11
And some companies are disorganized but honest about it, and go “um, we lost track of
this information and the guy who did it left the company, can you give us some time to
dig it out of the archives?” And if they’re making an honest effort, we’re polite about that
too.
My company was distributing BusyBox binary without the source. We
are contacted by your lawyers. Are we in trouble?
Yes, but it is not too bad yet. Stop being disorganized and x your licensing situation
before it gets really nasty. As I already mentioned, DON’T PANIC. Complying with
BusyBox’s license is easy. Get your act together, ght with internal inertia inside your
company and it will be okay. If you do not understand something, please send emails with
your questions to the BusyBox mailing lists, or privately to maintainers if you want to
keep it private. We will expand this document to cover them.
However, you really cannot afford to be careless about complying with the license anymore.
Some companies ignore the polite requests entirely, and go all deer in the headlights on
us, or maybe hope that if they ignore us long enough we’ll go away. Those are the ones
that the SFLC sends impolite requests to, asking for far more than the original request did
back when they were being nice.
For starters, if the SFLC has to actually sue someone to get their attention, they bill them
for expenses. (They have an ofce in New York City, you really don’t want to go there).
Also, they usually make the company appoint an “open source compliance ofcer” and
deliver quarterly reports. And make them try to contact the old customers they shipped
product to without source and let them know where the source is. All this is the lawyerly
equivalent of “raising your voice to be heard”. I’ve only seem them take the gloves off
once. They’ve only needed to once.
Some companies get in trouble because although they use an upstream vanilla source
tarball, they don’t say what version it was, or they don’t explicitly say it wasn’t modied.
Then when we approach them for more information, they don’t understand what we
could possibly want, and panic. (Panicing bad. Please don’t panic, this is actually pretty
easy to get right. Ignoring repeated polite requests is not going to end well. Please be
polite back. Ask for clarication if you don’t understand something, it’s not an admission
of weakness. If you ignore us until we stop knocking, these days it may mean we’re getting
the battering ram. This is not an improvement for anyone concerned.)
Another common failure mode is companies that redistribute some vendor board
support package they bought, and when we ask them they brush us off with “we got
it from a vendor, go bug our vendor, not our problem”. Dude, you’re copying and
distributing GPL code too. If the license is the only thing that gives you permission to
do that, then that license applies to you too. Really. If your vendor complied with the
license terms but you didn’t, you’re not off the hook. This is not a scavenger hunt, nor is
it the episode of M*A*S*H about getting tomato juice to Colonel Potter. We asked you,
and you have an obligation to provide this information. If you don’t even know what it
is when we ask, something is wrong. If you’d reprinted somebody else’s documentation
and stripped out BSD advertising clause notices, do you think you could then say “but
the original PDF we got from our vendor had the notice in it, so we’re ok, don’t bother
us”? Or would going “oops, here’s one with the right data” be your responsibility? Fixing
Komentáře k této Příručce