EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.27.08

Selling Services Without Selling Fear of Licences

Posted in Free/Libre Software, FUD, GPL, HP, Rumour, Security at 2:29 am by Dr. Roy Schestowitz

Accusations against H-P and Palamida seem baseless

It wasn’t long ago that McAfee and InformationWeek were both harshly (and rightly) accused for spreading GPL fear [1, 2, 3]. This was not appreciated. It is actually worth reminding ourselves of speculations and predictions of a McAfee-Novell tie-up because Novell too was caught using FUD to market itself.

“Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.”On the other hand, some baseless accusations are flying about at the moment. Having been in touch with some of the parties involved, we wish to debunk FUD (or just lies) about FUD that never was. Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.

Let us start with H-P. Just the other day, when H-P introduced a set of services and tools that assist tracking of software and licensing, Dana Blankenhorn accused rather than thanked.

The Hewlett-Packard open source strategy is becoming clear.

Fear the source.

I’m certain HP officials will disagree with that. But when your press release is headlined, ” HP Promotes Open Source Software Governance with New Initiative,” there is no other conclusion to draw.

Your big company can’t go into open source alone. It’s dangerous out there. Here, hold our hand.

PJ disagrees with this, as do I. “HP is trying to do something very good with Flossology. I totally support it,” she says.

Why would anyone try to show just the negative side-effect (and yes, we’re sometimes accused of doing this as well)? Maybe because it stands out from the crowd and because ZDNet bloggers can be rewarded for provocations. Regardless of the issue at hand, H-P did make either an observation or a complaint back in 2005 (maybe 2006) when it said there were too many open source licences. But coversely, In this newer case, there is an attempt to address the issue, not just raise it. We should be happy. We should be thankful. And here were have the latest report from Palamida (published on Friday) which heralds to the world that GPLv3 finds love. This is good news, not bad news. Project evolve successfully.

The GPL v3 growth for this week is consistent with our average growth rate. As of January 25th, the GPL v3 count is at 1579 GPL v3 projects, up 44 projects over the past week. The LGPL v3 list is growing slowly but steadily and is currently at 150 LGPL v3 projects, as compared to last weeks number of 148 LGPL v3 projects.

At least one person claimed to have found flaws in Palamida’s work. Here is what one of our readers had to tell to us before we heard from Palamida (it’s reverse-chronological):


[Anonymised:]

I have been visiting Palamida GPLv3 site and I think they are doing a great job at tracking the license adoption, and their statistics can be very useful to counter the established proprietary software oligopolies’ and the mainstream tech media’s FUD machine.

But today I have been warned by Pieter Hitjens about the following: I copy-paste the conversation about recent statements made in the palamida gplv3 site (gplv3.palamida.com -which redirects to –> gplv3.blogspot.com)

[Pieter:]

http://gpl3.blogspot.com/

This site looks like it’s promoting GPLv3 but in fact it looks like subtle anti-GPLv3 FUD. E.g.:

“In the case of putting a GPL v3 project under a commercial license as well, there is high potential to violate the terms of the GPL v3. This is not to say that any of the aforementioned projects are or are not
in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

What they are saying, I think, is that GPL projects that do not have a clear copyright centralization cannot easily be re-licensed. However they don’t state this clearly, and they are not publishing my comments on the blog.

-Pieter

[Anonymised:]

as somebody who has gotten note of Palamida very early after GPLv3 was released and I’ve got a bit of contact with actual GPLv2->v3 conversions, I can say this:

Palamida, the owner of this blog (it’s advertized in the banner on the top of the blog) is a company who’s business is software risk management, so it’s the business of marketing at this company to show what risks may be there and that risk is increasing.

It is increasing, because GPLv3 makes things indeed a bit more complicated by the simple fact that it is a successor of GPLv2.

The only long-term solution to that which I see is to convince as many free software developers that licensing under “GPL v2 only” is a __very__ bad idea.

I think you guessed right that they may suggest that companies might want to buy services from Palamida, to improve legal security in software distribution.

What I see, rather looks like research which gives great information of the GPLv3 adoption, and no clear FUD.

[Anonymised:]

I see clear FUD, in this respect.

Dual-licensing is in fact a very strong argument for using GPLv3 but it depends on clear centralization of copyright. Projects like 0MQ – see www.zeromq.org – are careful to demand copyright assignments and/or MIT licensing from all contributors. For these projects, dual licensing is essential. This statement:

“This is not to say that any of the aforementioned projects are or are not in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

Is really bad. It suggests that we have to wait for Palamida to give the green light on whether it’s safe to use 0MQ. That’s very misleading and designed to create business for Palamida by exaggerating the complexity of the GPLv3 and ignoring the key role of copyright ownership.

If a company owns its code, how can it be in violation of the GPLv3 by dual-licensing its own code? That’s pure FUD, and worse, it brings into question one of the key business models for new smart FOSS businesses.

[Anonymised:]

Care if I forward your message to Pamela Jones (groklaw) and Roy Schestowitz (boycottnovell) so they alert about the issue. Think the palamida guys, who are doing a great tracking of projects adopting the GPLv3 should be aware as well. And of course the FSF/FSFE

[Pieter:]

Forward away, of course. Tracking GPLv3 usage is fine. Throwing fear and uncertainty onto other businesses to try to create extra business is not fine.

-Pieter


Shared with implicit permission, the above is intended to at least show the arguments that were thrown into this debate, which we believe is resolved by several factors.

For starters, PJ says: “I don’t agree they are doing that [spreading fear]“. Further: “They want business, so they highlight problems without telling you the solution, because they want business, but that isn’t, to me, exactly the same thing as FUD, although it can have a similar effect.”

Our reader adds: “Up to now, their work at tracking GPLv3 project has proven nice and useful to counter quite a lot of FUD [...] I think Palamida at least should publish Pieter’s comments. If they don´t do it after a while, “someone” should be pointing at the problem. Of course making clear that the tracking of GPLv3 projects is nice and useful.”

We received a response from Palamida quite quickly and it was very convincing. Judge for yourselves however:


I can say with 100% honesty that no, Palamida does not resort to FUD to sell our services. However, we do point out what can happen if you don’t know what you’ve got in your code base, which is a reality, and it’s what drives a lot of lawsuits and insecure apps. It’s just something people want to avoid and we’re here to help organizations figure it out so they can get it right. There is a subset of folks (including you) that know what the heck is going on and would vet and check you code, versions, and licenses ahead of time. Funny though that very large organizations often do not, or possibly can not, because of their size and geographically dispersed team of developers. These are the folks who have the Top 5 Most Overlooked OS vulnerabilities (and many more but let’s stick with 5) and don’t know it.

So in general, our message and mantra has always been “Know What’s In Your Code.” It’s a message that shouldn’t be considered FUD, because not knowing has very real consequences (can anyone say Busybox?).


Since H-P came under similar unjustified scrutiny we brought up this issue, which quite expectedly revealed sympathy:


In general, we like HP but here’s something to think about. Back at the beginning of Palamida, folks used to ask us, “Why wouldn’t I just use Google Code Search instead of paying for Palamida?” Our response was always that
they certainly could use Google if they only wanted a skim the surface view of what was going on in one single segment (say, JBoss code). However, our expertise coupled with the depth and breadth of our code base (which weighs in at 3 Terabytes) could give you a little more (to put it mildly). So I personally feel the same about FOSSology. This is my singular opinion, it’s a fantastic tool but it answers only one of the many, many questions people need to be asking (take a look at the blog we just posted Friday) about: what code are you using? What version? What license is it under? Is it secure?

How often is the FOSSbazaar updated? What does it include? What are its rates of false positives or irrelevant search matches? How comprehensive is it? Who has tested it? Would you bet your eBanking system security on it?

That sort of thing.


This hopefully resolves the issue, at least for those who were involved in a blame game. Censorship (aka “selective approval”) of comment was probably the main reason for going this far. We never delete comments in this Web site and only a single abusive reader has his comments flagged (still truly visible) for repetitive abuses even against other readers. Transparency brings better answers than censorship, which we last complained about just an hours ago (ODF/OOXML).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. ernest park said,

    March 31, 2008 at 8:06 pm

    Gravatar

    I note and appreciate the emotion filled comments regarding Palamida’s involvement in tracking GPLv3 adoption rates.

    I am in charge of the research team and the blog site. We get numerous comments, and ALL are posted. If a comment was left, while I don’t agree with it, it is posted. The nature of the site has NEVER been to spread fear or spin regarding how spooky and scary OSS is. Rather, my team and I are sponsored by Palamida to provide objective information regarding OSS usage of certain licenses.

    The forum is open to debate and public input. I can directly be reached via email with questions, or emails can be sent to rdgroup@palamida.com. Our research and the GPLv3 work should serve more as a barometer of the OSS community as a whole. Since we look at thousands of projects per week for licensing, code changes, updates, my team and I provide an honest perspective on what is currently happening in OSS related to GPLv3 licensing.

    As an aside, our blogs do track adoption rates, but also keep readers informed regarding other issues of OSS relevance. Again, our goal is to honestly track and publish licensing and related trends across OSS, represented at http://gpl3.palamida.com. Our research is available for reuse by analysts, and is routinely used and trusted as an objective source.

    As an aside, our blog regarding dual licensing issues (http://gpl3.blogspot.com/2008/01/gpl-project-watch-list-for-week-of-0118.html) received a number of comments. It was my fault that I edited our information, and in doing so, did not accurately explain our point. We do include all comments received, and I invite comments in the future.

    Ernie

What Else is New


  1. Links 21/9/2018: Cockpit 178, Purism 'Dongle'

    Links for the day



  2. Criticism of Unitary Patent (UPC) Agreement Doomed the UPC and Patent Trolls' Plan -- Along With the Litigation Lobby -- for Unified 'Extortion Vector'

    The Unitary Patent or Unified Patent Court (UPC) was the trolls' weapon against potentially millions of European businesses; but those businesses have woken up to the fact that it was against their interests and European member states such as Spain and Poland now oppose it while Germany halts ratification



  3. It Wasn't Judges With Weapons in Their Office, It Was Benoît Battistelli Who Brought Firearms to the European Patent Office (EPO)

    The EPO scandals deepen in light of a very major scandal which has occupied the French media for a couple of months



  4. Links 20/9/2018: 2018 Linux Audio Miniconference and Blackboard's Openwashing

    Links for the day



  5. Links 19/9/2018: Chromebooks Get More DEBs, LLVM 7.0.0 Released

    Links for the day



  6. Links 18/9/2018: Qt 5.12 Alpha , MAAS 2.5.0 Beta, PostgreSQL CoC

    Links for the day



  7. Today's European Patent Office (EPO) Works for Large, Foreign Pharmaceutical Companies in Pursuit of Patents on Nature, Life, and Essential/Basic Drugs

    The never-ending insanity which is patents on DNA/genome/genetics and all sorts of basic things that are put together like a recipe in a restaurant; patents are no longer covering actual machinery that accomplishes unique tasks in complicated ways, typically assembled from scratch by humans; some supposed 'inventions' are merely born into existence by the natural splitting of organisms or conception (e.g. pregnancy)



  8. The EPO Has Quit Pretending That It Cares About Patent Quality, All It Cares About is Quantity of Lawsuits

    A new interview with Roberta Romano-Götsch, as well as the EPO's promotion of software patents alongside CIPA (Team UPC), is an indication that the EPO has ceased caring about quality and hardly even pretends to care anymore



  9. Qualcomm's Escalating Patent Wars Have Already Caused Massive Buybacks (Loss of Reserves) and Loss of Massive Clients

    Qualcomm's multi-continental patent battles are an effort to 'shock and awe' everyone into its protection racket; but the unintended effect seems to be a move further and further away from 'Qualcomm territories'



  10. Links 17/9/2018: Torvalds Takes a Break, SQLite 3.25.0 Released

    Links for the day



  11. The Patent Trial and Appeal Board (PTAB) Helps Prevent Frivolous Software Patent Lawsuits

    PTAB with its quality-improving inter partes reviews (IPRs) is enraging patent maximalists; but by looking to work around it or weaken it they will simply reduce the confidence associated with US patents



  12. Abstract Patents (Things One Can Do With Pen and Paper, Sometimes an Abacus) Are a Waste of Money as Courts Disregard Them

    A quick roundup of patents and lawsuits at the heart of which there's little or no substance; 35 U.S.C. § 101 renders these moot



  13. “Blockchain” Hype and “FinTech”-Like Buzzwords Usher in Software Patents Everywhere, Even Where Such Patents Are Obviously Bunk

    Not only the U.S. Patent and Trademark Office (USPTO) embraces the "blockchain" hype; business methods and algorithms are being granted patent 'protection' (exclusivity) which would likely be disputed by the courts (if that ever reaches the courts)



  14. Qualcomm's Patent Aggression Threatens Rationality of Patent Scope in Europe and Elsewhere

    Qualcomm's dependence on patent taxes (so-called 'royalties' associated with physical devices which it doesn't even make) highlights the dangers now known; the patent thicket has grown too "thick"



  15. Months After Oil States the Patent Maximalists Are Still Desperate to Crush PTAB in the Courts, Not Just in Congress and the Office

    Patent Trial and Appeal Board (PTAB) inter partes reviews (IPRs) improve patent quality and are therefore a threat to those who profit from spurious feuding and litigation; they try anything they can to turn things around



  16. IAM, Watchtroll and the EPO Still Spread the Mentality of Patent Maximalism

    The misguided idea that the objective (overall) should be to grant as many monopolies as possible (to spur a lot of litigation) isn't being challenged in echo chamber 'events', set up and sponsored by think tanks and pressure groups of the litigation 'industry'



  17. Watchtroll and Other Proponents of Patent Trolls Are Trying to Change the Law Outside the Courts in Order to Bypass Patent Justice

    35 U.S.C. § 101 (Section 101) voids almost every software patent — a reality that even the most zealous patent professionals have come to grips with and their way of tackling this ‘problem’ is legislative, albeit nowhere near successful (so far)



  18. Links 16/9/2018: Windows Plays 'Nice' Again, Elisa Music Player 0.3 Beta and Latte Dock 0.8.1

    Links for the day



  19. Slamming Courts and Judges Won't Help the Patent Maximalists; It Can Only Make Things Worse

    Acorda Therapeutics sees its stock price dropping 25% after finding out that its patent portfolio isn't solid, as affirmed by the Federal Circuitn(CAFC); the only way out of this mess is a pursuit of a vastly improved patent quality, thorough patent examination which then offers legal certainty



  20. Patent Trolls Are Still Active and Microsoft is Closely Connected to Many of Them

    A roundup of patent trolls' actions in the United States; Microsoft is connected to a notably high number of these



  21. Advancements in Automobile Technology Won't be Possible With Patent Maximalism

    Advancements in the development of vehicles are being discouraged by a thicket of patents as dumb (and likely invalid) as claims on algorithms and mere shapes



  22. Battistelli “Has Deeply Hurt the Whole Patent Profession, Examiners as Well as Agents” and Also the Image of France

    A French perspective regarding Battistelli's reign at the EPO, which has not really ended but manifests itself or 'metastasises' through colleagues of Battistelli (whom he chose) and another French President (whom he also chose)



  23. António Campinos Needs to Listen to Doctors Without Borders (MSF) et al to Salvage What's Left of Public Consent for the EPO

    Groups including Doctors Without Borders/Médecins Sans Frontières (MSF) and Médecins du Monde (MdM) have attempted to explain to the EPO, with notoriously French-dominated leadership, that it’s a mistake to work for Gilead at the expense of the public; but António Campinos is just another patent maximalist



  24. The Max Planck Institute's Determination on UPC's (Unitary Patent) Demise is Only “Controversial” in the Eyes of Rabid Members of Team UPC

    Bristows keeps lying like Battistelli; that it calls a new paper "controversial" without providing any evidence of a controversy says a lot about Bristows LLP, both as a firm and the individuals who make up the firm (they would not be honest with their clients, either)



  25. Links 15/9/2018: Wine 3.16, Overwatch's GNU/Linux (Wine) 'Ban', New Fedora 28 Build, and Fedora 29 Beta Delay

    Links for the day



  26. Max Planck Institute Pours More Water on the Dying Unitary Patent (UPC)

    The Max Planck Institute gives another sobering reality check for Team UPC to chew on; there's still no sign of any progress whatsoever for the UPC because even Team UPC appears to have given up and moved on



  27. EPO Seals Many Death Sentences With Acceptance of EP 2604620

    Very disappointing news as EP 2604620 withstands scrutiny, assuring that a lot of poor people will not receive much-needed, life-saving treatments



  28. Links 13/9/2018: Compiz Comeback, 'Life is Strange: Before the Storm'

    Links for the day



  29. Now We Have Patents on Rooms. Yes, Rooms!

    The shallow level of what nowadays constitutes "innovation" and merits getting a patent for a couple of decades



  30. EPO Granted a Controversial European Patent (Under Battistelli) Which May Literally Kill a Lot of People

    The EPO (together with CIPA) keeps promoting software patents; patents that are being granted by the EPO literally put lives at risk and have probably already cost a lot of lives


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts