EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.27.08

Selling Services Without Selling Fear of Licences

Posted in Free/Libre Software, FUD, GPL, HP, Rumour, Security at 2:29 am by Dr. Roy Schestowitz

Accusations against H-P and Palamida seem baseless

It wasn’t long ago that McAfee and InformationWeek were both harshly (and rightly) accused for spreading GPL fear [1, 2, 3]. This was not appreciated. It is actually worth reminding ourselves of speculations and predictions of a McAfee-Novell tie-up because Novell too was caught using FUD to market itself.

“Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.”On the other hand, some baseless accusations are flying about at the moment. Having been in touch with some of the parties involved, we wish to debunk FUD (or just lies) about FUD that never was. Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.

Let us start with H-P. Just the other day, when H-P introduced a set of services and tools that assist tracking of software and licensing, Dana Blankenhorn accused rather than thanked.

The Hewlett-Packard open source strategy is becoming clear.

Fear the source.

I’m certain HP officials will disagree with that. But when your press release is headlined, ” HP Promotes Open Source Software Governance with New Initiative,” there is no other conclusion to draw.

Your big company can’t go into open source alone. It’s dangerous out there. Here, hold our hand.

PJ disagrees with this, as do I. “HP is trying to do something very good with Flossology. I totally support it,” she says.

Why would anyone try to show just the negative side-effect (and yes, we’re sometimes accused of doing this as well)? Maybe because it stands out from the crowd and because ZDNet bloggers can be rewarded for provocations. Regardless of the issue at hand, H-P did make either an observation or a complaint back in 2005 (maybe 2006) when it said there were too many open source licences. But coversely, In this newer case, there is an attempt to address the issue, not just raise it. We should be happy. We should be thankful. And here were have the latest report from Palamida (published on Friday) which heralds to the world that GPLv3 finds love. This is good news, not bad news. Project evolve successfully.

The GPL v3 growth for this week is consistent with our average growth rate. As of January 25th, the GPL v3 count is at 1579 GPL v3 projects, up 44 projects over the past week. The LGPL v3 list is growing slowly but steadily and is currently at 150 LGPL v3 projects, as compared to last weeks number of 148 LGPL v3 projects.

At least one person claimed to have found flaws in Palamida’s work. Here is what one of our readers had to tell to us before we heard from Palamida (it’s reverse-chronological):


[Anonymised:]

I have been visiting Palamida GPLv3 site and I think they are doing a great job at tracking the license adoption, and their statistics can be very useful to counter the established proprietary software oligopolies’ and the mainstream tech media’s FUD machine.

But today I have been warned by Pieter Hitjens about the following: I copy-paste the conversation about recent statements made in the palamida gplv3 site (gplv3.palamida.com -which redirects to –> gplv3.blogspot.com)

[Pieter:]

http://gpl3.blogspot.com/

This site looks like it’s promoting GPLv3 but in fact it looks like subtle anti-GPLv3 FUD. E.g.:

“In the case of putting a GPL v3 project under a commercial license as well, there is high potential to violate the terms of the GPL v3. This is not to say that any of the aforementioned projects are or are not
in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

What they are saying, I think, is that GPL projects that do not have a clear copyright centralization cannot easily be re-licensed. However they don’t state this clearly, and they are not publishing my comments on the blog.

-Pieter

[Anonymised:]

as somebody who has gotten note of Palamida very early after GPLv3 was released and I’ve got a bit of contact with actual GPLv2->v3 conversions, I can say this:

Palamida, the owner of this blog (it’s advertized in the banner on the top of the blog) is a company who’s business is software risk management, so it’s the business of marketing at this company to show what risks may be there and that risk is increasing.

It is increasing, because GPLv3 makes things indeed a bit more complicated by the simple fact that it is a successor of GPLv2.

The only long-term solution to that which I see is to convince as many free software developers that licensing under “GPL v2 only” is a __very__ bad idea.

I think you guessed right that they may suggest that companies might want to buy services from Palamida, to improve legal security in software distribution.

What I see, rather looks like research which gives great information of the GPLv3 adoption, and no clear FUD.

[Anonymised:]

I see clear FUD, in this respect.

Dual-licensing is in fact a very strong argument for using GPLv3 but it depends on clear centralization of copyright. Projects like 0MQ – see www.zeromq.org – are careful to demand copyright assignments and/or MIT licensing from all contributors. For these projects, dual licensing is essential. This statement:

“This is not to say that any of the aforementioned projects are or are not in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

Is really bad. It suggests that we have to wait for Palamida to give the green light on whether it’s safe to use 0MQ. That’s very misleading and designed to create business for Palamida by exaggerating the complexity of the GPLv3 and ignoring the key role of copyright ownership.

If a company owns its code, how can it be in violation of the GPLv3 by dual-licensing its own code? That’s pure FUD, and worse, it brings into question one of the key business models for new smart FOSS businesses.

[Anonymised:]

Care if I forward your message to Pamela Jones (groklaw) and Roy Schestowitz (boycottnovell) so they alert about the issue. Think the palamida guys, who are doing a great tracking of projects adopting the GPLv3 should be aware as well. And of course the FSF/FSFE

[Pieter:]

Forward away, of course. Tracking GPLv3 usage is fine. Throwing fear and uncertainty onto other businesses to try to create extra business is not fine.

-Pieter


Shared with implicit permission, the above is intended to at least show the arguments that were thrown into this debate, which we believe is resolved by several factors.

For starters, PJ says: “I don’t agree they are doing that [spreading fear]“. Further: “They want business, so they highlight problems without telling you the solution, because they want business, but that isn’t, to me, exactly the same thing as FUD, although it can have a similar effect.”

Our reader adds: “Up to now, their work at tracking GPLv3 project has proven nice and useful to counter quite a lot of FUD [...] I think Palamida at least should publish Pieter’s comments. If they don´t do it after a while, “someone” should be pointing at the problem. Of course making clear that the tracking of GPLv3 projects is nice and useful.”

We received a response from Palamida quite quickly and it was very convincing. Judge for yourselves however:


I can say with 100% honesty that no, Palamida does not resort to FUD to sell our services. However, we do point out what can happen if you don’t know what you’ve got in your code base, which is a reality, and it’s what drives a lot of lawsuits and insecure apps. It’s just something people want to avoid and we’re here to help organizations figure it out so they can get it right. There is a subset of folks (including you) that know what the heck is going on and would vet and check you code, versions, and licenses ahead of time. Funny though that very large organizations often do not, or possibly can not, because of their size and geographically dispersed team of developers. These are the folks who have the Top 5 Most Overlooked OS vulnerabilities (and many more but let’s stick with 5) and don’t know it.

So in general, our message and mantra has always been “Know What’s In Your Code.” It’s a message that shouldn’t be considered FUD, because not knowing has very real consequences (can anyone say Busybox?).


Since H-P came under similar unjustified scrutiny we brought up this issue, which quite expectedly revealed sympathy:


In general, we like HP but here’s something to think about. Back at the beginning of Palamida, folks used to ask us, “Why wouldn’t I just use Google Code Search instead of paying for Palamida?” Our response was always that
they certainly could use Google if they only wanted a skim the surface view of what was going on in one single segment (say, JBoss code). However, our expertise coupled with the depth and breadth of our code base (which weighs in at 3 Terabytes) could give you a little more (to put it mildly). So I personally feel the same about FOSSology. This is my singular opinion, it’s a fantastic tool but it answers only one of the many, many questions people need to be asking (take a look at the blog we just posted Friday) about: what code are you using? What version? What license is it under? Is it secure?

How often is the FOSSbazaar updated? What does it include? What are its rates of false positives or irrelevant search matches? How comprehensive is it? Who has tested it? Would you bet your eBanking system security on it?

That sort of thing.


This hopefully resolves the issue, at least for those who were involved in a blame game. Censorship (aka “selective approval”) of comment was probably the main reason for going this far. We never delete comments in this Web site and only a single abusive reader has his comments flagged (still truly visible) for repetitive abuses even against other readers. Transparency brings better answers than censorship, which we last complained about just an hours ago (ODF/OOXML).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. ernest park said,

    March 31, 2008 at 8:06 pm

    Gravatar

    I note and appreciate the emotion filled comments regarding Palamida’s involvement in tracking GPLv3 adoption rates.

    I am in charge of the research team and the blog site. We get numerous comments, and ALL are posted. If a comment was left, while I don’t agree with it, it is posted. The nature of the site has NEVER been to spread fear or spin regarding how spooky and scary OSS is. Rather, my team and I are sponsored by Palamida to provide objective information regarding OSS usage of certain licenses.

    The forum is open to debate and public input. I can directly be reached via email with questions, or emails can be sent to rdgroup@palamida.com. Our research and the GPLv3 work should serve more as a barometer of the OSS community as a whole. Since we look at thousands of projects per week for licensing, code changes, updates, my team and I provide an honest perspective on what is currently happening in OSS related to GPLv3 licensing.

    As an aside, our blogs do track adoption rates, but also keep readers informed regarding other issues of OSS relevance. Again, our goal is to honestly track and publish licensing and related trends across OSS, represented at http://gpl3.palamida.com. Our research is available for reuse by analysts, and is routinely used and trusted as an objective source.

    As an aside, our blog regarding dual licensing issues (http://gpl3.blogspot.com/2008/01/gpl-project-watch-list-for-week-of-0118.html) received a number of comments. It was my fault that I edited our information, and in doing so, did not accurately explain our point. We do include all comments received, and I invite comments in the future.

    Ernie

What Else is New


  1. Links 22/6/2018: PulseAudio 12.0, Krita 4.1 Beta, LabPlot 2.5, Git 2.18.0

    Links for the day



  2. “Dr Ernst Should be Forced by National Politicians to Step Down With Immediate Effect” After Battistelli's Latest EPO Scandals

    Further discussions about the horrible legacy of Battistelli and his protectors, who seem to be interested in a patent trolls-friendly patent system which devalues workers and consciously lowers the patent bar (at all costs, even violation of laws and constitutions)



  3. Links 21/6/2018: Microsoft's 'Damage Control' Amid Role in ICE Scandals, 11-Hour Azure Downtime (Again), GNOME 3.29.3, and More GNU/Linux Wins

    Links for the day



  4. Battistelli and Topić Lose Their Bogus 'Case' Against Judge Corcoran After They Defamed Him and Ruined His Career/Life

    The SLAPP action against Judge Patrick Corcoran, who has so far won all cases involving the EPO, is finally dismissed in Germany; what remains is an ugly legacy at the EPO, wherein everyone bold enough to say something about corruption at the top is having his or her life — not just career — destroyed



  5. Even Media of the Patent Microcosm Mentions the Decline in Quality of Patents at the EPO, Based on Its Very Own Stakeholders, While IAM Ignores the News

    The whole world basically accepts, based on patent examiners as well as those whom they interact with (patent agents), that patent quality at the EPO has sunk; but the EPO and IAM continue to vigorously deny that as it threatens some people's nefarious agenda



  6. Links 20/6/2018: Qt 5.11.1, Oracle Solaris 11.3 SRU 33, HHVM 3.27.0, Microsoft Helping ICE

    Links for the day



  7. Patent Extremists Are Unable to Find Federal Circuit Cases That Help Them Mislead on Alice

    Patent extremists prefer talking about Mayo but not Alice when it comes to 35 U.S.C. § 101; Broadcom is meanwhile going on a 'fishing expedition', looking to profit from patents by calling for embargo through the ITC



  8. What Use Are 10 Million Patents That Are of Low Quality in a Patent Office Controlled by the Patent 'Industry'?

    The patent maximalists are celebrating overgranting; the USPTO, failing to heed the warning from patent courts, continues issuing far too many patents and a new paper from Mark Lemley and Robin Feldman offers a dose of sobering reality



  9. The Eastern District of Texas is Where Asian Companies/Patents/Trolls Still Go After TC Heartland

    Proxies of Longhorn IP and KAIST (Katana Silicon Technologies LLC and KAIST IP US LLC, respectively) roam Texas in pursuit of money of out nothing but patents and aggressive litigation; there's also a Microsoft connection



  10. EPO Insiders Correct the Record of Benoît Battistelli’s Tyranny and Abuse of Law: “Legal Harassment and Retaliation”

    Battistelli’s record, as per EPO-FLIER 37, is a lot worse than the Office cares to tell stakeholders, who are already complaining about decline in patent quality



  11. Articles About a Unitary Patent System Are Lies and Marketing From Law Firms With 'Lawsuits Lust'

    Team UPC has grown louder with its lobbying efforts this past week; the same lies are being repeated without much of a challenge and press ownership plays a role in that



  12. The Decline in Patent Quality at the EPO Causes Frivolous Lawsuits That Only Lawyers Profit From

    The European Patent Office (EPO) will continue granting low-quality European Patents under the leadership of the Battistelli-'nominated' Frenchman, António Campinos; this is bad news for science and technology as that quite likely means a lot more lawsuits without merit (which only lawyers profit from)



  13. What Battistelli's Workers Think of His Latest EPO Propaganda

    "Modernising the EPO" is what Battistelli calls a plethora of human rights abuses and corruption



  14. Links 19/6/2018: Total War: WARHAMMER II Confirmed for GNU/Linux, DragonFlyBSD 5.2.2 Released

    Links for the day



  15. More Media Reports About Decline in Quality of European Patents (Granted by the EPO)

    What the media is saying about the letter from Grünecker, Hoffmann Eitle, Maiwald and Vossius & Partner whilst EPO communications shift attention to shallow puff pieces about how wonderful Benoît Battistelli is



  16. Beware Team UPC's Biggest Two Lies About the Unitary Patent (UPC)

    Claims that a Unified Patent Court (UPC) will commence next year are nothing but a fantasy of the Liar in Chief, Benoît Battistelli, who keeps telling lies to French media (some of which he passes EPO money to, just like he passes EPO money to his other employer)



  17. Diversity at the EPO

    Two decades of EPO with 16-17 years under the control of French Presidents (and nowadays predominantly French management in general with Inventor Award held in France almost half the time) is "diversity at the EPO"



  18. Orrin Hatch, Sponsored the Most by the Pharmaceutical Industry, Tries to Make Its Patents Immune From Scrutiny (PTAB)

    Orrin Hatch is the latest example of laws being up for sale, i.e. companies can 'buy' politicians to act as their 'couriers' and pass laws for them, including laws pertaining to patents



  19. Links 17/6/2018: Linux 4.18 RC1 and Deepin 15.6 Released

    Links for the day



  20. To Keep the Patent System Alive and Going Practitioners Will Have to Accept Compromises on Scope Being Narrowed

    35 U.S.C. § 101 still squashes a lot of software patents, reducing confidence in US patents; the only way to correct this is to reduce patent filings and file fewer lawsuits, judging their merit in advance based on precedents from higher courts



  21. The Affairs of the USPTO Have Turned Into Somewhat of a Battle Against the Courts, Which Are Simply Applying the Law to Invalidate US Patents

    The struggle between law, public interest, and the Cult of Patents (which only ever celebrates more patents and lawsuits) as observed in the midst of recent events in the United States



  22. Patent Marketing Disguised as Patent 'Advice'

    The meta-industry which profits from patents and lawsuits claims that it's guiding us and pursuing innovation, but in reality its sole goal is enriching itself, even if that means holding science back



  23. Microsoft is Still 'Cybermobbing' Its Competition Using Patent Trolls Such as Finjan

    In the "cybersecurity" space, a sub-domain where many software patents have been granted by the US patent office, the patent extortion by Microsoft-connected trolls (and Microsoft's 'protection' racket) seems to carry on; but Microsoft continues to insist that it has changed its ways



  24. Links 16/6/2018: LiMux Story, Okta Openwashing and More

    Links for the day



  25. The EPO's Response to the Open Letter About Decline in Patent Quality as the Latest Example of Arrogance and Resistance to Facts, Truth

    Sidestepping the existential crisis of the EPO (running out of work and issuing many questionable patents with expectation of impending layoffs), the PR people at the Office choose a facts-denying, face-saving 'damage control' strategy while staff speaks out, wholeheartedly agreeing with concerned stakeholders



  26. In the United States the Patent Trial and Appeal Board, Which Assures Patent Quality, is Still Being Smeared by Law Firms That Profit From Patent Maximalism, Lawsuits

    Auditory roles which help ascertain high quality of patents (or invalidate low-quality patents, at least those pointed out by petitions) are being smeared, demonised as "death squads" and worked around using dirty tricks that are widely described as "scams"



  27. The 'Artificial Intelligence' (AI) Hype, Propped Up by Events of the European Patent Office (EPO), is Infectious and It Threatens Patent Quality Worldwide

    Having spread surrogate terms like “4IR” (somewhat of a 'mask' for software patents, by the EPO's own admission in the Gazette), the EPO continues with several more terms like “ICT” and now we’re grappling with terms like “AI”, which the media endlessly perpetuates these days (in relation to patents it de facto means little more than "clever algorithms")



  28. Links 15/6/2018: HP Chromebook X2 With GNU/Linux Software, Apple Admits and Closes a Back Door ('Loophole')

    Links for the day



  29. The '4iP Council' is a Megaphone of Team UPC and Team Battistelli at the EPO

    The EPO keeps demonstrating lack of interest in genuine patent quality (it uses buzzwords to compensate for deviation from the EPC and replaces humans with shoddy translators); it is being aided by law firms which work for patent trolls and think tanks that propel their interests



  30. Grünecker, Hoffmann Eitle, Maiwald and Vossius & Partner Find the Courage to Express Concerns About Battistelli's Ugly Legacy and Low Patent Quality

    The astounding levels of abuse at the EPO have caused some of the EPO's biggest stakeholders to speak out and lash out, condemning the Office for mismanagement amongst other things


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts