Software Freedom Conservancy sues TV maker Vizio for GPL infringement
- Reference: 1634745910
- News link: https://www.theregister.co.uk/2021/10/20/vizio_gpl_lawsuit/
- Source link:
Member projects of the SFC include the Debian Copyright Aggregation Project, BusyBox, Git, GPL Compliance Project for Linux Developers, Homebrew, Mercurial, OpenWrt, phpMyAdmin, QEMU, Samba, Selenium, Wine, and [1]many more .
The GPL Compliance Project is described as "comprised of copyright holders in the kernel, Linux, who have contributed to Linux under its license, the GPLv2. These copyright holders have formally asked Conservancy to engage in compliance efforts for their copyrights in the Linux kernel."
[2]
The lawsuit [3]alleges that Vizio's TV products, using a system called Smartcast, "contain software that Vizio unfairly appropriated from a community of developers who intended consumers to have very specific rights to modify, improve, share, and reinstall modified versions of the software."
[4]
[5]
The GPL is a copyleft licence, the terms of which [6]say that "each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions." The terms apply not only to the original GPL code used, but to any code derived from it.
Vizio described Smartcast as the "platform that powers every new VIZIO TV. Instantly access endless entertainment straight out-of-the-box with the latest technology that only gets smarter with automatic updates."
[7]
The SFC's lawsuit "seeks no monetary damages, but instead seeks access to the technical information that the copyleft licenses require Vizio to provide to all customers who purchase its TVs." The full complaint, filed in California, is [8]here [PDF].
The lawsuit is motivated in part by the desire to extend the life of hardware that might otherwise be discarded when the software it uses is no longer supported by the manufacturer.
According to the SFC's statement, the issue was first raised with Vizio in August 2018. Vizio "stopped responding to enquiries" in January 2020, the SFC claimed, and "by July 2021, the TV model that we originally complained was non-compliant was discontinued."
[9]
According to the lawsuit, the last (January 2020) communication from Vizio expressed hope that Vizio's chip supplier "will have more substantial updates for you in the next few weeks."
Also in the complaint, various cases are instanced where employees of SFC had purchased Vizio TVs and "after unboxing and carefully examining... found no source code or written offer for any source code."
The SFC claimed Vizio should provide this code as well as informing consumers of their rights under the GPL.
Specifically, the legal action demands that the code is made available "in a format that may be compiled without undue difficulty... complete source code means all source code for all modules contained in such version or versions of the SmartCast Programs at issue, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable."
The conservancy referenced the [10]OpenWrt project as an example where community-maintained, open-source software improves the functionality of commercial hardware.
[11]A press kit [PDF] produced by the SFC complains that "companies who build electronics products can surreptitiously and arbitrarily disable the software." The SFC claimed that this is the first case that "focuses on the rights of individual consumers as third-party beneficiaries of the GPL."
[12]Rails waves goodbye to mimemagic, welcomes Marcel to fix GPL MIME drama
[13]Open-source software starts with developers, but there are other important contributors, too. Who exactly? Good question
[14]30 years of Linux: OS was successful because of how it was licensed, says Red Hat
[15]Open-source developers under corporate pressure to adopt less-permissive licenses, Percona CEO says
In the past, the SFC said, "the plaintiffs have always been copyright holders of the specific GPL code."
The case could set an important precedent since the SFC claims that not only Vizio but "most products employ copylefted software, but they don't meet their obligations."
How does the SFC know that Smartcast uses GPL code? The press kit referred to "extensive research" on the core components of Smartcast, and states that Smartcast is Linux-based, that "multiple copies of the Linux kernel appear in the firmware," and that other GPL and LGPL (Lesser General Public License) programs were found.
The full complaint referred to specific components including BusyBox, a member project of the SFC, and other well-known libraries such as ffmpeg, bluez, and systemd.
The lawsuit is supported by various people well known in open source. Bob Young, co-founder of Red Hat, said: "Any company benefiting from the excellent GPL'd software in Linux-based systems but who refuse to follow the straightforward licensing terms… harms themselves."
Author and activist Cory Doctorow said: "Vizio's persistent unwillingness to obey the law and do its duty is an existential threat to the very idea that we can live our lives in ways that enhance our welfare, not some distant shareholder's."
Linux kernel maintainer Kees Cook said: "I'd long wondered why GPL enforcement took the route of needing the involvement of a copyright holder. The real power of the GPL comes from the ability of the end user to ask for the source code so they can continue to improve on the work and share it with other."
The CEO of repair site iFixit, Kyle Wiens, said: "Vizio smart TVs are a trap!"
Amanda Brock, CEO of the UK-based open source advocacy company OpenUK, said: "Litigation against organisations like Vizio doesn't happen every day and is indeed noteworthy... Smartcast, the software on Vizio's TVs, is based on [Linux]. That means that, irrespective of and in addition to any consumer law requiring the right to repair, under the GPL licence attached to the software, you can repair and hopefully extend your device's lifetime."
The Register has asked Vizio for comment. ®
Get our [16]Tech Resources
[1] https://sfconservancy.org/projects/current/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YXCRkTzdiVHh4vbMGGhhBQAAAAc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://sfconservancy.org/copyleft-compliance/vizio.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YXCRkTzdiVHh4vbMGGhhBQAAAAc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YXCRkTzdiVHh4vbMGGhhBQAAAAc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YXCRkTzdiVHh4vbMGGhhBQAAAAc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://sfconservancy.org/docs/conservancy-v-vizio-original-complaint-2021-10-19.pdf
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YXCRkTzdiVHh4vbMGGhhBQAAAAc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://openwrt.org/
[11] https://shoestring.agency/wp-content/uploads/2021/10/SFC_PressKit_10-19-2021_v1.pdf
[12] https://www.theregister.com/2021/03/29/rails_mime_fix/
[13] https://www.theregister.com/2021/09/08/open_source_beyond_the_programmers/
[14] https://www.theregister.com/2021/08/25/30_years_of_linux_red_hat/
[15] https://www.theregister.com/2021/05/13/open_source_proprietary/
[16] https://whitepapers.theregister.com/
Re: Signed binaries
Google sponsored "Chromebook" products are also of this nature. The boot software will not boot an owner installed OS kernel. The device manufacturer, using the "Chromebook" branding, refuses to provide any kind of software support, other than referring to Google's generic "Chromium" project. And, the Chromium project does not provide any straightforward process for installing an owner provided kernel. Perhaps Vizio is just a "first step" in guaranteeing the right of users to control their own GPL'ed software.
Re: Signed binaries
> The boot software will not boot an owner installed OS kernel.
That's also true with UEFI based systems with secure boot enabled, the firmware will only boot signed software. Of course you can normally get a choice of signed software and you can normally disable secure boot.
With newer kernels it can even be a problem loading non standard kernel modules, so for example loading ZFS on an RHEL 8 box doesn't work with secure boot enabled.
[root@m10vm8 ~]# modprobe zfs
modprobe: ERROR: could not insert 'zfs': Required key not available
[root@m10vm8 ~]#
Re: Signed binaries
If they use something under GPL3, you can request installation information. You probably won't get it, but the license gives you a right to it. That wasn't in the GPL 2, though, so just having the Linux kernel won't give you that. That may be a source of more legal action to come, but a lot of the projects concerned don't use GPL3, so it will be harder.
Re: Signed binaries
This would be the same Vizio that [1]the FTC fined for spying on their customers ? Why am I not surprised by this new news.
[1] https://www.theregister.com/2017/02/06/ftc_spanks_vizio_for_slurping_viewer_activity/
It's a trap !
I have zero confidence in any so-called "smart" TV.
TV makers do not know how to be smart. They have made dumb terminals for the past 100 years. They're not, all of a sudden, going to gain the necessary intelligence to make something that is indeed user-friendly and useful.
"Smart", for me, means that the object has been saddled with unnecessary restrictions, supervision, phoning home, and a very poorly thought-out UI which will annoy me every time I have to use it to get to the content I want.
I pray that my current television will hold out for many more years, pushing back the date at which I'm going to have to navigate those treacherous waters.
Re: It's a trap !
Our "smart TV" does not even have a remote with a numeric keypad! We are now forced to access every single channel *sequentially*! A person might suppose that this "oversight" was not by accident, and that the customer simply misunderstood what was meant by "smart" - "smart for whom?". Is someone making money every time a channel is accessed?
Re: It's a trap !
I wish they would make more dumb TVs. Just give me something that has 4 HDMI ports and I'll use my 'smart' devices. But they want to sell you a new TV when the 'smart' stuff needs updated, rather than allowing me to plug in a new Roku, etc.
Re: It's a trap !
While we're at it, can we have physical power switches back please? I had to remove my Samsung 7000 series from the wall to get to the mains power switch the other day after half the buttons on the remote control failed, as it's the only way to do a full power cycle
I smell a fight coming on
Placing bets that Visio will claim DMCA protections under the guise of defending against competitive theft of IP, a la John Deere, even whilst using GPL'd software.
Actually, that raises a point about John Deere itself, where their software comes from. Truly proprietary, or Linux-based? And, if Linux-based, their entire stance against right to access their software for right-to-repair completely falls apart.
Re: I smell a fight coming on
I used to work at John Deere (though not FOR John Deere). Their programmers are expressly forbidden from using GPL'd software. They had an annual refresher to remind them of that requirement.
Re: John Deere
Well, I'm on the side of the farmers /owners and therefore have no issue with them doing a bit of "hacking" in order to repair goods that they already own.
Re: I smell a fight coming on
"Actually, that raises a point about John Deere itself, where their software comes from. Truly proprietary, or Linux-based? And, if Linux-based, their entire stance against right to access their software for right-to-repair completely falls apart."
Unfortunately, depending on what software they're talking about, it might not. If the software is only given to the repair people they authorize, then the owner of the equipment doesn't have license rights because they didn't receive copies. The GPL only gives the right to source to those who already have the software, not to those who come into contact with someone who uses it. That allows you to use GPL components if you only use the program internally. For the same reason, they could use a proprietary stack on Linux and similarly avoid having to give up things they don't want to. A copy of the kernel source without the bits that run in userspace won't be as useful.
Not just Vizio
UK's TopUpTV pulled the same stunt back in the 2000s and tried some obfuscation stunts on the Ext4fs when called out on it in order to make it less obvsious what they were doing
Do they know that Vizio touched the kernel, or is it all in userland? I point by analogy to Mikrotik routers. They use RouterOS, Mikrotik's proprietary software. Oh, and it has a Linux kernel, but don't ask for sources... they say they don't do anything that obligates them to publish anything.
Signed binaries
You might find even if you can compile new binaries, you can't run them.
I have seen companies distributing GPL product where the boot ROM checks the signatures before loading, and if that fails, it won't boot.
If this is implemented in OTP inside the SoC then there is almost no chance of cracking it from the front door.