French telecom company Orange fined €650k for violation of GPL license(web.archive.org)
web.archive.org
French telecom company Orange fined €650k for violation of GPL license
https://web.archive.org/web/20240216164701/https://www.legalis.net/actualite/orange-condamne-a-650-000-e-pour-non-respect-de-la-licence-gpl/
41 コメント
As someone who worked at Orange, I’m not sure you want to read all of it. There’s definitely some getting-the-internet-to-work magic in there, but a lot of it is… Let’s just say not every developer is incentivized to write good code.
That really describes the state of the art in software. Don't bother trying to cover up the fact that you're normal and just like everybody else.
So it remains a valid punishment for Orange (unfortunately also a punishment for people who read that).
That could also be leveraged to find security issues, that can be interesting in an auth system.
That could also be leveraged to find security issues, that can be interesting in an auth system.
I'm curious if sudden public visibility would lead to security issues being found faster by people trying to patch them or exploit them.
Are you the user? The user is entitled to the source acvording to GPL.
This raises the question whether a third-party (potential) beneficiary can claim the source when the GPL code is not released to the user.
This has been discussed (on HN) with the recent Vizio judicial ruling.
For instance see https://news.ycombinator.com/item?id=39082722
(there might have better links)
This has been discussed (on HN) with the recent Vizio judicial ruling.
For instance see https://news.ycombinator.com/item?id=39082722
(there might have better links)
The user is the French government who contracted Orange to build its portal and Orange forked the Lasso single-sign-on library without respecting the GPL or buying the proprietary license on offer.
I guess in some jurisdictions a judge could order source code publishing as a punitive measure?
I’m very worried about these kind of things. I’ve worked on a number of projects that were not checking any of the licenses they were building on top of. As long as it’s open sourced people always assume that it’s OK to use it. I really wish it was the case. It’s really like people are leaving these small mines here and there for people to trip on it.
Right there at the top on the landing page:
That's hardly hiding the choice, someone at the telecom company chose not to get a commercial use license.
Lasso is a free software C library aiming to implement the Liberty Alliance standards; it defines processes for federated identities, single sign-on and related protocols. Lasso is built on top of libxml2, XMLSec and OpenSSL and is licensed under the GNU General Public License (with an OpenSSL exception).
We strongly recommend the use of the GNU General Public License each time it is possible.
But for proprietary projects, that wouldn't want to use it, we designed a commercial license.
That's hardly hiding the choice, someone at the telecom company chose not to get a commercial use license.
Hmm, the link for the commercial license is a 404 page though - https://www.entrouvert.com/en/expertise/licenses/
Edit: So are the links for the GPL and the OpenSSL Exception - https://lasso.entrouvert.org/license
Edit: So are the links for the GPL and the OpenSSL Exception - https://lasso.entrouvert.org/license
Those links have been dead for three years, it's a webpage </shrug>
https://dev.entrouvert.org/issues/52569
https://git.entrouvert.org/entrouvert/lasso
For commercial usage, though, the git page and forums are active enough and real live humans can be communicated with.
https://dev.entrouvert.org/issues/52569
https://git.entrouvert.org/entrouvert/lasso
For commercial usage, though, the git page and forums are active enough and real live humans can be communicated with.
If you act in good faith and fix issues as they are raised, nothing really bad should happen to you. Usually, GPL breakages are amicably pointed out and only if no agreement can be reached, the big legal tools are used.
Orange knows what they are doing.
Orange knows what they are doing.
As a developer, it's your responsibility to make sure the licenses check out; chances are you know more about those than your manager or employer's legal department.
On that note, we should probably double check our licenses and that we publish them as well.
On that note, we should probably double check our licenses and that we publish them as well.
Tell that to the average JavaScript dev who uses npm to download a library with 12 dependencies in order to use a function that returns the number of words in a string.
As a company, it's your responsibility to set and enforce a clear policy on using third party code. License is only one part of the problem.
As a company, it's your responsibility to set and enforce a clear policy on using third party code. License is only one part of the problem.
It cannot be the individual dev's sole responsibility.
There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game.
By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.
There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game.
By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.
IMO, using "free software" to describe GPL work doesn't really make sense. If I give you something, but require you to adhere to certain conditions, it's not really "free".
Say, if Bertram Gilfoyle lets you live in an apartment he owns as long as you remain a practicing member of the Church of Satan, that's not really "free", now, is it?
Of course, this idea of "freedom" is on a spectrum. By my lights, the MIT license is more free than the GPL because it imposes fewer restrictions on the user.
Personally, I don't let GPL software come anywhere near anything I'm working on. I don't even like using GCC, and was very happy when LLVM appeared on the scene with a less-scary license.
Say, if Bertram Gilfoyle lets you live in an apartment he owns as long as you remain a practicing member of the Church of Satan, that's not really "free", now, is it?
Of course, this idea of "freedom" is on a spectrum. By my lights, the MIT license is more free than the GPL because it imposes fewer restrictions on the user.
Personally, I don't let GPL software come anywhere near anything I'm working on. I don't even like using GCC, and was very happy when LLVM appeared on the scene with a less-scary license.
Yeah I think GPL should be described as booby trapped software
This seems an easily solvable problem. AI driven licence check on git merge to release?
Not even AI driven is fine, "just" match against a large corpus of known open source software.
Nah it has to be AI driven these days to get approval from management.
“Known open source”
But who will check the licences of those softwares to build the corpus?
But who will check the licences of those softwares to build the corpus?
A good start would be to crawl github and sourceforge. Most have license data. BlackDuck has a scanner with a corpus, don’t know how good it is.
a press article talking about it (still in french) https://www.zdnet.fr/blogs/l-esprit-libre/non-respect-de-la-...
First if 'service-public.fr' still mandate a big tech browser (aka javascript) and does not have a noscript/basic (x)html portal/compatibility, it should go to hell, really.
90% of their activity is keeping the portals safe and available: it is extremely hard for "juicy" web portals, usually you need special handling from state grade internet carriers (don't be fooled this is not a "small" thing, and you better know how to do that yourself, or Big Tech will take it all away and will dictate everything to your own core network/telecom infrastructure).
Second, I don't really know that piece of software, but if it is GPLv2, Orange should have provided the modified source code to the french administration (the "user"). If there was an "affero" clause, the french adminitration would have to publish to the french people the modified source code (or point to "upstream" if using verbatim).
If you want to screw your "clients" with open source: use massive and complex (SDK included, for instance using c++/rust/similar) open source software breaking it sufficiently often to force planned obsolescence (ISO+feature creeps is about 5-10 years planned obsolescence cycle), you know, what we actually today...
90% of their activity is keeping the portals safe and available: it is extremely hard for "juicy" web portals, usually you need special handling from state grade internet carriers (don't be fooled this is not a "small" thing, and you better know how to do that yourself, or Big Tech will take it all away and will dictate everything to your own core network/telecom infrastructure).
Second, I don't really know that piece of software, but if it is GPLv2, Orange should have provided the modified source code to the french administration (the "user"). If there was an "affero" clause, the french adminitration would have to publish to the french people the modified source code (or point to "upstream" if using verbatim).
If you want to screw your "clients" with open source: use massive and complex (SDK included, for instance using c++/rust/similar) open source software breaking it sufficiently often to force planned obsolescence (ISO+feature creeps is about 5-10 years planned obsolescence cycle), you know, what we actually today...
Orange is not just any telecom in France. It’s the incumbent, a bit like AT&T or Verizon in the US or BT in the UK, the French government still owns almost a quarter of the company.
Looks like Orange created something called "IDMP platform" (didn't find anything about it online) and used a library called Lasso that is licenced under the infectious GPL without releasing the source code to the "IDMP platform"
Or alternatively, buying a proprietary license from Entr'Ouvert. The court finally recognized the authors' purpose with the licensing model and validated it, that's really good news.
Liblasso is also available under a commercial license from the copyright holder.
If Orange wanted a commercial license, there doesn't appear to be any reason why it couldn't have bought one.
https://lasso.entrouvert.org/
https://www.entrouvert.com/expertise/licences/
If Orange wanted a commercial license, there doesn't appear to be any reason why it couldn't have bought one.
https://lasso.entrouvert.org/
https://www.entrouvert.com/expertise/licences/
> infectious
Self-inflicted.
Self-inflicted.
Definitely - I did not mean "infectious" in a disparaging way, since that's what the licence was written for. If you include GPL code, the licence "infects" everything around it.
The infection meme is very good to easily explain how GPL works - but it does "infect" only if you follow the license terms.
If you do not follow the license terms, you are using a copyrighted work without permission. And then, we are back to plain copyright law, with potential damages being awarded etc. (And the copyright owner is under no obligation to let the past infraction slip just because the violating party decides to suddenly follow the GPL terms.)
If you do not follow the license terms, you are using a copyrighted work without permission. And then, we are back to plain copyright law, with potential damages being awarded etc. (And the copyright owner is under no obligation to let the past infraction slip just because the violating party decides to suddenly follow the GPL terms.)
>And the copyright owner is under no obligation to let the past infraction slip just because the violating party decides to suddenly follow the GPL terms.
The owner might not, the court might. Proving damages from tardy publishing of source code would be tedious (at least in the EU). In this case they used their proprietary license option to justify the damages, which doesn't exist for a lot of software.
The owner might not, the court might. Proving damages from tardy publishing of source code would be tedious (at least in the EU). In this case they used their proprietary license option to justify the damages, which doesn't exist for a lot of software.
Yes, that is a very good point. To be awarded monetary damages, you have to make a case for it. In practice, I think a lot of companies wouldn't want to find out and try to settle in private instead.
In this case as you say, they had a proprietary license, so I guess the bottom floor for damages is the same price as a proprietary license. But I could from my complete layman perspective imagine damages to reputation, decreased likelyhood of getting new proprietary sales in the future if companies can ignore the licensing terms with impunity etc?
In this case as you say, they had a proprietary license, so I guess the bottom floor for damages is the same price as a proprietary license. But I could from my complete layman perspective imagine damages to reputation, decreased likelyhood of getting new proprietary sales in the future if companies can ignore the licensing terms with impunity etc?
Maybe I will be downvoted to oblivion, but here is what I think. As a Free Software proponent, I find the GPL license oppressive as far as free software goes and I never considered it a true Free as in Freedom license.
I know the arguments and I see where people come from. But I find BSD-like licenses a lot easier to enforce and understand, and a lot more compatible with my personal concept of Free Software
I know the arguments and I see where people come from. But I find BSD-like licenses a lot easier to enforce and understand, and a lot more compatible with my personal concept of Free Software
I want the whole source code published. That would be a real punishment - your proprietary code is now GPL'd.