
BMW Australia Refusing to Comply with Terms of GNU Public License - jordigh
https://gist.github.com/duncan-bayne/fc3213d4a0eabb70bb1e
======
zmmmmm
To me this doesn't really look like a clear cut case. Does he own one of these
cars? If not, then I think it is very dubious whether he has any standing to
request the source code. If he _does_ then included with the car should be an
offer for how to access the GPL source code. He should have followed that (or
clearly stated that he could not locate it in his email). The requirement for
him to enter the VIN to access the source code does not seem unreasonable
since they are only required to distribute source code to customers, and he
has simply emailed them out of the blue asking them to give him the source
without any proof that he's a customer. The statement about BMW being the
"sole owner" is probably concerning proprietary parts of the software that may
not be subject to GPL at all. It is probably way beyond the skills of some
random customer service rep to distinguish the subtleties of those kind of
things.

This kind of interaction actually looks to me to be _counter_ to the spirit
under which the Free Software Foundation tries to administer the GPL - which
is that they work cooperatively to help companies comply rather than try to
trick them into legal hot water. I agree with the FSF approach and I don't
think this sort of PR ambush type tactic is helpful in promoting the use of
free software.

~~~
tzs
> To me this doesn't really look like a clear cut case. Does he own one of
> these cars? If not, then I think it is very dubious whether he has any
> standing to request the source code.

(All section references below are to GPLv2, since that is what the Linux
kernel uses)

Section 3 governs distribution of object or executable code. Section 3 gives
these requirements:

a) Accompany it with the complete corresponding machine-readable source code,
which must be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give
any third party, for a charge no more than your cost of physically performing
source distribution, a complete machine-readable copy of the corresponding
source code, to be distributed under the terms of Sections 1 and 2 above on a
medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to
distribute corresponding source code. (This alternative is allowed only for
noncommercial distribution and only if you received the program in object code
or executable form with such an offer, in accord with Subsection b above.)

BMW is distributing commercially and they did not receive the program in
object or executable form, so option "c" is out.

They are not distributing the source code with their cars, so option "a" is
out.

That leaves option "b", which requires them to give the code to _any third
party_ that requests it, at no more than their cost of performing a source
distribution.

~~~
mrb
_" They are not distributing the source code with their cars, so option "a" is
out"_

I disagree. BMW currently offers the source code as a download on their
website if a customer provides his 7-digit VIN, so this is them fulfilling the
requirement that they must "accompany [the car] with the complete
corresponding machine-readable source code". It is all in the meaning of
"accompany it": giving the source code physically along with the keys when you
purchase the car, or offering a source code download link. I would argue that
either option is compliant with the GPL, so to me it seems BMW is in the
right.

Edit: s/IBM/BMW/

~~~
0xffff2
(I think you meant BMW, not IBM...)

~~~
5ilv3r
BMW VIN must be longer than 7 digits.... IBM product license serial numbers at
7 digits would make more sense.

~~~
sjwright
BMW only ever cares about the last 7 digits of your VIN, as demonstrated on
their iDrive software update page:

[http://www.bmw.com/update](http://www.bmw.com/update)

(an example code would be "J123456")

------
SyneRyder
Google could have helped here:

BMW Car IT: Open Source [http://www.bmw-carit.com/open-
source/](http://www.bmw-carit.com/open-source/)

I'll take a guess based on the filename "ConnStarter" in the BMW firmware that
ConnMann is the primary GPL'd software. As the BMW site says: "The ConnMan
project provides a daemon for managing internet connections within embedded
devices running the Linux operating system.... ConnMan is available under the
terms of the GPL v2."

[http://www.bmw-carit.com/open-source/connman.php](http://www.bmw-
carit.com/open-source/connman.php)

You can download the source if you like.

~~~
jmiserez
The linked site may be useful, but where on that site did you find a download
link for the specific software version (including modifications) used? All I
see is a generic link to ConnMan's project website. I don't think that
suffices?

~~~
SyneRyder
I think BMW would argue that contributing their modifications directly to the
ConnMan Git repository for others to use would suffice. You can find a list of
BMW's commits to the ConnMan project here (Daniel Wagner seems to be the main
developer from BMW Car IT working on it):

[http://git.kernel.org/cgit/network/connman/connman.git/log/?...](http://git.kernel.org/cgit/network/connman/connman.git/log/?qt=author&q=bmw)

~~~
DannyBee
BMW would be wrong to argue that. They are required to provide corresponding
source code, which means the exact version they put in the cars, with any
patch files and build scripts needed to build it.

They can't just link to the general project site

~~~
gknoy
In the era of distributed source control, it seems reasonable to me if
"provide" meant, "link to a repo with our changes". I can see why that's not
in the letter of the GPL (e.g., what if github ceases to exist ten years from
now, and you want to tinker on your car), but for now it seems reasonable.

~~~
jordigh
It is in fact in the letter of the GPL:

[https://www.gnu.org/licenses/gpl-
faq.html#SourceInCVS](https://www.gnu.org/licenses/gpl-faq.html#SourceInCVS)

The actual relevant text of GPLv3 is in section 6d:

    
    
        d) Convey the object code by offering access from a designated
        place (gratis or for a charge), and offer equivalent access to the
        Corresponding Source in the same way through the same place at no
        further charge.  You need not require recipients to copy the
        Corresponding Source along with the object code.  If the place to
        copy the object code is a network server, the Corresponding Source
        may be on a different server (operated by you or a third party)
        that supports equivalent copying facilities, provided you maintain
        clear directions next to the object code saying where to find the
        Corresponding Source.  Regardless of what server hosts the
        Corresponding Source, you remain obligated to ensure that it is
        available for as long as needed to satisfy these requirements.
    

In GPLv2, this reads a bit differently:

    
    
        If distribution of executable or object code is made by offering
        access to copy from a designated place, then offering equivalent
        access to copy the source code from the same place counts as
        distribution of the source code, even though third parties are not
        compelled to copy the source along with the object code.
    

GPLv3 here seems a bit clearer to me. This in fact is one of the better
reasons for GPLv3. It gives more modern options for distributing source code,
since internet distribution became a lot more popular by the time GPLv3 was
written.

~~~
SyneRyder
The code is licensed under GPL 2, but I agree the GPL 3 is actually much
clearer & seems to suggest they're in compliance. (At least in respect to
ConnMan.)

Either way, if people are genuinely concerned and want a specific version of
the source code for their car, it seems Daniel Wagner is a contact at BMW to
ask. There's an email address in the git repository commits.

------
dmm
What GPL licensed software are they actually infringing upon? The linked
post[1] says they found mentions of systemd, but does the firmware actually
contain a linux kernel? I don't see anything that looks like a kernel in the
file listing.

Also if the firmware is properly signed delivering it over http shouldn't
matter, right?

[1] [https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-
softw...](https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-
updates-une=ncrypted/)

~~~
noselasd
The specific update here is just a delta update, and doesn't contain the
entire firmware. But it does contain shared libraries built for running on a
linux system, so it stands to reason there's linux kernel running somewhere
there.

(On that note - have someone sent a similar request to Tesla - they've at
least semi-officially said they're running Linux)

~~~
cynix
> (On that note - have someone sent a similar request to Tesla - they've at
> least semi-officially said they're running Linux)

Yes, people have sent requests to Tesla, and they continue to ignore these
requests to this day. See
[http://www.teslamotorsclub.com/archive/index.php/t-10748.htm...](http://www.teslamotorsclub.com/archive/index.php/t-10748.html)

------
genericacct
Frankly: given recent news (hacked jeeps, software used to cheat on emission
tests) I think it is time to _require_ _all_ software used on vehicles that
transit on public roads to be open sourced and available to the public. (for
independent testing and verification in the name of public safety)

~~~
lucb1e
Vehicles aren't the only things running software that might need verifying.
Far from it. While I wholeheartedly agree that it would be an amazing step, I
also fear the huge backlash from the car and IT industry. Doing this more
gradual probably works better, perhaps requiring open source (I'm not talking
freedom of modification or redistributing or anything yet, just viewing source
code) for software older than x years (like the patent model a bit, 20 years
or so).

Of course Windows 10 wouldn't have to be open source just because Windows is
older than 20 years, but Windows 95 would be.

Anyway, that is just one of the many possible ways. I just think we should be
weary of people stuck in the old ways and not limit the move to just cars.

~~~
cyphar
> Doing this more gradual probably works better, perhaps requiring open source
> (I'm not talking freedom of modification or redistributing or anything yet,
> just viewing source code) for software older than x years (like the patent
> model a bit, 20 years or so).

In that case, the car software is still proprietary software so you've gained
very little from making the source code public. If a vulnerability is found,
you can't write a patch for it and you have to wait for BMW to "get around to
you". Car software should be free software _upfront_.

~~~
lucb1e
> Car software should be free software upfront.

Yes! Just like medical implants (and the server-side counterparts that control
them), and my password manager, and actually any software that is in between
me and my password manager (OS, drivers, perhaps a browser), and private stuff
like my email client/server, and instant messaging client/server, and things
that track my vitals like those smart watch-like wristbands, and any non-
domestically developed software the government uses, etc.

Except few people aside from a few "open source radicals" will think like
that. For every person I know who will fully support this motion, I know five
who will object and another one or two who aren't really sure, and I already
have a biased social circle because I do believe in this cause.

As it stands, we never get to peek under the hood. A system like this would at
least make people aware that "gosh, if we implement this cheating now (or
whatever), we have to make sure to cover it up before we have to go public
with it. Better document extensively where it's implemented so we can remove
it thoroughly". Which is a bigger step than just one manager going "do it".
And we would be able to see trends over the past years and reflect necessary
changes in new policy. Perhaps two decades too late by then, but as it stands,
we have naught.

Then once people get used to the idea that in 20 years, when the software is
commercially useless anyway, perhaps we can open source it sooner. Or more
companies will go "look at us, we publish after 5 years for transparency
without loosing our cutting edge!" A bit of wishful thinking perhaps, but I'm
sure some will, and everyone would be forced after a certain time anyway.

But once again, this is just one way of doing it. There are almost certainly
better ways I didn't think of yet. We should just be thinking about it in the
first place.

------
OJFord
It seems to me less like refusal to comply with the terms of GPL, and more
like denial that they use GPLed code.

    
    
        > I have confirmed with our technical department who
        > advised that ... the usage rights agreement states that
        > the software is protected by copyright and BMW is the
        > sole owner... it is not subject to the requirements of a
        > "Public" licence
    

That may or may not be the case, but to me that doesn't say "yeah we use, na
you can't have it".

------
strictnein
I'm confused here. Where is the evidence that they've modified GPL'd software,
which they are then distributing, and are refusing to distribute the source
code for their modifications?

~~~
nailer
> Where is the evidence that they've modified GPL'd software

There's a Linux kernel and systemd in the 'i3'. See the links in the first few
sentences of the article.

> which they are then distributing

BMW is a Bayerische Motor Work, a car company that distributes cars

> and are refusing to distribute the source code for their modifications?

The letters from BMW to the people asking for a copy of the source, stating
they are refusing to distribute the source code for their modifications,
linked to in the article.

~~~
strictnein
I read that, but isn't this is the lowest type of "violation" there is? People
are just wanting them to host the source code that is already available in
about a billion locations then?

My question still stands, is there evidence that they're modifying GPL'd code
and then not distributing that code?

~~~
thom_nic
I think if they're running unmodified code, they could just say "we are
running X version Y with no modifications" and link to the upstream and be
done with it. Which could be the case.

Or they _have_ modified it and are refusing to release the source with their
modifications. But they haven't stated the former.

~~~
daemin
Technically they don't need to give you the code unless you own that model of
car. There's no requirement in the GPL that the code has to be shared to the
whole world/everyone. It only needs to be provided to the person that has
bought the vehicle which includes said software in compiled form.

~~~
yaur
This is not correct. They need to provide the offer for source to anyone they
provide the binaries to (e.g. customers) but the offer has to be valid for
anyone that gets a hold of it[1].

[1][http://www.gnu.org/licenses/gpl-
faq.en.html#WhatDoesWrittenO...](http://www.gnu.org/licenses/gpl-
faq.en.html#WhatDoesWrittenOfferValid)

~~~
daemin
I think I didn't expand my comment enough. In this context (of software
running a car), the manufacturer needs to provide a way of getting the GPL'd
source code to anyone that owns a vehicle with the relevant binary running in
the car.

Basically you don't lose your GPL software right if you've bought the car from
someone else other than the manufacturer.

------
rattray
Worth noting that the BMW people in the thread are in customer support, not
legal.

~~~
SyneRyder
Looking through the user's Github account, they have a history of contacting
customer support representatives of companies and threatening to post the
transcripts to Hacker News if their specific legal concerns are not addressed:

[https://gist.github.com/duncan-
bayne/74d6e38c506000982237](https://gist.github.com/duncan-
bayne/74d6e38c506000982237)

~~~
pjc50
How else can one get in touch with a megacorp?

~~~
spiznnx
I would assume the legal department would generally read and respond to
letters on legitimate concerns, even at a megacorp.

~~~
nevinera
Generally speaking, they will _definitely_ read them (and occasionally take
action), but only respond if they have some legal obligation to do so. Any
reply they make to an inquiry or accusation of this type can be used against
them, but a lack of response cannot (unless that lack of response violates
some requirement of the law).

~~~
anonbanker
This is why it's good to have a bilateral contract with them prior to your
contact, so that they have a legal obligation to reply. When they dont reply
to your offer of renegotiation or relief, you're safe to use their silence as
acquiescence or dishonor, depending on circumstance.

------
greydius
Please correct me if I'm wrong. I thought the GPL only required providing the
source code to the purchasers of the product. (Who can then redestribute it if
they'd like.) I didn't think it meant that if you use GPL code in your
product, then you are obligated to make your code available to everyone.

~~~
voxic11
You are required to distribute the source code to anyone you distribute
binaries to. So if for instance their binaries were available to the public
then they would also have to make their source code available to the public.
It seems in this case they released a patch to their software and made the
patch available to the public.

~~~
13of40
If I sell a computer with Linux on it, and I bundle on my own application
that's compiled to run on Linux, am I required to make the source code for
that application available?

In this case, if they just have an unmodified copy of Linux to provide the
run-time environment for their nav system or whatever, and the nav system
itself is an application on top of it, I don't know if it follows that they
need to release the source for their nav system.

~~~
icebraining
If it's an application, no, but if it's a kernel module (e.g. drivers to talk
to their devices), then yes. They still have to offer a copy of the kernel
source, even if they haven't modified it.

~~~
amscanne
>If it's an application, no, but if it's a kernel module (e.g. drivers to talk
to their devices), then yes.

There is debate about this, but there are certainly cases of compliant non-GPL
modules. It doesn't strictly follow. (Consider Ndiswrapper, for example.)

> They still have to offer a copy of the kernel source, even if they haven't
> modified it.

I don't really think the license implies technical minutae like this. The
source must simply be made available "on a medium customarily used for
software interchange". Whether you point to a tag on kernel.org or host it own
your own web servers (both cases including the Kconfig) is irrelevant.

~~~
icebraining
_There is debate about this, but there are certainly cases of compliant non-
GPL modules. It doesn 't strictly follow. (Consider Ndiswrapper, for
example.)_

Ndiswrapper is GPL-licensed. The resulting modules are probably not, but they
are usually not distributed anyway.

 _I don 't really think the license implies technical minutae like this. The
source must simply be made available "on a medium customarily used for
software interchange". Whether you point to a tag on kernel.org or host it own
your own web servers (both cases including the Kconfig) is irrelevant._

Sure, but have they pointed?

~~~
amscanne
> Ndiswrapper is GPL-licensed. The resulting modules are probably not, but
> they are usually not distributed anyway.

I was referring to modules wrapped by ndiswrapper. Of course they are
distributed.

There are other examples as well: nvidia being a salient one.

------
jwildeboer
History has proven over and over again that this kind of public shame and
blame approach doesn't help in any way, quite the opposite.

Hand this over to the Free Software Conservancy or the SFLC. And that should
have been the first step.

Now that the bridges are burning, BMW will be far less open to civil
discussion and cooperative solutions. Well done. #sarcasm

~~~
lucb1e
History has proven over and over again that naming and shaming works miracles.
Companies that turned a blind eye and were completely unreachable suddenly
turned active and kind just to save their reputation. Going to or even just
threatening to go to the media, I know from experience, is indeed productive.

I am really curious where you got the idea that it's counter productive.
Asking the conservancy to clean up this dirty work is expensive and takes
forever.

~~~
akamaka
The problem is when random people from the internet start unwarranted attacks
over GPL violations when the problem can be dealt with constructively.

The example that pops into my head is the time when some kid start working on
a mod to the Quake 3D engine that was possibly in violation of a free software
license. Instead of just reporting it to the copyright holder (id Software),
they engaged in a campaign of harassment until John Carmack himself came out
and told them to stop. It was some seriously shameful shit.

Public shaming should be one of the last steps to take. Maybe before starting
a lawsuit, or maybe after, that's up for debate, but certainly after other
avenues have been exhausted.

~~~
lucb1e
I see your point but would say there is a difference between a kid and a
multinational. The same law rules both but an individual doing this by
accident vs. a company doing it due to ignorance (in the best case) is
different. The multinational has enough money to defend itself in court, any
individual is bound to have less, especially a kid (in your example).

~~~
FireBeyond
What does this person realistically expect to gain by contacting Tier 1
customer service about an issue with -the source code and licensing of an in
car entertainment computer-?

Now in theory, CS should be "empowered" or able to escalate, but this is
juvenile, to me, the very briefest of exchanges and then off to HN and
elsewhere with "time for a lawsuit!".

------
fauria
Harald Welte founded gpl-violations ([http://gpl-
violations.org/about/](http://gpl-violations.org/about/)) 12 years ago. The
have been offline for some time, but it looks like they plan to continue with
their activities this year: "Actual GPL enforcement activity is expected to
resume at some point in 2016." Maybe they can help sorting this out.

------
antocv
Has anyone ever seen GPL being encorced in any country?

Wont this end with BWM uploading a tar.gz of a kernel found on kernel.org and
call it a good working day?

Have seen it happen too many times, and in most countries the user has no
claim on the license/copyright.

So unless I contributed/own some copyright found in exact Linux kernel
version/other software used by a distributor, and buy their stuff, there is
zilch I can do.

Which also means, you are free to sell/and break GPL software/license and as
long as you dont upset somebody who owns the copyright to it, you're good to
go.

~~~
luso_brazilian
Yes, and actually on BMW home country, Germany. The summary can be read at
this old Slashdot submission [1] from 2005 but the gist of it is that

 _> Harald Welte of the netfilter/iptables core team sought to enjoin Sitecom
from distributing its WL-122 router, which used netfilter's GPL'd code,
without also providing the source code and a copy of the GPL, as that license
requires _

and

 _> The Munich Court granted Welte a preliminary injunction [2] and then
upheld that injunction [3][4] _

I believe there are other instances of GPL being upheld in courts around the
world and this one should be only one of many examples.

GPL is not even necessary in these cases, in the absence of the (GP) license
it reverts to the default copyright rules, with all rights of copy and
distribution being at the hands of the copyright holders (save for Fair use
and other exceptions).

A company that would try to argue that GPL is not a valid license in court
would actually be admitting in court that they are distributing the software
without a license from the copyright holders all along.

[1] Munich Court Again Enforces GPL:
[http://news.slashdot.org/story/05/04/14/2024258/munich-
court...](http://news.slashdot.org/story/05/04/14/2024258/munich-court-again-
enforces-gpl)

[2] Preliminary injunction:
[http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=...](http://yro.slashdot.org/article.pl?sid=04/04/15/1649250&tid=123)

[3] Injunction upheld:
[http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=...](http://yro.slashdot.org/article.pl?sid=04/07/23/1558219&tid=117)

[4] Court's decision in English (pdf):
[http://www.jbb.de/judgment_dc_munich_gpl.pdf](http://www.jbb.de/judgment_dc_munich_gpl.pdf)

~~~
darkr
Yup, I can remember several companies settling and being forced to comply for
violations of busybox GPL'd code in the US off the top of my head - Verizon,
Extreme Networks and Xterasys. There are likely quite a few other examples of
GPL being successfully enforced.

------
y04nn
At least their update binaries are unencrypted, which allow us to see what
they are using. If some of you want to have a look: The article:
[https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-
softw...](https://shkspr.mobi/blog/2016/02/bmw-are-sending-their-software-
updates-unencrypted/)

Direct link to the binary:
[http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07...](http://www.bmw.com/_common/shared/owners/bluetooth/bin/UPD07012.bin)

------
rewqfdsa
Good. I'm sick of people walking over copyleft licenses generally. It's only
because of copyleft that there exists a pro-sharing social norm in the
software development community. If you kick down the GPL, the norm will shift
back toward proprietary software everywhere. You, young developer, have no
idea just how shitty a world that is.

------
sargun
Tesla still continues to violate the GPL as well -
[https://forums.teslamotors.com/forum/forums/gpl-
sources](https://forums.teslamotors.com/forum/forums/gpl-sources).

------
stusmall
I've gotten the same response from a company when requesting kernel source
before. What is the best source for help in dealing this? I reached out to GNU
but got no response. I know the kernel isn't their project but didn't know
where else to turn.

------
_Codemonkeyism
Poor customer support agent.

------
sudhirj
Is it a violation if they don't modify Linux itself? So if I make a device
that runs Linux and my application binary, am I required to make my
application code public?

~~~
lucb1e
In that case, it shouldn't be a problem to point to Linux' code repository
right?

~~~
ocschwar
And it won't be. But cut their public relations staff some slack. They can't
tell Richard Stallman from Gregory Rasputin, and before saying or doing
anything they're going to be bringing themselves up to speed on what the GPL
is. No need to get rage-y just yet.

~~~
lucb1e
It's their obligation to forward what they don't understand. If I work for a
mobile network carrier and say something that indicates we don't follow some
privacy law, it's my fault for not asking my boss how we handle certain
things. (And my boss might ask his/hers, etc.)

Edit: I didn't downvote you, by the way.

------
kazinator
Misleading title; it looks more like they in fact refuse to acknowledge at all
that some of the code is someone else's.

> _Part of the usage rights agreement states that the software is protected by
> copyright and BMW is the sole owner. So in this case it is not subject to
> the requirements of a "Public" licence [sic]_

I.e. "This is all our software; there is no third-party GPL stuff in it, so we
need not comply with any such license."

------
castis
What is the worst-case scenario for an entity that refuses to comply?

~~~
Kiro
Probably not much and that's why I don't put any licenses on my stuff.

~~~
umanwizard
So, you release code but don't let anyone use it? Because that's the legal
effect of not putting licenses on your stuff.

~~~
Kiro
Yep and I use code without license all the time. Show me one case where that
has ever caused a problem.

~~~
oldmanjay
The point isn't that it may cause you a problem. The point is that the license
is the structure by which people understand how they can use things, and the
lack of a license is generally taken as "don't touch this" by the larger
community. It's essentially opting out of the larger pool of contribution,
which is of course totally valid and your right.

~~~
umanwizard
It's not just how the community interprets it; it's the law.

------
famerr
So it is strange for me even if I understand GPL. Does it means all the
network routers running custom linux have to provide sources of entire
modification? I assume if we want companies to make use of linux on a wide
level, there should be the ways to overcome this problem(if exists).

~~~
st3v3r
What's the problem?

~~~
famerr
First is security, if current asset based on linux is vulnerable and you make
it public consequences are obvious. Or even your system is vulnerable itself
because of modifications. Or 0day that will reveal afterwards. And your
product is based on embedded systems. I understand it's your choice, but it
holds the development.

Second is competitive advantage. If you have to release modified system, that
you use in your product on day 0, when you started, it interfere your
business. Again it's your choice, but it could hold the development. So
reasonable alternative would be good.

~~~
cyphar
If you choose to use code that is under the GPL or similar copyleft licenses,
then you have to play by the rules and provide people you distribute your
software to a way to get the source code.

~~~
famerr
Yes, I understand

------
outworlder
This is ridiculous. So now, any John Doe can contact customer support of any
company, then publicly shame them for not getting the response they want?
Aren't there organizations with the sole purpose of investigating Free
Software license violations, with access to actual lawyers? Where's the email
thread of such correspondence?

This sounds like a child crying mommy. Oh, and while I usually approve
attempts at breaking the way-too-serious corporate speak, smileys seem to
detract from the gravity of the issue being discussed.

Can we get responsible people to handle this, please? Like the Free Software
Foundation? Not a flash mob on the internet. This is counter-productive.

------
goerz
It seems to me that they're not distributing any software (i.e., the product
is a car, not software), which means licensing doesn't come into play. It
would be akin to someone finding out that I'm _privately_ using (and maybe
modifying) GPL software, and then demand that I make the source code available
to them. Only in GPLv3, the issue of selling a product that uses GPL software
internally is addressed. The situation changes of course once they make the
software itself accessible to third parties, in which case they'd also have to
supply the source code.

~~~
ceejayoz
If that were the case, you could get around the GPL by claiming to sell CDs,
thumbdrives, or zip files. Including software in your hardware product is
undeniably distributing that software, IMO.

~~~
goerz
I disagree. If you sell me a CD with software on it, I have the software. If
you sell me a car that runs a software internally, I have a car, but not the
software. The car, unlike the CD, is not a container for the software. In
fact, there is no trivial or intended way to get the software out of the car.
As I said, GPLv3 addresses this explicitly, but with GPLv2 the license just
doesn't apply. Then again, lots of people strongly dislike GPLv3, possibly
exactly for this reason.

~~~
goerz
Incidentally, if you send me a USB stick with some GPL software on it, I can
demand that you give me the source code of that software. However, I can _not_
demand that you also give me the source code for the _firmware_ of the USB
stick, even if the source code for that firmware is under GPL (v2)

~~~
cyphar
I would definitely demand the firmware if it is GPL. Just because it is
"firmware" doesn't suddenly not make it software that you've given me.

~~~
goerz
I can't fathom a reading of the GPLv2 that would support your position. It's
just not in there (it is, in GPLv3).

------
duncan_bayne
Duncan here. I'm the one who contacted BMW to ask about source code
availability. I don't own one of the BMWs in question, but the chap who wrote
the original article investigating the update contents did.

I've since been contacted by someone clueful from BMW Germany, and have put
him in touch with the car owner. They are working together to determine what
needs to be done for BMW to be compliant.

tl;dr: It looks like it's all going to be sorted out amicably.

------
yeukhon
This topic is getting dull every time on HN. Someone has to argue about GPL,
free software vs proprietary software.

------
jolux
pretty sure it's this:
[http://www.magnetimarelli.com/excellence/technological-
excel...](http://www.magnetimarelli.com/excellence/technological-
excellences/open-source-platform-genivi-compliant)

can't find the source for it though.

