2

How can one enforce open source licensing terms on the usage of its derivative works?

For example, if a software is GPL licensed, and I use that software to develop some closed-source application of my own and distribute just the binary executable, how can the copyright owner find out that I used his software?

Improve this question
3
  • 5
    In many cases this is very difficult obviously. But once you have to fire one of your employees you may be very happy if you haven't done anything illegal. Upset former employees, competitors (who may know more about your business than you may like) and various other sources are possible in such cases.
    – thorsten müller
    Apr 1, 2015 at 10:44
  • It depends if you're OK with sending the source code to any of your customers who ask for a copy.
    – ideasman42
    Apr 1, 2015 at 11:03
  • 2
    This would be a great question for the new proposal Open Source Stackexchange which still needs more people to commit before it can go into beta.
    – Philipp
    Apr 1, 2015 at 11:17

1 Answer 1

Reset to default
6

Quite often, corporate misconduct is revealed by disgruntled employees or ex-employees.

When no inside source is available, and the only proof you have is the compiled binary of the product, it might get harder to prove that a copyright violation has happened. But there are a few things you can try:

  • One possible sign is identical behavior. When both products have the exact same obscure bug, it might be a sign that they obviously use the same code-base. When a product is based on an open source product, they likely did so because they did not want to reimplement everything themselves, so you can assume that most of the behavior will be the same.
  • When there is a limited amount of possible compiler toolchains and settings for the technology used to build the application, you might be able to reproduce the build-process and generate a binary from the open source codebase which is in large parts identical to the binary delivered by the company. This would be clear evidence that a copyright violation has happened.
  • Sometimes you find debugging symbols or other identifiers in a binary which hint on the structure and content of the original sourcecode. This can be a smoking gun. However, these can be suppressed through technology-dependent compiler-settings and/or obfuscators.

Whether or not any of this evidence would hold up in court is a question only a lawyer can answer.

Improve this answer
4
  • Identical text strings or other constants in the code would also be a clue. Of course the fact that two programs both have the message "Error - retry" would prove nothing. But as messages get longer, we'd expect there to be differences in wording, even if the basic idea is the same.
    – Jay
    Apr 1, 2015 at 14:05
  • Hmm, I wonder if anyone has ever built a software product to examine two sets of binary code to try to determine if they have sections that were compiled from the same source? Obviously even a minor change would make all the addresses different, but if a program had all the same opcodes in the same order, and only the addresses were different, that would be awfully suspicious. But maybe I'm being too simple-minded there.
    – Jay
    Apr 1, 2015 at 14:08
  • @Jay Try with some different options and compilers with gcc.godbolt.org - note that tossing in a different -O or switching from gcc to clang can completely change the compiled output.
    – user40980
    Apr 1, 2015 at 19:41
  • @MichaelT True. Such a compare would only work if both people used the same compiler with the same options set. I was being too simple-minded. So I suppose it MIGHT work, if the test passed they are from the same source, but there would be lots of false negatives.
    – Jay
    Apr 2, 2015 at 12:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.