Rick Moen <rick@???> wrote:

> [Sorry, this ended up being longer than I'd hoped.]

That's OK - it's worth the read.

> Quoting Simon Hobson (linux@???):
>
>> There was one other thing that came to mind earlier ...
>> If ${company} decided to do that, and they had previously distributed
>> binaries ... doesn't the GPL mean they are required to provide the
>> sources to anyone they've distributed the binaries to ?

> Case B: At least some GPL-covered components are owned by a third party
> and are being redistributed by Exampleco.

That's the case I had in mind.

> Moving on to Case B: Here, Exampleco has acquired code created and
> owned by Otherco. Otherco as owner offered its work on, say, its
> otherco.co.uk Web site, and Exampleco downloaded it. ...
>
> Continuing the hypothetical, Exampleco either creates a derivative work
> based on Otherco's copyrighted material and distributes that, or merely
> redistributes Otherco's creation. Either way, Exampleco has just
> exercised one or two or Otherco's exclusive rights.
>
> Let us say that you receive the derivative work or redistributed copy
> as a binary from _either_ Exampleco or from any other place whatsoever.[2]
> You determine that Exampleco had been publishing the work at some time
> within the preceding three years. You request matching source code
> from Exampleco, politely citing its act of distribution and the wording
> of GPLv2 clause 3b.
>
> Is Exampleco committing a tort if it fails comply? Yes, but there's a
> subtle but vital point to note: Its tort is not against _you_. If you
> attempt to haul Exampleco into court on a tort of copyright violation,
> your suit will be dismissed for _lack of standing_, because you are not
> the owner of the work in question.

Yes, that's an important point.

> On the other hand, Otherco _could_ successfully haul Exampleco into
> court and seek relief. Please note that Otherco could _not_ get the
> court to order Exampleco to give you source code (at least in courts in
> the UK, USA, Canada, Australia, NZ, and other places with
> English-derived legal systems[3]), because 'specific performance' is not a
> remedy available for the tort of copyright violation. Courts will
> grant relief in the form of ordering that unauthorised distribution
> _cease_ (e.g., order Exampleco to disable download), and may order
> payment of monetary damages.

OK.
So given the hypothetical case where Exampleco "takes over"* a project with the sole desire of burying it, the worst (effectively) that any of the copyright holders in that code could do is have a court order that Exampleco cease distribution of the code or any derived works. Thus if Exampleco "takes over"* the project and any repositories holding the code, they can kill it, and effectively there's nothing anyone can do using copyright law.

However, if the aim is to add halloween code and kill all prior versions, then anyone with standing** can go to court and ask for an order preventing redistribution of any derived works. So while they still can't force Exampleco to provide sources for the current or previous versions, they can prevent Exampleco from "profiting" from control over it.
Of course, Exampleco could then go through the code and rip out all of that copyright holders code and re-write it themselves - but at least then they've had to put more effort in.

* Where I mean, they by whatever means - whether it's buying a company, brib^H^H^H^Hemplying people, whatever - they gain control over the public servers and are able to remove the source code from public availability.

** Eg ${random_dev_with_his_name_against_some_of_the_code} and who hasn't previously assigned his copyright to someone else.


And suddenly I see another musing forming from the ether ...
Isn't there one of the "free software advocacy groups" (for want of a better description) that asks contributors to assign their copyright in stuff they submit to it's projects to them ? Lets call them GoodCo ...
As above, if GoodCo turn bad - or are somehow co-erced (maybe they've gone bankrupt etc) - then ExampleCo could acquire them and it turns into Scenario A you describe. The original developers no longer have any standing (because they gave away their copyright to GoodCo) and there's nothing they can do to stop ExampleCo doing what they want.

So, one part of "securing" open software is for all contributors to keep their copyright. That way, if anyone wants to try "bad stuff", there's a lot of different people they will have to subvert or who's code they'll need to rip out. A bit like the trick of buying a piece of land and then selling or giving lots and lots of very small plots to a large group of different people - thus meaning that EvilDeveloper then has to negotiate with hundreds or thousands of individuals (most of whom are against EvilDeveloper) to buy all these small plots - or work around any plots he can't buy.


> The above is admittedly very detailed and picky in going through the
> mechanics, but I was attempting to dispel some very common
> misconceptions, such as the implication that violating a copyright is
> in any way like a traffic violation ('breach', 'required') and the
> common misconception that users who are _not_ copyright owners may
> somehow seek redress in court.


Thanks for taking the time to clear that up. I now have a better idea (I did actually have some clue before) about how GPL and copyright applies in this sort of case. Sometimes, "picky is good" :-)