2

How can one enforce open source licensing terms on the usage of its derivative works?

For example, if a software is GPL licensed, and I use that software to develop some closed-source application of my own and distribute just the binary executable, how can the copyright owner find out that I used his software?

  • 5
    In many cases this is very difficult obviously. But once you have to fire one of your employees you may be very happy if you haven't done anything illegal. Upset former employees, competitors (who may know more about your business than you may like) and various other sources are possible in such cases. – thorsten müller Apr 1 '15 at 10:44
  • It depends if you're OK with sending the source code to any of your customers who ask for a copy. – ideasman42 Apr 1 '15 at 11:03
  • 2
    This would be a great question for the new proposal Open Source Stackexchange which still needs more people to commit before it can go into beta. – Philipp Apr 1 '15 at 11:17
6

Quite often, corporate misconduct is revealed by disgruntled employees or ex-employees.

When no inside source is available, and the only proof you have is the compiled binary of the product, it might get harder to prove that a copyright violation has happened. But there are a few things you can try:

  • One possible sign is identical behavior. When both products have the exact same obscure bug, it might be a sign that they obviously use the same code-base. When a product is based on an open source product, they likely did so because they did not want to reimplement everything themselves, so you can assume that most of the behavior will be the same.
  • When there is a limited amount of possible compiler toolchains and settings for the technology used to build the application, you might be able to reproduce the build-process and generate a binary from the open source codebase which is in large parts identical to the binary delivered by the company. This would be clear evidence that a copyright violation has happened.
  • Sometimes you find debugging symbols or other identifiers in a binary which hint on the structure and content of the original sourcecode. This can be a smoking gun. However, these can be suppressed through technology-dependent compiler-settings and/or obfuscators.

Whether or not any of this evidence would hold up in court is a question only a lawyer can answer.

  • Identical text strings or other constants in the code would also be a clue. Of course the fact that two programs both have the message "Error - retry" would prove nothing. But as messages get longer, we'd expect there to be differences in wording, even if the basic idea is the same. – Jay Apr 1 '15 at 14:05
  • Hmm, I wonder if anyone has ever built a software product to examine two sets of binary code to try to determine if they have sections that were compiled from the same source? Obviously even a minor change would make all the addresses different, but if a program had all the same opcodes in the same order, and only the addresses were different, that would be awfully suspicious. But maybe I'm being too simple-minded there. – Jay Apr 1 '15 at 14:08
  • @Jay Try with some different options and compilers with gcc.godbolt.org - note that tossing in a different -O or switching from gcc to clang can completely change the compiled output. – user40980 Apr 1 '15 at 19:41
  • @MichaelT True. Such a compare would only work if both people used the same compiler with the same options set. I was being too simple-minded. So I suppose it MIGHT work, if the test passed they are from the same source, but there would be lots of false negatives. – Jay Apr 2 '15 at 12:41

protected by gnat Oct 5 '18 at 8:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.