EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.27.08

Selling Services Without Selling Fear of Licences

Posted in Free/Libre Software, FUD, GPL, HP, Rumour, Security at 2:29 am by Dr. Roy Schestowitz

Accusations against H-P and Palamida seem baseless

It wasn’t long ago that McAfee and InformationWeek were both harshly (and rightly) accused for spreading GPL fear [1, 2, 3]. This was not appreciated. It is actually worth reminding ourselves of speculations and predictions of a McAfee-Novell tie-up because Novell too was caught using FUD to market itself.

“Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.”On the other hand, some baseless accusations are flying about at the moment. Having been in touch with some of the parties involved, we wish to debunk FUD (or just lies) about FUD that never was. Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.

Let us start with H-P. Just the other day, when H-P introduced a set of services and tools that assist tracking of software and licensing, Dana Blankenhorn accused rather than thanked.

The Hewlett-Packard open source strategy is becoming clear.

Fear the source.

I’m certain HP officials will disagree with that. But when your press release is headlined, ” HP Promotes Open Source Software Governance with New Initiative,” there is no other conclusion to draw.

Your big company can’t go into open source alone. It’s dangerous out there. Here, hold our hand.

PJ disagrees with this, as do I. “HP is trying to do something very good with Flossology. I totally support it,” she says.

Why would anyone try to show just the negative side-effect (and yes, we’re sometimes accused of doing this as well)? Maybe because it stands out from the crowd and because ZDNet bloggers can be rewarded for provocations. Regardless of the issue at hand, H-P did make either an observation or a complaint back in 2005 (maybe 2006) when it said there were too many open source licences. But coversely, In this newer case, there is an attempt to address the issue, not just raise it. We should be happy. We should be thankful. And here were have the latest report from Palamida (published on Friday) which heralds to the world that GPLv3 finds love. This is good news, not bad news. Project evolve successfully.

The GPL v3 growth for this week is consistent with our average growth rate. As of January 25th, the GPL v3 count is at 1579 GPL v3 projects, up 44 projects over the past week. The LGPL v3 list is growing slowly but steadily and is currently at 150 LGPL v3 projects, as compared to last weeks number of 148 LGPL v3 projects.

At least one person claimed to have found flaws in Palamida’s work. Here is what one of our readers had to tell to us before we heard from Palamida (it’s reverse-chronological):


[Anonymised:]

I have been visiting Palamida GPLv3 site and I think they are doing a great job at tracking the license adoption, and their statistics can be very useful to counter the established proprietary software oligopolies’ and the mainstream tech media’s FUD machine.

But today I have been warned by Pieter Hitjens about the following: I copy-paste the conversation about recent statements made in the palamida gplv3 site (gplv3.palamida.com -which redirects to –> gplv3.blogspot.com)

[Pieter:]

http://gpl3.blogspot.com/

This site looks like it’s promoting GPLv3 but in fact it looks like subtle anti-GPLv3 FUD. E.g.:

“In the case of putting a GPL v3 project under a commercial license as well, there is high potential to violate the terms of the GPL v3. This is not to say that any of the aforementioned projects are or are not
in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

What they are saying, I think, is that GPL projects that do not have a clear copyright centralization cannot easily be re-licensed. However they don’t state this clearly, and they are not publishing my comments on the blog.

-Pieter

[Anonymised:]

as somebody who has gotten note of Palamida very early after GPLv3 was released and I’ve got a bit of contact with actual GPLv2->v3 conversions, I can say this:

Palamida, the owner of this blog (it’s advertized in the banner on the top of the blog) is a company who’s business is software risk management, so it’s the business of marketing at this company to show what risks may be there and that risk is increasing.

It is increasing, because GPLv3 makes things indeed a bit more complicated by the simple fact that it is a successor of GPLv2.

The only long-term solution to that which I see is to convince as many free software developers that licensing under “GPL v2 only” is a __very__ bad idea.

I think you guessed right that they may suggest that companies might want to buy services from Palamida, to improve legal security in software distribution.

What I see, rather looks like research which gives great information of the GPLv3 adoption, and no clear FUD.

[Anonymised:]

I see clear FUD, in this respect.

Dual-licensing is in fact a very strong argument for using GPLv3 but it depends on clear centralization of copyright. Projects like 0MQ – see www.zeromq.org – are careful to demand copyright assignments and/or MIT licensing from all contributors. For these projects, dual licensing is essential. This statement:

“This is not to say that any of the aforementioned projects are or are not in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

Is really bad. It suggests that we have to wait for Palamida to give the green light on whether it’s safe to use 0MQ. That’s very misleading and designed to create business for Palamida by exaggerating the complexity of the GPLv3 and ignoring the key role of copyright ownership.

If a company owns its code, how can it be in violation of the GPLv3 by dual-licensing its own code? That’s pure FUD, and worse, it brings into question one of the key business models for new smart FOSS businesses.

[Anonymised:]

Care if I forward your message to Pamela Jones (groklaw) and Roy Schestowitz (boycottnovell) so they alert about the issue. Think the palamida guys, who are doing a great tracking of projects adopting the GPLv3 should be aware as well. And of course the FSF/FSFE

[Pieter:]

Forward away, of course. Tracking GPLv3 usage is fine. Throwing fear and uncertainty onto other businesses to try to create extra business is not fine.

-Pieter


Shared with implicit permission, the above is intended to at least show the arguments that were thrown into this debate, which we believe is resolved by several factors.

For starters, PJ says: “I don’t agree they are doing that [spreading fear]“. Further: “They want business, so they highlight problems without telling you the solution, because they want business, but that isn’t, to me, exactly the same thing as FUD, although it can have a similar effect.”

Our reader adds: “Up to now, their work at tracking GPLv3 project has proven nice and useful to counter quite a lot of FUD [...] I think Palamida at least should publish Pieter’s comments. If they don´t do it after a while, “someone” should be pointing at the problem. Of course making clear that the tracking of GPLv3 projects is nice and useful.”

We received a response from Palamida quite quickly and it was very convincing. Judge for yourselves however:


I can say with 100% honesty that no, Palamida does not resort to FUD to sell our services. However, we do point out what can happen if you don’t know what you’ve got in your code base, which is a reality, and it’s what drives a lot of lawsuits and insecure apps. It’s just something people want to avoid and we’re here to help organizations figure it out so they can get it right. There is a subset of folks (including you) that know what the heck is going on and would vet and check you code, versions, and licenses ahead of time. Funny though that very large organizations often do not, or possibly can not, because of their size and geographically dispersed team of developers. These are the folks who have the Top 5 Most Overlooked OS vulnerabilities (and many more but let’s stick with 5) and don’t know it.

So in general, our message and mantra has always been “Know What’s In Your Code.” It’s a message that shouldn’t be considered FUD, because not knowing has very real consequences (can anyone say Busybox?).


Since H-P came under similar unjustified scrutiny we brought up this issue, which quite expectedly revealed sympathy:


In general, we like HP but here’s something to think about. Back at the beginning of Palamida, folks used to ask us, “Why wouldn’t I just use Google Code Search instead of paying for Palamida?” Our response was always that
they certainly could use Google if they only wanted a skim the surface view of what was going on in one single segment (say, JBoss code). However, our expertise coupled with the depth and breadth of our code base (which weighs in at 3 Terabytes) could give you a little more (to put it mildly). So I personally feel the same about FOSSology. This is my singular opinion, it’s a fantastic tool but it answers only one of the many, many questions people need to be asking (take a look at the blog we just posted Friday) about: what code are you using? What version? What license is it under? Is it secure?

How often is the FOSSbazaar updated? What does it include? What are its rates of false positives or irrelevant search matches? How comprehensive is it? Who has tested it? Would you bet your eBanking system security on it?

That sort of thing.


This hopefully resolves the issue, at least for those who were involved in a blame game. Censorship (aka “selective approval”) of comment was probably the main reason for going this far. We never delete comments in this Web site and only a single abusive reader has his comments flagged (still truly visible) for repetitive abuses even against other readers. Transparency brings better answers than censorship, which we last complained about just an hours ago (ODF/OOXML).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. ernest park said,

    March 31, 2008 at 8:06 pm

    Gravatar

    I note and appreciate the emotion filled comments regarding Palamida’s involvement in tracking GPLv3 adoption rates.

    I am in charge of the research team and the blog site. We get numerous comments, and ALL are posted. If a comment was left, while I don’t agree with it, it is posted. The nature of the site has NEVER been to spread fear or spin regarding how spooky and scary OSS is. Rather, my team and I are sponsored by Palamida to provide objective information regarding OSS usage of certain licenses.

    The forum is open to debate and public input. I can directly be reached via email with questions, or emails can be sent to rdgroup@palamida.com. Our research and the GPLv3 work should serve more as a barometer of the OSS community as a whole. Since we look at thousands of projects per week for licensing, code changes, updates, my team and I provide an honest perspective on what is currently happening in OSS related to GPLv3 licensing.

    As an aside, our blogs do track adoption rates, but also keep readers informed regarding other issues of OSS relevance. Again, our goal is to honestly track and publish licensing and related trends across OSS, represented at http://gpl3.palamida.com. Our research is available for reuse by analysts, and is routinely used and trusted as an objective source.

    As an aside, our blog regarding dual licensing issues (http://gpl3.blogspot.com/2008/01/gpl-project-watch-list-for-week-of-0118.html) received a number of comments. It was my fault that I edited our information, and in doing so, did not accurately explain our point. We do include all comments received, and I invite comments in the future.

    Ernie

What Else is New


  1. Links 13/12/2018: IRS Migration, GNOME 3.31.3 Released

    Links for the day



  2. Patent Trial and Appeal Board (PTAB) Decisions Still Uncontroversial Unless One Asks the Patent Maximalists

    Contrary to what the Director of the U.S. Patent and Trademark Office has claimed, PTAB is liked by companies that actually create things and opposition to PTAB comes from power brokers of the Koch brothers, law firms, and trolls (including those who foolishly repeat them)



  3. Latest Talk From IBM’s Manny Schecter Shows That IBM Hasn't Changed and After the Red Hat Takeover It'll Continue to Promote Software Patents

    IBM's hardheaded attitude and patent aggression unaffected by its strategic acquisition of a company that at least claimed to oppose software patents (whilst at the same time pursuing them)



  4. The European Patent Troll Wants as Much Litigation as Possible

    Patent quality is a concept no longer recognisable at the European Patent Office; all that the management understands is speed and PACE, which it conflates with quality in order to register as much cash as possible before the whole thing comes crashing down (bubbles always implode at the end)



  5. António Campinos Turns His 'Boss' Into His Lapdog, Just Like Battistelli and Kongstad

    The European Patent Organisation expects us to believe that Josef Kratochvíl will keep the Office honest while his predecessor, the German who failed to do anything about Battistelli's abuses, becomes officially subservient to António Campinos



  6. Links 12/12/2018: Mesa 18.3.1 Released, CNCF Takes Control of etcd

    Links for the day



  7. EPO Trust, Leadership and Commitment

    "Trust, leadership and commitment" is the latest publication from EPO insiders, who in the absence of free speech and freedom of association for the union/representation are an essential spotlight on EPO abuses



  8. Links 11/12/2018: Tails 3.11, New Firefox, FreeBSD 12.0

    Links for the day



  9. Number of Filings at the Patent Trial and Appeal Board (PTAB) Highest in Almost Two Years

    Patent Trial and Appeal Board (PTAB) inter partes reviews (IPRs), which [cref 113718 typically invalidate software patents by citing 35 U.S.C. § 101], are withstanding negative rhetoric and hostility from Iancu



  10. With 'Brexit' in a Lot of Headlines Team UPC Takes the Unitary Patent Lies up a Notch

    Misinformation continues to run like water; people are expected to believe that the UPC, an inherently EU-centric construct, can magically come to fruition in the UK (or in Europe as a whole)



  11. The EPO Not Only Abandoned the EPC But Also the Biotech Directive

    Last week's decision (T1063/18, EPO Technical Board of Appeal 3.3.04) shows that there's still a long way to go before the Office and the Organisation as a whole fulfil their obligation to those who birthed the Organisation in the first placeLast week's decision (T1063/18, EPO Technical Board of Appeal 3.3.04) shows that there's still a long way to go before the Office and the Organisation as a whole fulfil their obligation to those who birthed the Organisation in the first place



  12. Patents on Abstract Things and on Life (or Patents Which Threaten Lives) Merely Threaten the Very Legitimacy of Patent Offices, Including EPO

    Patent Hubris and maximalism pose a threat or a major risk to the very system that they claim to be championing; by reducing the barrier to entry (i.e. introducing low-quality or socially detrimental patents) they merely embolden ardent critics who demand patent systems as a whole be abolished; the EPO is nowadays a leading example of it



  13. Links 10/12/2018: Linux 4.20 RC6 and Git 2.20

    Links for the day



  14. US Courts Make the United States' Patent System Sane Again

    35 U.S.C. § 101 (Section 101), the Patent Trial and Appeal Board (PTAB) and other factors are making the patent system in the US a lot more sane



  15. Today's USPTO Grants a Lot of Fake Patents, Software Patents That Courts Would Invalidate

    The 35 U.S.C. § 101 effect is very much real; patents on abstract/nonphysical ideas get invalidated en masse (in courts/PTAB) and Director Andrei Iancu refuses to pay attention as if he's above the law and court rulings don't apply to him



  16. A Month After Microsoft Claimed Patent 'Truce' Its Patent Trolls Keep Attacking Microsoft's Rivals

    Microsoft's legal department relies on its vultures (to whom it passes money and patents) to sue its rivals; but other than that, Microsoft is a wonderful company!



  17. Good News: US Supreme Court Rejects Efforts to Revisit Alice, Most Software Patents to Remain Worthless

    35 U.S.C. § 101 will likely remain in tact for a long time to come; courts have come to grips with the status quo, as even the Federal Circuit approves the large majority of invalidations by the Patent Trial and Appeal Board’s (PTAB) panels, initiated by inter partes reviews (IPRs)



  18. Florian Müller's Article About SEPs and the EPO

    Report from the court in Munich, where the EPO is based



  19. EPO Vice-President Željko Topić in New Article About Corruption in Croatia

    The Croatian newspaper 7Dnevno has an outline of what Željko Topić has done in Croatia and in the EPO in Munich; it argues that this seriously erodes Croatia's national brand/identity



  20. The Quality of European Patents Continues to Deteriorate Under António Campinos and Software Patents Are Advocated Every Day

    The EPC in the European Patent Office and 35 U.S.C. § 101 in the USPTO annul most if not all software patents; under António Campinos, however, software patents are being granted in Europe and the USPTO exploits similar tricks



  21. Team UPC is Still Spreading False Rumours in an Effort to Trick Politicians and Pressure Judges

    Abuses at the European Patent Office, political turmoil and an obvious legislative coup by a self-serving occupation that produces nothing have already doomed the Unitary Patent or Unified Patent Court (UPC); so now we deal with complete fabrications from Team UPC as they're struggling to make something out of nothing, anonymously smearing opposition to the UPC and anonymously making stuff up



  22. Patents on Life and Patents That Kill the Poor Would Only Delegitimise the European Patent Office

    After Mayo, Myriad and other SCOTUS cases (the basis of 35 U.S.C. § 101) the U.S. Patent and Trademark Office is reluctant to grant patents on life; the European Patent Office (EPO), however, goes in the opposite direction, even in defiance of the European Patent Convention



  23. EPO 'Untapped Potential'

    "Campinos is diligently looking for ways to further increase the Office’s output without increasing the number of examiners," says the EPO-FLIER team



  24. Links 9/12/2018: New Linux Stable Releases (Notably Linux 4.19.8), RC Coming, and Unifont 11.0.03

    Links for the day



  25. Links 8/12/2018: Mesa 18.3.0, Mageia 7 Beta, WordPress 5.0

    Links for the day



  26. The European Patent Organisation is Like a Private Club and Roland Grossenbacher is Back in It

    In the absence of Benoît Battistelli quality control at the EPO is still not effective; patents are being granted like the sole goal is to increase so-called 'production' (or profit), appeals are being subjected to threats from Office management, and external courts (courts that assess patents outside the jurisdiction of the Office/Organisation) are being targeted with a long-sought replacement like the Unified Patent Court, or UPC (Unitary Patent)



  27. Links 7/12/2018: GNU Guix, GuixSD 0.16.0, GCC 7.4, PHP 7.3.0 Released

    Links for the day



  28. The Federal Circuit's Decision on Ancora Technologies v HTC America is the Rare Exception, Not the Norm

    Even though the PTAB does not automatically reject every patent when 35 U.S.C. § 101 gets invoked we're supposed to think that somehow things are changing in favour of patent maximalists; but all they do is obsess over something old (as old as a month ago) and hardly controversial



  29. The European Patent Office Remains a Lawless Place Where Judges Are Afraid of the Banker in Chief

    With the former banker Campinos replacing the politician Battistelli and seeking to have far more powers it would be insane for the German Constitutional Court to ever allow anything remotely like the UPC; sites that are sponsored by Team UPC, however, try to influence outcomes, pushing patent maximalism and diminishing the role of patent judges



  30. Many of the Same People Are Still in Charge of the European Patent Office Even Though They Broke the Law

    "EPO’s art collection honoured with award," the EPO writes, choosing to distract from what actually goes on at the Office and has never been properly dealt with


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts