Tag: legal

  • Hashicorp Versus OpenTofu Gets Ugly

    Hashicorp Versus OpenTofu Gets Ugly

    When HashiCorp dumped its open-source Mozilla license for the Business Source License (BSL 1.1) for its flagship program, infrastructure as code (IaC) tool Terraform, many Terraform developers and partners were ticked off. As open source developers are wont to do in such situations, they created a Terraform fork, called OpenTofu.

    So far, that’s business as usual when a company shifts a project away from open source. Things heated up, though, when the Linux Foundation announced it would support the new fork. Now, the conflict between HashiCorp and OpenTofu is starting to boil, as HashiCorp accused OpenTofu of “not respecting the terms of its BSL license governing its Terraform codebase.”

    Them’s fighting words!

    OpenTofu replied, “OpenTofu vehemently disagrees with any suggestion that it misappropriated, mis-sourced, or otherwise misused HashiCorp’s BSL code.” The organization added, “HashiCorp may be conflating code that it had previously been open-sourced under the MPL and more recently developed code it published under the BSL.” And, OpenTofu says, it will “issue a written response providing a more detailed explanation of its position.”

    So, what is this code in question? Neither Hashicorp nor Terraform is saying, quite yet. However, it appears to be a “removed block” automation process that enables Terraform to manage resource deletion.

    Matt Asay, MongoDB‘s VP of Developer Relations, revealed this accusation. He accused OpenTofu of lifting the “removed block” code, which was released under the BSL a few months after the OpenTofu fork was created. “The tell? OpenTofu took this BUSL-licensed HashiCorp code, removed the headers, and tried to instead relicense it under the Mozilla Public License (MPL 2.0),” Asay wrote.

    Oh, it’s on now.

    Even before news of the legally threatening message emerged, prominent open source leaders attacked Asay’s claim. Bryan Cantrill, the hyper-cloud Oxide Computer co-founder and CTO, claimed, “This is an extraordinarily serious accusation – and the cited files frankly don’t substantiate it.”

    Cantrill is far from alone in thinking that there is insufficient evidence to justify the accusation that OpenTofu has stolen any code. Until we have harder evidence, the issue will remain a case of “He said, she said.”

    Chris Aniszczyk, the CTO of the Cloud Native Computing Foundation (CNCF), a Linux Foundation-related organization, doesn’t think it’s a good look for HashiCorp. He said it’s “embarrassing to see a company light all of its hard-earned developer reputation on fire, on top of attacking open source.”

    Dan Lorenc, CEO and co-founder of Chainguard, a software supply chain security company, warns this could be the start of something big and ugly in software development circles. “I don’t have any philosophical or ethical issues with source-available licenses, but their proponents are going to have to address these cease-and-desist threats,” he wrote. “Developers working in OSS (OSI/FSF approved licenses) are going to be prevented from engaging with or even looking at source-available projects completely to prevent the risk of lawsuits. It’s just too risky to pretend otherwise.”

    Lorenc adds, “There’s no gradual transition here, it’s going to be a hard fork in communities if these lawsuit threats keep continuing. And I know which community I’d bet on sticking around.”

    I lived through the SCO-Linux copyright wars. I think I know who will win, too.

    Photo credit: Quino Al on Unsplash

  • Forking RHEL! Oracle and SUSE Join the Fight ¦ Silverman Sues AI Firms

    Forking RHEL! Oracle and SUSE Join the Fight ¦ Silverman Sues AI Firms

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: SUSE announces a Red Hat Enterprise Linux fork after Oracle said a similar thing, and Sarah Silverman says OpenAI and Meta have stolen her words. (more…)

  • IBM/Red Hat Sparks Anger at GPL ‘breach’ as RHEL Source Locked Up

    IBM/Red Hat Sparks Anger at GPL ‘breach’ as RHEL Source Locked Up

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Red Hat Enterprise Linux (RHEL) goes closed source. Well—no, not really; but IBM’s lawyers are accused of skating so close to the edge of legality that they risk violating the GNU Public License. (more…)

  • Oracle v. Google and Its Impact on APIs and Code

    Oracle v. Google and Its Impact on APIs and Code

    What, if any, impact will the Supreme Court’s rulings on Oracle v. Google have on the industry at large?

    TL/DR: It is unlikely to impact the vast majority of us, vendor and enterprise developer alike.

    Disclaimer: I am a technologist, not a lawyer. I have done some research, and talked to lawyers, but all that I say here is opinion—even my direct quotes of lawyers are their opinion. The Supreme Court can and has caught people off guard and taken cases in different directions than expected. Though I believe this path is the one it will follow, nothing is assured until the Court rules.

    Throughout this blog, references to The Case are actually using Harvard’s case document.

     

    Background

    On Nov. 15, the U.S. Supreme Court agreed to hear a dispute between Oracle and Google. The Oracle v. Google case has been going on for nearly a decade. And its roots go further back than that.

    The origins of the case go back to 2005, when Google and Sun Microsystems discussed the licensing of Java for Android. This will likely be important because it shows that Google knew it was someone else’s intellectual property (IP). More on this later.

    The crux of the case falls into three parts:

    1. Eight files that were decompiled and used. In one court case, these were found to never have made it into distribution and only used for testing (which limits liability).
    2. Two source files from Java used directly. These were found to be infringing, but damages were set to zero with consent of both legal teams.
    3. The part at issue: the copying of the entirety of Java’s interface from 37 modules. Most tech writers imply this as 37 APIs. It is not—it is hundreds of classes and thousands of methods. The 37 is the number of Java packages.

    The case has been through four court hearings/rulings so far. To sum up the relevant parts of these cases:

    1. The first case (split between a jury and district court, running at the same time) included patent violations. Those were defeated and Oracle has not appealed that defeat. On copyright infringement, the court found that Google did violate copyright on the 37 packages and the directly copied source code, but not on the eight decompiled files. The jury could not settle the issue of “fair use” of the 37 packages.
    2. The district court decided that the eight decompiled files and the copied source code for one function were violations, but remanded the rest back to the jury trial to settle the issue of fair use.
    3. In the end, the district court determined that APIs are not protected by copyright. Their decision involved two parts:
      1. That there is only one way to write a given API.
      2. The interface code and hierarchy can be replicated by third parties without violating copyright because it is an interface and not content.
    4. On appeal, the finding was reversed, and APIs were deemed copyrightable, sending the case back again.
    5. At this point, Google asked the U.S. Supreme Court to intervene. The court chose not to.
    6. Back at jury trial, the court found that while APIs may be copyrightable, Google’s use was fair use in the legal sense. This is the one topic the jury could not originally agree upon.
    7. Oracle appealed this decision, and the District Court ruled that it indeed was not fair use to copy the structure and exact interfaces.
      1. Where the jury and the district court appear to disagree is in the idea of APIs. Calling a publicly documented API is obviously fair use, and the jury latched onto that idea. The District Court appears to acknowledge the difference between calling an API and copying it.
    8. And after some tumultuous hearings and years in the court, the Supreme Court has agreed to weigh in on the issue.

    The real problem here is that copyright law is not a great fit for software. It never has been. If I rewrite your Java application in Python, using the same exact structure and naming, is that protected? All of the “words” have changed. It is akin to rewriting your Hindi book in English without a direct translation  … except that in software there is the added issue of it behaving exactly the same.

    But we can’t fix the misapplication of copyright law to software—only Congress can. So what to expect?

    A fair number of people, from the open source community and from businesses that see opportunity in a ruling that favors their world  view, are advocating that affording copyright protection to APIs is a horrible idea because it would hurt independent developers. This is not quite true. Independent developers are not generally copying Java. While this case does have bearing on coding practices and what developers can do, it does not have a huge impact on innovation, just on copying others’ work and how that is achieved—much like the “reverse engineering” court cases of the ’80s.

    There are good arguments on both sides of this case, but it seems to me that fair use will lose. They are public APIs in the sense that anyone can call them; indeed, some of these packages are so core to the system that you could argue every app must call them. But calling a function is not the same as re-creating it. In that sense, they are not in the public domain. Anyone can read a book, but that does not make it public domain.

    But no matter how this turns out, it is all good for the industry. This uncertainty has hung over the IT sector for nearly a decade. Just like when a new boss comes along and there is uncertainty in the department until everyone adjusts to the new demands/style of the boss, a solid ruling will allow settling to start. The industry can adapt once it knows what the rules are and we can move along.

    The real long-term answer is to have an equivalent to copyright and patent that is designed around the unique parts of computer code. Clearly, software is not the same beast as a book or magazine. The considerations are half-patent and half-copyright, and trying to bend those two to meet the needs of software has created some serious issues. Oracle quoted a 1995 case to showcase this problem—the company is quoting it to win the appeal, but it should be quoted as the reason the protections need to be designed for this medium that is not a publication and yet consists of words whose sequence matters: “Applying copyright law to computer programs is like assembling a jigsaw puzzle whose pieces do not quite fit.” (attributed by Oracle to the concurring opinion of J. Boudin in Lotus Dev. Corp. v. Borland Int’l, Inc., 1995).

    One interesting bit that the courts thus far have ignored, and I would love to see the Supreme Court take up, is this: If Google entered into licensing negotiations, the company knew it was Sun/Oracle’s IP. To then go and copy parts of it without licensing appears wrong on its face. It would be interesting to understand the process that ended in the copying and hear whether that bears upon the legal standing of the case. I can think of both malicious and innocent routes to get there; it would be interesting to hear testimony about motivations and thought processes.

    But even without delving into the licensing negotiations, this case stands to redefine copyright with regards to software. J. Michael Keyes, a partner at the international law firm Dorsey & Whitney, had this (and more) to say:

    “One of the issues that the court may decide is the scope of copyright protection for software. Google had early success below in convincing the trial judge that the snippets of copied code were not copyrightable. Google may urge to have the court take a look at this issue anew. Another huge implication is the scope of fair use. The jury found that Google’s use was “fair” and that it was not liable for infringement. The appellate court overturned that jury conclusion and found that Google’s use was not fair as a matter of law. The Supreme Court will likely wade into this thicket and provide guidance on the scope of fair use in the context of software code and what role an appellate court plays in reviewing jury decisions in that regard.”

    What we (all of us) do not want to do is confuse “good for the industry” with “legal standard.” It is not the court’s job to do what we think is best for the industry; it is the court’s job to determine applicable law and what that implies needs to happen. Presumably, the Supreme Court will do just that. And it may not please any of us. But if we think the current iteration of the law is flawed, that is something to take up with elected representatives, not ask a court to “fix” on the fly.

    For the vast majority of us, though, it impacts our development not at all. Using APIs or forking open source projects are all still perfectly acceptable, and no ruling by the Supreme Court is going to change that—because copying someone’s APIs is the issue here, not using them. And open source licenses allow for copying and improving projects. So carry on. Get the job done. And read about the Supreme Court’s final decision with a smile, because either way, the industry will adapt to the new normal and continue forward.

    — Don Macvittie

  • DevOps Institute Brandjacking: When Imitation is Not the Sincerest Form of Flattery

    DevOps Institute Brandjacking: When Imitation is Not the Sincerest Form of Flattery

    “There can be only one”    ~ Duncan McCloud, Highlander

    They say that imitation is the sincerest form of flattery. Often it is absolutely true. But stealing, ripping off and/or trying to trade on the name of others crosses the line between right and wrong, legal and illegal. As a co-founder of the true, one and only DevOps Institute, I was appalled to see the efforts of another company, whose name I won’t even dignify in this article, trying to launch “the DevOps Institute.”

    If you told me that this company perhaps did not know that there was already a DevOps Institute (it’s not like we hide it), I would say OK, maybe it was an honest mistake. But no. In this case, the company in question actually reached out to DevOps Institute—us—and had several conversations/interactions regarding becoming a registered education partner of the DOI. What the company reps were actually doing was fishing for information as they sought to launch their own version of DevOps Institute. So this is certainly not a case of an innocent mistake; rather, it’s a deliberate attempt to misappropriate the name, assets and hard work of another. Where I come from, the streets of NYC, we call it stealing.

    You have to ask yourself: Knowing what we know of the situation, why would these people commit such an unethical, illegal act? I can only come up with a few reasons:

    1. They are seeking to deceive and confuse the public by literally trading on DevOps Institute’s—our—good name to make a quick buck.
    2. They are part of those in the world who do not respect intellectual property, seeking to sell out the back door anything they get their hands on from the front door.
    3. They are unscrupulous thieves who are incapable of building a business by themselves.

    No matter whether one or all of the above, none of the reasons are very good.

    In generally acceptable business practices worldwide, there are more than several acceptable ways for companies to imitate the business strategy and models of others. More power to them—after all, competition makes us all up our game.

    In the DevOps education training and education space, there is certainly no shortage of competitors. Just do a Google search of DevOps Institute and look at the companies buying that ad word or otherwise using SEO to get listed. Lots of competitors, for sure. Remember, this isn’t even a generic “DevOps training” search, but actually searching for DevOps Institute.

    Taking another’s name crosses the acceptable boundary. So now we have to lawyer up to protect our rights and property. No one likes to throw good money at lawyers to go after bad actors. But protecting one’s brand, reputation and IP is that important.

    For those of you familiar with the DevOps Institute, you know that the team has worked hard for more than four years now to lead the way in curating content for bringing DevOps training, education and certification to the market. It hasn’t always been smooth sailing. When DevOps Institute launched, we faced strong headwinds from those who thought a training/certification program around DevOps was wrong. We listened, we learned, we set up the feedback loops and we iterated (like good DevOps should). We have won over many of our critics; they saw the good work we were doing.

    More than that, they saw DevOps Institute try to be stewards of and active participants in the DevOps community. We are not in this for the fast buck or the quick hustle. The executive team has plowed our revenue back into the company and community, expanding the association’s offerings and reaching out to DevOps communities throughout the world. Today, DevOps Institute has ambassadors in Europe, South America, AsiaPac and of course here in North America. We go wherever DevOps goes.

    Recently DevOps Institute has tried to build a greater DevOps community based on the Humans of DevOps and our SKILS framework (Skills, Knowledge Ideas and Learning). We have worked with the leading names in the DevOps industry to do research and help bring greater understanding of DevOps. We have sponsored and spoken at many of the DevOps events you have attended. In fact, I am satisfied to rest on our laurels.

    If you are not familiar with the real DevOps Institute (and that is at https://devopsinstitute.com, btw) check it out for yourself. We have nearly 200 partners around the world who deliver training for our certifications. We have a healthy global community and active engagement with industry thought leaders. We obviously are doing something right.

    Finally, I wanted to speak to my entrepreneur friends in the audience: Those of you know who know me, know that this isn’t my first rodeo. I have founded and helped several venture-backed startups through IPO and exit. I have had my share of wins and my share of losses. I am not one to whine or back down from some good competition, but this kind of shadiness has no place in the business world.

    We put a good chunk of our own blood, sweat and tears into our businesses, and for someone to swoop in and steal the fruits of our labor is just plain wrong. Brandjacking is stealing. I started this article off with the quote from “Highlander.” So if you see me walking around with a severed head or sword in my hand, remember: There can be only one.

    — Alan Shimel

  • How to Manage Risk, Regulation and Compliance Differently —and Better

    How to Manage Risk, Regulation and Compliance Differently —and Better

    During my career as a technology leader I have worked on PCI security, lawsuits, federal and state compliance, foreign market launches and acquisitions. All of these have regulatory, compliance and legal aspects to them, and over time I’ve come to realize we are bad at dealing with such things—really bad. At the heart of being so bad at this is something I call “binary risk management.” Binary risk management can, and often does, paralyze an organization.

    Binary Risk Management  is a failure to recognize the probability associated with a risk and treat all risks as if they are destined to happen. If there is no risk at all, proceed. If there is any risk, no matter how small the probability of its occurrence, halt!

    We have all heard something like this: “Legal says we have to replace all the images that have any text in them across our entire French site because you’re not allowed to have any English on a site in France.” I actually heard that. It turned out not to be the case, but that did not stop me from wasting quite a bit of time working on this project. I was scared. The fines were said to be “hefty” and legal said it, so it must be true. Right?

    I have wasted months on work that never had to be done. I have seen a CEO need to ask a compliance department’s permission for lower-level employees to have an informal social get-together. I’ve seen an acquisition almost fall apart because of a non-existent risk (the risk was similar to your chances of catching AIDS from a toilet seat). I have many stories and I’d love to hear some of yours in the comments section.

    In all these cases, the outcome of the risk materializing instead of the probability of it actually happening was the focal point of conversation. In some of these cases the probability of occurrence was, in fact, zero because the whole thing was misinterpreted to begin with,  so paralyzing are specters of lawsuits and fines.

    Here are a couple of rules of thumb—tenets, if you will—for dealing with regulatory, legal and compliance issues. These tenets safeguard against wasting time and money that could be better spent helping our customers and making my company more secure, compliant and safe.

    1. Examine the probability, speak of the probability: Examine the probability of each risk that is factored into a business decision. When speaking about a risk don’t just speak about outcomes, as if occurrence is presupposed. Speaking in probabilistic terms can help us reason more effectively about risk.
    2. Examine the outcome: Is the worst case really the worst case? Oftentimes things can be done in the event of a failure that soften the blow. If such mitigations are available, then the ultimate risk that should be considered is with this softened outcome, not the worst case. The wind may blow and the tightrope walker may fall, and then he will die. But wait—what if we put an air mattress at the bottom? Now the walk is not so risky. In business, we often assume and focus on the unmitigated worst case.
    3. Know the wording: Don’t just take for granted that “it is decreed that” you must do something. Read the law and regulation in question and know exactly what it says. You will be shocked how frequently the experts don’t do this because they are busy and overawed by perceived negative outcomes. Knowing the actual regulation can aid in finding an effective solution, not a broad CYA solution that hurts your company and customers.

    Legal and compliance teams often are not compensated on business outcomes, so, for them, choices on preventing risk can be either A: Take a risk, or B: Take no risk. They often choose B. Forcing a critical examination of the wording of regulations in question, an exact understanding of the consequences, how they can be softened and a real analysis of the probability of the outcome of an event can save your company a lot of money. The money saved can be directed to achieving better outcomes for your customers.

    I’d love to hear some of your examples of binary risk management. Please share in the comments.

    I’d also love to hear from those legal and compliance minds that do get it (I have met a few) on other techniques for being safe and effective while avoiding paralysis that comes of binary risk management.

    — Martin J. Logan

  • Why PR, Legal and HR Matter for Continuous Delivery

    Why PR, Legal and HR Matter for Continuous Delivery

    By most definitions, DevOps involves making developers and IT Ops teams work better together. But integrating other parts of an organization, such as legal and public relations, into DevOps is also important. Here’s why.

    DevOps has become popular because it helps to speed the delivery of software. The goal is to reach continuous delivery, which means code is changed, tested, staged and delivered to users on a (nearly) continuous basis.

    If you think only from a technical perspective, then getting to continuous delivery of software involves only technical people. Developers, IT Ops admins and software testers are all you need.

    DevOps in the Big Picture

    Yet, to deliver software continuously on a reliable basis, you need to think beyond just technical processes and personnel. Effective DevOps workflows have to involve all of the other parts of the organization that play a role in creating software, delivering it to users and maintaining it once it is in production.

    For example, PR teams need to be plugged into the software delivery chain so they know when new features are coming down the pipeline and can prepare to promote them. Legal professionals should play a role as well, since they’ll know when code changes require tweaks to licensing, compliance procedures and so on.

    The list can go on. In most organizations, human resources has a role to play in DevOps, since personnel changes can affect the continuous delivery chain. Supply chain managers should be involved, too, since they have a hand in provisioning the infrastructure on which DevOps teams rely.

    To be sure, these various non-technical teams don’t need to be as plugged into the DevOps workflow as deeply developers and admins do. Code can be written and tested without their perpetual involvement. Still, at a minimum, all parts of the organization should at least be aware of the state of the delivery chain. Otherwise, visibility and communication break down.

    Taking this big-picture approach to DevOps is important because ultimately, despite the relatively narrow purview implied by the term DevOps itself, the value of DevOps lies in adding efficiency and promoting better communication across the entire organization in ways that optimize software delivery.

    So, if you want to make the most of DevOps, start thinking beyond just Dev and Ops.

    — Chris Tozzi