> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it.
This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that:
1. The GPL requires the company to send the user a written offer of source code.
2. The user uses this offer to request the source code from the company.
3. If the user does not receive the source code, the user can sue the company for not honoring its promises, i.e. the offer of source code. This is not a GPL violation; it is a straight contract violation; the contract in this case being the explicit offer of source code, and not the GPL.
Note that all this is completely off the rails if the user does not receive a written offer of source code in the first place. In this case, the user has no right to source code, since the user did not receive an offer for source code.
However, the copyright holders can immediately sue the company for violating the GPL, since the company did not send a written offer of source code to the user. It does not matter if the company does or does not send the source code to the user; the fact that the company did not send a written offer to the user in the first place is by itself a GPL violation.
This is an open legal question, which the Conservancy v Vizio case will hopefully change; in that case, Conservancy is arguing that consumers have the right to enforce the GPL in order to receive source code.
Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community.
Which brings us to the question: what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? Of which there are likely none. Try and run custom software on his medical device which can likely kill him? More than likely.
The judge's comments on the Vizio case are such that should this guy get his hands on the code, he has no right to modify/reinstall it AND expect it will continue to operate as an insulin pump.
This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system.
There are a lot of people hacking on insulin pumps and they are lightyears ahead of commerce. If you want a very interesting rabbit hole to dive into try 'artificial pancreas hacking' as google feed.
I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up, it's the equivalent of flying a plane you built yourself.
> it's the equivalent of flying a plane you built yourself
A great analogy because people die that way. I personally would never push code to another person’s insulin pump (or advertise code as being used for an insulin pump) because I couldn’t live with the guilt if my bug got someone else killed.
I know people die that way (GA). But someone is working for the companies that make insulin pumps and they are not as a rule equally motivated so I would expect them to do worse, not better.
And to the best of my knowledge none of the closed-loop people have died as a result of their work and they are very good at peer reviewing each others work to make sure it stays that way. And I'd trust my life to open source in such a setting long before I'd do it to closed source. At least I'd have a chance to see what the quality of the code is, which in the embedded space ranges from 'wow' all the way to 'no way they did that'.
which is why lots of systems and processes (sometimes called red tape) exist to try and prevent the undesired outcome, and dont rely on the competency of a single person as the weak link!
Anytime anybody does something himself, there is a risk. People die because of welding parts cleaned with break-cleaner, people die driving, diving, sky-diving, doing bungee jumping...
Advertising that code, IMHO would be as showing of you doing extreme sports, for example. I do not think is any bad. A good disclaimer should be enough to take away any guilt.
I'm not aware of any deaths attributed to open source artificial pancreas systems. Meanwhile there have been multiple attributed to closed source glucose monitors.
I can guarantee you, from my personal experience of being diabetic for 30 years, that every day—and in the most incredible ways—I have managed to “almost kill myself.” Whether when I used finger-prick testing, sensors, injecting insulin with pens, or managing insulin with a pump. Our life is always a delicate balancing act between too little, too much, and way too much—the kind where this time I really kick the bucket
By personal choice I use a commercial CGM (if I could “touch it,” I’d be firmly on the side of certainty about killing myself through sheer stupidity), but reading something like “associated with” really makes me angry. Before making such subtle insinuations about the open-source world (the source of the revolution of the last 10 years in this field), regulatory bodies should open their eyes to what is actually happening with the quality of current sensors and the real problems they are causing.
And strength to you. I had a business partner for some time that was much like you and every time he'd be 10 minutes late for an appointment I'd get nervous and if it was more than an hour I'd be on the phone to his family to check up on him.
And yet someone IS pushing code to these devices. Every single one.
So the question really becomes - Are these people working on their own pumps with open source more or less invested than the random programmers hired by a company that pretty clearly can't get details right around licensing, and is operating with a profit motive?
More reckless as well? Perhaps. But at least motivated by the correct incentives.
You, an engineer at a major aircraft manufacturer that isn't Boeing, have been working after hours with some of your colleagues on a hobby project to add some modern safety features to an older model of small private plane, because you regard it as unsafe even though it still has a government certification and you got into this field because you want to save lives.
Your "prototype" is a plane from the original manufacturer with no physical modifications but a software patch to use data from sensors the plane already had to prevent the computer from getting confused under high wind conditions in a way that has already caused two fatal crashes.
Now you have to fly somewhere and your options for a plane are the one with the history of fatal crashes or the same one with your modifications, and it's windy today. Which plane are you getting on?
Are you kidding me? How many times have you unwillingly introduced bugs into a code base you didn’t fully understand? That’s basically table stakes for software engineering.
> Definitely not the untested code I wrote myself!
Nobody said it was untested.
> How many times have you unwillingly introduced bugs into a code base you didn’t fully understand? That’s basically table stakes for software engineering.
Which applies just the same to the people the company hired to do it, and now we're back to "the people with a stronger incentive to get it right are the people who die if it goes wrong".
I can’t tell if you seriously think a random person writing code in their basement is equivalent to a company that has access to API docs, design specs, actual test hardware, the expertise of a ton of engineers that have worked on the project and understand how it can go wrong, not to mention all the regulations and verifications they’re subject to.
But if you do then wow. That really puts in perspective the kind of people that use hacker news. I’m gonna be more selective about who I bother replying to going forward.
> I can’t tell if you seriously think a random person writing code in their basement is equivalent to a company that has access to API docs, design specs
Are you saying not having those things is dangerous? They should be required to publish all of that for safety-critical devices then.
> actual test hardware
Why would arbitrary people be unable to buy test hardware? Again something to be addressed if true rather than used as an excuse.
> the expertise of a ton of engineers that have worked on the project and understand how it can go wrong
Do they not have internet access? If they don't even work for the company anymore then that could be the only way to access that information.
Literally something which is happening on the linked Reddit page.
> not to mention all the regulations and verifications they’re subject to.
Regulations are for preventing someone else from harming you. You don't need a government incentive to protect you from yourself, you already come with that incentive.
Tested how? With 100% "unit test" coverage? I can certainly see how a random person on the internet might be highly motivated and actually talented enough to contribute to these sorts of projects. But they don't have the budget and resources that commercial entities have. They don't have the same due diligence requirements. They don't have the same liability. If I use a commercial device unaltered, it's the company's fault if the device fucks up or is defective and causes harm. If I install random internet software on my medical device and it fucks up and causes harm, it's my fault.
I say this as someone who might modify my own medical devices because I'm so fucking jaded over the capitalist march towards enshitification and maximizing profit over human lives. There is simply no way random folks on the internet can test these types of systems to any reliable degree. It requires rigorous testing across hundreds to thousands of test cases. They at best can give you the recipe that works well for them and the few people that have voluntarily tried their version. That doesn't scale and certainly isn't any safer than corporate solutions.
Why do people think constantly something made by some random company is automatically better than something made "DIY".
I totally understand, that because of liability and some more availability of resources, you would expect a company product to be "safe". BUT: if it is your butt that is going to be in the line, then I bet you: you will be much more careful that a random engineer in some random company. About the resources available in a big company, they are usually more directed to marketing, legal (including lobbing to avoid right to repair) and oder areas to maximize revenue, and not exactly in quality.
I worked in 2 different big companies which worked in "mission critical systems" and boy! I can tell you some stories about how unsafe is what they do, and how much money is invested in "cover your ass" instead of making products better/safer.
I thought I explained it, but I'll break it down into smaller words. Medical software doesn't just have to solve one particular users's problems. It has to be generalized to the majority of folk seeking treatment for a particular problem. If one particular CPAP user is able to tweak their settings to work better for their particular lifestyle, it is not generalizeable to every CPAP user. A corporation offering a general solution is put under *far* more scrutiny than a random github repo is. A corporation can be sued for releasing a product that kills people, but good luck convincing a court that your family deserves restitution for you installing a random script you found on the internet into your insulin pump.
This has fuck all to do with how much corporations care about people. It has everything to do with liability laws and how victims can get restitution. It has everything to do with the actual risks of installing random internet scripts versus the corporations who have to jump through regulatory hoops. And it's not to say corporations get everything right. They fuck things up constantly. But they fuck things up constantly with oversight and regulation and you want me to believe random internet users will make a better product without it. It's nonsense.
I have explained it already in other comments, but let me break it down for you again:
The “liability”, “scrutiny”, “regulation” only generate “cover your ass” measures, bureaucracy, red tape, costs, and hardly any real measure to increase quality or safety. My work is in such a critical mission systems company, and they don’t give a shit about safety, just are interested in coming out clean or not waste too much money in settlement with dead people relatives.
> but good luck convincing a court that your family deserves restitution for you installing a random script you found on the internet into your insulin pump.
And good luck fighting a Pharma corporation for whatever did wrong. BTW, you bring the CPAP topic. Maybe you can read this at leisure [1] in this case, because it was a huge scandal, they pay. But 90% of the time, they don’t. And even if this case, with legal cost deducted, and divided by all people, is not a real compensation (spoiler alert: it never ever is!).
Please note in this case they DID KNOW about the issue, and did nothing. So much for liability and scrutiny.
This is fucking retarded. Liability isn't just CYA. It's real fucking consequences when someone dies. From your own fucking source:
> Philips Respironics agreed to a $1.1 billion settlement on April 29, 2024, to compensate people for financial damages related to the recall.
Which open source individual contributor will agree to a $1.1 billion dollar settlement because of wrongdoing? Not a single fucking one because those numbers don't make sense when random internet users are promising salvation if you just download their firmware. What a complete crock of shit you're suggesting here and you're just reinforcing my point. Did you even do the barest amount of critical thinking here?
> But they don't have the budget and resources that commercial entities have.
Everyone is standing on the shoulders of giants. You're not going from stone tools to jet engines in a month, but you could fix a bug in one in that time.
> They don't have the same due diligence requirements. They don't have the same liability.
Things that exist to try to mitigate the misalignment of incentives that comes from paying someone else to create something you depend on. Better for the incentives to align to begin with.
Notice also that these things are floors, not ceilings. The company is only required to do the minimum. You can exceed it by as much as you like.
> If I use a commercial device unaltered, it's the company's fault if the device fucks up or is defective and causes harm. If I install random internet software on my medical device and it fucks up and causes harm, it's my fault.
And then if the community version fixes a bug that would have killed you and you stick with the commercial version you can sue them for killing you. Except that you're dead.
> There is simply no way random folks on the internet can test these types of systems to any reliable degree.
Basically the entire population is on the internet, so the set of them includes all the people doing it for a corporation. Are they going to forget how to do their jobs when they go home, or when they or a member of their family gets issued another company's device and they want it to be right?
Flying in a plane you built yourself is likely safer than flying in the same model of plane built by a company that assembled it for you using lowest-bid labor while making you sign a twenty page lawyer barf disclaiming liability.
See my other follow up comment ("same model"). Medical device software development feels much closer to homegrown (or worse) than aeronautical engineering.
Why do you think a random person, who is VERY passionate about something, as to invest all the free hours in life to do something, is less skilled that one who just does it because is needed to survive?
Sorry. I would be much more inclined to have something made by somebody passionate about it, as done by some guy that received hopefully some kind of instruction on how to do things and was then left alone.
In this context (GA) we are not comparing Airbus/Boeing with a garage build. We are comparing some small company making 2 seaters with your hangar and maybe 10 certified aircraft mechanics that will help you a lot on the process.
And why do you think pathos arguments are logical? Granted, they didn't cite them, but assuming it is true, empirical studies showing the accident rates are the logical point from which to draw conclusions. What you would like, how you and others feel about it, and what you would expect are meaningless.
You're also equivocating. They made it extremely clear they are referring to hobbyist and other such groups with vague or unknown qualifications; whereas, you go in and make stipulated claims about small businesses with certified mechanics, etc. These two are clearly not the same category, making your argument non-responsive. It's also contradictory in terms of discussed liabilities and such, as the small company, and its mechanics, that whoever worked with, would have liability as well, as opposed to the "random git repo".
You write that as if you have ample experience with codebases of medical devices and I'm going to take a stab at this and say that you don't. Prove me wrong.
My comment rests on the fact that the types of planes you can build yourself are completely different models than the fully assembled models from the likes of Boeing etc. I do agree that a kit 737, if such a thing existed, would be less safe than one off the line.
I think the Beechcraft Bonanza deserves special mention here. I'm sure all the people that worked on it were experts too!
The big problem with this analogy is that it conflates three very important things:
- GA is more dangerous, period. Doesn't matter whether you build the plane yourself or if you bought it ready made (hopefully new, hopefully very well maintained if second hand)
- GA craft tend to have less experienced pilots than airliners, but even airliner pilots tend to do worse as GA pilots than when they're at work. The reason for that is simple: the processes are what keeps commercial aviation (mostly) safe.
- GA craft tend to kill the pilots, because they are more often than not the only person on the plane.
- GA craft have malfunctions like larger aircraft, there is nothing special about them in that sense. But there is something that they don't have that larger aircraft do have: redundancy. In electronics systems, in the design of the mechanical bits, and finally in the people.
- GA craft that are designed and built by their operators are experimental class for a reason: they are untested and so more likely to fail than the ones that are certified. The design processes for commercial aircraft are nothing compared to the design processes employed by what we'll call hobbyists to distinguish them.
- And finally, even though it is a fun analogy I only meant it from a skin-in-the-game point of view, a GA hobbyist is still going to do his level best to make sure that he's not going to get killed. Boeing executives only care about the bottom line, safety is a distant second. And based on my experience with the difference between the guts of various bits and pieces of avionics and the software that they run on compared to my experience looking at medical devices, their guts and the software that they run on I would be more than happy to bet that the loop hackers know as much more more about the failure modes of these devices as the manufacturers do.
Cleanroom manufacturing under sterile conditions is the main differentiator here, and that just applies to the hardware, and it is an art that the medical industry understands very well. Electronics is already at a lower level of competence and their software knowledge tends to be terrible, not to mention the QA processes on said software.
Programmers working for corporations don't necessarily suddenly grow an extra quality brain when they do their work.
Now look at something like the Bede BD-5 and see how many of it's amatuer builders IT killed. Death rate on the first flight alone was something like 10%.
PS: AIrcraft aren't assembled in cleanrooms.
Frankly, you don't have a damn clue on and are getting basically everything wrong in the process
You can believe it and simultaneously function in society.
We aren't all building our own planes because it's worse, but because it's time consuming. I don't have 20,000 hours to burn learning about how planes work to make my own.
If we magically beamed the knowledge straight into people's heads and also had a matter fabricator, I'd imagine yes - everyone would build their own plane. And it might be safer, I don't know.
Point is, the ideas are not mutually exclusive. You can believe both and still resolve it internally and with the world
Not the original poster, but that was snark and not meant literally.
Also, building your own plane is absolutely worse, even if you do have expert-level knowledge. That's true for any complex design. Aircraft design, material sourcing, fabrication, assembly and quality control are all very different skill sets, but the real kicker is experience.
The reason why commercial aircraft are so safe is a lot of work goes into investigating and understanding the root causes of accidents, and even more work goes into implementing design fixes and crew training.
The problem is that the system incentivizes incompetence. The mechanics who are paid a skilled wage, take their time, and double check to make sure they are not missing anything show up as big red problems on the beancounters' spreadsheets and get optimized away.
The system can make up for this in other ways like repeatability of processes, redundancy, etc. Which is why commercial aviation is safer than general aviation, and also why I specifically worded my comment as being about the same model of plane - ie if instead of building your own experimental-class kit plane, you hired it out to a liability-limiting company hiring minimum-wage workers to follow the directions. I'm guessing such a thing is illegal per FAA regs, but that kind of proves my point.
For another example, have you experienced the medical system lately? Doctors are generally smart people, but that intelligence is squandered by having their attention smashed into 10 minute chunks, with the entire rest of the system revolving around blame passing - the end result is a lot of smart and well-meaning people ending up grossly incompetent through emergent effects. I would much rather be able to go to a doctor and trust whatever answers they gave me rather than having to do my own independent research and advocacy to drive the process. But that is not how the system we have works.
I don’t even disagree with you about the system incentives. I hate capitalism just as much as you!
But I still trust the institutions around me to keep me safe. Obviously that depends on where you live, I wouldn’t feel the same way if I still lived in Brazil.
Last time I went to a doctor was about 3 years ago. They diagnosed me in 5 minutes, and took another 10 to treat me and write me a prescription. It was great, I loved it.
Sounds like you have this trust issue with lots of different areas of your life, it might be worth reexamining your own perspective. Or maybe you just have to move to somewhere that you do trust.
I'm glad for you that you've had good experiences so far! "Diagnosed me in 5 minutes" doesn't sound like anywhere near a complex medical issue though.
I certainly keep trying to obtain good results from the system, ie extend trust, but situations routinely run aground. Can you really say it's a "trust issue" when the problem is that I dig into details of situations and repeatedly discover how so-called professionals abjectly drop key issues on the floor?
Latest example: I need a new dishwasher. I should be able to read some reviews, spend $1k, and get the problem solved, right? Guess again - first delivery, a dent (crease) in the tub from the thing being slammed so hard that its plastic frame deformed and pushed up into the metal tub. Second delivery - loud noise from wash motor. I try to engage with warranty service figuring I'd be fine with them swapping the whole pump assembly. Nope, the guy that comes can't even be assed to do his job either! "Oh that's normal so there is nothing to fix, this is a good model, you should keep it". Third try, wash motor sounds a little better but still has a problem. The third set of delivery guys didn't even take away unit #2 for the exchange (even though I even pushed back when they said someone else was going to come later). I had wanted to simply pay money to solve the problem, but instead I'm left with two noisy dishwashers and a big ole project in my court. (do I keep pushing this exchange button? do I just order a new pump assembly and fix it myself, considering the bonus dishwasher compensation for that? do I say fuck it to the whole brand and rethink the purchase decision?)
Sure, I could drop my standards here, check out, and stop caring about the details. The dented tub probably wouldn't leak a decade down the line, the loud motor isn't really that big of a deal if I only run it overnight, and if the motor needs replacing in a few years it's only a $200 repair. But should not giving in to this "best effort" service (after paying $1k) really be considered a "me" problem? It seems more like an economy problem, with me only being exceptional for noticing, having some expertise on how these things should function, and having the willingness to push back.
(although I am thankful that the thing in the front of my mind that I'm frustrated with is an appliance rather than dealing with the medical system again)
> I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up
I would think it's the opposite. People that hack on this only risk their own life. Companies risk many people's lives and will get sued. Of course the person doing the hacking doesn't want to die but they're also willing to take the risk.
The absolute worst-case scenario of messing this up as a company is that you get sued and they win, or you're forced to settle. You pay out some money, post a public apology, whatever. If things get really bad, the company goes under. But you're likely still far richer than the average person, and the blame is distributed enough that no one gets a criminal sentence - not that it was a realistic option to begin with.
The baseline worst-case scenario of messing this up on yourself is that you die.
Right, but getting sued is basically the least risky activity ever. Okay, a little dramatic but: you won't go to jail, and if you're rich and become less rich you're still better off than most people. In pure absolutionist terms, being a business owner is basically always less risky than being labor.
A lot of the other responses say something along the lines of "of course people have more incentive not to mess up, they care about their own lives more than corporations care about getting sued" and sure, that's true in general, but:
- people try to wingsuit through narrow obstacles and miss
- people try to build their own planes and helicopters and die
- people try to build submersible vehicles to go see the titanic and, uh, don't have a 100% success rate
- people try to build steam-powered rockets and die
"It's their life, they won't fuck it up" doesn't exactly cover a lot of behaviors.
I'd argue home-rolling your own medical device firmware is closer to daredevil/"hold my beer" behavior than normal.
None of these have anything to do with your average diabetic loop hacker. You are comparing people that live for the thrills with people that are just trying to live.
I'd like some proof that the embedded programmers working for 'the man' at medical device companies are better and more motivated than those that are hacking on loop devices.
You're comparing people with a death wish in disguise with people that are extremely motivated to improve the QOL and they're very careful about how they do this, in fact if you read up on this you'd notice the insane attention to detail and the very rigorous process, on par with what I've seen in industry and in fact probably better than most.
All of this talk in this thread makes me think back to a time when people were laughing at that Finnish kid that was making his own OS with his buddies. Surely nobody would ever trust their business, their property or the lives to open source.
I checked and this is actually hacker news, not the BSA.
I'm arguing that "it's their life, so they'll be more careful than 'the man'" is tenuous.
There have been many people who "made informed decisions" about their medical treatments over the advice of professionals and ended up being wrong. They don't count as thrill seekers.
Even in other threads on HN, you'll find takes on this topic ranging from "I don't trust my device, so I do finger tests every day" to "I trust my vibes and my device and don't do finger tests anymore" which tells me there's a pretty wide spectrum along which hackers might fall.
I'm not at all arguing that it's impossible that someone would do a good job of hacking their device, let alone do better than pharma/med companies.
I just don't buy that everyone who hacks away at it will inherently do a better than said companies because their life is at stake. There are way too many examples of people taking their lives in their own hands and getting it wrong.
Well, in this case the proof is there for your perusal: it works. They have ironed out most if not all of the kinks and manufacturers are pissed that they got shown up by a bunch of people who they consider to be subjects, not having agency. Because after all, if a bunch of ordinary but skilled people can do this their justification for obscene pricing all but evaporates.
I look at these companies for a living. Every two weeks on average another one. I see their codebases. I interview their engineers. There is no magic sauce. It is rare that you come across a company that really gets engineering and that doesn't see the product as a minor obstacle on the way to profits. Medical device companies in general are not exceptional in this sense (though I am aware of one that is).
But fine, you think that the people that work for these companies are somehow better than that ones whose lives are at stake. I beg to differ.
True, but the suggestions made here are that they are worse and shouldn't be trusted. I disagree with that. They are at least as good, and they could well be better.
> The spirit of the GPLv2 was about contributing software improvements back to the community.
It may be the case that when all is settled, the courts determine that the letter of the license means others' obligations are limited to what the judge in the Vizio case wrote. And Linus can speak authoritatively about his intent when he agreed to license kernel under GPL.
But I think that it's pretty clear—including and especially the very wordy Preamble—not to mention the motivating circumstances that led to the establishment of GNU and the FSF, the type of advocacy they engage in that led up to the drafting/publication of the license, and everything since, that the spirit of the GPL is very much in line with exactly the sort of activism the SFC has undertaken against vendors restricting the owners of their devices from using them how they want.
Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.
Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The lack of a written offer is in itself a clear violation.
> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately.
You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines.
In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source.
If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.
Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales.
That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.
Wouldn't that imply that end-user license agreements are all unenforceable because the software was sold through a retailer, and even if it wasn't you could just a get a secondhand copy?
By my understanding EULAs are based on contract law and having a clickwrap agreement that requires you agree to it before using the software, not copyright law. Except perhaps to the extent that copyright law would prevent you from creating a derivative work that doesn't require you to agree to that clickwrap agreement prior to using the software.
I think the usual argument is that you don't own the digital good, you have a license to use it, and that license is between you and the originator (or their reseller) directly. And you aren't allowed to resell the license.
> No, not if the same itself was unlawful because Alice signed a contract to not sell it like that.
It's the contract that's the violation, isn't it? What would the first sale doctrine be if in order to get a copy you could be required to sign a contract not to exercise your rights under it? For that matter, how could state-level contract law override the federal first sale doctrine?
The "derivative work" hack also seems kind of fragile. The normal way to get someone to agree to something is that they need a right from the license, which they then don't get if they don't agree to it. But if it doesn't give them anything that they need then "there are ways to use the copy they own and have a right to use without agreeing to any additional terms" is more like the default you're trying to hack your way out of than something they're exploiting a loophole to get into, and where does that leave you if anything slips?
Suppose Alice is a three year old. She owns the copy, she presses the button and now she has a running copy even though she's not competent to enter into a contract, and then Bob buys it from her. Or Alice owns the copy and Carol presses the button, and then maybe Carol could be sued, but also maybe Carol lives in another country, and either way Alice now owns a running copy she never agreed not to sell. And then you want to be able to say "but that's cheating" except that it's not any less cheating than what you were doing to try to get them to agree to it.
Sure, maybe anyways but let's assume it is, the parties to that contract are the manufacturer and the copyright holder. The contract allows the manufacturer to distribute it to the distributor without requiring the distributor to agree to the terms and itself become a party. The distributor can then sell the device with the software on it on without acquiring a license and becoming a party to the contract because the copyright has been exhausted (first sale doctrine).
EULA's get around this by forcing the end user to become a party to the contract via a click wrap agreement. There is usually no such click wrap agreement binding the distributor in the case of the GPL. And the GPL doesn't require the creation or maintenance of such a click wrap agreement so the manufacturer would be free to remove it even if the original software had one.
Like when I buy a second hand book and then I start printing copies of the book and selling them without any agreement with the original author or publisher?
Like when you buy or sell a second hand book without getting permission from the copyright holder to distribute their copyrighted material, which would otherwise be necessary.
Distribution agreement is generally different from a sale. Distributors act as agents of the manufacturer. It’s not yet counted as a sale. Most warranties are limited to first owner and do not transfer. How do you think this squares with that? Does it mean I don’t get warranty on the dishwasher I got from Costco? It’s also the same principle of a distributor acting as an agent that enables the manufacturer to have a contract with you.
> first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor).
The copyright doesn’t go away when copies are sold to a distributor. Someone (probably the manufacturer) still has legal obligations to the copyright holder.
copyright doesn't give you the kind of rights that a GPL license does - which is not based on copyright, but on contract law (ala, it's in the name - licenses).
A sale of an object does not transfer those licenses (but those licenses are still valid on the seller - a manufacturer selling widgets will have to obey the GPL clauses. If an end user of this widget wants the source code, they have to go back all the way to the manufacturer, rather than any of the middle-men presumably).
> When the device is transferred or resold to you, it need not be accompanied by the offer of source.
This is false. The person transferring the device must either pass along the offer they received (GPLv2 clause 3(c), and only if performing non-commercial redistribution), or pass along the source code (GPLv2 clause 3(a)).
By my understanding under US law first sale doctrine means that 3 (both (a) and (c)) doesn't apply, copyright has been exhausted and the intermediate party here doesn't need a license at all to sell the device on. Even if you want to argue the GPL is a contract and not just a license the intermediate owner has never been required to become a party to it. Even if for some reason they agreed to the contract - and somehow it was a binding contract despite the complete lack of consideration - it seems unlikely that the courts would interpret 3 to apply because reselling a device isn't "distributing" within the meaning of copyright law because of first sale doctrine.
You already created an interesting top-level comment analyzing the difference between "offering" and "providing" which has a lot of discussion. I'm just saying it's not "ridiculous" to expect software licensing terms to be applied and enforced, whatever a judge decides those terms end up meaning.
It's a medical device that requires a prescription. You can't buy it off the shelf. They're not distributing software to you either. You must go through a medical equipment supplier who transfers the device to you after insurance has paid for some or all of it.
For the same reason you can't find an airplane entertainment system in the trash and call up the company and demand source code.
It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form:
"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable."
The GPL here doesn't extend beyond the kernel boundary. Userland is isolated unless they have GPL code linked in there as well. If they were careless about the linkage boundaries then that's on them.
You've gone off the rails by narrowly focusing on a passage of a software license without understanding the contract law and copyright law environments that those licenses and transactions exist in.
If you file a statement of claim to a court that is just riffing on the theme of "Compiled binaries of GPL code are being distributed" - you won't get anywhere.
I implore you to learn how to identify the parties involved, which contracts get formed when and between whom, de minimis, exemptions to copyright, and the non-copyrightable parts of code.
The recipient of that object code is the medical device supplier, not the end-user.
It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code.
In other words, assume you are the second owner in all cases when it comes to certified medical equipment.
AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received the offer of source during a purchase transaction. You know that little slip of paper you toss as soon as you open some new electronics that says "Open Source Software Notice".
> In other words, assume you are the second owner in all cases when it comes to certified medical equipment.
By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it.
It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.
Would you disagree with this logic?
You distribute GPL code to me on a dvd. I give that dvd to someone else. I have not made a copy of the source code, so copyright does not come into this. If instead I copied the dvd and emailed the iso to someone else I would be distributing and copyright comes into it.
No it doesn't. It can not bind someone that has not agreed to it. A failure to agree might mean they are infringing on copy-right and is liable for damages, but it is wrong to say it binds everyone that distributes it.
They are distributing it without the right to distribute it. The only thing that allows them to distribute it is agreeing to the license/contract to do it in a specific way. If they don't do that, they don't have the right to distribute it. The person they got it from saying otherwise doesn't change that.
the license travels with the copy, it is what allows the copy.
if the license does not travel with the copy, then the copy is unlicensed and is a copyright violation. the license carries restrictions and grants rights. those aspects cannot be violated or the license ceases to exist.
you don't know what you are talking about, so stop guessing.
So when I buy a product with GPL code via Amazon, Amazon is the one with the rights to receive the source? That medical supplier is getting paid via the medical coverage the end user is paying for.
If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Separately, do you think it's remotely a good idea?
> If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it?
Yes, of course. It is abhorrent that people have devices implanted into their bodies and are in any way prevented from obtaining every last detail about how those devices operate.
> Separately, do you think it's remotely a good idea?
In rare circumstances, yes. See, by way of example, Karen Sandler's talk on her implanted pacemaker and its bugs, for specific details on why one might want to do so.
Obviously yes to the first question. How could you possibly not have the right to operating your own heart.
Naturally it would generally not be a good idea.
>Which brings us to the question: what is this guy going to do with (presumably) the kernel source?
it doesn't bring us to the question, but the answer to the question is, run a diff between the software that has this guys life in its hands, and the version it was derived from, to see if they inserted back doors, stray pointers, etc.
>> Try and run custom software on his medical device which can likely kill him? More than likely
I think this sentence is very sad. Not only this is a hard accusation, it is also the primary argument of the anti right to repair movement. An argument that I think is extremely bogus and ill intentioned, and I particularly (like Mr. Rossman) viscerally dislike.
Maybe the primary motivation is a) curiosity, and b) just for kicks to know if they honor the license.
If you carefully read what I wrote, you will notice that I never claimed otherwise. Whether or not third parties have standing to sue on a GPL violation is immaterial to my point, none of which is “an open question”.
> The GPL requires the company to send the user a written offer of source code
It should be noted that this is just one of three options that someone who wants to distribute binaries of GPL code can choose from. It's the most commonly chosen one, and one is only available for noncommercial distribution, so the odds are good that this is the option they are using.
The other available option is to accompany the binary with the source code.
That one leads to an interesting possibility where someone could end up with a binary and there is no one obligated to provide source to them. As far as I know this has not actually arisen, but it seems like something that is bound to happen sometime.
Suppose company X decides to make a generic hardware platform that other companies can buy to build their products on. X's platform is basically a small single board computer with WiFi, Bluetooth, dual, USB ports, a couple Ethernet ports, and some GPIO ports. X ports Linux to their hardware.
When X ships a system it comes with an SD card with a Linux distribution installed including their custom kernel. It is configured to boot from the first SD card slot, and then to run a custom login system that looks at the second SD card slot and if there is a card in there it mounts it, looks for an executable on its root name application.exe, and runs that as root. X includes in the box a small thumb drive with a copy of the source code for everything on the SD card.
The idea is that a company Y that wants to make something like a WiFi access point or an air quality monitor can buy these boards from X, put them in a case with whatever peripherals or sensors they need like air quality sensors, write the software for the application, put it on an SD card, and put that in the second SD card slot.
So lets say Y buys 1000 of these systems from X, builds 1000 of their access points or whatever from them, and sells them.
One of their customers asks Y for the source code of the GPL parts. Does Y have to provide it?
I'd say they do not. They are not making copies or derivative works. They are just receiving physical copies from X and passing those on unmodified to their customers. This should fall squarely under the First Sale Doctrine in US copyright law, and similar rules in other jurisdictions.
How about if they ask X for a copy?
X has made copies and derivative works and distributed them. But X satisfied their GPL requirements by including a thumb drive with the source with each board they shipped to Y.
The written offer is part of the licence, as is the need to respond to that offer with the source code offered. It is all part of the same agreement.
A written offer on its own would not normally be directly enforceable in many (most?) jurisdictions, for the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise) except where other laws/regulations (anti bait&switch rules for instance), or the desire to avoid fighting in the court of public opinion, come into effect.
But in this instance, the written offer and the response to that offer are part of the wider licence that has been agreed to.
> If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.
That section (and similar in section 6d) is not about the written offer of source code. The written offer of source code is instead covered in section 6c.
> c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.
So according to the legal theory expressed in this thread so far, nobody can sue anybody and there's no obligation to provide source code. The copyright holder couldn't sue because the license was followed (an offer was provided) and the end user couldn't sue because the offer doesn't have to be followed up on.
Or, instead of theorycrafting reasons why it shouldn't work, you could "just" sue them and see if the judge agrees.
> the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise)
The hell? Over here, the price tags are a sort of public contract, to which the seller pre-commits. The seller forgot to change the tags? That's not the buyer's problem.
Since money has not exchanged hands, you could always decide not to buy at the counter. So atleast in the countries I have been, it is not legally binding.
Only if deliberate. If the incorrect price is corrected as soon as the problem is noticed then that is (legally) fine. If the incorrect price is left displayed, or was put up deliberately to draw people in, then it is bait & switch.
The other solid bait & switch is advertising a product that they don't have any of to sell, in the hope that you'll come in and buy something more expensive (or lower value) instead.
Offer and acceptance are part of how contracts are formed. There is no contract without there first being an offer.
If you accept someones offer, provided it meets the rest of the criteria for a valid contract - congratulations you now have a contract. If the any party violates it, yes this is a breach of contract.
> A written offer is not the same thing as a contract.
An offer is a precondition and component of a contract
The customer spends money to buy the product along with the source code offered. It's part of the transaction. Not honoring part of the transaction is a breach of contract.
I think they're just saying the GPL doesn't really cover consumer/distributor (dis)agreements, it only covers copyright. While the spirit of the GPL is user-first, it still has to be realized within the confines of copyright law. Even though many people might conflate the spiritual goal and the legal agreement, it doesn't grant "users" any extraordinary legal powers.
It's not illegal to not honor written offers, it's illegal to distribute copyrighted material in violation of it's license.
So gpl is a licensor-licensee contract, if code and license is not shared to the user, then there is no contract to which the user is a party, rather the user is a beneficiary.
The offer of source code seems to be a way to facilitate the conveyance of source code through opt-in means separately from the object code rather than some legal trickery to create a user-licensee contract.
While the offer may indeed convey a licensee-user obligation, a compliant distribution would attach a license anyway, converting the user into a licensee and licensor to licensee in a recursive fashion
I wonder if lawyers specialize in this, it sounds very cool and not at all standard law, but somehow compatible with contract law
On the shelves are three insulin pumps: one with a 5-year warranty, one at a bargain barrel price that comes with no warranty, and one accompanied by a written offer allowing you to obtain the source code (and, subject to the terms of the GPL, prepare your own derivative works) at no additional charge any time within the next three years.
Weighing your options, you go with pump #3. You write to the company asking for the GPL source. They say "nix". They're in breach.
The GPLv2 under which Linux is licensed does not prohibit that insulin pump from bricking itself if you tried to install "your own derivative work" that wasn't signed by the manufacturer.
This is not only possible but also prudent for a device which can also kill you.
Maybe it’s not technically “breach of contract”, and an offer might or might not be a contract. But if you don’t honor an offer you made, you must surely be guilty of something. Otherwise, all offers would be meaningless and worth nothing.
> you must surely be guilty of something. Otherwise, all offers would be meaningless and worth nothing.
You don't have to be "guilty" of anything to be liable in civil law (which contract law is a part of). "Guilt" is a concept from criminal law. It isn't required for contracts to be enforceable.
In general (there are exceptions) offers alone aren't enforceable and don't result in a contract. You need other elements (agreement by the parties, plus something done in return for what's offered) for a contract to be formed - and then it's enforceable.
The written offer with a limited term of three years is just one permitted method of distribution. If an offer was never made then they're not covered by that clause and are bound to comply by other means without the protection of the three year window.
Yes. I did not cover these cases because approximately nobody does that.
I mean, the absolutely simplest, and cheapest, way for companies to comply with the GPL is to ship the source code together with the software. Stick it in a zip file in a directory somewhere. The company can then forget the whole thing and not worry about anyone contacting them and ranting about source code and the GPL. But no company does that.
The other simple way for companies to comply with the GPL is for companies to provide a link to download the source code at the same place that users download the program itself. If the user did not download the source code when they had the chance, that’s the user’s problem. This will also let the company ignore any GPL worries. No company does this, either.
(The GPL provides a third way for individuals and non-profits, which is not relevant here.)
What's the consideration in the written offer? Promises aren't enforceable in court. For a contract to be enforceable, it has to be an exchange of something, not a one sided offer.
Maybe. Who can and cannot sue is irrelevant to my point. But I seriously doubt that anyone can sue for source code. Someone might sue for damages, and the company might offer to settle by offering source code. But IIUC, no company can be sued and forced to give up any source code, unless the company itself chooses to do this instead of paying damages.
I don't know how easy it is in Germany compared to the U S., but this is false. In the U.S., you absolute can sue (and it is extremely common) to force certain actions. See: constructive trust, mandatory injunction, prohibitive injunction, specific performance, recission, writ.
In all likelihood, you would not receive the source code in the U.S., though. If deadset against release, the outcome would likely be that the offender would be fined and injoined from any further distribution.
Not according to the original reasoning by its creators, but opinions differ wildly. However, this is irrelevant to the point; the written offer, which is separate from the GPL, is what is failing to be honored, not the GPL. If you did not receive such a written offer, the GPL, in itself, makes no guarantee that you have the right to the source code.
> If you did not receive such a written offer, the GPL, in itself, makes no guarantee that you have the right to the source code
Wrong. The requirement to provide source code under the GPL is primarily governed by Section 3 of the GNU General Public License v2 and Section 1 of the GNU General Public License v3. The whole point of the the GPL is to make it so users of software could get source code to the software.
Section 3 of GPL 2 states that the company must either give the source to the user alongside the product (in which case the user has the source already), or the company must give to the user a written offer of source code. Note that if the second option is taken, the company is not obligated by the GPL itself to give the source code to the user. It is then only the written offer which obligates the company to give the source code to the user; only the written offer gives the user the right to the source code. Not the GPL itself.
Be sure to read the top comment where someone who claims to have worked for the company provides some inside information.
In my experience, this is quite common when the development of hardware is viewed as a cost center and is outsourced to various providers and teams. Those providers and teams churn a lot and nobody who worked on that is likely still involved with the company via contracts or direct employment.
Front line support people aren’t equipped to respond to these requests. If you’re lucky they’ll get bounced around internally while project managers play hot potato with the e-mail until it gets forgotten. You might get lucky if you go the corporate legal route, but more likely is that the lawyers will do the math on the likelihood of you causing them actual legal trouble for anything and decide it’s best to ignore it.
When I worked at a company that had a history of GPL drama one of the first things I did was enforce a rule that every release had a GPL tarball that was archived and backed up. We educated support people on where to forward requests. I handled them myself. 7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to all of our source code and they were disappointed when they only found GPL code in the tarball. It really opened my eyes to some of the craziness you get exposed to with these requests (though clearly not the polite and informed request in this Reddit thread) which is probably another reason why support staff are uneasy about engaging with these requests.
> 7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to all of our source code and they were disappointed when they only found GPL code in the tarball.
Well, if your non-GPL code was directly linked to, or closely interoperated with, any GPL code, those users would have been right.
As far as I understand it, Richard Stallman has gotten his view about linking from FSF’s lawyers, who has advised the FSF about what does and does not count as a “derived work”, in the sense of US copyright law.
If you want to argue that the FSF’s lawyers are wrong, please provide more detailed, and hopefully referenced, arguments (as opposed to plain assertions).
FSF has opinions but not case law - anyone else's opinion is as valid, there's no citation because no court has ruled that dynamic linking is or isn't a derivative work.
You have to construct your own view based on existing statute and vaguely related cases.
Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021) is not a pro-FSF opinion.
Whether linking (dynamic or not) is a derivative work is defined by things like incorporation, similarity, and creative expression.
I think the FSF view is unreasonably confident in its public opinions where the current law is that each potential infraction is going to be decided on a case by case basis. Read 17 USC 101 for yourself and square that with FSF/Stallman opinions.
There's too much nuance to have a stance about what happens when you link a program. "It depends" is the only thing you can say.
>Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021)
does not apply to the linking of GPLed code. Google copied just the application programming interfaces and then supplied their own code that they wrote themselves.
if you link to a GPL library you are including their copyrighted code, even if the API that GNU uses did not originate with them but came from POSIX or similar.
I would point towards Oracle v. Rimini, where the Ninth Circuit has specifically ruled (inside a complex and yet-unresolved case) that a system built to interoperate with a copyrighted program does not constitute a derivative work of that program. (https://cdn.ca9.uscourts.gov/datastore/opinions/2024/12/16/2...)
They reference a less on point but better known case (https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...., for some reason you have to manually add the period at the end of the link) about whether NES cheat cartridges were copyright infringement. If a work that directly links to and interoperates with a program is a derivative work of that program, the Game Genie really was illegal after all. To me that doesn't seem right, and given the FSF's general opinion on console restrictions (https://www.fsf.org/bulletin/2025/winter/new-nintendo-drm-ba...) I kinda feel like they'd have to agree.
On some sites it's possible to work around this type of linkification bug by percent-encoding the last character (percent symbol followed by 2 hex digits representing the ASCII character):
i don't see how either of those cases applies to the FSF and GNU's attitude on library linking; in neither case were they creating a combined derivative work.
if I make an ai driven viewscreen that you can stick your paperback book into and it gives you a better reading experience of the book, your paperback book is still in there and you can take it out. My viewscreen may not work without the book, but it hasn't merged/modified the book with anything.
I guess I would say that you've illustrated the problem precisely. Dynamically linking to a GPL library in your program clearly does not combine your program with the library: the library's still there, you can see the .so/.ddl file sitting separately on your computer, it hasn't been merged with your program and your program didn't modify it. Yet the FSF still claims it's a combined derivative work.
Am I misunderstanding something about the analogy?
Ehh, I'm not sure it's fair to call the FSF dynamic linking absolutists. They only care about any of this because they've boxed themselves into a corner. They want to prevent people from writing proprietary wrappers around copyleft programs, but they don't want a license so restrictive that proprietary and copyleft programs are forbidden from interacting, and Freedom 0 means they can't explicitly prohibit a copyleft program from being used for suchandsuch purpose.
Not the kernel, but LGPL libraries do have relevant carveouts. And if you've ever heard RMS speak, he is extremely particular and does understand the nuances of all this.
As always, the solution is to contact their legal department, preferably via a lawyer. Engineers and support staff are not going to risk their jobs making legal decisions about giving away company property.
The FSF could help a lot here by publishing demand letter templates outlining the statutory and precedential basis for license enforcement and recovery of damages.
But it's the company's legal department which would evaluate that claim. Because it's a legal claim. Licenses aren't magic spells, they're social agreements and non-executive employees don't want to get in trouble for making executive decisions.
That really depends. A company can still own the copyright to the code that they’ve written, even if it’s licensed with GPL. It’s an asset that is transferred if the company is sold, etc, so yes, it’s actually company property.
The GPL grants rights to use and distribute, but does not grant ownership. It’s not suddenly in the public domain.
Yeah there are are startups where head guys don’t know that and developers jump the gun because they feel like they’re ones that have the best understanding of the issue at hand.
I agree that a front-line CSR or even engineer is not likely the right person, but surely then the responsible action is to redirect the request to the responsible department or person?
Absolutely, and companies that routinely get requests like this train customer service agents on specific trigger words like "license" or "GDPR" that must be redirected. Without that training, it's not obvious why "it's GPLv2 licensed" is more compelling than the last customer's argument that the device warranty obligates you to drop everything and immediately fix the minor UI bug they reported.
I get mad triggered by software license violation discussions.
Please for the love of all that the FSF thinks is holy - just file a damn lawsuit if you are telling me they are violating the law. State your claim and have a court sort it out.
It costs hundreds of dollars. For a medical device? Seems like a good deal.
What's their basis for sending the emails then? If not one of legal standing in copyright/contract law?
Edit: My point is this is just another one of many annoying people you have to deal with who will email you alleging all sorts of legal violations, who don't themselves understand anything about the claims they are making.
Sure, I understand that there's a difference. That's why I sought clarification.
My understanding of the concept of "basis" does not fit the context of sending an email, and "reason" is the closest I can find that fits.
Basis being concerned with rules or authority. The assumption being when asking "what is the basis for X?" that there was a bar that needed to be met beyond the doers motivations. That there needed to be more than they wanted to. Which of course, does not apply to sending an email. I could email you right now asking you what your favourite type of fish is or seeing if you want to play a game of chess, no basis needed. I'd just need a reason to.
Poorly explained maybe but it covers not just that there is no basis but that no basis is needed and draws attention to the odd request for a basis where none is needed.
Just "there is no basis" as a response would be like saying "yes" or "no" to "have you stopped beating your wife?"
We're talking about Lost-Entrepreneur439 on Reddit emailing a company to ask for some of their code.
You can just do that. No GPL, open source, enforcement, demands, etc language needed. Just "I'm trying to do X, can I see the code for Y?". I receive and send them at work pretty frequently.
They've mentioned the GPL as a way to try to increase the chances of getting sent the code. A support person for a medical device company might not know anything about software licences or linux or GPL. If the company has some sort of "send GPL code to askers" policy and Lost-Entrepreneur439 just asks for the linux kernel, the support person might not know that the GPL policy applies and just say no. If you include it in your message then it increases the chances of them typing "GPL" in to whatever internal knowledge bank they have and seeing "for GPL requests, forward the enquiry to jeff@ourcompany.com" or something like that.
The GPL isn't between Lost-Entrepreneur439 and the company so I don't think "enforcement/exercising a legal right" is an accurate way to describe what we're talking about. That would be if the copyright holders to the linux kernel get involved.
EDIT:
Although that seems like largely just a semantics thing. Like if a judge orders a company to pay you some money and you say "give it to austhrow743" is it valid to say that I have a right to that money? Or is it that you have the right that I get that money? If someone wants to phrase "linux kernel copyright holders have a right to demand users of their code share it with anyone who asks" as "anyone who asks has a right to that code" then I don't really have a problem with that.
I just see a big difference between making a request and making a claim. I don't need to think I'm legally entitled to something to ask for it. I don't even need to think that getting it is likely. Whereas Abigail appears to be treating sending and receiving requests by emails as equivalent to a court summons.
And now we get to my question of why. They want the Linux source code, the company is not giving it to them, why is the next step a blog post instead of a lawsuit? Again this is a medical device - it's important enough to spend the money on.
They make a blog post about GPL violations which allege the company is violating the law.
I'm absolutely begging for anyone in a similar situation to prove it. The reasons those emails were sent is because they think they have a legal entitlement to be sent the source code. *PROVE IT*. It's cheap!
This will probably dox me but I'm going to win a federal discrimination case against a university, with nothing but GPT5.x and Claude, and some filing fees. I'm no dummy but I'm not a genius. I barely got through the Advent of Code 2025 problems with a mess of spaghetti.
In my country people have a common law right to enforce the law themselves without having to pay legal fees. In America it's a statutory right I believe.
The risks of getting a costs order against me are higher than 0% but if I lose narrowly I won't be paying anything.
This is a fantasy. OK, well, if the intent is to waste time and lose a lawsuit, sure, a few hundred dollars will give you that experience. In the real world, no way. A single deposition can cost many times that figure.
You can choose to disagree, of course. My guess is that you have never done this and you have never been involved in a nontrivial legal dispute outside, perhaps, small claims court. You probably don't even own a nontrivial business. Not one person running a business would ever suggest a lawsuit could cost a few hundred dollars.
Like I said, in the real world things are different. I know people who have burned through over $50K in seemingly simple cases (one of them self-represented) only to bow out once they realized they only scratched the surface. In one case they went broke, had to sell their home to pay for the losses and move to a lower cost state just to survive. Tragic. And, BTW, they didn't lose the case. They just got to a point, tens of thousands of dollars later, where they simply had to drop it or face ending-up in a far worse situation.
When I was much younger (and really stupid as most young know-it-alls are) I decided to go after a company that owed me $100K in contractually agreed-upon consulting fees. They had already paid me over a million dollars over a couple of years, so this was not about a little $100K contract.
There was a change in management and they simply decided not to pay vendors. They did this as the simplest method (aside from laying people off) to improve financials. The new CEO and his wife also happened to own a law practice.
So, I hired an attorney (no way to do this on your own for $400). $11K later I finally understood that the balance of power was not in my favor. I may have won. It may have cost me somewhere around $75K to do so.
However, then the other reality would kick in: Collecting. Yup. Collecting was probably going to cost money and maybe even another lawsuit. Not to mention the time, measured in years, for the full experience. Not to mention the real potential of them filing for bankruptcy to gift me the experience of using my judgement as rough toilet paper.
In fact, that is precisely what they did about 18 months later to other vendors, who, like me, where chasing payment. They took a year to transfer all assets to a new corporation. When the original corporation had no assets whatsoever, the went ahead and filed BK and told everyone to go shove their judgements (if any).
I was actually glad that I only burned $12K to learn an important lesson: The legal path is only viable when you are talking about going up against an equal. Like anything, there are exceptions to this, however, in general, this is the way the real world works.
Still don't believe me? If you happen to be a budding entrepreneur looking for investors, do this: During your meeting, tell them that you are not concerned about lawsuits because they can be sorted with $405. Don't blink or you'll miss to witness just how quickly they leave the room. Really.
> The Copyright Claims Board (CCB)
is available to resolve copyright disputes of a relatively low economic value and provides an efficient, less expensive alternative to federal court.
If the only GPLed component used is the Linux kernel, you probably aren't entitled to any noteworthy source code. It's well established that using the kernel doesn't create a GPL requirement userspace software running on the same device, and the most likely arrangement here is a completely-uncustomized kernel paired with an open-source userspace program that does all the interesting bits.
It's trivial in terms that it will cost them nothing, because it's very likely there are no changes to the kernel, or nothing of value nor commercially-sensitive anyway.
It's not trivial in terms of big company bureaucracy - this request will have to go through so many levels of red tape that they (correctly) decided not complying to random people's requests is more profitable.
I'm sure if you actually sue them then they will comply right away, because at that point paying for some engineer's time to tar up the source tree and send it to you now becomes cheaper than lawyer time.
But their analysis is correct in that nobody will waste time/money suing to get what is effectively a stock kernel they can get from the official source anyway. Which is why these complaints are also a bit stupid - they're not asking for anything of value or using the GPL to advance software freedom by freeing up some valuable code, they're just wasting both theirs and others' time asking for something they can already download directly.
> because it's very likely there are no changes to the kernel
That is a gratuitous assumption. My experience is, as long as there is the smallest custom hardware, you will have to make some tweaks here and there.
> they're not asking for anything of value or using the GPL to advance software freedom by freeing up some valuable code, they're just wasting both theirs and others' time asking for something they can already download directly.
I'm sorry that the company which is making lots of money by using a copyrighted SW has to "waste" 200 dollars in some bureaucracy, printing and postage. But is the license of the SW they are using, and should abide by it.
> That is a gratuitous assumption. My experience is, as long as there is the smallest custom hardware, you will have to make some tweaks here and there.
How sure are you small tweaks create a derivative work? In your experience.
No the license does not hold! Fair use exists independently of the GPL license.
Using GPL software does not take away your rights under the law. As much as the angry FSF lawyers want you to believe - I can use any GPL software in any way I choose and have the affirmative defense of fair use for every single claim they throw at me.
Whether I lose or not depends on specific factors of my use - and I'm sorry but one comma isn't going to cut it.
Edit: A single comma will lose 100% of the time to a summary judgement via de minimis. That's just an incredible legal theory you have there and not something you should be spreading.
Edit2: The Beastie Boys famously won via de minimis at summary judgement for a 3 note sample. It matters not whether those 3 notes were GPL notes or not. It matters what the law is.
Let me guess. Omnipod. They've had some pretty bad recalls too. Never in a lifetime would I trust my well-being to their p.o.s. hardware / software combo. Apologies that person in this thread that worked there, but I hope you are working for a better company now.
My point is: they could have left it out. There are not that many manufacturers of insulin pumps and there is only one that the title could have conceivably applied to.
Since a company building it themselves hasn't gotten it in the form of a binary from someone else that they're just passing along to you and their use is commercial, they don't satisfy either condition of GPLv2 3(c), but they'd need to satisfy both in order to be able to exercise that option.
Oh well. The whole thing has already been reverse engineered. Look up Loop or Trio or OpenAPS. Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices. This isn’t really that big a deal. What we need right now is help REing the Omnipod 5
I’m aware of a few people working on REing the Omnipod 5. The furthest issue that I have seen is that when a PDM/Omnipod 5 app signs into your insulet id, it gets a private key from the API which is stored in the keychain (and uses SSL pinning to prevent MiTM retrieval of the private key). When pairing with the pod they exchange public keys and then a derived key from the devices private key+pods public keys, but haven’t been able to get a copy of a private key yet to make further progress.
Anyway to follow the progress? I attended the Nightscout conference and asked around regarding this but no one really knew of any group to follow. Or really knew of the latest developments on this effort.
I am not aware of any public groups to follow the progress, I have just met a few people on the Loop Zulip and have talked with them every few months whenever people have time to look into it.
I'm thinking we probably need to get more organized and start picking up the pace with this. There are rumors, which of course I am not sure how credible, but word is that the Dash will be discontinued soon. Maybe we can add another channel to the Zulip to try to get things moving.
It seems to use the play integrity API when communicating with Insulet's servers which provide a private key to the PDM/app once it was registered with the user's account. However since the Pod doesn't have access to the internet, it has no way to check the play integrity signature AFAIK, so instead it checks that the certificate that the PDM/app presents to it is issued from the cert chain that it trusts.
Not all though, I've been looking at Minimed pump reverse engineering (which would be just reading glucose data, not controlling the pump), and that's not solved yet, at least not for the 780G. But I hope it will be, and perhaps I'll be able to contribute.
I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps.
The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.
> Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices
No it's true. Companies like Insulet and Dexcom could send out lawsuits to all the open source projects out there that involved REing. Dexcom's glucose share API was REed years ago, and Dexcom hasn't even tried updating or stopping the use of unofficial APIs. All I'm saying is that the companies really don't care at all.
So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)?
Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"?
Kinda feels like that just screams data-stealing, regardless of where it was made.
Security… The PDM is walled off completely, it cant install apps, its not on wifi, you cant change any settings. The issue is that a PDM technically could easily kill you, by giving you a lethal dose of insulin.
Funny thing is that the newer Omnipod 5 from the same company works with regular phones now, but only in th US.
Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already.
So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just uses their phone.
This is kind of a regulatory quirk; basically from the FDA's point of view you had to have a complete standalone system, that did not include the phone, in order to be able to prescribe it. I think they do not require companion devices any more, it's OK to release something that requires the user to have a phone.
"we plan on users having a phone to connect to it and use primarily. FDA requires a primary/backup. well it's already phone-controlled, go find a phone that works with it. needs to be cheap, cuz no one will really use it anyway"
That makes a little more sense. I was imagining the development process involving both devices, rather than one device first, then determining what the second would be later.
One thing is that you need to tell the insulin pump when you eat food so it can deliver insulin to cover the food. I bet that is a lot easier in an app than some separate controller device.
Insulin pumps are paired with glucose monitor. I bet it is handy to check glucose levels to make things are stable and correct if off.
I recall idly looking through the manual of our Bosch dishwasher when it was delivered and seeing that they offered to share GPL'ed source code from the machine's embedded guts. I thought to myself, "that's kind of interesting, I'll take them up on that". So I emailed the address they provided for this purpose. I got an auto email back saying, effectively, "No. You're not an authorised person, we don't recognise your email address, we don't know who you are, we're not going to talk to you."
Oh well. Big Corp doing what Big Corps do. Paying lip service to legal requirements, but reluctantly and with barriers that would no doubt take a lot of time and money to even try and break down.
I was troubled by my own comment. How exactly did Bosch handle this? I went back and checked and in fact the rejection email came from their email server, it was an "access denied" type email that I originally misinterpreted as a "you don't have access" type message leaving me annoyed but really I took away and remembered a wrong impression. Looking more carefully, the message doesn't mean anything subtle, it just means the email address (oss-request@bshg.com for the record) doesn't exist. Which is bad, but not nearly as bad as I portrayed it above. Apologies (for the record) to Bosch.
Why is this relevant for understanding how the IP works or even tweaking it? Whatever is relevant for that matter will most certainly not be a modification to the Linux kernel that the android system is running. It will not fall under the GPL that the kernel is licensed under. Can someone explain why this dispute is worth having beyond a theoretical legal debate on whether they should hand out the particular source tree from which their kernel was built (if they even built it)?
I'm sorry you didn't get a response yet. I'm not a lawyer and have no legal training but it seems to boil down to this:
It's part of the debate of whether (1) GPL is a contract, (2) GPL can be enforced by non-parties, (3) How Fair Use applies, (4) Methods to bully/shame companies to give up source code ...? (5) Who the actual parties involved are if the actual rights holder (Linux Kernel) tries to sue someone. (First Sale doctrine might apply).
TL;DR: Not the FSF, but SFC; email compliance@sfconservancy.org
The dominant legal theory is that the GPL can only be enforced by the party holding the copyright. SFC's lawsuit against Vizio is strategically trying to establish precedent changing that; establishing that end-users are "third party beneficiaries" under the GPL, so others can enforce the GPL; but for now the copyright holder is the only one who can enforce it.
So the FSF could only take it up if the violation is on projects that do copyright-assignment to the FSF (i.e.: most GNU stuff). If you do find a violation of GNU stuff, the process is "email license-violation@gnu.org". I do not know what process Craig and Krzysztof use when triaging reports and deciding what to pursue.
Many Linux-kernel contributors (also, SFC member projects such as OpenWrt, Git, Qemu) have assigned their copyright to SFC or named SFC as their legal representative (also, SFC member projects; so SFC can take up something like this. Similarly, you can report violations to them by emailing compliance@sfconservancy.org (see https://sfconservancy.org/copyleft-compliance/help.html for more info).
Now, SFC is aware of more violations than they could ever possibly pursue, so they're strategic about pursuing ones that are high-impact. I'm not sure how they decide that. But I can say that medical devices are near-and-dear to them, between executive-director Karen Sandler's implanted defibrillator and policy-fellow Bradley Kühn's blood glucose monitor.
It shocks me how much comments, here in HACKER news, are something like:
"Why do you want the source code?! leave it alone! Don't touch it, is unsafe! Big Pharma companies know much better than you what they do!"
REALLY?! REALLY?!
I'm not saying, go changing the SW like crazy. Is clear it can kill you. But this "anybody who is not a mega pharma company is absolutely unable to do anything right, you will absolutely kill yourself if you look at the code" that is just... idk... so low.
It may be named hacker news, but boy, many people here are not remotely near what I would call a hacker...
"Agency is dangerous, please take away my(and by extension, everyone's) agency to hurt myself!" is a sentiment that's somehow gained a lot of traction everywhere. The People yearn for the accountability sink.
What a remarkable stalking horse to try and kneecap right-to-repair by arguing "Please, think of the chil^H^H^H^Hhackers!"
You wouldn't download a CAR, would you? You wouldn't hack your own INSULIN pump, would you?
Face it: If it's GPL and vulnerable to interference, responsibility is squarely on the manufacturer and the fastest death-free way to prove it. If it's GPL and modified by the owner, fuck off.
> This honestly disgusts me. GPL violations are already bad on their own, but on a medical device? That me, and thousands of people rely on to stay alive?
Disgusting is not respecting the producers who put together the device that wouldn’t exist otherwise, leaving thousands of people in pain or death.
The normal response to a company importing illegal products is to seize them at the border, destroy them, and, optionally, send the importer a big fine. This is already an established process.
Why would you come to that conclusion instead of the obvious one being that the kind of people to use Hacker News are the same kind to prefer old Reddit?
> I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it.
This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that:
1. The GPL requires the company to send the user a written offer of source code.
2. The user uses this offer to request the source code from the company.
3. If the user does not receive the source code, the user can sue the company for not honoring its promises, i.e. the offer of source code. This is not a GPL violation; it is a straight contract violation; the contract in this case being the explicit offer of source code, and not the GPL.
Note that all this is completely off the rails if the user does not receive a written offer of source code in the first place. In this case, the user has no right to source code, since the user did not receive an offer for source code.
However, the copyright holders can immediately sue the company for violating the GPL, since the company did not send a written offer of source code to the user. It does not matter if the company does or does not send the source code to the user; the fact that the company did not send a written offer to the user in the first place is by itself a GPL violation.
(IANAL)
This is an open legal question, which the Conservancy v Vizio case will hopefully change; in that case, Conservancy is arguing that consumers have the right to enforce the GPL in order to receive source code.
This got buried on HN a few days ago which is a shame:
https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ
Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community.
Which brings us to the question: what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? Of which there are likely none. Try and run custom software on his medical device which can likely kill him? More than likely.
The judge's comments on the Vizio case are such that should this guy get his hands on the code, he has no right to modify/reinstall it AND expect it will continue to operate as an insulin pump.
This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system.
There are a lot of people hacking on insulin pumps and they are lightyears ahead of commerce. If you want a very interesting rabbit hole to dive into try 'artificial pancreas hacking' as google feed.
One interesting link:
https://www.drugtopics.com/view/hacking-diabetes-the-diy-bio...
I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up, it's the equivalent of flying a plane you built yourself.
> it's the equivalent of flying a plane you built yourself
A great analogy because people die that way. I personally would never push code to another person’s insulin pump (or advertise code as being used for an insulin pump) because I couldn’t live with the guilt if my bug got someone else killed.
I know people die that way (GA). But someone is working for the companies that make insulin pumps and they are not as a rule equally motivated so I would expect them to do worse, not better.
And to the best of my knowledge none of the closed-loop people have died as a result of their work and they are very good at peer reviewing each others work to make sure it stays that way. And I'd trust my life to open source in such a setting long before I'd do it to closed source. At least I'd have a chance to see what the quality of the code is, which in the embedded space ranges from 'wow' all the way to 'no way they did that'.
> I would expect them to do worse, not better.
which is why lots of systems and processes (sometimes called red tape) exist to try and prevent the undesired outcome, and dont rely on the competency of a single person as the weak link!
There are more financial reasons to violate and cheat the red tape than there are incompetent open source hackers in the world.
Anytime anybody does something himself, there is a risk. People die because of welding parts cleaned with break-cleaner, people die driving, diving, sky-diving, doing bungee jumping...
Advertising that code, IMHO would be as showing of you doing extreme sports, for example. I do not think is any bad. A good disclaimer should be enough to take away any guilt.
I'm not aware of any deaths attributed to open source artificial pancreas systems. Meanwhile there have been multiple attributed to closed source glucose monitors.
Not attributed to. The FDA wording says "associated with" which is much weaker causally.
I can guarantee you, from my personal experience of being diabetic for 30 years, that every day—and in the most incredible ways—I have managed to “almost kill myself.” Whether when I used finger-prick testing, sensors, injecting insulin with pens, or managing insulin with a pump. Our life is always a delicate balancing act between too little, too much, and way too much—the kind where this time I really kick the bucket
By personal choice I use a commercial CGM (if I could “touch it,” I’d be firmly on the side of certainty about killing myself through sheer stupidity), but reading something like “associated with” really makes me angry. Before making such subtle insinuations about the open-source world (the source of the revolution of the last 10 years in this field), regulatory bodies should open their eyes to what is actually happening with the quality of current sensors and the real problems they are causing.
Thank you.
And strength to you. I had a business partner for some time that was much like you and every time he'd be 10 minutes late for an appointment I'd get nervous and if it was more than an hour I'd be on the phone to his family to check up on him.
https://news.ycombinator.com/item?id=46398414
And yet someone IS pushing code to these devices. Every single one.
So the question really becomes - Are these people working on their own pumps with open source more or less invested than the random programmers hired by a company that pretty clearly can't get details right around licensing, and is operating with a profit motive?
More reckless as well? Perhaps. But at least motivated by the correct incentives.
So flying in a plane you built yourself is in fact safer than flying commercial because the motivations line up. Got it.
You, an engineer at a major aircraft manufacturer that isn't Boeing, have been working after hours with some of your colleagues on a hobby project to add some modern safety features to an older model of small private plane, because you regard it as unsafe even though it still has a government certification and you got into this field because you want to save lives.
Your "prototype" is a plane from the original manufacturer with no physical modifications but a software patch to use data from sensors the plane already had to prevent the computer from getting confused under high wind conditions in a way that has already caused two fatal crashes.
Now you have to fly somewhere and your options for a plane are the one with the history of fatal crashes or the same one with your modifications, and it's windy today. Which plane are you getting on?
This example is so right. Including the parallel with what happened with those two aircrafts.
Definitely not the untested code I wrote myself!
Are you kidding me? How many times have you unwillingly introduced bugs into a code base you didn’t fully understand? That’s basically table stakes for software engineering.
> Definitely not the untested code I wrote myself!
Nobody said it was untested.
> How many times have you unwillingly introduced bugs into a code base you didn’t fully understand? That’s basically table stakes for software engineering.
Which applies just the same to the people the company hired to do it, and now we're back to "the people with a stronger incentive to get it right are the people who die if it goes wrong".
I can’t tell if you seriously think a random person writing code in their basement is equivalent to a company that has access to API docs, design specs, actual test hardware, the expertise of a ton of engineers that have worked on the project and understand how it can go wrong, not to mention all the regulations and verifications they’re subject to.
But if you do then wow. That really puts in perspective the kind of people that use hacker news. I’m gonna be more selective about who I bother replying to going forward.
> I can’t tell if you seriously think a random person writing code in their basement is equivalent to a company that has access to API docs, design specs
Are you saying not having those things is dangerous? They should be required to publish all of that for safety-critical devices then.
> actual test hardware
Why would arbitrary people be unable to buy test hardware? Again something to be addressed if true rather than used as an excuse.
> the expertise of a ton of engineers that have worked on the project and understand how it can go wrong
Do they not have internet access? If they don't even work for the company anymore then that could be the only way to access that information.
Literally something which is happening on the linked Reddit page.
> not to mention all the regulations and verifications they’re subject to.
Regulations are for preventing someone else from harming you. You don't need a government incentive to protect you from yourself, you already come with that incentive.
Tested how? With 100% "unit test" coverage? I can certainly see how a random person on the internet might be highly motivated and actually talented enough to contribute to these sorts of projects. But they don't have the budget and resources that commercial entities have. They don't have the same due diligence requirements. They don't have the same liability. If I use a commercial device unaltered, it's the company's fault if the device fucks up or is defective and causes harm. If I install random internet software on my medical device and it fucks up and causes harm, it's my fault.
I say this as someone who might modify my own medical devices because I'm so fucking jaded over the capitalist march towards enshitification and maximizing profit over human lives. There is simply no way random folks on the internet can test these types of systems to any reliable degree. It requires rigorous testing across hundreds to thousands of test cases. They at best can give you the recipe that works well for them and the few people that have voluntarily tried their version. That doesn't scale and certainly isn't any safer than corporate solutions.
Why do people think constantly something made by some random company is automatically better than something made "DIY".
I totally understand, that because of liability and some more availability of resources, you would expect a company product to be "safe". BUT: if it is your butt that is going to be in the line, then I bet you: you will be much more careful that a random engineer in some random company. About the resources available in a big company, they are usually more directed to marketing, legal (including lobbing to avoid right to repair) and oder areas to maximize revenue, and not exactly in quality.
I worked in 2 different big companies which worked in "mission critical systems" and boy! I can tell you some stories about how unsafe is what they do, and how much money is invested in "cover your ass" instead of making products better/safer.
I thought I explained it, but I'll break it down into smaller words. Medical software doesn't just have to solve one particular users's problems. It has to be generalized to the majority of folk seeking treatment for a particular problem. If one particular CPAP user is able to tweak their settings to work better for their particular lifestyle, it is not generalizeable to every CPAP user. A corporation offering a general solution is put under *far* more scrutiny than a random github repo is. A corporation can be sued for releasing a product that kills people, but good luck convincing a court that your family deserves restitution for you installing a random script you found on the internet into your insulin pump.
This has fuck all to do with how much corporations care about people. It has everything to do with liability laws and how victims can get restitution. It has everything to do with the actual risks of installing random internet scripts versus the corporations who have to jump through regulatory hoops. And it's not to say corporations get everything right. They fuck things up constantly. But they fuck things up constantly with oversight and regulation and you want me to believe random internet users will make a better product without it. It's nonsense.
I have explained it already in other comments, but let me break it down for you again:
The “liability”, “scrutiny”, “regulation” only generate “cover your ass” measures, bureaucracy, red tape, costs, and hardly any real measure to increase quality or safety. My work is in such a critical mission systems company, and they don’t give a shit about safety, just are interested in coming out clean or not waste too much money in settlement with dead people relatives.
> but good luck convincing a court that your family deserves restitution for you installing a random script you found on the internet into your insulin pump.
And good luck fighting a Pharma corporation for whatever did wrong. BTW, you bring the CPAP topic. Maybe you can read this at leisure [1] in this case, because it was a huge scandal, they pay. But 90% of the time, they don’t. And even if this case, with legal cost deducted, and divided by all people, is not a real compensation (spoiler alert: it never ever is!).
Please note in this case they DID KNOW about the issue, and did nothing. So much for liability and scrutiny.
[1] https://www.drugwatch.com/philips-cpap/lawsuits/
This is fucking retarded. Liability isn't just CYA. It's real fucking consequences when someone dies. From your own fucking source:
> Philips Respironics agreed to a $1.1 billion settlement on April 29, 2024, to compensate people for financial damages related to the recall.
Which open source individual contributor will agree to a $1.1 billion dollar settlement because of wrongdoing? Not a single fucking one because those numbers don't make sense when random internet users are promising salvation if you just download their firmware. What a complete crock of shit you're suggesting here and you're just reinforcing my point. Did you even do the barest amount of critical thinking here?
> But they don't have the budget and resources that commercial entities have.
Everyone is standing on the shoulders of giants. You're not going from stone tools to jet engines in a month, but you could fix a bug in one in that time.
> They don't have the same due diligence requirements. They don't have the same liability.
Things that exist to try to mitigate the misalignment of incentives that comes from paying someone else to create something you depend on. Better for the incentives to align to begin with.
Notice also that these things are floors, not ceilings. The company is only required to do the minimum. You can exceed it by as much as you like.
> If I use a commercial device unaltered, it's the company's fault if the device fucks up or is defective and causes harm. If I install random internet software on my medical device and it fucks up and causes harm, it's my fault.
And then if the community version fixes a bug that would have killed you and you stick with the commercial version you can sue them for killing you. Except that you're dead.
> There is simply no way random folks on the internet can test these types of systems to any reliable degree.
Basically the entire population is on the internet, so the set of them includes all the people doing it for a corporation. Are they going to forget how to do their jobs when they go home, or when they or a member of their family gets issued another company's device and they want it to be right?
Flying in a plane you built yourself is likely safer than flying in the same model of plane built by a company that assembled it for you using lowest-bid labor while making you sign a twenty page lawyer barf disclaiming liability.
We have decades of data saying that isn’t true. Homebuilt aircraft have much worse accident rates than factory built aircraft.
Are you really comparing an amateur skillset to designs from paid engineers made on a company assembly line with QC?
Why on earth would you think an experimental aircraft made by a hobbyist would be safer?
See my other follow up comment ("same model"). Medical device software development feels much closer to homegrown (or worse) than aeronautical engineering.
Why do you think a random person, who is VERY passionate about something, as to invest all the free hours in life to do something, is less skilled that one who just does it because is needed to survive?
Sorry. I would be much more inclined to have something made by somebody passionate about it, as done by some guy that received hopefully some kind of instruction on how to do things and was then left alone.
In this context (GA) we are not comparing Airbus/Boeing with a garage build. We are comparing some small company making 2 seaters with your hangar and maybe 10 certified aircraft mechanics that will help you a lot on the process.
And why do you think pathos arguments are logical? Granted, they didn't cite them, but assuming it is true, empirical studies showing the accident rates are the logical point from which to draw conclusions. What you would like, how you and others feel about it, and what you would expect are meaningless.
You're also equivocating. They made it extremely clear they are referring to hobbyist and other such groups with vague or unknown qualifications; whereas, you go in and make stipulated claims about small businesses with certified mechanics, etc. These two are clearly not the same category, making your argument non-responsive. It's also contradictory in terms of discussed liabilities and such, as the small company, and its mechanics, that whoever worked with, would have liability as well, as opposed to the "random git repo".
You write that as if you have ample experience with codebases of medical devices and I'm going to take a stab at this and say that you don't. Prove me wrong.
You can’t honestly believe that or you wouldn’t be able to function in society.
My comment rests on the fact that the types of planes you can build yourself are completely different models than the fully assembled models from the likes of Boeing etc. I do agree that a kit 737, if such a thing existed, would be less safe than one off the line.
I would still trust a cessna way more than any plane built or modified by a single person.
I think the Beechcraft Bonanza deserves special mention here. I'm sure all the people that worked on it were experts too!
The big problem with this analogy is that it conflates three very important things:
- GA is more dangerous, period. Doesn't matter whether you build the plane yourself or if you bought it ready made (hopefully new, hopefully very well maintained if second hand)
- GA craft tend to have less experienced pilots than airliners, but even airliner pilots tend to do worse as GA pilots than when they're at work. The reason for that is simple: the processes are what keeps commercial aviation (mostly) safe.
- GA craft tend to kill the pilots, because they are more often than not the only person on the plane.
- GA craft have malfunctions like larger aircraft, there is nothing special about them in that sense. But there is something that they don't have that larger aircraft do have: redundancy. In electronics systems, in the design of the mechanical bits, and finally in the people.
- GA craft that are designed and built by their operators are experimental class for a reason: they are untested and so more likely to fail than the ones that are certified. The design processes for commercial aircraft are nothing compared to the design processes employed by what we'll call hobbyists to distinguish them.
- And finally, even though it is a fun analogy I only meant it from a skin-in-the-game point of view, a GA hobbyist is still going to do his level best to make sure that he's not going to get killed. Boeing executives only care about the bottom line, safety is a distant second. And based on my experience with the difference between the guts of various bits and pieces of avionics and the software that they run on compared to my experience looking at medical devices, their guts and the software that they run on I would be more than happy to bet that the loop hackers know as much more more about the failure modes of these devices as the manufacturers do.
Cleanroom manufacturing under sterile conditions is the main differentiator here, and that just applies to the hardware, and it is an art that the medical industry understands very well. Electronics is already at a lower level of competence and their software knowledge tends to be terrible, not to mention the QA processes on said software.
Programmers working for corporations don't necessarily suddenly grow an extra quality brain when they do their work.
Now look at something like the Bede BD-5 and see how many of it's amatuer builders IT killed. Death rate on the first flight alone was something like 10%.
PS: AIrcraft aren't assembled in cleanrooms.
Frankly, you don't have a damn clue on and are getting basically everything wrong in the process
You can believe it and simultaneously function in society.
We aren't all building our own planes because it's worse, but because it's time consuming. I don't have 20,000 hours to burn learning about how planes work to make my own.
If we magically beamed the knowledge straight into people's heads and also had a matter fabricator, I'd imagine yes - everyone would build their own plane. And it might be safer, I don't know.
Point is, the ideas are not mutually exclusive. You can believe both and still resolve it internally and with the world
Not the original poster, but that was snark and not meant literally.
Also, building your own plane is absolutely worse, even if you do have expert-level knowledge. That's true for any complex design. Aircraft design, material sourcing, fabrication, assembly and quality control are all very different skill sets, but the real kicker is experience.
The reason why commercial aircraft are so safe is a lot of work goes into investigating and understanding the root causes of accidents, and even more work goes into implementing design fixes and crew training.
Nope, not snark. You can’t believe that you’re better than everyone else and everyone else is incompetent and still function in society.
If you do then you probably have an undiagnosed mental illness.
The problem is that the system incentivizes incompetence. The mechanics who are paid a skilled wage, take their time, and double check to make sure they are not missing anything show up as big red problems on the beancounters' spreadsheets and get optimized away.
The system can make up for this in other ways like repeatability of processes, redundancy, etc. Which is why commercial aviation is safer than general aviation, and also why I specifically worded my comment as being about the same model of plane - ie if instead of building your own experimental-class kit plane, you hired it out to a liability-limiting company hiring minimum-wage workers to follow the directions. I'm guessing such a thing is illegal per FAA regs, but that kind of proves my point.
For another example, have you experienced the medical system lately? Doctors are generally smart people, but that intelligence is squandered by having their attention smashed into 10 minute chunks, with the entire rest of the system revolving around blame passing - the end result is a lot of smart and well-meaning people ending up grossly incompetent through emergent effects. I would much rather be able to go to a doctor and trust whatever answers they gave me rather than having to do my own independent research and advocacy to drive the process. But that is not how the system we have works.
I don’t even disagree with you about the system incentives. I hate capitalism just as much as you!
But I still trust the institutions around me to keep me safe. Obviously that depends on where you live, I wouldn’t feel the same way if I still lived in Brazil.
Last time I went to a doctor was about 3 years ago. They diagnosed me in 5 minutes, and took another 10 to treat me and write me a prescription. It was great, I loved it.
Sounds like you have this trust issue with lots of different areas of your life, it might be worth reexamining your own perspective. Or maybe you just have to move to somewhere that you do trust.
I'm glad for you that you've had good experiences so far! "Diagnosed me in 5 minutes" doesn't sound like anywhere near a complex medical issue though.
I certainly keep trying to obtain good results from the system, ie extend trust, but situations routinely run aground. Can you really say it's a "trust issue" when the problem is that I dig into details of situations and repeatedly discover how so-called professionals abjectly drop key issues on the floor?
Latest example: I need a new dishwasher. I should be able to read some reviews, spend $1k, and get the problem solved, right? Guess again - first delivery, a dent (crease) in the tub from the thing being slammed so hard that its plastic frame deformed and pushed up into the metal tub. Second delivery - loud noise from wash motor. I try to engage with warranty service figuring I'd be fine with them swapping the whole pump assembly. Nope, the guy that comes can't even be assed to do his job either! "Oh that's normal so there is nothing to fix, this is a good model, you should keep it". Third try, wash motor sounds a little better but still has a problem. The third set of delivery guys didn't even take away unit #2 for the exchange (even though I even pushed back when they said someone else was going to come later). I had wanted to simply pay money to solve the problem, but instead I'm left with two noisy dishwashers and a big ole project in my court. (do I keep pushing this exchange button? do I just order a new pump assembly and fix it myself, considering the bonus dishwasher compensation for that? do I say fuck it to the whole brand and rethink the purchase decision?)
Sure, I could drop my standards here, check out, and stop caring about the details. The dented tub probably wouldn't leak a decade down the line, the loud motor isn't really that big of a deal if I only run it overnight, and if the motor needs replacing in a few years it's only a $200 repair. But should not giving in to this "best effort" service (after paying $1k) really be considered a "me" problem? It seems more like an economy problem, with me only being exceptional for noticing, having some expertise on how these things should function, and having the willingness to push back.
(although I am thankful that the thing in the front of my mind that I'm frustrated with is an appliance rather than dealing with the medical system again)
>You can’t believe that you’re better than everyone else and everyone else is incompetent and still function in society.
Welcome to HN.
This post has been a wake up call. I need to be more careful who I bother responding to.
This reminds me of the time I found out there’s a ton of libertarians here that think drivers licenses are oppression.
Those people on the boeing flights would have appreciated a little more of the correct motivations.
Instead they got McDonnell Douglas'd
As it turns out the motivations matter way more than you might think.
> I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up
I would think it's the opposite. People that hack on this only risk their own life. Companies risk many people's lives and will get sued. Of course the person doing the hacking doesn't want to die but they're also willing to take the risk.
The absolute worst-case scenario of messing this up as a company is that you get sued and they win, or you're forced to settle. You pay out some money, post a public apology, whatever. If things get really bad, the company goes under. But you're likely still far richer than the average person, and the blame is distributed enough that no one gets a criminal sentence - not that it was a realistic option to begin with.
The baseline worst-case scenario of messing this up on yourself is that you die.
>People that hack on this only risk their own life
Yeah, only their own life, yknow, something not particularly valuable or motivating to conserve for them, as opposed to the companies financials!
Right, but getting sued is basically the least risky activity ever. Okay, a little dramatic but: you won't go to jail, and if you're rich and become less rich you're still better off than most people. In pure absolutionist terms, being a business owner is basically always less risky than being labor.
> People that hack on this only risk their own life.
Provided they do not risk anyone elses, that is entirely their right.
A lot of the other responses say something along the lines of "of course people have more incentive not to mess up, they care about their own lives more than corporations care about getting sued" and sure, that's true in general, but:
- people try to wingsuit through narrow obstacles and miss
- people try to build their own planes and helicopters and die
- people try to build submersible vehicles to go see the titanic and, uh, don't have a 100% success rate
- people try to build steam-powered rockets and die
"It's their life, they won't fuck it up" doesn't exactly cover a lot of behaviors.
I'd argue home-rolling your own medical device firmware is closer to daredevil/"hold my beer" behavior than normal.
None of these have anything to do with your average diabetic loop hacker. You are comparing people that live for the thrills with people that are just trying to live.
They're also people who had a lot of confidence in their own skills (including thinking they knew better than others) and ended up being wrong.
I would say that can have a lot to do with your average diabetic loop hacker.
I'd like some proof that the embedded programmers working for 'the man' at medical device companies are better and more motivated than those that are hacking on loop devices.
You're comparing people with a death wish in disguise with people that are extremely motivated to improve the QOL and they're very careful about how they do this, in fact if you read up on this you'd notice the insane attention to detail and the very rigorous process, on par with what I've seen in industry and in fact probably better than most.
All of this talk in this thread makes me think back to a time when people were laughing at that Finnish kid that was making his own OS with his buddies. Surely nobody would ever trust their business, their property or the lives to open source.
I checked and this is actually hacker news, not the BSA.
I'm arguing that "it's their life, so they'll be more careful than 'the man'" is tenuous.
There have been many people who "made informed decisions" about their medical treatments over the advice of professionals and ended up being wrong. They don't count as thrill seekers.
Even in other threads on HN, you'll find takes on this topic ranging from "I don't trust my device, so I do finger tests every day" to "I trust my vibes and my device and don't do finger tests anymore" which tells me there's a pretty wide spectrum along which hackers might fall.
I'm not at all arguing that it's impossible that someone would do a good job of hacking their device, let alone do better than pharma/med companies.
I just don't buy that everyone who hacks away at it will inherently do a better than said companies because their life is at stake. There are way too many examples of people taking their lives in their own hands and getting it wrong.
Well, in this case the proof is there for your perusal: it works. They have ironed out most if not all of the kinks and manufacturers are pissed that they got shown up by a bunch of people who they consider to be subjects, not having agency. Because after all, if a bunch of ordinary but skilled people can do this their justification for obscene pricing all but evaporates.
I look at these companies for a living. Every two weeks on average another one. I see their codebases. I interview their engineers. There is no magic sauce. It is rare that you come across a company that really gets engineering and that doesn't see the product as a minor obstacle on the way to profits. Medical device companies in general are not exceptional in this sense (though I am aware of one that is).
But fine, you think that the people that work for these companies are somehow better than that ones whose lives are at stake. I beg to differ.
> But fine, you think that the people that work for these companies are somehow better than that ones whose lives are at stake.
That is not the point I'm making.
The point I'm making is that someone's life being at stake does not inherently make then better.
True, but the suggestions made here are that they are worse and shouldn't be trusted. I disagree with that. They are at least as good, and they could well be better.
> The spirit of the GPLv2 was about contributing software improvements back to the community.
It may be the case that when all is settled, the courts determine that the letter of the license means others' obligations are limited to what the judge in the Vizio case wrote. And Linus can speak authoritatively about his intent when he agreed to license kernel under GPL.
But I think that it's pretty clear—including and especially the very wordy Preamble—not to mention the motivating circumstances that led to the establishment of GNU and the FSF, the type of advocacy they engage in that led up to the drafting/publication of the license, and everything since, that the spirit of the GPL is very much in line with exactly the sort of activism the SFC has undertaken against vendors restricting the owners of their devices from using them how they want.
Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.
Rather crucially, the license itself does not say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The lack of a written offer is in itself a clear violation.
> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately.
You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines.
In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source.
If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.
> If that was true, anyone reselling an Android phone could open themselves up to legal liability.
That’s only an appeal to ridicule. If those are valid, here’s an opposing one:
If this is not true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.
Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales.
That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.
Wouldn't that imply that end-user license agreements are all unenforceable because the software was sold through a retailer, and even if it wasn't you could just a get a secondhand copy?
By my understanding EULAs are based on contract law and having a clickwrap agreement that requires you agree to it before using the software, not copyright law. Except perhaps to the extent that copyright law would prevent you from creating a derivative work that doesn't require you to agree to that clickwrap agreement prior to using the software.
How does that solve it? Alice buys the software, clicks "agree" so that it runs and then sells it to Bob who uses it without ever agreeing.
Somewhere deep in the legalese Alice agreed she would not do that, i.e. "non transferable license".
Isn't that the part that would violate the first sale doctrine?
I think the usual argument is that you don't own the digital good, you have a license to use it, and that license is between you and the originator (or their reseller) directly. And you aren't allowed to resell the license.
E.g. this sort of thing https://www.tomshardware.com/video-games/pc-gaming/steam-che...
No, not if the same itself was unlawful because Alice signed a contract to not sell it like that.
The GPL notably allows for the sale, it was legal here.
> No, not if the same itself was unlawful because Alice signed a contract to not sell it like that.
It's the contract that's the violation, isn't it? What would the first sale doctrine be if in order to get a copy you could be required to sign a contract not to exercise your rights under it? For that matter, how could state-level contract law override the federal first sale doctrine?
The "derivative work" hack also seems kind of fragile. The normal way to get someone to agree to something is that they need a right from the license, which they then don't get if they don't agree to it. But if it doesn't give them anything that they need then "there are ways to use the copy they own and have a right to use without agreeing to any additional terms" is more like the default you're trying to hack your way out of than something they're exploiting a loophole to get into, and where does that leave you if anything slips?
Suppose Alice is a three year old. She owns the copy, she presses the button and now she has a running copy even though she's not competent to enter into a contract, and then Bob buys it from her. Or Alice owns the copy and Carol presses the button, and then maybe Carol could be sued, but also maybe Carol lives in another country, and either way Alice now owns a running copy she never agreed not to sell. And then you want to be able to say "but that's cheating" except that it's not any less cheating than what you were doing to try to get them to agree to it.
So too is the GPL a contract, or at least nobody has proven that it is not a contract and the SFC will fight to prove that it is
Sure, maybe anyways but let's assume it is, the parties to that contract are the manufacturer and the copyright holder. The contract allows the manufacturer to distribute it to the distributor without requiring the distributor to agree to the terms and itself become a party. The distributor can then sell the device with the software on it on without acquiring a license and becoming a party to the contract because the copyright has been exhausted (first sale doctrine).
EULA's get around this by forcing the end user to become a party to the contract via a click wrap agreement. There is usually no such click wrap agreement binding the distributor in the case of the GPL. And the GPL doesn't require the creation or maintenance of such a click wrap agreement so the manufacturer would be free to remove it even if the original software had one.
Like when I buy a second hand book and then I start printing copies of the book and selling them without any agreement with the original author or publisher?
Like when you buy or sell a second hand book without getting permission from the copyright holder to distribute their copyrighted material, which would otherwise be necessary.
It doesn't scale as well if I only have a single copy and don't make more. I daresay it won't be commercially viable.
Second hand book stores and libraries the world over have made it work
They typically buy more than one book.
Distribution agreement is generally different from a sale. Distributors act as agents of the manufacturer. It’s not yet counted as a sale. Most warranties are limited to first owner and do not transfer. How do you think this squares with that? Does it mean I don’t get warranty on the dishwasher I got from Costco? It’s also the same principle of a distributor acting as an agent that enables the manufacturer to have a contract with you.
> first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor).
The copyright doesn’t go away when copies are sold to a distributor. Someone (probably the manufacturer) still has legal obligations to the copyright holder.
copyright doesn't give you the kind of rights that a GPL license does - which is not based on copyright, but on contract law (ala, it's in the name - licenses).
A sale of an object does not transfer those licenses (but those licenses are still valid on the seller - a manufacturer selling widgets will have to obey the GPL clauses. If an end user of this widget wants the source code, they have to go back all the way to the manufacturer, rather than any of the middle-men presumably).
With regards to further distribution of the copy sold to the distributor, it does go away.
> When the device is transferred or resold to you, it need not be accompanied by the offer of source.
This is false. The person transferring the device must either pass along the offer they received (GPLv2 clause 3(c), and only if performing non-commercial redistribution), or pass along the source code (GPLv2 clause 3(a)).
By my understanding under US law first sale doctrine means that 3 (both (a) and (c)) doesn't apply, copyright has been exhausted and the intermediate party here doesn't need a license at all to sell the device on. Even if you want to argue the GPL is a contract and not just a license the intermediate owner has never been required to become a party to it. Even if for some reason they agreed to the contract - and somehow it was a binding contract despite the complete lack of consideration - it seems unlikely that the courts would interpret 3 to apply because reselling a device isn't "distributing" within the meaning of copyright law because of first sale doctrine.
My Android phone does come with an explicit written offer of source. It's in Settings>About>Legal.
> In theory, that written offer only needs to go to the device suppliers.
The GPL clearly specifies recipients, it doesn’t say anything about suppliers.
You already created an interesting top-level comment analyzing the difference between "offering" and "providing" which has a lot of discussion. I'm just saying it's not "ridiculous" to expect software licensing terms to be applied and enforced, whatever a judge decides those terms end up meaning.
It's a medical device that requires a prescription. You can't buy it off the shelf. They're not distributing software to you either. You must go through a medical equipment supplier who transfers the device to you after insurance has paid for some or all of it.
For the same reason you can't find an airplane entertainment system in the trash and call up the company and demand source code.
It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form:
The GPL here doesn't extend beyond the kernel boundary. Userland is isolated unless they have GPL code linked in there as well. If they were careless about the linkage boundaries then that's on them.You've gone off the rails by narrowly focusing on a passage of a software license without understanding the contract law and copyright law environments that those licenses and transactions exist in.
If you file a statement of claim to a court that is just riffing on the theme of "Compiled binaries of GPL code are being distributed" - you won't get anywhere.
I implore you to learn how to identify the parties involved, which contracts get formed when and between whom, de minimis, exemptions to copyright, and the non-copyrightable parts of code.
The recipient of that object code is the medical device supplier, not the end-user.
It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code.
In other words, assume you are the second owner in all cases when it comes to certified medical equipment.
AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received the offer of source during a purchase transaction. You know that little slip of paper you toss as soon as you open some new electronics that says "Open Source Software Notice".
> purchase transaction
The licensee has to offer code to users (more precisely, to any third party). It doesn’t say they have to purchase anything to be a legitimate user.
> In other words, assume you are the second owner in all cases when it comes to certified medical equipment.
By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it.
It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.
Would you disagree with this logic? You distribute GPL code to me on a dvd. I give that dvd to someone else. I have not made a copy of the source code, so copyright does not come into this. If instead I copied the dvd and emailed the iso to someone else I would be distributing and copyright comes into it.
The GPL binds _everyone_ who distributes GPL-covered work, including resellers. It doesn't matter if you made a copy of it, you are distributing it.
No it doesn't. It can not bind someone that has not agreed to it. A failure to agree might mean they are infringing on copy-right and is liable for damages, but it is wrong to say it binds everyone that distributes it.
They are distributing it without the right to distribute it. The only thing that allows them to distribute it is agreeing to the license/contract to do it in a specific way. If they don't do that, they don't have the right to distribute it. The person they got it from saying otherwise doesn't change that.
the license travels with the copy, it is what allows the copy.
if the license does not travel with the copy, then the copy is unlicensed and is a copyright violation. the license carries restrictions and grants rights. those aspects cannot be violated or the license ceases to exist.
you don't know what you are talking about, so stop guessing.
So when I buy a product with GPL code via Amazon, Amazon is the one with the rights to receive the source? That medical supplier is getting paid via the medical coverage the end user is paying for.
> what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel?
As the original Reddit comment explains, Insulet is an American company.
> Try and run custom software on his medical device which can likely kill him? More than likely.
It's not like the OEM software also won't kill you: https://sfconservancy.org/blog/2025/dec/23/seven-abbott-free...
Big disagree, if they distribute the code they’re on the hook for the gpl source, too!
That’s about as ridiculous as buying a plane and knowing you’re entitled to the gpl sources used.
> Linus rants
Linus is arguing against a strawman that Conservancy never actually argued. See https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelev... for details.
> Which brings us to the question: what is this guy going to do with (presumably) the kernel source?
https://openaps.org/
If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it? Separately, do you think it's remotely a good idea?
> If you have a pacemaker implanted, do you believe you have the right to modify and update the software that operates it?
Yes, of course. It is abhorrent that people have devices implanted into their bodies and are in any way prevented from obtaining every last detail about how those devices operate.
> Separately, do you think it's remotely a good idea?
In rare circumstances, yes. See, by way of example, Karen Sandler's talk on her implanted pacemaker and its bugs, for specific details on why one might want to do so.
Not that person, but yes. You have entirely missed the ability to simply view and understand what's inside your own body.
Where your interpretation means someone else needs to follow your whim for their own problem, despite the legalese stating otherwise.
I think that is an absurd position and I am sorry to feel the need to have to be blunt about it.
Obviously yes to the first question. How could you possibly not have the right to operating your own heart. Naturally it would generally not be a good idea.
>Which brings us to the question: what is this guy going to do with (presumably) the kernel source?
it doesn't bring us to the question, but the answer to the question is, run a diff between the software that has this guys life in its hands, and the version it was derived from, to see if they inserted back doors, stray pointers, etc.
>> Try and run custom software on his medical device which can likely kill him? More than likely
I think this sentence is very sad. Not only this is a hard accusation, it is also the primary argument of the anti right to repair movement. An argument that I think is extremely bogus and ill intentioned, and I particularly (like Mr. Rossman) viscerally dislike.
Maybe the primary motivation is a) curiosity, and b) just for kicks to know if they honor the license.
> Linus rants
That happens every Tuesday, hardly newsworthy.
The argument here is that, if there is an offer, they already do under standard contract law.
If you carefully read what I wrote, you will notice that I never claimed otherwise. Whether or not third parties have standing to sue on a GPL violation is immaterial to my point, none of which is “an open question”.
> The GPL requires the company to send the user a written offer of source code
It should be noted that this is just one of three options that someone who wants to distribute binaries of GPL code can choose from. It's the most commonly chosen one, and one is only available for noncommercial distribution, so the odds are good that this is the option they are using.
The other available option is to accompany the binary with the source code.
That one leads to an interesting possibility where someone could end up with a binary and there is no one obligated to provide source to them. As far as I know this has not actually arisen, but it seems like something that is bound to happen sometime.
Suppose company X decides to make a generic hardware platform that other companies can buy to build their products on. X's platform is basically a small single board computer with WiFi, Bluetooth, dual, USB ports, a couple Ethernet ports, and some GPIO ports. X ports Linux to their hardware.
When X ships a system it comes with an SD card with a Linux distribution installed including their custom kernel. It is configured to boot from the first SD card slot, and then to run a custom login system that looks at the second SD card slot and if there is a card in there it mounts it, looks for an executable on its root name application.exe, and runs that as root. X includes in the box a small thumb drive with a copy of the source code for everything on the SD card.
The idea is that a company Y that wants to make something like a WiFi access point or an air quality monitor can buy these boards from X, put them in a case with whatever peripherals or sensors they need like air quality sensors, write the software for the application, put it on an SD card, and put that in the second SD card slot.
So lets say Y buys 1000 of these systems from X, builds 1000 of their access points or whatever from them, and sells them.
One of their customers asks Y for the source code of the GPL parts. Does Y have to provide it?
I'd say they do not. They are not making copies or derivative works. They are just receiving physical copies from X and passing those on unmodified to their customers. This should fall squarely under the First Sale Doctrine in US copyright law, and similar rules in other jurisdictions.
How about if they ask X for a copy?
X has made copies and derivative works and distributed them. But X satisfied their GPL requirements by including a thumb drive with the source with each board they shipped to Y.
Are you saying that in the general case if you send someone a written offer for something and then don't honour it, you are in breach of contract?
That doesn't sound right to me.
A written offer is not the same thing as a contract.
The written offer is part of the licence, as is the need to respond to that offer with the source code offered. It is all part of the same agreement.
A written offer on its own would not normally be directly enforceable in many (most?) jurisdictions, for the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise) except where other laws/regulations (anti bait&switch rules for instance), or the desire to avoid fighting in the court of public opinion, come into effect.
But in this instance, the written offer and the response to that offer are part of the wider licence that has been agreed to.
I don’t think so; I can’t recall any support for such a connection between the written offer and the GPL itself written into the GPL license text.
From section 4 [1]
> If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.
Similar clauses in Sec 6.
[1] https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
That section (and similar in section 6d) is not about the written offer of source code. The written offer of source code is instead covered in section 6c.
Ah.. Thanks
> c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.
So according to the legal theory expressed in this thread so far, nobody can sue anybody and there's no obligation to provide source code. The copyright holder couldn't sue because the license was followed (an offer was provided) and the end user couldn't sue because the offer doesn't have to be followed up on.
Or, instead of theorycrafting reasons why it shouldn't work, you could "just" sue them and see if the judge agrees.
> the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise)
The hell? Over here, the price tags are a sort of public contract, to which the seller pre-commits. The seller forgot to change the tags? That's not the buyer's problem.
Since money has not exchanged hands, you could always decide not to buy at the counter. So atleast in the countries I have been, it is not legally binding.
it's still bait-and-switch
Only if deliberate. If the incorrect price is corrected as soon as the problem is noticed then that is (legally) fine. If the incorrect price is left displayed, or was put up deliberately to draw people in, then it is bait & switch.
The other solid bait & switch is advertising a product that they don't have any of to sell, in the hope that you'll come in and buy something more expensive (or lower value) instead.
Offer and acceptance are part of how contracts are formed. There is no contract without there first being an offer.
If you accept someones offer, provided it meets the rest of the criteria for a valid contract - congratulations you now have a contract. If the any party violates it, yes this is a breach of contract.
> A written offer is not the same thing as a contract.
An offer is a precondition and component of a contract
The customer spends money to buy the product along with the source code offered. It's part of the transaction. Not honoring part of the transaction is a breach of contract.
I think they're just saying the GPL doesn't really cover consumer/distributor (dis)agreements, it only covers copyright. While the spirit of the GPL is user-first, it still has to be realized within the confines of copyright law. Even though many people might conflate the spiritual goal and the legal agreement, it doesn't grant "users" any extraordinary legal powers.
It's not illegal to not honor written offers, it's illegal to distribute copyrighted material in violation of it's license.
So gpl is a licensor-licensee contract, if code and license is not shared to the user, then there is no contract to which the user is a party, rather the user is a beneficiary.
The offer of source code seems to be a way to facilitate the conveyance of source code through opt-in means separately from the object code rather than some legal trickery to create a user-licensee contract.
While the offer may indeed convey a licensee-user obligation, a compliant distribution would attach a license anyway, converting the user into a licensee and licensor to licensee in a recursive fashion
I wonder if lawyers specialize in this, it sounds very cool and not at all standard law, but somehow compatible with contract law
IANAL
That's not what they're saying.
On the shelves are three insulin pumps: one with a 5-year warranty, one at a bargain barrel price that comes with no warranty, and one accompanied by a written offer allowing you to obtain the source code (and, subject to the terms of the GPL, prepare your own derivative works) at no additional charge any time within the next three years.
Weighing your options, you go with pump #3. You write to the company asking for the GPL source. They say "nix". They're in breach.
The GPLv2 under which Linux is licensed does not prohibit that insulin pump from bricking itself if you tried to install "your own derivative work" that wasn't signed by the manufacturer.
This is not only possible but also prudent for a device which can also kill you.
Possibly true, but irrelevant to the post to which you are replying.
The argument is over providing you the source code.
Maybe it’s not technically “breach of contract”, and an offer might or might not be a contract. But if you don’t honor an offer you made, you must surely be guilty of something. Otherwise, all offers would be meaningless and worth nothing.
> you must surely be guilty of something. Otherwise, all offers would be meaningless and worth nothing.
You don't have to be "guilty" of anything to be liable in civil law (which contract law is a part of). "Guilt" is a concept from criminal law. It isn't required for contracts to be enforceable.
In general (there are exceptions) offers alone aren't enforceable and don't result in a contract. You need other elements (agreement by the parties, plus something done in return for what's offered) for a contract to be formed - and then it's enforceable.
I don't think you're guilty of anything for failing to honour an offer in most cases.
An offer is legally binding in that when someone acts based on that offer you can be liable for damages.
This does not force you to honor the original offer though.
Such offer is as legally binding as any tender. Of course a contract dispute could go either way.
And what are the damages?
The written offer with a limited term of three years is just one permitted method of distribution. If an offer was never made then they're not covered by that clause and are bound to comply by other means without the protection of the three year window.
Yes. I did not cover these cases because approximately nobody does that.
I mean, the absolutely simplest, and cheapest, way for companies to comply with the GPL is to ship the source code together with the software. Stick it in a zip file in a directory somewhere. The company can then forget the whole thing and not worry about anyone contacting them and ranting about source code and the GPL. But no company does that.
The other simple way for companies to comply with the GPL is for companies to provide a link to download the source code at the same place that users download the program itself. If the user did not download the source code when they had the chance, that’s the user’s problem. This will also let the company ignore any GPL worries. No company does this, either.
(The GPL provides a third way for individuals and non-profits, which is not relevant here.)
Doesn't seem incorrect if, extra steps aside, the company is ultimately obligated to provide the source code by the terms of the GPL.
IANAL, but this is my understanding.
What's the consideration in the written offer? Promises aren't enforceable in court. For a contract to be enforceable, it has to be an exchange of something, not a one sided offer.
https://www.law.cornell.edu/wex/consideration
There are substitutes for consideration. Search for "detrimental reliance" and "promissory estoppel" if you want to go down that rabbit hole.
In America, maybe this is the case. In Germany, it seems an end user can sue them directly for source code.
Maybe. Who can and cannot sue is irrelevant to my point. But I seriously doubt that anyone can sue for source code. Someone might sue for damages, and the company might offer to settle by offering source code. But IIUC, no company can be sued and forced to give up any source code, unless the company itself chooses to do this instead of paying damages.
To repeat: Maybe that's how it works in America. In Germany, it seems you can sue for anything you're entitled to, not just money.
I don't know how easy it is in Germany compared to the U S., but this is false. In the U.S., you absolute can sue (and it is extremely common) to force certain actions. See: constructive trust, mandatory injunction, prohibitive injunction, specific performance, recission, writ.
In all likelihood, you would not receive the source code in the U.S., though. If deadset against release, the outcome would likely be that the offender would be fined and injoined from any further distribution.
> This is not a GPL violation; it is a straight contract violation
But GPL is a contract
I think the distinction you are pointing would be between a gpl licensor-licensee contract, rather than a licensee-user contract.
(IANAL)
> But GPL is a contract
Not according to the original reasoning by its creators, but opinions differ wildly. However, this is irrelevant to the point; the written offer, which is separate from the GPL, is what is failing to be honored, not the GPL. If you did not receive such a written offer, the GPL, in itself, makes no guarantee that you have the right to the source code.
> If you did not receive such a written offer, the GPL, in itself, makes no guarantee that you have the right to the source code
Wrong. The requirement to provide source code under the GPL is primarily governed by Section 3 of the GNU General Public License v2 and Section 1 of the GNU General Public License v3. The whole point of the the GPL is to make it so users of software could get source code to the software.
Section 3 of GPL 2 states that the company must either give the source to the user alongside the product (in which case the user has the source already), or the company must give to the user a written offer of source code. Note that if the second option is taken, the company is not obligated by the GPL itself to give the source code to the user. It is then only the written offer which obligates the company to give the source code to the user; only the written offer gives the user the right to the source code. Not the GPL itself.
The GPL forces the offer and provides the remedy if you don't provide source, so I'm not sure why this is so important to you?
Be sure to read the top comment where someone who claims to have worked for the company provides some inside information.
In my experience, this is quite common when the development of hardware is viewed as a cost center and is outsourced to various providers and teams. Those providers and teams churn a lot and nobody who worked on that is likely still involved with the company via contracts or direct employment.
Front line support people aren’t equipped to respond to these requests. If you’re lucky they’ll get bounced around internally while project managers play hot potato with the e-mail until it gets forgotten. You might get lucky if you go the corporate legal route, but more likely is that the lawyers will do the math on the likelihood of you causing them actual legal trouble for anything and decide it’s best to ignore it.
When I worked at a company that had a history of GPL drama one of the first things I did was enforce a rule that every release had a GPL tarball that was archived and backed up. We educated support people on where to forward requests. I handled them myself. 7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to all of our source code and they were disappointed when they only found GPL code in the tarball. It really opened my eyes to some of the craziness you get exposed to with these requests (though clearly not the polite and informed request in this Reddit thread) which is probably another reason why support staff are uneasy about engaging with these requests.
> 7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to all of our source code and they were disappointed when they only found GPL code in the tarball.
Well, if your non-GPL code was directly linked to, or closely interoperated with, any GPL code, those users would have been right.
Richard Stallman is wrong about linking.
As far as I understand it, Richard Stallman has gotten his view about linking from FSF’s lawyers, who has advised the FSF about what does and does not count as a “derived work”, in the sense of US copyright law.
If you want to argue that the FSF’s lawyers are wrong, please provide more detailed, and hopefully referenced, arguments (as opposed to plain assertions).
FSF has opinions but not case law - anyone else's opinion is as valid, there's no citation because no court has ruled that dynamic linking is or isn't a derivative work.
You have to construct your own view based on existing statute and vaguely related cases.
Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021) is not a pro-FSF opinion.
Whether linking (dynamic or not) is a derivative work is defined by things like incorporation, similarity, and creative expression.
I think the FSF view is unreasonably confident in its public opinions where the current law is that each potential infraction is going to be decided on a case by case basis. Read 17 USC 101 for yourself and square that with FSF/Stallman opinions.
There's too much nuance to have a stance about what happens when you link a program. "It depends" is the only thing you can say.
>Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021)
does not apply to the linking of GPLed code. Google copied just the application programming interfaces and then supplied their own code that they wrote themselves.
if you link to a GPL library you are including their copyrighted code, even if the API that GNU uses did not originate with them but came from POSIX or similar.
until you actually sue them, all you have are guesses, and you miss all shots you don't take
I would point towards Oracle v. Rimini, where the Ninth Circuit has specifically ruled (inside a complex and yet-unresolved case) that a system built to interoperate with a copyrighted program does not constitute a derivative work of that program. (https://cdn.ca9.uscourts.gov/datastore/opinions/2024/12/16/2...)
They reference a less on point but better known case (https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...., for some reason you have to manually add the period at the end of the link) about whether NES cheat cartridges were copyright infringement. If a work that directly links to and interoperates with a program is a derivative work of that program, the Game Genie really was illegal after all. To me that doesn't seem right, and given the FSF's general opinion on console restrictions (https://www.fsf.org/bulletin/2025/winter/new-nintendo-drm-ba...) I kinda feel like they'd have to agree.
> (https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...., for some reason you have to manually add the period at the end of the link)
On some sites it's possible to work around this type of linkification bug by percent-encoding the last character (percent symbol followed by 2 hex digits representing the ASCII character):
https://en.wikipedia.org/wiki/Lewis_Galoob_Toys,_Inc._v._Nin...
i don't see how either of those cases applies to the FSF and GNU's attitude on library linking; in neither case were they creating a combined derivative work.
if I make an ai driven viewscreen that you can stick your paperback book into and it gives you a better reading experience of the book, your paperback book is still in there and you can take it out. My viewscreen may not work without the book, but it hasn't merged/modified the book with anything.
I guess I would say that you've illustrated the problem precisely. Dynamically linking to a GPL library in your program clearly does not combine your program with the library: the library's still there, you can see the .so/.ddl file sitting separately on your computer, it hasn't been merged with your program and your program didn't modify it. Yet the FSF still claims it's a combined derivative work.
Am I misunderstanding something about the analogy?
Galoob is terrible for the FSF because it provides for a program that only exists to enhance another.
That doesn't fit into the dynamic linking absolutists worldview at all.
Ehh, I'm not sure it's fair to call the FSF dynamic linking absolutists. They only care about any of this because they've boxed themselves into a corner. They want to prevent people from writing proprietary wrappers around copyleft programs, but they don't want a license so restrictive that proprietary and copyleft programs are forbidden from interacting, and Freedom 0 means they can't explicitly prohibit a copyleft program from being used for suchandsuch purpose.
Not the kernel, but LGPL libraries do have relevant carveouts. And if you've ever heard RMS speak, he is extremely particular and does understand the nuances of all this.
As always, the solution is to contact their legal department, preferably via a lawyer. Engineers and support staff are not going to risk their jobs making legal decisions about giving away company property.
The FSF could help a lot here by publishing demand letter templates outlining the statutory and precedential basis for license enforcement and recovery of damages.
It is not company property.
But it's the company's legal department which would evaluate that claim. Because it's a legal claim. Licenses aren't magic spells, they're social agreements and non-executive employees don't want to get in trouble for making executive decisions.
That really depends. A company can still own the copyright to the code that they’ve written, even if it’s licensed with GPL. It’s an asset that is transferred if the company is sold, etc, so yes, it’s actually company property.
The GPL grants rights to use and distribute, but does not grant ownership. It’s not suddenly in the public domain.
Support staff or even engineers are not in a position to be making that call. It’s a legal department decision, even if it seems obvious to you.
This should be the most upvoted answer.
Yeah there are are startups where head guys don’t know that and developers jump the gun because they feel like they’re ones that have the best understanding of the issue at hand.
But of course that’s legal territory.
I agree that a front-line CSR or even engineer is not likely the right person, but surely then the responsible action is to redirect the request to the responsible department or person?
Absolutely, and companies that routinely get requests like this train customer service agents on specific trigger words like "license" or "GDPR" that must be redirected. Without that training, it's not obvious why "it's GPLv2 licensed" is more compelling than the last customer's argument that the device warranty obligates you to drop everything and immediately fix the minor UI bug they reported.
Derivative works are owned by those who create them. What copyright says you can do with them depends on the specifics, but the general case is true.
I get mad triggered by software license violation discussions.
Please for the love of all that the FSF thinks is holy - just file a damn lawsuit if you are telling me they are violating the law. State your claim and have a court sort it out.
It costs hundreds of dollars. For a medical device? Seems like a good deal.
The OP almost certainly isn’t a copyright holder for the Linux kernel. They probably would have said if they were.
The theory is being tested that you don't need to be a copyright holder to file a lawsuit https://sfconservancy.org/copyleft-compliance/vizio.html
Then why are they trying to enforce copyright/contract law without standing?
Making a blog post about someone elses copyright being violated is even more annoying to me.
Huh, they’re not. You’re the one saying they should.
What's their basis for sending the emails then? If not one of legal standing in copyright/contract law?
Edit: My point is this is just another one of many annoying people you have to deal with who will email you alleging all sorts of legal violations, who don't themselves understand anything about the claims they are making.
Basis? You mean reason?
They want the Linux kernel source code.
No, he means basis, not reason. There's a difference and I'm genuinely curious in your answer.
Sure, I understand that there's a difference. That's why I sought clarification.
My understanding of the concept of "basis" does not fit the context of sending an email, and "reason" is the closest I can find that fits.
Basis being concerned with rules or authority. The assumption being when asking "what is the basis for X?" that there was a bar that needed to be met beyond the doers motivations. That there needed to be more than they wanted to. Which of course, does not apply to sending an email. I could email you right now asking you what your favourite type of fish is or seeing if you want to play a game of chess, no basis needed. I'd just need a reason to.
That’s a very intricate and convoluted way of saying they have no basis for making a demand.
But sounds like we agree, they have no real basis for making a demand.
Poorly explained maybe but it covers not just that there is no basis but that no basis is needed and draws attention to the odd request for a basis where none is needed.
Just "there is no basis" as a response would be like saying "yes" or "no" to "have you stopped beating your wife?"
Aren’t we talking about enforcing/exercising a legal right?
Whether you have a reason to make a claim is much different than whether you have a legal basis for your claim.
We're talking about Lost-Entrepreneur439 on Reddit emailing a company to ask for some of their code.
You can just do that. No GPL, open source, enforcement, demands, etc language needed. Just "I'm trying to do X, can I see the code for Y?". I receive and send them at work pretty frequently.
They've mentioned the GPL as a way to try to increase the chances of getting sent the code. A support person for a medical device company might not know anything about software licences or linux or GPL. If the company has some sort of "send GPL code to askers" policy and Lost-Entrepreneur439 just asks for the linux kernel, the support person might not know that the GPL policy applies and just say no. If you include it in your message then it increases the chances of them typing "GPL" in to whatever internal knowledge bank they have and seeing "for GPL requests, forward the enquiry to jeff@ourcompany.com" or something like that.
The GPL isn't between Lost-Entrepreneur439 and the company so I don't think "enforcement/exercising a legal right" is an accurate way to describe what we're talking about. That would be if the copyright holders to the linux kernel get involved.
EDIT: Although that seems like largely just a semantics thing. Like if a judge orders a company to pay you some money and you say "give it to austhrow743" is it valid to say that I have a right to that money? Or is it that you have the right that I get that money? If someone wants to phrase "linux kernel copyright holders have a right to demand users of their code share it with anyone who asks" as "anyone who asks has a right to that code" then I don't really have a problem with that.
I just see a big difference between making a request and making a claim. I don't need to think I'm legally entitled to something to ask for it. I don't even need to think that getting it is likely. Whereas Abigail appears to be treating sending and receiving requests by emails as equivalent to a court summons.
And now we get to my question of why. They want the Linux source code, the company is not giving it to them, why is the next step a blog post instead of a lawsuit? Again this is a medical device - it's important enough to spend the money on.
They make a blog post about GPL violations which allege the company is violating the law.
I'm absolutely begging for anyone in a similar situation to prove it. The reasons those emails were sent is because they think they have a legal entitlement to be sent the source code. *PROVE IT*. It's cheap!
In what planet does a lawsuit cost hundreds of dollars?
$405
https://www.caed.uscourts.gov/caednew/index.cfm/attorney-inf...
I’ve personally never seen a lawsuit cost less than a few grand in legal fees even for small time bully defense.
This will probably dox me but I'm going to win a federal discrimination case against a university, with nothing but GPT5.x and Claude, and some filing fees. I'm no dummy but I'm not a genius. I barely got through the Advent of Code 2025 problems with a mess of spaghetti.
In my country people have a common law right to enforce the law themselves without having to pay legal fees. In America it's a statutory right I believe.
The risks of getting a costs order against me are higher than 0% but if I lose narrowly I won't be paying anything.
This is a fantasy. OK, well, if the intent is to waste time and lose a lawsuit, sure, a few hundred dollars will give you that experience. In the real world, no way. A single deposition can cost many times that figure.
You can choose to disagree, of course. My guess is that you have never done this and you have never been involved in a nontrivial legal dispute outside, perhaps, small claims court. You probably don't even own a nontrivial business. Not one person running a business would ever suggest a lawsuit could cost a few hundred dollars.
Like I said, in the real world things are different. I know people who have burned through over $50K in seemingly simple cases (one of them self-represented) only to bow out once they realized they only scratched the surface. In one case they went broke, had to sell their home to pay for the losses and move to a lower cost state just to survive. Tragic. And, BTW, they didn't lose the case. They just got to a point, tens of thousands of dollars later, where they simply had to drop it or face ending-up in a far worse situation.
When I was much younger (and really stupid as most young know-it-alls are) I decided to go after a company that owed me $100K in contractually agreed-upon consulting fees. They had already paid me over a million dollars over a couple of years, so this was not about a little $100K contract.
There was a change in management and they simply decided not to pay vendors. They did this as the simplest method (aside from laying people off) to improve financials. The new CEO and his wife also happened to own a law practice.
So, I hired an attorney (no way to do this on your own for $400). $11K later I finally understood that the balance of power was not in my favor. I may have won. It may have cost me somewhere around $75K to do so.
However, then the other reality would kick in: Collecting. Yup. Collecting was probably going to cost money and maybe even another lawsuit. Not to mention the time, measured in years, for the full experience. Not to mention the real potential of them filing for bankruptcy to gift me the experience of using my judgement as rough toilet paper.
In fact, that is precisely what they did about 18 months later to other vendors, who, like me, where chasing payment. They took a year to transfer all assets to a new corporation. When the original corporation had no assets whatsoever, the went ahead and filed BK and told everyone to go shove their judgements (if any).
I was actually glad that I only burned $12K to learn an important lesson: The legal path is only viable when you are talking about going up against an equal. Like anything, there are exceptions to this, however, in general, this is the way the real world works.
Still don't believe me? If you happen to be a budding entrepreneur looking for investors, do this: During your meeting, tell them that you are not concerned about lawsuits because they can be sorted with $405. Don't blink or you'll miss to witness just how quickly they leave the room. Really.
This one. That's what the filing fees are for a lawsuit like this. There's no rule saying you have to pay a lawyer to write a statement of claim.
Edit:
Courts deal with contract law disputes all the time. It's their bread and butter, everyday, nothing special stuff.
Edit2:
To you below, citation needed
Is that also what it costs when you lose and the court makes you pay their lawyer time?
Use the CCB then?
Edit: I'm somewhat mad that there's all these tools out there to solve the screeching about GPL violations and nobody seems to want to use them.
For reference for non Americans/non legal people:
> The Copyright Claims Board (CCB) is available to resolve copyright disputes of a relatively low economic value and provides an efficient, less expensive alternative to federal court.
https://ccb.gov/
Thank you, I should have provided that myself and been more courteous in my response.
>nobody seems to want to use them.
Basically everybody who knows enough to try, knows what the outcomes will tend to be.
If the only GPLed component used is the Linux kernel, you probably aren't entitled to any noteworthy source code. It's well established that using the kernel doesn't create a GPL requirement userspace software running on the same device, and the most likely arrangement here is a completely-uncustomized kernel paired with an open-source userspace program that does all the interesting bits.
Then it should be trivial for them to provide the source code.
It's trivial in terms that it will cost them nothing, because it's very likely there are no changes to the kernel, or nothing of value nor commercially-sensitive anyway.
It's not trivial in terms of big company bureaucracy - this request will have to go through so many levels of red tape that they (correctly) decided not complying to random people's requests is more profitable.
I'm sure if you actually sue them then they will comply right away, because at that point paying for some engineer's time to tar up the source tree and send it to you now becomes cheaper than lawyer time.
But their analysis is correct in that nobody will waste time/money suing to get what is effectively a stock kernel they can get from the official source anyway. Which is why these complaints are also a bit stupid - they're not asking for anything of value or using the GPL to advance software freedom by freeing up some valuable code, they're just wasting both theirs and others' time asking for something they can already download directly.
> because it's very likely there are no changes to the kernel
That is a gratuitous assumption. My experience is, as long as there is the smallest custom hardware, you will have to make some tweaks here and there.
> they're not asking for anything of value or using the GPL to advance software freedom by freeing up some valuable code, they're just wasting both theirs and others' time asking for something they can already download directly.
I'm sorry that the company which is making lots of money by using a copyrighted SW has to "waste" 200 dollars in some bureaucracy, printing and postage. But is the license of the SW they are using, and should abide by it.
> That is a gratuitous assumption. My experience is, as long as there is the smallest custom hardware, you will have to make some tweaks here and there.
How sure are you small tweaks create a derivative work? In your experience.
I’m not sure of anything. And that is irrelevant. Even if it is a coma, the license holds.
No the license does not hold! Fair use exists independently of the GPL license.
Using GPL software does not take away your rights under the law. As much as the angry FSF lawyers want you to believe - I can use any GPL software in any way I choose and have the affirmative defense of fair use for every single claim they throw at me.
Whether I lose or not depends on specific factors of my use - and I'm sorry but one comma isn't going to cut it.
Edit: A single comma will lose 100% of the time to a summary judgement via de minimis. That's just an incredible legal theory you have there and not something you should be spreading.
Edit2: The Beastie Boys famously won via de minimis at summary judgement for a 3 note sample. It matters not whether those 3 notes were GPL notes or not. It matters what the law is.
It also doesn’t apply to driver modules if you use gpl shim (eg nvidia drivers and many others) so i dont get why author thinks they violate anything
Let me guess. Omnipod. They've had some pretty bad recalls too. Never in a lifetime would I trust my well-being to their p.o.s. hardware / software combo. Apologies that person in this thread that worked there, but I hope you are working for a better company now.
Don't need to guess, the company name is mentioned in the second line of the linked posting.
My point is: they could have left it out. There are not that many manufacturers of insulin pumps and there is only one that the title could have conceivably applied to.
If they built the kernel directly from tree, just pointing out the correct https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... should be enough...
Since a company building it themselves hasn't gotten it in the form of a binary from someone else that they're just passing along to you and their use is commercial, they don't satisfy either condition of GPLv2 3(c), but they'd need to satisfy both in order to be able to exercise that option.
Oh well. The whole thing has already been reverse engineered. Look up Loop or Trio or OpenAPS. Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices. This isn’t really that big a deal. What we need right now is help REing the Omnipod 5
I’m aware of a few people working on REing the Omnipod 5. The furthest issue that I have seen is that when a PDM/Omnipod 5 app signs into your insulet id, it gets a private key from the API which is stored in the keychain (and uses SSL pinning to prevent MiTM retrieval of the private key). When pairing with the pod they exchange public keys and then a derived key from the devices private key+pods public keys, but haven’t been able to get a copy of a private key yet to make further progress.
Anyway to follow the progress? I attended the Nightscout conference and asked around regarding this but no one really knew of any group to follow. Or really knew of the latest developments on this effort.
I am not aware of any public groups to follow the progress, I have just met a few people on the Loop Zulip and have talked with them every few months whenever people have time to look into it.
I'm thinking we probably need to get more organized and start picking up the pace with this. There are rumors, which of course I am not sure how credible, but word is that the Dash will be discontinued soon. Maybe we can add another channel to the Zulip to try to get things moving.
Was going to ask the something. And also, so the omnipod app is not using android attestation but stores private key it got from omnipod server?
It seems to use the play integrity API when communicating with Insulet's servers which provide a private key to the PDM/app once it was registered with the user's account. However since the Pod doesn't have access to the internet, it has no way to check the play integrity signature AFAIK, so instead it checks that the certificate that the PDM/app presents to it is issued from the cert chain that it trusts.
Not all though, I've been looking at Minimed pump reverse engineering (which would be just reading glucose data, not controlling the pump), and that's not solved yet, at least not for the 780G. But I hope it will be, and perhaps I'll be able to contribute.
I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps.
The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.
> Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices
Absolutely not true, not any more.
No it's true. Companies like Insulet and Dexcom could send out lawsuits to all the open source projects out there that involved REing. Dexcom's glucose share API was REed years ago, and Dexcom hasn't even tried updating or stopping the use of unofficial APIs. All I'm saying is that the companies really don't care at all.
> The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.
May I ask where did you get this info? And what “newer” means here?
This person is referring to this guidance document: https://www.fda.gov/medical-devices/digital-health-center-ex...
I'm a medical device developer working on this exact problem (glucose control)
Thanks!
So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)?
Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"?
Kinda feels like that just screams data-stealing, regardless of where it was made.
Security… The PDM is walled off completely, it cant install apps, its not on wifi, you cant change any settings. The issue is that a PDM technically could easily kill you, by giving you a lethal dose of insulin.
Funny thing is that the newer Omnipod 5 from the same company works with regular phones now, but only in th US.
Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already.
So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just uses their phone.
This is kind of a regulatory quirk; basically from the FDA's point of view you had to have a complete standalone system, that did not include the phone, in order to be able to prescribe it. I think they do not require companion devices any more, it's OK to release something that requires the user to have a phone.
So essentially, it's like this?
"we plan on users having a phone to connect to it and use primarily. FDA requires a primary/backup. well it's already phone-controlled, go find a phone that works with it. needs to be cheap, cuz no one will really use it anyway"
That makes a little more sense. I was imagining the development process involving both devices, rather than one device first, then determining what the second would be later.
Thanks for the insight!
Its also for security.. outside the US, you still cant use a regular phone with the omnipod.
One thing is that you need to tell the insulin pump when you eat food so it can deliver insulin to cover the food. I bet that is a lot easier in an app than some separate controller device.
Insulin pumps are paired with glucose monitor. I bet it is handy to check glucose levels to make things are stable and correct if off.
I recall idly looking through the manual of our Bosch dishwasher when it was delivered and seeing that they offered to share GPL'ed source code from the machine's embedded guts. I thought to myself, "that's kind of interesting, I'll take them up on that". So I emailed the address they provided for this purpose. I got an auto email back saying, effectively, "No. You're not an authorised person, we don't recognise your email address, we don't know who you are, we're not going to talk to you."
Oh well. Big Corp doing what Big Corps do. Paying lip service to legal requirements, but reluctantly and with barriers that would no doubt take a lot of time and money to even try and break down.
I was troubled by my own comment. How exactly did Bosch handle this? I went back and checked and in fact the rejection email came from their email server, it was an "access denied" type email that I originally misinterpreted as a "you don't have access" type message leaving me annoyed but really I took away and remembered a wrong impression. Looking more carefully, the message doesn't mean anything subtle, it just means the email address (oss-request@bshg.com for the record) doesn't exist. Which is bad, but not nearly as bad as I portrayed it above. Apologies (for the record) to Bosch.
Why is this relevant for understanding how the IP works or even tweaking it? Whatever is relevant for that matter will most certainly not be a modification to the Linux kernel that the android system is running. It will not fall under the GPL that the kernel is licensed under. Can someone explain why this dispute is worth having beyond a theoretical legal debate on whether they should hand out the particular source tree from which their kernel was built (if they even built it)?
I'm sorry you didn't get a response yet. I'm not a lawyer and have no legal training but it seems to boil down to this:
It's part of the debate of whether (1) GPL is a contract, (2) GPL can be enforced by non-parties, (3) How Fair Use applies, (4) Methods to bully/shame companies to give up source code ...? (5) Who the actual parties involved are if the actual rights holder (Linux Kernel) tries to sue someone. (First Sale doctrine might apply).
Out of interest is there a process to petition the FSF to take up something like this?
How do they triage and decide what to pursue?
TL;DR: Not the FSF, but SFC; email compliance@sfconservancy.org
The dominant legal theory is that the GPL can only be enforced by the party holding the copyright. SFC's lawsuit against Vizio is strategically trying to establish precedent changing that; establishing that end-users are "third party beneficiaries" under the GPL, so others can enforce the GPL; but for now the copyright holder is the only one who can enforce it.
So the FSF could only take it up if the violation is on projects that do copyright-assignment to the FSF (i.e.: most GNU stuff). If you do find a violation of GNU stuff, the process is "email license-violation@gnu.org". I do not know what process Craig and Krzysztof use when triaging reports and deciding what to pursue.
Many Linux-kernel contributors (also, SFC member projects such as OpenWrt, Git, Qemu) have assigned their copyright to SFC or named SFC as their legal representative (also, SFC member projects; so SFC can take up something like this. Similarly, you can report violations to them by emailing compliance@sfconservancy.org (see https://sfconservancy.org/copyleft-compliance/help.html for more info).
Now, SFC is aware of more violations than they could ever possibly pursue, so they're strategic about pursuing ones that are high-impact. I'm not sure how they decide that. But I can say that medical devices are near-and-dear to them, between executive-director Karen Sandler's implanted defibrillator and policy-fellow Bradley Kühn's blood glucose monitor.
> Bradley Kühn's
I saw that spelling for the first time last week, I think.
Did he change his name? Has he always been Kühn, but went with Kuhn, because Umlaute are hard for Americans?
He changed his name.
https://fedi.copyleft.org/@bkuhn/115461658201124515
It shocks me how much comments, here in HACKER news, are something like:
"Why do you want the source code?! leave it alone! Don't touch it, is unsafe! Big Pharma companies know much better than you what they do!"
REALLY?! REALLY?!
I'm not saying, go changing the SW like crazy. Is clear it can kill you. But this "anybody who is not a mega pharma company is absolutely unable to do anything right, you will absolutely kill yourself if you look at the code" that is just... idk... so low.
It may be named hacker news, but boy, many people here are not remotely near what I would call a hacker...
"Agency is dangerous, please take away my(and by extension, everyone's) agency to hurt myself!" is a sentiment that's somehow gained a lot of traction everywhere. The People yearn for the accountability sink.
Copyright is only as good as your enforcement of it.
Seems like this company already understands enforcement is crap.
What a remarkable stalking horse to try and kneecap right-to-repair by arguing "Please, think of the chil^H^H^H^Hhackers!"
You wouldn't download a CAR, would you? You wouldn't hack your own INSULIN pump, would you?
Face it: If it's GPL and vulnerable to interference, responsibility is squarely on the manufacturer and the fastest death-free way to prove it. If it's GPL and modified by the owner, fuck off.
> This honestly disgusts me. GPL violations are already bad on their own, but on a medical device? That me, and thousands of people rely on to stay alive?
Disgusting is not respecting the producers who put together the device that wouldn’t exist otherwise, leaving thousands of people in pain or death.
Good luck trying to enforce the GPL against a Chinese company
Well it looks like insulet is the primary offender here, and Nuu (the Chinese company) is just the hardware manafacturer
An actual good use case for tariffs.
Not really.
You can tariff a single company.
Or you could just prevent the goods from being sold, rather than making the American tax payer foot the bill for that company's crime.
The normal response to a company importing illegal products is to seize them at the border, destroy them, and, optionally, send the importer a big fine. This is already an established process.
> importing illegal products
What's "illegal" about these products?
> send the importer a big fine.
And that gets paid?
> This is already an established process.
And has it ever been used for /civil/ software GPL violations?
[flagged]
Why would you come to that conclusion instead of the obvious one being that the kind of people to use Hacker News are the same kind to prefer old Reddit?
Some of us just prefer the old version, so when we copy the link from our URL bar it's to the old version.
No