offer. And so we took them up on that offer and then found that it was very incomplete. Really, obviously, not enough to repair the software that's running on the tractor. And so that really is how we started with that. And it's really been quite a journey to see how this is impacting people in different ways, because as you said, it's a big experiment. The big egg is a big experiment. And I think we don't really know how it works very well. And as a result, it's important for us to be very nimble and able to adapt to any issues that might arise with this experiment we're undertaking. And the problem not being able to repair your tractor is you can't adapt. The only way you can do things as if John Deere says you can do them. And so that's really the big issue we have here is that farmers who have traditionally been very adaptable because they know how to fix their machines. And that's something that's always been available to them. Now they can't do that anymore because John Deere is putting these restrictions on there, even though they picked software that has software right to repair built in, they could have Chosen not to do that. But that's not what they did because it provides benefit to them. And so they need to reciprocate and give that benefit to the farmers as well. ([Time 0:09:48](https://share.snipd.com/snip/a8d0fe0f-20ea-4541-a57f-248c0a6853c2)) - **GPL Enforcement Strategy** - Conservancy prefers private engagement for license compliance before going public. - Public disclosure happens only when companies fail to fix compliance issues. Transcript: Speaker 1 So according to our principles of community oriented GPL enforcement, we don't use public shaming as an initial way to to discuss our concerns with the public about a company. We contact them privately so that they have a chance to repair it before it becomes a public thing. Cool. Now in the case of John Deere, of course, they did not repair it. They did not fix the problem to be able to let farmers prepare their software on the tractors. ([Time 0:13:01](https://share.snipd.com/snip/c50ac9f4-9470-42f1-84e7-1325c2ae2433)) - **Global GPL Compliance Efforts** - GPL compliance efforts exist worldwide, with active contributors in Germany and Europe. - Collaboration and resource availability shape the effectiveness in various regions. Transcript: Speaker 2 You're obviously based in Canada. Are there people looking out for user protections in other countries in the world? Speaker 1 Yes, there are definitely. I would say there are a number of different organizations, some that we've worked in different capacities. And it kind of depends on the ability of the people involved at the time that they are in their life or whatever, how much work they're able to do on it. One person who's done a lot of work on GPL compliance in Germany is Harold Velta. And so he's Linux developer and he's ensured that a lot of the programs, especially with wireless components that are part of Linux have their license being complied with properly Because a lot of companies in Germany have had issues with that. And so he's done a lot of very successful enforcement on that. I know there are other organizations such as FSFE, which is a loosely tied to FSFE, but mostly effectively runs independently in Europe. And they're very excited about making this happen as well. So I'm very excited for the work that they're doing as well, because I think this is, of course, a global issue. ([Time 0:13:39](https://share.snipd.com/snip/b777b0ab-c96a-42ed-9ad5-a4c5c4ffe64b))