EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

01.27.08

Selling Services Without Selling Fear of Licences

Posted in Free/Libre Software, FUD, GPL, HP, Rumour, Security at 2:29 am by Dr. Roy Schestowitz

Accusations against H-P and Palamida seem baseless

It wasn’t long ago that McAfee and InformationWeek were both harshly (and rightly) accused for spreading GPL fear [1, 2, 3]. This was not appreciated. It is actually worth reminding ourselves of speculations and predictions of a McAfee-Novell tie-up because Novell too was caught using FUD to market itself.

“Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.”On the other hand, some baseless accusations are flying about at the moment. Having been in touch with some of the parties involved, we wish to debunk FUD (or just lies) about FUD that never was. Empty allegations are used against Hewlett Packard (H-P) and Palamida and we wish to present them here in order to make some clarifications.

Let us start with H-P. Just the other day, when H-P introduced a set of services and tools that assist tracking of software and licensing, Dana Blankenhorn accused rather than thanked.

The Hewlett-Packard open source strategy is becoming clear.

Fear the source.

I’m certain HP officials will disagree with that. But when your press release is headlined, ” HP Promotes Open Source Software Governance with New Initiative,” there is no other conclusion to draw.

Your big company can’t go into open source alone. It’s dangerous out there. Here, hold our hand.

PJ disagrees with this, as do I. “HP is trying to do something very good with Flossology. I totally support it,” she says.

Why would anyone try to show just the negative side-effect (and yes, we’re sometimes accused of doing this as well)? Maybe because it stands out from the crowd and because ZDNet bloggers can be rewarded for provocations. Regardless of the issue at hand, H-P did make either an observation or a complaint back in 2005 (maybe 2006) when it said there were too many open source licences. But coversely, In this newer case, there is an attempt to address the issue, not just raise it. We should be happy. We should be thankful. And here were have the latest report from Palamida (published on Friday) which heralds to the world that GPLv3 finds love. This is good news, not bad news. Project evolve successfully.

The GPL v3 growth for this week is consistent with our average growth rate. As of January 25th, the GPL v3 count is at 1579 GPL v3 projects, up 44 projects over the past week. The LGPL v3 list is growing slowly but steadily and is currently at 150 LGPL v3 projects, as compared to last weeks number of 148 LGPL v3 projects.

At least one person claimed to have found flaws in Palamida’s work. Here is what one of our readers had to tell to us before we heard from Palamida (it’s reverse-chronological):


[Anonymised:]

I have been visiting Palamida GPLv3 site and I think they are doing a great job at tracking the license adoption, and their statistics can be very useful to counter the established proprietary software oligopolies’ and the mainstream tech media’s FUD machine.

But today I have been warned by Pieter Hitjens about the following: I copy-paste the conversation about recent statements made in the palamida gplv3 site (gplv3.palamida.com -which redirects to –> gplv3.blogspot.com)

[Pieter:]

http://gpl3.blogspot.com/

This site looks like it’s promoting GPLv3 but in fact it looks like subtle anti-GPLv3 FUD. E.g.:

“In the case of putting a GPL v3 project under a commercial license as well, there is high potential to violate the terms of the GPL v3. This is not to say that any of the aforementioned projects are or are not
in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

What they are saying, I think, is that GPL projects that do not have a clear copyright centralization cannot easily be re-licensed. However they don’t state this clearly, and they are not publishing my comments on the blog.

-Pieter

[Anonymised:]

as somebody who has gotten note of Palamida very early after GPLv3 was released and I’ve got a bit of contact with actual GPLv2->v3 conversions, I can say this:

Palamida, the owner of this blog (it’s advertized in the banner on the top of the blog) is a company who’s business is software risk management, so it’s the business of marketing at this company to show what risks may be there and that risk is increasing.

It is increasing, because GPLv3 makes things indeed a bit more complicated by the simple fact that it is a successor of GPLv2.

The only long-term solution to that which I see is to convince as many free software developers that licensing under “GPL v2 only” is a __very__ bad idea.

I think you guessed right that they may suggest that companies might want to buy services from Palamida, to improve legal security in software distribution.

What I see, rather looks like research which gives great information of the GPLv3 adoption, and no clear FUD.

[Anonymised:]

I see clear FUD, in this respect.

Dual-licensing is in fact a very strong argument for using GPLv3 but it depends on clear centralization of copyright. Projects like 0MQ – see www.zeromq.org – are careful to demand copyright assignments and/or MIT licensing from all contributors. For these projects, dual licensing is essential. This statement:

“This is not to say that any of the aforementioned projects are or are not in violation of the license, since our analysis of the terms are not yet complete, but caution should be used if a project is under both the GPL v3 and a commercial license.”

Is really bad. It suggests that we have to wait for Palamida to give the green light on whether it’s safe to use 0MQ. That’s very misleading and designed to create business for Palamida by exaggerating the complexity of the GPLv3 and ignoring the key role of copyright ownership.

If a company owns its code, how can it be in violation of the GPLv3 by dual-licensing its own code? That’s pure FUD, and worse, it brings into question one of the key business models for new smart FOSS businesses.

[Anonymised:]

Care if I forward your message to Pamela Jones (groklaw) and Roy Schestowitz (boycottnovell) so they alert about the issue. Think the palamida guys, who are doing a great tracking of projects adopting the GPLv3 should be aware as well. And of course the FSF/FSFE

[Pieter:]

Forward away, of course. Tracking GPLv3 usage is fine. Throwing fear and uncertainty onto other businesses to try to create extra business is not fine.

-Pieter


Shared with implicit permission, the above is intended to at least show the arguments that were thrown into this debate, which we believe is resolved by several factors.

For starters, PJ says: “I don’t agree they are doing that [spreading fear]“. Further: “They want business, so they highlight problems without telling you the solution, because they want business, but that isn’t, to me, exactly the same thing as FUD, although it can have a similar effect.”

Our reader adds: “Up to now, their work at tracking GPLv3 project has proven nice and useful to counter quite a lot of FUD [...] I think Palamida at least should publish Pieter’s comments. If they don´t do it after a while, “someone” should be pointing at the problem. Of course making clear that the tracking of GPLv3 projects is nice and useful.”

We received a response from Palamida quite quickly and it was very convincing. Judge for yourselves however:


I can say with 100% honesty that no, Palamida does not resort to FUD to sell our services. However, we do point out what can happen if you don’t know what you’ve got in your code base, which is a reality, and it’s what drives a lot of lawsuits and insecure apps. It’s just something people want to avoid and we’re here to help organizations figure it out so they can get it right. There is a subset of folks (including you) that know what the heck is going on and would vet and check you code, versions, and licenses ahead of time. Funny though that very large organizations often do not, or possibly can not, because of their size and geographically dispersed team of developers. These are the folks who have the Top 5 Most Overlooked OS vulnerabilities (and many more but let’s stick with 5) and don’t know it.

So in general, our message and mantra has always been “Know What’s In Your Code.” It’s a message that shouldn’t be considered FUD, because not knowing has very real consequences (can anyone say Busybox?).


Since H-P came under similar unjustified scrutiny we brought up this issue, which quite expectedly revealed sympathy:


In general, we like HP but here’s something to think about. Back at the beginning of Palamida, folks used to ask us, “Why wouldn’t I just use Google Code Search instead of paying for Palamida?” Our response was always that
they certainly could use Google if they only wanted a skim the surface view of what was going on in one single segment (say, JBoss code). However, our expertise coupled with the depth and breadth of our code base (which weighs in at 3 Terabytes) could give you a little more (to put it mildly). So I personally feel the same about FOSSology. This is my singular opinion, it’s a fantastic tool but it answers only one of the many, many questions people need to be asking (take a look at the blog we just posted Friday) about: what code are you using? What version? What license is it under? Is it secure?

How often is the FOSSbazaar updated? What does it include? What are its rates of false positives or irrelevant search matches? How comprehensive is it? Who has tested it? Would you bet your eBanking system security on it?

That sort of thing.


This hopefully resolves the issue, at least for those who were involved in a blame game. Censorship (aka “selective approval”) of comment was probably the main reason for going this far. We never delete comments in this Web site and only a single abusive reader has his comments flagged (still truly visible) for repetitive abuses even against other readers. Transparency brings better answers than censorship, which we last complained about just an hours ago (ODF/OOXML).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

A Single Comment

  1. ernest park said,

    March 31, 2008 at 8:06 pm

    Gravatar

    I note and appreciate the emotion filled comments regarding Palamida’s involvement in tracking GPLv3 adoption rates.

    I am in charge of the research team and the blog site. We get numerous comments, and ALL are posted. If a comment was left, while I don’t agree with it, it is posted. The nature of the site has NEVER been to spread fear or spin regarding how spooky and scary OSS is. Rather, my team and I are sponsored by Palamida to provide objective information regarding OSS usage of certain licenses.

    The forum is open to debate and public input. I can directly be reached via email with questions, or emails can be sent to rdgroup@palamida.com. Our research and the GPLv3 work should serve more as a barometer of the OSS community as a whole. Since we look at thousands of projects per week for licensing, code changes, updates, my team and I provide an honest perspective on what is currently happening in OSS related to GPLv3 licensing.

    As an aside, our blogs do track adoption rates, but also keep readers informed regarding other issues of OSS relevance. Again, our goal is to honestly track and publish licensing and related trends across OSS, represented at http://gpl3.palamida.com. Our research is available for reuse by analysts, and is routinely used and trusted as an objective source.

    As an aside, our blog regarding dual licensing issues (http://gpl3.blogspot.com/2008/01/gpl-project-watch-list-for-week-of-0118.html) received a number of comments. It was my fault that I edited our information, and in doing so, did not accurately explain our point. We do include all comments received, and I invite comments in the future.

    Ernie

What Else is New


  1. Links 21/11/2017: LibreELEC (Krypton) v8.2.1 MR, Mesa 17.3.0 RC5

    Links for the day



  2. PTAB Inter Partes Reviews (“IPRs”) Are Essential in an Age When One Can Get Sued for Merely Mocking a Patent

    The battle over the right to criticise particular patents has gotten very real and the Electronic Frontier Foundation (EFF) fought it until the end; this is why we need granted patents to be criticised upon petitions too (and often invalidated as a result)



  3. Chinese Patent Policy Continues to Mimic All the Worst Elements of the American System

    China is becoming what the United States used to be in terms of patents, whereas the American system is adopting saner patent policies that foster real innovation whilst curtailing mass litigation



  4. Links 20/11/2017: Why GNU/Linux is Better Than Windows, Another Linus Torvalds Rant

    Links for the day



  5. “US Inventor” is a “Bucket of Deplorables” Not Worthy of Media Coverage

    Jan Wolfe of Reuters treats a fringe group called “US Inventor” as though it's a conservative voice rather than a bunch of patent extremists pretending to be inventors



  6. Team Battistelli's Attacks on the EPO Boards of Appeal Predate the Illegal Sanctions Against a Judge

    A walk back along memory lane reveals that Battistelli has, all along, suppressed and marginalised DG3 members, in order to cement total control over the entire Organisation, not just the Office



  7. PTAB is Safe, the Patent Extremists Just Try to Scandalise It Out of Sheer Desperation

    The Leahy-Smith America Invents Act (AIA), which gave powers to the Patent Trial and Appeal Board (PTAB) through inter partes reviews (IPRs), has no imminent threats, not potent ones anyway



  8. Update on the EPO's Crackdown on the Boards of Appeal

    Demand of 35% increases from the boards serves to show that Battistelli now does to the 'independent' judges what he already did to examiners at the Office



  9. The Lobbyists Are Trying to Subvert US Law in Favour of Patent Predators

    Mingorance, Kappos, Underweiser and other lobbyists for the software patents agenda (paid by firms like Microsoft and IBM) keep trying to undo progress, notably the bans on software patents



  10. Patent Trolls Based in East Texas Are Affected Very Critically by TC Heartland

    The latest situation in Texas (United States District Court for the Eastern District of Texas in particular), which according to new analyses is the target of legal scrutiny for the 'loopholes' it provided to patent trolls in search of easy legal battles



  11. Alice Remains a Strong Precedential Decision and the Media Has Turned Against Software Patents

    The momentum against the scourge of software patents and the desperation among patent 'professionals' (people who don't create/develop/invent) is growing



  12. Harm Still Caused by Granted Software Patents

    A roundup of recent (past week's) announcements, including legal actions, contingent upon software patents in an age when software patents bear no real legitimacy



  13. Links 18/11/2017: Raspberry Digital Signage 10, New Nano

    Links for the day



  14. 23,000 Posts

    23,000 blog posts milestone reached in 11 years



  15. BlackBerry Cannot Sell Phones and Apple Looks Like the Next BlackBerry (a Pile of Patents)

    The lifecycle of mobile giants seems to typically end in patent shakedown, as Apple loses its business to Android just like Nokia and BlackBerry lost it to Apple



  16. EFF and CCIA Use Docket Navigator and Lex Machina to Identify 'Stupid Patents' (Usually Software Patents That Are Not Valid)

    In spite of threats and lawsuits from bogus 'inventors' whom they criticise, EFF staff continues the battle against patents that should never have been granted at all



  17. The Australian Productivity Commission Shows the Correct Approach to Setting Patent Laws and Scope

    Australia views patents on software as undesirable and acts accordingly, making nobody angry except a bunch of law firms that profited from litigation and patent maximalism



  18. EPO 'Business' From the United States Has Nosedived and UPC is on Its Death Throes

    Benoît Battistelli and Elodie Bergot further accelerate the ultimate demise of the EPO (getting rid of experienced and thus 'expensive' staff), for which there is no replacement because there is a monopoly (which means Europe will suffer severely)



  19. Links 17/11/2017: KDE Applications 17.12, Akademy 2018 Plans

    Links for the day



  20. Today's EPO and Team UPC Do Not Work for Europe But Actively Work Against Europe

    The tough reality that some Europeans actively work to undermine science and technology in Europe because they personally profit from it and how this relates to the Unitary Patent (UPC), which is still aggressively lobbied for, sometimes by bribing/manipulating the media, academia, and public servants



  21. Links 16/11/2017: WordPress 4.9 and GhostBSD 11.1 Released

    Links for the day



  22. The Staff Union of the EPO (SUEPO) is Rightly Upset If Not Shocked at What Battistelli and Bergot Are Doing to the Office

    The EPO's dictatorial management is destroying everything that's left (of value) at the Office while corrupting academia and censoring discussion by threatening those who publish comments (gagging its own staff even when that staff posts anonymously)



  23. EPO Continues to Disobey the Law on Software Patents in Europe

    Using the same old euphemisms, e.g. "computer-implemented inventions" (or "CII"), the EPO continues to grant patents which are clearly and strictly out of scope



  24. Links 16/11/2017: Tails 3.3, Deepin 15.5 Beta

    Links for the day



  25. Benoît Battistelli and Elodie Bergot Have Just Ensured That EPO Will Get Even More Corrupt

    Revolving door-type tactics will become more widespread at the EPO now that the management (Battistelli and his cronies) hires for low cost rather than skills/quality and minimises staff retention; this is yet another reason to dread anything like the UPC, which prioritises litigation over examination



  26. Australia is Banning Software Patents and Shelston IP is Complaining as Usual

    The Australian Productivity Commission, which defies copyright and patent bullies, is finally having policies put in place that better serve the interests of Australians, but the legal 'industry' is unhappy (as expected)



  27. Patent Trial and Appeal Board (PTAB) Defended by Technology Giants, by Small Companies, by US Congress and by Judges, So Why Does USPTO Make It Less Accessible?

    In spite of the popularity of PTAB and the growing need/demand for it, the US patent system is apparently determined to help it discriminate against poor petitioners (who probably need PTAB the most)



  28. Declines in Patent Quality at the EPO and 'Independent' Judges Can No Longer Say a Thing

    The EPO's troubling race to the bottom (of patent quality) concerns the staff examiners and the judges, but they cannot speak about it without facing rather severe consequences



  29. The EPO is Now Corrupting Academia, Wasting Stakeholders' Money Lying to Stakeholders About the Unitary Patent (UPC)

    The Unified Patent Court/Unitary Patent (UPC) is a dying project and the EPO, seeing that it is going nowhere fast, has resorted to new tactics and these tactics cost a lot of money (at the expense of those who are being lied to)



  30. Links 15/11/2017: Fedora 27 Released, Linux Mint Has New Betas

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts