eWEEK: “The DRM provisions are designed to go after companies like TiVo, which uses Linux but collects information on consumers’ actions. While TiVo complies with GPL 2.0, it may have more difficulty complying with GPLv3’s anti-DRM provisions.”
Not true. As far as I know (I’m not an insider), TiVo is not a derivative work of Linux in the legal sense—it’s simply a Linux application that happens to ship with a Linux distribution bundled as a complete package.
Given that it’s not a derivative work, the anti-DRM provisions (or anything else for that matter) in GPLv3 can’t affect TiVo at all, nor can they affect similar products that simply bundle a Linux application with Linux itself (i.e., pretty much any Linux-based server appliance, etc.).
Now, my first assumption was that this was yet another case of misunderstanding the GPL and/or how Linux-based products such as TiVo work. However, Eben Moglen himself appears to sow the seeds of confusion this time:
Asked if TiVo could avoid using GPL 3.0 when that license is released next year, Moglen said, “Once a GPL’d work has been relicensed under GPLv3, although a party having a copy under GPLv2 could continue to distribute it under that license, any further maintenance from upstream would force the license upgrade.” TiVo could avoid using GPL 3.0 even if, say, the Linux kernel were to change licenses, but only by freezing itself at the last version of the kernel that was licensed under GPL 2. “That will prove to be impracticable in almost every real commercial setting,” Moglen said.
I assume Eben isn’t misunderstanding the GPL, so perhaps he’s misunderstanding how TiVo works. Or, perhaps he made some comments that were taken out of context (the above isn’t an exact quote, after all, and goodness knows, I’ve been misquoted enough times I take such attributed statements with a grain of salt). I do hope, though, it’s not the FSF overplaying its hand on what constitutes a derivative work.
Linux will not be placed under the terms of GPL v3. Linux himself said so: Lihttp://lkml.org/lkml/2006/1/25/273
You’re misunderstanding something. The TiVo application itself need not be released, but if they use any packages licensed under GPLv3 (say, shellutils, since it seems the kernel itself is unlikely to be relicensed), then according to the proposed terms they won’t be able to “deny users that run covered works the full exercise of the legal rights granted by this License”, namely the right to modify the shellutils on the device.
Here’s my understanding: let’s assume that some component that Tivo needs to run is licensed under GPLv3. Tivo makes a modified version of it. They digitally sign the executable, and the Tivo box checks that signature before agreeing to run the application.
Under GPLv2, they can release the source, and people can read the source, but they can’t use that source to build code that will run in a Tivo, because they don’t have the appropriate key to sign the executable with.
Under GPLv3, they can no longer use this approach. Since the executable won’t run without a signature, they have to either provide all recipients of the binary with the means to produce their own modified, signed, runnable executables, or they can’t distribute.
However, it appears Linus objects to this model, so the kernel will continue to use GPLv2. If he does, then RMS’s plan to take free software away from the DRM people will fail, as there is too much free software they can still use.
The larger point is that the GPL cannot affect a piece of code unless it is a derivative work. The mere act of bundling with a GPL program does not create a derivative work. Neither does calling a GPL program from the command line. It’s not even clear that linking creates a derivative work. So, the notion that the shift to GPL v3 is going to impact all sorts of things simply isn’t true—it can, by definition, only affect derivative works. Yes, if TiVo ships shellutils (modified or no), they have to provide the source code to its customers, but that’s no different than GPL v2.
-ian