How to spot that someone copied open source code licensed with GPL to their closed source commercial application, when you don't have access to their closed source code?

Edit: Great answers! Part 2. What if it is a webapp where you don't even have access to the executables?

Scenario: They copy the source, make some minor changes to the gui so the front end is nearly identical; add a new feature to the otherwise totally identical back-end; and fail to release it back to open source.

  • 1
    Yes, it is more than just a "nice idea". It is enforceable through legal repercussions (in many jurisdictions). That is, hire (or obtain) a lawyer and analysis team. – pst May 31 '11 at 23:26
  • After editing, this is quite clear. Probably wouldn't have been migrated in its current form. Since it can't be sent back so easily, I've done my best to answer. I also revised your title. – Tim Post Jun 1 '11 at 3:32
  • Keep an eye on this guy ;) – MarkJ Jun 1 '11 at 8:13

It looks like you are, indeed trying to spot it, which means you have to dig into the compiled executable (or associated libraries) of the proprietary program in order to tell. You're looking for strings and symbols that obviously match the free software you suspect.

On a UNIX like operating system, the strings utility provides a great clue. Careful analysis will usually reveal what you need. If you see foolib_easy_init , well .. the compiled program is using foolib.

This of course varies with levels of compiler optimization, obfuscation done before compiling and possibly un-used / debug symbols being stripped away, but people who are too lazy to write their own software are generally equally lazy when it comes to hiding that.

  • 1
    I see, what if the program is a webapp, where you don't even have access to the binaries? They copy the whole GPL licensed source code, change a couple of GUI elements and release their own closed-source webapp with nearly identical front end, and totally identical backend. Then they add a new feature to the app without releasing it as open source. Is it feasible to spot this kind of violation of GPL? – siamii Jun 1 '11 at 15:58
  • 3
    @bizso09: That's not a GPL violation, assuming we're talking about the back end. See my answer for more detail. – David Thornley Jun 1 '11 at 18:17
  • 2
    @bizso09 - It would only be a GPL violation if the application was transferred to you in obfuscated / compiled format without the source code. Merely putting it 'in service' and allowing people to use it would not be a violation. It would, however violate the Affero GPL, which specifically covers software that interacts with a network. Still, you might be able to spot it through firebug / dev tools by inspecting all elements (or even looking for known bugs that exist in the code you suspect was misused). – Tim Post Jun 1 '11 at 20:48

BusyBox has had several high-profile cases of suing hardware manufacturers for using BusyBox without releasing sources. These lawsuits were filed by the lawyers at Software Freedom Law Center.

If your project is mature enough to join the Software Freedom Conservancy, you could engage the services of SFLC too. (Not sure if non-Conservancy projects could use SFLC's services---you should check.)

  • Very nice link. Didn't even know things like that existed. – pst May 31 '11 at 23:28
  • 1
    Do they do the research for you or do they just provide the lawyers? Cause I think the OP was looking for the former – TheLQ Jun 1 '11 at 2:22
  • 1
    -1 While interesting, this doesn't answer the question asked. – HedgeMage Jun 1 '11 at 3:31
  • 1
    @HedgeMage - the question was a little more ambiguous before editing. – detly Jun 1 '11 at 6:25

The GPL has only a limited application to server-side webapps. Anything client-side is being distributed, but this is normally Javascript, and the user automatically gets the source. Anything that's strictly server-side is being run, not distributed, and the GPL primarily applies to distribution.

This was the motivation for the Affero GPL, which (IIRC) says essentially that if you use AGPLed software in something like a web app, it's necessary to offer to distribute source.

  • 1
    Correct. The AGPL specifically covers 'software that interacts with a network'. It would apply just as much to ... an IMAP server ... as it would to a web application. – Tim Post Jun 2 '11 at 20:58

If it behaves like and runs like your program, you could start with objdump and similar tools. This old Slashdot entry shows another, more formal method for detecting GPL violation.


Harald Welte has had success with carrot and stick approaches to getting companies who have used his GPL-licensed code improperly to conform to the terms of the license. Many companies simply needed to be educated about the consequences of their decisions and settled their problems out of court.

  • -1 Doesn't actually address the question asked, which is how to identify such abuses, not what to do after one is found. – HedgeMage Jun 1 '11 at 3:31
  • 5
    @HedgeMage - the question was edited recently, it was actually confusing enough that it was migrated here, when in fact it probably does belong on SO. – Tim Post Jun 1 '11 at 3:43
  • 2
    @Tim: Can we now go and retaliate-downvote @HedgeMage now? Pleeeez? :-P (For third-party lurkers: No, that is not a serious suggestion. Both Tim and I are moderators on other SE sites and would never engage in anything like that. Surely!) – Chris Jester-Young Jun 1 '11 at 12:41

If you spot a GPL violation (someone used code under your copyright and did not offer source while distributing binaries), get in contact with the violator and ask to resolve the situation. Document the mails, data of when you contacted whom etc. .

If it's not your copyright but you spotted the violation, get in contact with the original copyright holder next to the violator and tell her/him about the violation as well. Advisably before you contact the violator.

If the software is a combined work with many copyright holders, the same applies to you if you're only one of the copyright holders or only a group of copyright holders (and not all). It's your copyright then, and the GPL applies to any kind of derivates - large or small.

If you're due to technical limitations unable to gain knowledge if a probable violation really is a violation, you need to look for other ways to find out more. E.g. by asking question to the probably violator, by getting access to binary or even sources through third parties etc..

If the code in question is under GPL v2 and there is a violation of the licensing terms, termination applies. The violator has lost all rights forever to make use of the GPL'ed code. He must get in contact with all copyright holders again and ask for reinstatement of rights, otherwise still using the code violates copyright.

If the code in question is under GPL v3 and there is a violation of the licensing terms, termination is in effect as well but the violator can recover from this by stopping the violation on it's own - unless a copyright holder asks for more.

Edit: This is merely general information. If you want to look into the concrete legal side of this you should be a copyright owner and you should contact your legal team upfront to find out what you need for a proof and what is suggested to solve a violation even w/o the law as this is much more practical.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.