News for hackers. Stuff that matters.
Re:More awful IoT stuff by Klathmon on Wednesday June 22, 2016 @08:54AM (#11953465)
>It's running Linux and includes Busybox and dnsmasq, so plenty of GPLed code. I emailed the manufacturer asking for a copy and got told that they wouldn't give it to me, which is unsurprising but still disappointing.

Has the GPL really lost it's power that much? I mean not responding to inquiries is one thing, but outright saying no?

Re:More awful IoT stuff by oliwarner on Wednesday June 22, 2016 @10:49AM (#11954343)
Lost its power? This is just copyright apathy. Nothing new, especially in China. Look at it from the manufacturer's point of view. They know how expensive this would be to take to China and prosecute and they know they're a tiny fish. It's simply a reasoned gamble that saying no is the fastest, most efficient way to get this dealt with. Much easier than auditing the code, having the developer separate out sensitive data, etc. Well before you consider the long term archiving of this stuff. They're probably already making the next generation of this rubbish.

I dare say if this were a major manufacturer, more effort would be made to make them behave, but we're talking about a short-run switch here.

If there ever becomes a mechanism to DMCA-takedown physical products on an international level, we might see some movement here. But China (et al) would never, ever agree to that. It's hard enough to get them to block things that clearly break international safety standards.

Re:More awful IoT stuff by josho on Wednesday June 22, 2016 @11:18AM (#11954593)
This makes me wonder how imports are handled. If I can buy a third party power supply from a US based order system (amazon), and this ps is dangerous (eg. those knock off Apple power supplies). How is this legal, presumably the device hasn't passed safety regulations here. So, there must be some way to stop this product from entering the country. Why isn't that mechanism happening?

Same applies for this device. If a mfg is infringing on copyright then shouldn't we have a mechanism to stop it from being imported?

It strikes me that we have two laws in this country. The laws for those with money/power (e.g. MPAA to protect US corporate media interests), and then those same laws that are not applied to protect consumers. Is the only difference that MPAA has lawyers to ensure copyright infringement stops while consumers don't?

Re:More awful IoT stuff by ehntoo on Wednesday June 22, 2016 @12:33PM (#11955142)
I cannot speak to copyright, but there seem to be mechanisms in place for stopping import of trademark infringing goods to the US. See for example the run-in which SparkFun had with importing lookalike Fluke Multimeters a few years ago: https://www.sparkfun.com/news/1428 and previous HN discussion here: https://news.ycombinator.com/item?id=7428799

This might actually do more to confirm than dispute your comment about "laws for those with money/power", though.

Re:More awful IoT stuff by oliwarner on Wednesday June 22, 2016 @06:37PM (#11957590)
There are mechanisms for policing (certainly in the UK) this but:

- Containers are MASSIVE. Seriously. You can fit hundreds and hundreds and hundreds of thousands of plug-sized widgets in a container.

- Millions of containers leave China every day.

- People lie about certification, provenance, component specs. Even if you do test one, the next 999,999 are probably all using shitty capacitors.

- There are many ports that don't all share data.

The only stuff that gets refused are where you have repeat offenders coming into the same port with the same dangerous stuff.

And yes, MPAA and other trademark bandits with all the cash can pay to police this stuff. It isn't fair... But I'm not sure the world would have the appetite for absorbing the costs in import tax. A testing container of plugs would push the price up way beyond $30 a unit and that's testing 1/1000.

Demanding certified manufacturing might be an option but that's expensive for China so they'll resist (or do a job equally shitty as the plugs they'd be supposed to police).

Re:More awful IoT stuff by euroclydon on Wednesday June 22, 2016 @11:25AM (#11954647)
Right, but can't Amazon or Home Depot be sued?
Re:More awful IoT stuff by schneidmaster on Wednesday June 22, 2016 @11:24AM (#11954643)
I'm also curious how many manufacturers (especially of questionable-quality products like this) simply don't bother to read and understand the licenses of the OSS they're using. I suspect it's a lot.
Re:More awful IoT stuff by oliwarner on Wednesday June 22, 2016 @06:43PM (#11957627)
Pretend that you knew you could get away with not paying tax or keeping records. You might get an email from the IRS but in this imaginary world, they only prosecute the biggest cheats.

I'm sure you're a fine person who would keep paying but do you think everybody would because it's the right thing?

That's all that's happening here.

Re:More awful IoT stuff by mikegerwitz on Wednesday June 22, 2016 @08:59AM (#11953499)
> Has the GPL really lost it's power that much?

It's up to the copyright holder to enforce it.

Re:More awful IoT stuff by BostonEnginerd on Wednesday June 22, 2016 @09:10AM (#11953569)
I don't believe that's the case. As an owner of a device with GPL code on it, you are entitled to the source as well.
Re:More awful IoT stuff by icebraining on Wednesday June 22, 2016 @09:16AM (#11953608)
You are entitled by the license, but only the copyright holder can sue for the violation.
Re:More awful IoT stuff by JoeAltmaier on Wednesday June 22, 2016 @09:43AM (#11953807)
So, the GPL never had much power?
Re:More awful IoT stuff by maxerickson on Wednesday June 22, 2016 @09:53AM (#11953883)
It's not any different than any other copyright license in that respect.
Re:More awful IoT stuff by Klathmon on Wednesday June 22, 2016 @09:45AM (#11953823)
If that's really how it works then does that mean that open source projects with no clear copyright owner can't enforce their license?
Re:More awful IoT stuff by drostie on Wednesday June 22, 2016 @10:18AM (#11954116)
It depends.

If it has "no clear copyright owner" because it comes from an entire community and has a ton of copyright holders for little bits of the code here and there, then it means that every copyright holder can sue for breach of copyright.

If on the other hand it has "no clear copyright owner" because it was written by one person under a pseudonym and that holder is almost surely never going to come forward to prove that they are the person intended... then it's de facto public domain even if that's not its status de jure. If you really want to push it in court, you can say that you met the person in-person at a conference and that they verbally told you to do anything you want with it: unless they stand up to say "that's a total lie!" there's no way of proving, because just because some code C has been licensed to a million people under the GPL, it doesn't mean it hasn't been licensed to one other person under the WTFPL.

As for how this could happen... It could be that everything suggests that they never want to come back, like the apparent disappearance from Earth of Satoshi Nakamoto; it could also be something with more stake, for example if Ross Ulbricht had gotten out of the Silk Road business and GPLed his code as the Dread Pirate Roberts before he was caught; in that hypothetical universe, nobody would want to prove that they were the DPR until some statute of limitations for running the black market had passed.

Re:More awful IoT stuff by icebraining on Wednesday June 22, 2016 @10:11AM (#11954058)
Well, if it's a project with lots of contributors, any one of them can sue¹. If no contributor can be identified, it's probably unenforceable, yes, though IANAL.

¹I believe there are some exceptions, like having contributed only an insignificant fraction of the whole work.

Re:More awful IoT stuff by iofj on Wednesday June 22, 2016 @11:58AM (#11954891)
That reasoning works until the judge considers damages. Then let's say it's a small developer, not too much work, and no commercial interest in the code. Damages are limited, in western law, to, well, damages. You need to have suffered a financial loss, the other party needs to have violated the license/contract/law/... and you need to show the causal connection between the two.

Let's say you contributed 500 lines of code to some project. You sue somebody for violating GPL and not publishing their changes. The judge has to give them the choice : either pay damages or actually comply (another western legal principle : money buys your way out of anything, as long as it isn't criminal).

What damages to assign ? Well, seems reasonable to say "how much for 500 lines of code ? A week's wages ? Okay, 2500 dollar damages awarded". The other party might become scared because other developers could conceivably sue, but ...

Re:More awful IoT stuff by icebraining on Wednesday June 22, 2016 @12:22PM (#11955066)
Re:More awful IoT stuff by startling on Wednesday June 22, 2016 @02:47PM (#11956072)
I believe you can still sue for an injunction (e.g. to compel them to distribute copies of code as per the GPL).
Re:More awful IoT stuff by iofj on Thursday June 23, 2016 @02:25AM (#11959202)
Injunction is a way to prevent more damage from occurring. So generally speaking, injunctions :

1) are only available either during a trial or as a last resort (if you can make a good case the defendant won't pay even if the judge compels them)

2) you'd still have to prove more damage will be done if injunction isn't there. Those have to be real damages, with real monetary amounts on them.

This is western law, it's practical. Anything you do that either doesn't bother anyone, or you prevent damage from occuring is legal, no matter how much it is against (civil) law.

The fact that something violates copyright, by itself, is not sufficient to get anything done in court at all.

Re:More awful IoT stuff by startling on Monday June 27, 2016 @04:08AM (#11984781)
Thanks for clarifying!
Re:More awful IoT stuff by JoeAltmaier on Wednesday June 22, 2016 @09:47AM (#11953839)
Doesn't the actual text of the license list the owner?
Re:More awful IoT stuff by lmm on Wednesday June 22, 2016 @01:01PM (#11955377)
mjg59 is a copyright holder for Linux though. Surely he of all people should be actually lawyering up rather than just telling people not to use this device on the internet.
Re:More awful IoT stuff by ashitlerferad on Thursday June 23, 2016 @02:46PM (#11963430)
The GPL is not and has never been magic pixie dust. Ensuring companies and people comply with it costs money thanks to the legal system. The folks at gpl-violations.org and Software Freedom Conservancy do a lot of good work bringing companies into compliance, including helping Linux developers to sue VMware for their infringing use of the Linux kernel.

https://sfconservancy.org/ http://gpl-violations.org/

Re:More awful IoT stuff by pjc50 on Wednesday June 22, 2016 @10:29AM (#11954203)
This happens a lot. The GPL remains enforcable, but just because you have a copyright doesn't mean that people will bother to comply with it.
Re:More awful IoT stuff by Klathmon on Wednesday June 22, 2016 @10:50AM (#11954346)
I've heard of companies like BMW (not true, see edit) just ignoring requests for GPL code, or promising to release it but just never doing so.

And that's a shitty thing to do which I 100% disagree with, but at least it gives lip service that they are doing something wrong. If what this reviewer says is true, the company just told him no.

That's not ignoring copyright/GPL, that's laughing in it's face.

Edit: BMW apparently did not do that, I probably read that somewhere that had an axe to grind...

Re:More awful IoT stuff by Tomte on Wednesday June 22, 2016 @10:55AM (#11954386)
The case you heard about was overhyped. BMW did provide source code.

It required a second request, and BMW's internal bureaucracy took some days (or weeks?), but they did fully comply.

Re:More awful IoT stuff by Klathmon on Wednesday June 22, 2016 @11:02AM (#11954462)
Fair enough! But that was just one of many that i've heard of.
Re:More awful IoT stuff by porsupah on Wednesday June 22, 2016 @11:08AM (#11954517)
The Register provides a brief summary of the BMW matter:

http://www.theregister.co.uk/2016/03/30/bmw_complies_with_gp...

Re:More awful IoT stuff by arantius on Thursday June 23, 2016 @02:57PM (#11963534)
You're only required to distribute sources if you modify them _and_ distribute the resulting binaries right? Is there any evidence that the busybox and/or dnsmasq binaries are anything besides the normal stock installation? The customization is in other binaries that need not necessarily be GPL it seems.