Asahi Linux Drops MIT and Goes Full GPL After Spotting LLM-Assisted License Laundering (itsfoss.com) 184
It's FOSS reports:
Asahi Linux is the reason you can run Linux on an Apple Silicon Mac today. For years, the project put most of its own code under the MIT license so that anyone, including the BSDs, could reuse it as needed... They have announced that Asahi is moving all of its repositories to the GNU General Public License version 2 or later. Going forward, all Asahi Linux code will be under strong copyleft licenses only.
Asahi Linux compares their dilemma to the 1990s, when "permissively licenced projects were viewed by tech companies as free real estate to pilfer and exploit," adding that "Those who do not learn from history are doomed to repeat it... The malicious practices of the 90s and 2000s have reared their ugly heads once again, this time driven in large part by both the insatiable appetite of frontier AI labs for high-quality training data, and militant animosity toward the Free Software community." In short, they argue that for Asahi Linux, using the permissive MIT license "is no longer viable." Some time ago, we were made aware of multiple attempts to exploit our permissive licensing to hijack our work, with a direct view to replacing the project and aggressively monetising Linux on Apple Silicon. In some extreme cases, in-development feature code was being lifted straight out of our personal forks and published without attribution or lazily rewritten with LLM assistance to obfuscate its origin. The MIT licence explicitly allows this, and has no carveouts to protect against bad faith actors. As such, we made the difficult decision to begin the process of transitioning all of our repositories to the GNU General Public License version 2 or later. Going forward all Asahi Linux code will be licenced under strong copyleft licences only.
It's FOSS explains that "Under the GPL, anyone who distributes a modified version has to release the source under the same license. You can't legally build a closed, paid Apple Silicon distro on top of GPL code. And if a product's source has to be public, the copying is easier to spot."
And their article also points out that before AI, bad actors attempting code laundering "usually meant manually rewriting code line by line, renaming variables and stuff, and shuffling functions around until it no longer looked like the original. LLMs made it much more easy and cheaper of course." In case you did not know, Asahi Linux forbids AI generated code contribution... As far as I can tell, this is the first time a major open source project has moved to copyleft specifically because of AI-assisted code laundering. Projects have relicensed before, but usually to stop cloud providers from reselling their work as a service. This one is specifically about AI...
The move has drawn criticism, particularly from the BSD side, which was one of the main reasons Asahi chose MIT in the first place. OpenBSD's Apple Silicon support relies on Asahi's m1n1 bootloader.
Asahi Linux compares their dilemma to the 1990s, when "permissively licenced projects were viewed by tech companies as free real estate to pilfer and exploit," adding that "Those who do not learn from history are doomed to repeat it... The malicious practices of the 90s and 2000s have reared their ugly heads once again, this time driven in large part by both the insatiable appetite of frontier AI labs for high-quality training data, and militant animosity toward the Free Software community." In short, they argue that for Asahi Linux, using the permissive MIT license "is no longer viable." Some time ago, we were made aware of multiple attempts to exploit our permissive licensing to hijack our work, with a direct view to replacing the project and aggressively monetising Linux on Apple Silicon. In some extreme cases, in-development feature code was being lifted straight out of our personal forks and published without attribution or lazily rewritten with LLM assistance to obfuscate its origin. The MIT licence explicitly allows this, and has no carveouts to protect against bad faith actors. As such, we made the difficult decision to begin the process of transitioning all of our repositories to the GNU General Public License version 2 or later. Going forward all Asahi Linux code will be licenced under strong copyleft licences only.
It's FOSS explains that "Under the GPL, anyone who distributes a modified version has to release the source under the same license. You can't legally build a closed, paid Apple Silicon distro on top of GPL code. And if a product's source has to be public, the copying is easier to spot."
And their article also points out that before AI, bad actors attempting code laundering "usually meant manually rewriting code line by line, renaming variables and stuff, and shuffling functions around until it no longer looked like the original. LLMs made it much more easy and cheaper of course." In case you did not know, Asahi Linux forbids AI generated code contribution... As far as I can tell, this is the first time a major open source project has moved to copyleft specifically because of AI-assisted code laundering. Projects have relicensed before, but usually to stop cloud providers from reselling their work as a service. This one is specifically about AI...
The move has drawn criticism, particularly from the BSD side, which was one of the main reasons Asahi chose MIT in the first place. OpenBSD's Apple Silicon support relies on Asahi's m1n1 bootloader.
Uhh... Cool? (Score:4, Informative)
The license can be legally worked around:
1. Have one AI agent document the code fully by explaining how it works in plain english
2. Copy that new documentation to an entirely segregated second agent
3. Instruct the new agent to write brand new code according to the documentation
It's unlikely this will be done for all OSS projects since the result usually has bugs and inconsistencies. But spend a week or two doing passes over it for improvement and you get a functional reimplementation. (What license that can use will depend on how the law around AI code shakes out in the future)
Re:Uhh... Cool? (Score:5, Insightful)
Re:Uhh... Cool? (Score:4, Insightful)
I would say as soon as even one line of the original code was in the training data, this becomes a copyright violation. "Clean room" means nothing of the inner workings of the original besides the spec ever made it to the implementation team. And you have to be able to prove that.
Re:Uhh... Cool? (Score:4)
First off, you can always just use a LLM with an open training dataset (OLMo, Pythia, etc) to prove that the data isn't in it, and have that handle the "clean" side of the equation.
Secondly, you are under the mistaken impression that a LLM that has been exposed (which, BTW, does not mean "memorized", or even any rough understandings of the workings - ask the LLM (ideally an abliterated one to avoid refusals) to reproduce the original code verbatim, it'll almost certainly fail badly) automatically fails in such a suit. It does not. There is no such thing as "homeopathic copyright contamination". Copyvio requires substantial similarity. LLMs will tend to have common algos memorized, but those are the very things that tend to be simultaneously not copyrightable.
The cleanroom is an evidentiary shield, not a pillar of copyright law. If you can prove that the cleanroom team had no access to the original, then you can prove that they didn't copy it, and potentially get summary judgement. If you can't prove that, that doesn't mean that it's not copyvio, it just means that you instead have to focus on substantial-similarity defenses. Access without substantial similiarity is not copyvio. If you read an open-source codebase, close it, and then later write a new program purely on your own that looks nothing like the original, you had "access", but still did not infringe. The same applies to LLMs - but even moreso, because humans are much better at learning from brief, limited exposures to content than LLMs are. A court will usually apply an "Abstraction-Filtration-Comparison" test - they break the code down into layers (source code, parameters, architecture, algos, etc) (abstraction), remove everything that copyright law does not protect (ideas and common algos, things where there's only a limited number of ways to possibly do it, etc) (filtration), and then compare the creative expression that remains to see if there exists sufficient similarity to count as infringement. It is highly unlikely that a LLM-implemented version will fail that.
(That said, you're talking about a long, expensive legal battle if you get to that point, so you obviously prefer to be able to get summary judgement if you can)
Re: (Score:3)
Oh, also, as pointed out further downthread [slashdot.org], any LLM with a training cutoff before the license change date is pretty much assured to be okay for use in a cleanroom implementation. Copyright holders cannot make retroactive copyright changes, and open source licenses generally explicitly grant rights in perpetuity anyway. The threat would be new code. But since the cleanroom side has never seen that new code (it was released after the training date), it remains untainted. And training cutoffs generally lag
Re: Uhh... Cool? (Score:2, Flamebait)
"There is no such thing as "homeopathic copyright contamination". Copyvio requires substantial similarity."
Lolol "copyvio" go hack a Gibson.
Re: (Score:2)
I'm sorry if shorthand offends your sensibilities. Should I spell out all shorthand for you? Maybe make sure I only use emdashes instead of "-" while I'm at it?
Re: (Score:2, Flamebait)
Shorthand should be something that other people actually use, and save significant space, not just be something you made up because you think it makes you look cool. It not only does the exact opposite, it actually makes the text less readable. It's no different from the hipsters who put their text in tt because it looks old timey.
Re: Uhh... Cool? (Score:4)
Okay Felicia. [google.com]
TL/DR: "copyvio" is the Wikipedia-standard shorthand for copyright violation, used both in direct speech and in official templates. If a person says "copyvio", they've probably spent a lot of time hanging out at Wikipedia, where copyright violation is a frequent topic of discussion.
Re: (Score:2)
Judges aren't drunks, though. Usually.
Not even the lawyers are that drunk. At least, on the day of the hearing. Well, at the time of the hearing, at least.
Re: (Score:2)
You don't even need to do that, because LLMs don't store the code even if trained on it. There is no way to determine if the code was part of the initial training process, or at least it would be extremely difficult and would involve much more than just grepping the LLM for the code. Even if they could prove it was it would not really matter anymore than trying to claim that a stud
Re: (Score:3)
There is an effect called "memorization" in LLMs. It is enough to cause copyright violation. There are currently several decisions by German courts with a respective finding.
Re: (Score:2)
I won't speak about what laws Germany might have, as I am concerned only about US law. As far as memorization, if they used the actual repo in the training set the issue would need to be looked at more closely, but the likelihood a code snippet makes it into the output is still close to 0. At the end of the day the litigant would have to prove that happened. It isn't necessary for the defendant to prove that it didn't.
Re: (Score:3)
It is open source so obviously everyone "has access to it." They would need to prove that the LLM actually *did* access it in the process of development (by the second instance.) There are a couple of things to keep in mind here. First, a model isn't the same thing as a running instance. The second is that a clean room operation has 3 teams, not 2. One running instance looks at the code and generates the spec. A second running instance writes the code. A third running instance, the judge, is allowed to look
Re: (Score:3)
You said:
Furthermore "I don't recall" is never perjury because you can't prove that they do recall.
That is absolutely and completely false.
Further, you don't understand how a subpoena works.
I do, because I receive them regularly.
I have never had to go to court for one.
They issue a subpoena asking for data, and I either give it to them, or say I don't have it.
What is critical here- is that my response is under oath. If I lie in that response, I am guilty of perjury.
Anthropic knows exactly what data went into each one of its models (as does every model trainer).
I've
Re: (Score:2)
Note that since free software projects with compatible licenses can share code freely, simply not finding that source amongst an enumeration of the sources is not going to be enough to prove none of the code was there. If all of the training data was explicitly provided with authorisation from the writers to feed it to a LLM and
Re: (Score:2)
You have the workings of the law backwards. The litigant is the one who has to do the proving. The defendant doesn't have to prove they didn't access it, because that is called "proving a negative" which is impossible. This is why they don't arrest someone for murder and start the trial with "OK, defendant, prove you didn't commit the murder or we are going to execute you for murder." If they want to sue for infringement then they have to prove that the LLM instance running the code accessed the codebase. W
Re: (Score:3)
Sometimes you do have to prove your innocence, because you invoked a strong defense that is only available if you can prove it.
In civil law, the preponderance of evidence wins. If I accuse you of being a poopy-pants, and your only defense is something you would have to prove (self defense, etc), and you fail to prove it, then I already won. That's why lawyers say things like, "My client did not kill that man, and even if he did, he had a permissible reason!" It sounds stupid if you don't understand the law.
Re: (Score:2)
"You neither understand the law or the technology. I hope they do "accuse my LLM of containing the data" since a single grep of the LLM will prove that it does not contain the codebase. Off you go now ...
Re: (Score:2)
It is in no way that simple. And, specifically, if the defendant used technology that makes proving they violated the law very hard or impossible, things get much more complex. You can even get a complete inversion of the burden of proof.
You mistake the law for a formal system. It is not. But people like you have tried to do the "perfect crime" for a long time. ProTip: Usually backfires.
Re: (Score:3)
I seem to recall that some Linux devs were worried about that when the Windows source code leaked. Maybe it was people working on SAMBA or WINE. They wanted to avoid seeing it because it might make the liable for infringement, even if they wrote their own code from scratch.
Re: (Score:3)
Yes. What essentially happens is that if the accusation becomes plausible and likely enough, you are required to prove innocence. Civil law is much more flexible here than criminal law. But a lot of people do not understand that and mistake the law (and especially civil law) for some form of absolute formal rule system. It really is not.
Re: (Score:2)
I'm not sure what the terminology is for the US, but in the UK we have two different standards of proof described thus:
Criminal law - beyond a reasonable doubt
Civil law - on the balance of probabilities
In practice some very questionable criminal convictions have been made on flimsy evidence. For civil law it tends to depend on the mood of the judge on the day, unfortunately, but is in theory whoever can exceed 50% probability will prevail.
Re: (Score:2)
Clean room reverse engineering is impossible with an LLM if it has ever seen the input data.
I leave proving whether it has or hasn't as a job for the lawyers.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Legal arguments that involve *waves hands* "uhhh, it's just different." don't usually hold up very well.
Re: (Score:2)
Re: (Score:2)
Except where "waves hands" is actually "cites SCOTUS precedent." As here.
You clearly didn't understand the argument the adults are having. Maybe you should sit this one out?
Re: (Score:2)
How does that differ from a human that worked on any licensed code and learned from it?
The human can testify that they did not ever read the code, and so could not have learned from it.
When doing a clean-room implementation, you intentionally recruit people without exposure to the original.
An LLM is not a person, and cannot testify. That puts the person using it at a substantial disadvantage in providing evidence is support of a clean-room defense.
Re: (Score:3)
No, not just clean room implementations of that code. By your logic, you can not ever work on any other project, because your knowledge of the original copyrighted work will taint the new project with its license. If I learn about a technique for organising multithreading while working on one project, and then apply something kinda vaguely similar at any point in the future, by your reasoning, I am now violating the original project's copyright.
Re: (Score:2)
That would not matter if they start with the version where MIT was still the license. This GPL license change is a childish move to block Omarchy and other projects that allow AI generated from using their code goiing forwards. Nothing to do with the frontier labs, this is just silly power play and job security.
Re: (Score:2)
The hilarious part is that the GPL version is a derivative of the MIT version, and might reasonably also fail going forwards if they ever accepted code from people who didn't sign the new license.
And if the code is insular enough to have all contributors on board for a license change, it's probably insignificant anyway. It's just a distro, how much new code would they even have?
Re: (Score:3)
What the GP described is known as a cleanroom implementation, and it's perfectly legal, and has been done many times in ways that have been upheld by the courts. The dividing line, by and large, is that the documentation has to be flexible enough that there's multiple potential ways it could be implemented, that you're not just transforming a code flow into "text pseudocode" and back. It doesn't matter if, by chance, it looks like the original - only that there were multiple means by which it could have b
Re:Uhh... Cool? (Score:4, Interesting)
The stupid little legal ritual you propose makes less and less sense as something that could become the accepted status quo when you realize it works just as well if a little more laboriously if the first step is done over a decompile of the software, perhaps in combination of letting the LLM just eat the documentation or perhaps experiment with the software in the process. Works with electronics to a pretty good degree, too.
We're sooner or later gonna have to deal with the fact that a LLM can just make a functioning (not necessarily good) copy of any software, open source or not. And if the legal precedent that this is a fair game holds, it's gonna be the inevitable death of Autodesk and Adobe and in the long long run, probably Microsoft and Oracle.
I personally could live with open source becoming a little more annoying if that's the cost of death of the whole current commercial software, particularly SaaS ecosystem, but I feel like the legal winds of what's derivative and what's protected intellectual property will still very well change, before all the behemoths bleed to death.
Re: (Score:2)
I don't really get why the open source guys would complain about this situtaion either. The entire *goal* of the open source movement was that I as a user ought to be able to take the software that I own, modify it, do what I like to it, fit it to my needs, make it work for me etc.
AI seems like a pretty massive step forward in getting there.
Re: Uhh... Cool? (Score:2)
Because the AI is claimed to be washing away copyrights. It's creating code that cannot be copyrighted and therefore can be closed and hidden away and the benefits go to the corporations. Then you have to reverse engineer it again to benefit from it.
If it can wash away copyrights then it's stealing.
If it can't then it's still stealing.
Re: (Score:2)
These days, in most cases a binary isn't even provided, you only get a cloud service. So even under "free software" principles you're entitled to no control at all over the cloud service's code.
Re: (Score:2)
These days, in most cases a binary isn't even provided, you only get a cloud service. So even under "free software" principles you're entitled to no control at all over the cloud service's code.
That's what the AGPL [gnu.org] is for.
I keep hearing this but (Score:5, Insightful)
The license can be legally worked around:
1. Have one AI agent document the code fully by explaining how it works in plain english 2. Copy that new documentation to an entirely segregated second agent 3. Instruct the new agent to write brand new code according to the documentation
It's unlikely this will be done for all OSS projects since the result usually has bugs and inconsistencies. But spend a week or two doing passes over it for improvement and you get a functional reimplementation. (What license that can use will depend on how the law around AI code shakes out in the future)
I keep hearing this but... if the AI was already trained on the code I don't think this set of steps makes any sense. It isn't clean room regardless. If you remove the guardrails of whatever model you are using, I'm pretty sure you can get literal quotes of open source projects. Its all garbage all the way down enabled by the government allowing rapid IP infringement.
Re: (Score:2)
I keep hearing this but... if the AI was already trained on the code I don't think this set of steps makes any sense. It isn't clean room regardless. If you remove the guardrails of whatever model you are using, I'm pretty sure you can get literal quotes of open source projects. Its all garbage all the way down enabled by the government allowing rapid IP infringement.
Yes. The training data would also need to be provably clean. With regular clean-room, you also need to prove the implementer-side does not know the sources. THis is probably done by them stating it under oath.
Re: (Score:3)
1. The burden of proof lies on the one making an accusation of copyright violation, not on the one defending it, so no vibe coder has to prove anything to you, YOU're the one having to prove things. Got access to Anthropic's training data set? Yeah, didn't think so. BTW, variations of "everyone knows", "you can't prove otherwise", etc. are not proof of anything.
Incorrect, in the context you're using.
While it's true that the plaintiff must prove that copying happened- that's absolutely trivial, and flatly undeniable. Anthropic would be subpoenaed for their data set, and they would provide it, and since your code was on $theInternet, it was part of the training corpus. No sane person would even try to argue that copying hadn't happened.
This brings us to your fair use rights.
Your fair use right to create a sufficiently transformative work are an affirmative defens
Re: (Score:3)
1. Okay, lets assume you're right. Defendant is simply going to go "okay, well, we did some simple performance testing on A and B. A's algorithmic complexity came out to scale as n^1.89, while B's scales as n^1.16. Different algorithmic complexities can exist only where different algorithms are used, ergo, these use different algorithms, ergo, they haven't stolen the code." There's going to be a whole succession of this kind of thing that a court is going to look at and go "look, the code looks complet
Re: (Score:2)
So you think if I take an algorithm you wrote, add a loop to the end of it, I haven't stolen your code?
2: No shit.
See: "And here is where the argument actually rotates, and in this respect, you're probably correct."
This is 2 dumb posts from you, now.
Re: (Score:2)
The burden of proof is never on the defendant. That is the definition of how are legal system works. The litigant / prosecution must always prove their case, because you can't prove a negative. You also don't understand how LLM training works. The LLM doesn't copy the code in any way during training.
Re: (Score:2)
The LLM doesn't copy the code in any way during training.
That doesn't matter. The code is used in creating the LLM, and the LLM is used in creating the work, and the standard for a derivative work is whether it contains substantial recognizable elements. Exactly how that applies to LLM output hasn't been determined yet. Therefore there remains a risk that original copyrights will be held to apply to LLM output. The LLM itself might even be considered to be part of the work, and vice versa.
Re: (Score:2)
Actually it does matter, because I made that statement to specifically counter the original misunderstanding where it was asserted that it does, specifically "No sane person would even try to argue that copying hadn't happened." I agree with you that how any of this applies hasn't been determined yet. That is kind of the whole point of this article, isn't it? I will take it a step further and say we don't know if any of this applies since it is new ground. All of the laws we have now assume that only hum
Re: (Score:2)
Incorrect on several fronts. First, you do not understand how the legal system works, especially for civil law. And second, there is an effect called "memorization" where the LLM does copy part of its training data. It is enough to trigger copyright violation, or at least several German courts think so.
Re: I keep hearing this but (Score:2)
Re: (Score:2)
Got access to Anthropic's training data set?
Bring a case and get a subpoena. Easy peasy, and coming to some courtroom eventually. My bet is on Adobe. Adobe has thousands of patents in various states of pending or active. All of the LLM generated clones are probably stepping on multiple patents, and the LLMs have hovered up those patents in training data. No need to have even seen proprietary code to get caught up in the IP thicket: the purveyor of infringing work will naturally deny any knowledge and point the finger at the LLM. The kill shot w
Re: (Score:2)
Isn't the documentation generated in step 1 subject to GPL? If not, why not?
Re: (Score:3)
Because merely describing what something does is not the same as copying its source. Importantly, your description must say things like "the list must be sorted by the identity of the objects", not "use mergesort on the UUIDs of the objects"
Re:Uhh... Cool? (Score:4, Interesting)
It is not clear whether that will continue to work. Copyright is specifically there to prevent things like that from happening. This legal loophole exists for several reasons and one is that this process used to be high-effort. It is quite possible copyright will be adjusted to prevent this approach. Also, remembering some of the code lawsuits, if the AI was trained on even one line of original code from the project, this goes completely out the window. And that may be happening even by accident.
Re: (Score:3)
Copyright doesn't remotely concern itself with effort. The clean-room approach approach fundamentally exists because Copyright defends an expression and not an underlying idea. If a functionality is re-created, even perfectly 1-1 without knowledge of the original expression it is a unique creation. This concept was fundamental in the creation of the IBM clone.
The question on whether this is legally valid rests on whether a LLM can be considered to be independent on account of having potentially be trained o
Re: (Score:2)
it'll be incredibly difficult to prove what was or wasn't in a frontier model's training set.
If the Courts decide to do their job then either the evidence is clear via the discovery process, or else you spoiled the evidence and the inference that advantages your opponent will be presumed.
Re: (Score:2)
I guess you have never heard of conditions that cause inversion of the burden of proof....
Re: (Score:2)
I suppose you could use a good, and not clean model to create a very, very, very good spec of what it saw, and then try to use a shitty model that wasn't trained on $theEntireFuckingInternet to do the reimplementation... bu
Re: (Score:2)
I've gotten modded down in the past for explaining this in depth, so I'll leave it at: that isn't how LLM weights work at all, and it invalidates your argument.
Re: (Score:2)
You were apparently modded down correctly.
If you were trying to argue that LLMs are not designed to store tokens verbatim as they're trained- you'd have been right, but that isn't relevant to the clean-room procedure.
Pre-training does one thing, and one thing only- it uses backpropagation to adjust the weights to be able to autocomplete a batch of tokens.
This is, by design, lossy- with neural drop-out and maximum learning rate (maximum amount the weights can be nudged to autocomplete correct
Re: (Score:2)
If I had mod points I'd make sure to down-vote something or other that you said, because you're not supposed to protest moderations. It violates the slashdot social contract. See also: Get Off My Lawn.
Except that, grandpa, you must have spilled your meds. It's the only explanation. You're old enough to know better.
Re: (Score:2)
I don't think this is true. Generally court rulings on whether AI output is infringing have centred around whether the output looks like the copyrighted material, and have generally ignored whether the copyrighted material was included in the training data.
If the AI produces code that looks fundamentally the same as the original. It uses the same algorithms, the same structures, has the same performance characterestics, many of the same bugs etc, then you've almost certainly infringed copyright.
If the AI
Re: (Score:2)
I don't think this is true.
It is.
Generally court rulings on whether AI output is infringing have centred around whether the output looks like the copyrighted material, and have generally ignored whether the copyrighted material was included in the training data.
This is correct.
This comment makes me think you don't know what a clean-room reverse engineering of something is.
If the AI produces code that looks fundamentally the same as the original. It uses the same algorithms, the same structures, has the same performance characterestics, many of the same bugs etc, then you've almost certainly infringed copyright.
This comment makes me think you don't know what a clean-room reverse engineering of something is.
If the AI produces code that looks fundamentally different. It uses different algorithms, different acceleration structures, has different performance characteristics, has new and exciting bugs, but implements the same functionality, then you've almost certainly not infringed copyright
This makes me think you don't know what a clean-room reverse engineering of something is.
Re: (Score:3)
A clean-room implementation of something is when you take thing A and reproduce thing B, where externally- you can't see any real difference in them. A =~ B.
i.e., they're, at first approximation, a copyright infringement.
The clean room is created to guarantee- to shut down- any possible claim of copyright infringement.
Even if that code looks identical as fuck, the clean team never saw it, and it simply can't be.
The doctrine arose from the cloning of the original P
Re:Uhh... Cool? (Score:4)
Not quite.
A and B in this case are both black boxes. The way clean room protocol works is to gaurentee that the surfaces of A and B are identical. Everything you can see, looks exactly the same. If however, you open up the boxes, you will very likely find entirely different contents that just happen to produce the same surface behaviour. If you were to clean room something, and produce identical A and B - i.e. not only is the behaviour exactly the same, but the code is exactly the same too, you would *very* likely find a court taking an extremely sceptical view of the idea that your clean room was in any way clean. That is, you'd still get found liable for the copyright infringement.
The purpose of the clean room is not merely to provide plausible deniability, it is to provide *actual* deniability. The thing you plead to the judge is not "Your Honor, we didn't look at the code, we pinky promise", it is "Your Honor, this can't be copyright infringement, look, the implementations are entirely different." The implementations necessarily will be different because without the system being trivially simple to the point of uncopyrightability, there are so many different ways to implement the same behaviour, that the chance of selecting the exact same one will be basically 0.
Re: (Score:2)
If however, you open up the boxes, you will very likely find entirely different contents that just happen to produce the same surface behaviour.
Completely incorrect.
That functionally negates the need for a clean room.
The purpose of the clean room is not merely to provide plausible deniability, it is to provide *actual* deniability.
Dude, did you even fucking read? "A clean-room implementation isn't to circumvent copyright- it's to prove that you didn't."
Are you just fucking meat proxying ChatGPT to me?
Re: (Score:2)
Did you consider the most likely case: That you're both idiots, you're both ignorant of legal precedent, and you're both RONG
Re: (Score:2)
Since it is phenomenally unlikely that the LLM was trained on this data this really isn't much of a problem. Why do you think it is likely, with all the data available, that it is likely that they specifically used this repo? Let's say it turns out, though is is extremely unlikely, that they did? So what? The LLM would then be like a college student who browsed a bunch
Re: (Score:3)
But wait, a document describing in enough detail how the original code works is a derived work of the original.
A copy of that document to another machine is clearly also a derived work.
Writing new code from that document is a derived work of the document which is a derived work of the original code.
Now, derived works are not allowed by copyright unless one has license.
Re: (Score:3)
You are exercising your fair use rights to convert the work into ideas (the dirty team), and transmitting those ideas (through a filter that ensure nothing copyrightable made it through) for re-implementation by a clean team, which has not seen the source, or talked to the dirty team, and thus cannot possibly be polluting the ideas with copyrightable material.
Re: Uhh... Cool? (Score:2)
Re: (Score:3)
Note that this all is around the Compaq BIOS case, and a part that keeps getting glossed over is the finding that the part being protected, the ABI interface, was not substantial enough for protection.
Software that is more substantial beyond just ABI/API is likely to be considered differently.
Note if it documents the full code body and translates that back into code, that may be treated differently. The BIOS documentation covering inputs and outputs, but not how those things are processed are one thing, bu
MIT vs GPL (Score:5, Informative)
If you want companies to give back if they use your code, then use GPL. If you want to dual license, then use GPL.
Both licenses are good, just use the right tool for the goal.
Re: (Score:3)
The assumption that code will be more widely used if it's MIT licensed could at best be called wishful thinking, but is actually self delusion to justify irrational behavior. As MIT licenses provide no incentive to contribute back, your code is not going to attract as many contributors and thus become stale and less useful than copyleft licensed code. The success of MIT licensed code depends entirely on people who are willing to exhaust themselves to further other people's agenda. There is a plentiful suppl
Re: (Score:2)
But also, companies do avoid using code that is GPL'ed.
Re:MIT vs GPL (Score:5, Insightful)
The assumption that code will be more widely used if it's MIT licensed could at best be called wishful thinking, but is actually self delusion to justify irrational behavior. As MIT licenses provide no incentive to contribute back, your code is not going to attract as many contributors and thus become stale and less useful than copyleft licensed code.
Not really. MIT licenses might not give an incentive to contribute back, but most larger companies that use MIT-licensed code do, in fact, contribute back. By contrast, GPL v3 is so toxic that with the sole exception of my first tech employer (which was a Linux distro), no company I've ever worked at will touch it with a ten-meter pole.
Moreover, the GPL does not force you to give back, either. You can GPL something, and someone can use it indefinitely in a modified state without ever giving you the changes back. Someone can even create their own fork on GitHub and commit millions of changes and never send you a pull request or tell you that they did it. They have to give the source to their users, not yours. And this problem exists even in V3, and indeed, even in Affero V3.
So the notion that GPL somehow makes a project less stagnant is seriously wishful thinking. All the GPL does is eliminate most corporate contributors. The problem of getting people who change your code to actually give the code back to you in a usable form is exactly the same regardless of license.
Re:MIT vs GPL (Score:4, Informative)
While your argument has some merits, there are counter arguments.
If I as a company hold patents, I will likely avoid GPLv3 code like the plague. I don't want to accidentally give up the rights to my patents because I happened to touch some GPLv3 code that was in vaguely the same area.
A good example of this would be Apple. They dropped bash for zsh, dropped gcc and wrote clang instead, dropped gdb and wrote lldb instead, dropped samba and wrote SMBClient and SMBX instead, dropped GNU tar and used libarchive/bsdtar instead, dropped GNU rsync and used openrsync instead,
- For zsh they appear to have contributed relatively little code upstream, but that's maybe expected for a mature project that is maintaining stability at this point rather than adding exciting new features.
- For gcc/gdb, they appear to have voluntarily given away *massive* amounts of code, clang and lldb simply didn't exist before Apple created them and open sourced them.
- For openrsync despite only having adopted it last year, they've contributed quite a lot of feature parity code to it (not just macOS compatibility code)
- For bsdgrep, it seems like you may be more right - it seems like Apple prefers to maintain a fork there rather than substantially contribute upstream.
- Samba seems to be a mixed bag - they went from a GPLv3 implementation to a BSD/APSLv2 client, and a proprietary server. The client they are contributing code actively. The server they're keeping all to themselves.
- For libarchive, it looks like Apple's made a ton of fixes, and contributed them upstream, same for bsdtar.
WebKit didn't replace a GPLed project, but Apple has written about 80% of the code in the repository, and licensed it mostly as BSD (with some licensed as LGPL to comply with KHTML's original licensing). BSD is their default license for new WebKit code.
With CUPS/OpenPrinting the story is similar - they adopted a GPLv2 project, relicensed it more permissively, and then proceeded to contribute massive amounts of code.
There's a bunch more cases of the same thing going on.
- XNU - weak copyleft licensed, continues to upstream changes
- Swift - permissively licensed, continues to upstream changes
- libdispatch - permissively licensed, continues to upstream changes
- mDNSResponder - permissively licensed, continues to upstream changes
- dyld - weak copyleft licensed, continues to upstream changes
- launchd - weak copyleft licensed, continues to upstream changes
- Swift Foundation - permissively licensed, continues to upstream changes
- bsd libc - BSDed apple contirbutes heavily upstream
- OpenSSH - BSDed, apple contributes upstream
- curl - BSDed, apple contributes upstream
- sqlite - public domain, apple contributes upstream
- libxml and libxslt - apple adopted them, and actively maintain them.
- Heimdal - Apple appears to have forked it, the license remains BSD in their fork, and all their changes are there.
- OpenPAM - looks like apple keeps its changes to itself here.
The overall picture is that despite all these BSDed projects, Apple in particular still contributes code upstream heavily. This is of course one anecdotal example, but at least from it, it doesn't appear that the motivating factor for changes being contributed upstream is being forced to with a copyleft license. Instead, it looks much more likely that it's simply that having the community all work together on single, standardised components is much more efficient for the industry than everyone having their own implementations, with incompatible quirks, bugs etc.
Re: (Score:2)
They also aren't exclusive. Asahi Linux could make parts of their code available to other projects under their choice of license on a "by request" basis. It depend on whether, e.g., the BSD project needs things available that Asahi considers too significant. That would still mean the scrapers (What's a better word for that?) would be scraping GPL licensed code.
Re: (Score:2)
I would add to this: use GPLv3 or later if you can.
The FSF (and Lawrence Lessig [wikipedia.org]) designed the GPLv3 to protect open source creators from new exploitation tricks that companies came up with in the mid 2000s to bypass the GPLv2.
Sadly Linus Torvalds was one of the vocal opponents of GPLv3 because he fancied himself a startup millionaire (remember Transmeta [wikipedia.org]? Me neither.)
As a result, he refused to support bumping the version from 2 to 3 in the Linux kernel at the time, and many projects followed suit.
Re:MIT vs GPL (Score:5, Interesting)
Sadly Linus Torvalds was one of the vocal opponents of GPLv3 because he fancied himself a startup millionaire (remember Transmeta [wikipedia.org]? Me neither.)
Oh, fuck you, buddy.
The fact that he disagreed with what GPLv3 was designed to fix- i.e., the inability for someone to cryptographically secure payloads on hardware that used his kernel, doesn't mean he disagreed with it "because he fancies himself a startup millionaire".
He wanted linux to be code-shared. He did not want it to be something that commercial entities wouldn't dare touch.
Do you feel like you're clever by trying to reduce the many arguments against the GPLv3 to that cheeky bullshit?
The neckbeards wanted his kernel under a licensing that fit their ideological beliefs- the problem is that Linux never shared those beliefs.
What followed was a change of the license to make a behavior they didn't like impossible, and a social pressure campaign to to move the kernel they pinched their nose and used (Hurd Hurd Hurd!) because they couldn't ever get theirs working (Hurd Hurd Hurd!) to a license they would have selected.
I, for one, am glad that Linux didn't go GPLv3. I wouldn't knock it if it had- after all, I didn't start that project. If it had- 90% of the devices that use linux today would be running VxWorks or QNX, and we would have gotten nothing in return, rather than source trees that add process support for 10 zillion arm variants- almost all contributed by manufacturers who were never going to give you the cryptographic signing keys for the devices they shipped.
Re: (Score:2)
You're right of course that companies were never going to give access to their changes, instead they just exploited the commons when given the chance, and here we are, a generation of people who rent software instead of owning and controlling it locally.
IMHO that was a strategic mistake.
Re: (Score:2)
Encrypted signing keys was just one of the loopholes GPLv3 addressed.
The one Linus specifically objected to.
Another was running modified GPL code on a server and never giving back to the community.
He did not specifically object to that. Being the above was a poison pill for him, this isn't really relevant.
You're right of course that companies were never going to give access to their changes
That's a funny interpretation of:
"and we would have gotten nothing in return, rather than source trees that add processor [sic] support for 10 zillion arm variants- almost all contributed by manufacturers who were never going to give you the cryptographic signing keys for the devices they shipped."
You really get off on spinning shit, don't you?
instead they just exploited the commons when given the chance
Exploited? Sure
Re: (Score:3)
Huh? You're in a trolling mood today? I guess I'll kick the ball back.
Linus is often full of shit on stuff he doesn't know much about, but he has had an outsized influence over the years. Media darling and bullying, mostly for 30 years. Defending him instead of talking about the GPL like I did is your way to move the goal posts, I guess?
I'm not going to address how wrong you are about driver contributions in detail. Maybe another time. It's enough to remind everyone here about binary NVIDIA drivers and
Re: (Score:2)
Linus is often full of shit on stuff he doesn't know much about, but he has had an outsized influence over the years. Media darling and bullying, mostly for 30 years. Defending him instead of talking about the GPL like I did is your way to move the goal posts, I guess?
And you aren't capable of a single fucking shred of intellectual honesty.
The thing I quoted and started this entire conversation with was:
Sadly Linus Torvalds was one of the vocal opponents of GPLv3 because he fancied himself a startup millionaire (remember Transmeta [wikipedia.org]? Me neither.)
Re: (Score:2)
What kind of logic is that? There is not ing about the GPL that does not promote ones code being used as widely as possible. Literally anyone can use it.
The only restriction is in distribution, so you are not talking about use but distribution. The GPL clearly encourages distribution.
GPL MIT BSD - Each project can pick what they like (Score:2)
If you have a project and it has code that can be licensed, you have your choices.
Asahi is right to select a license that better fits how they want their code used. I'm not saying GPLv2 is better than GPLv3, Apache, MIT, BSD, etc. What I'm saying is it's THEIR project and THEIR code and THEY get to choose the license.
That having been said, they did originally put it under the MIT license so that the scaredy-cats who know nothing of licenses (BSD rats) would shirk away in fear and uncertainty and doubt, mo
Re:GPL MIT BSD - Each project can pick what they l (Score:4, Informative)
I was a full-time linux desktop user from the late 90s until 2021, when I was bored during the COVID full-time-WFH era, and bought my first Mac (MacBook Air) due to me having waited most of my professional life to see an Arm that actually performed well.
Asahi on that 2021 has some of the best fleshed out hardware support of any laptop I've ever used linux on- and that's been a lot (though no dedicated ships-with-linux laptops)
The GPU support (including acceleration) in particular blows my mind. They reverse-engineered that shit, and built a full 3D driver for it, to the point where if you want a modern GL for Apple Silicon, you can only get it in linux- thanks to the Asahi folks. Incredible shit.
Their hardware support does lag Apple release significantly (still no support for my now-aging M4 Max MBP), but the fact that they're working on it makes me happy.
If one day having a real operating system on your Mac is something that's important to you- head on over to that donate link. I do regularly.
Re: (Score:2)
That having been said, they did originally put it under the MIT license so that the scaredy-cats who know nothing of licenses (BSD rats) would shirk away in fear and uncertainty and doubt, monsters under the bed and in the licensing closets preventing them from "being infected" with the "virus of GPL" licenses.
A lot of us who do understand it very well also shirk away from GPL, and V3 in particular. It's messy when you're shipping a boot loader that gets loaded onto hardware. This is not to say that having the source available isn't a good thing, but there's no guarantee that users will be able to update it even if they have the source, thanks to code signing requirements, etc.
Besides, consider how many ARM board manufacturers don't bother to contribute their patches to mainline Linux and end up with hardware t
Re: (Score:2)
In reality, it's a giant pile of forks.
I have several years of first-hand experience with the great-sea-of-arm-and-mips-forks situation, and that's a perfect description of the practical reality of GPL compliance when it comes to the kernel.
However, that code being available still has immense value- and things that have broader appeal do get pulled into mainline manually (adopted) by people who care, and it otherwise wouldn't have in most cases.
Re: (Score:2)
Re: (Score:2)
The reality is, if you're a BSD distro, folks kind of expect the whole thing to be BSD-licensed, or else what's the point. So having GPL-licensed bits is the sort of thing that they try to avoid. They held their noses and put up with gcc until clang got good enough. There are probably other examples. But there are really good reasons from a "we want you to be able to drop our stuff into any commercial situation and use it without worrying about licensing" perspective why they would want to avoid bringi
Re: (Score:2)
I was commenting/agreeing that even for someone who is ok with the GPLv2 on their commercial hardware (which is many people), v3 presents a particularly extra toxic barrier.
Uhh (Score:3)
"free real estate to pilfer and exploit"
Um... that is literally the purpose of Open Source. Every license allows this to one degree or another.
"exploit our permissive licensing"
Well, you picked the license.
"hijack our work"
Zir, that is what you said they could do. (The license.)
"In some extreme cases, in-development feature code was being lifted straight out of our personal forks"
So they did exactly what the license allowed, and you allowed, by making the repositories public?
"In case you did not know, Asahi Linux forbids AI generated code contribution"
Ah, so there we go, we found the reason, you're opposed to your work being "hijacked" by AI people who aren't actually writing the code, and profiting from doing so.
Let's just be honest what this is: you're making defensive efforts to avoid AI contributions. That's fine, but I have one question: when will you be changing out the Linux kernel for something else? Huge swaths of it have had AI contributions at this point.
The more I read this, the more I realize: are they really talking about Caldera Linux (fraudulent Linux copyright/ownership claims), which was entirely unrelated to the gripe he's got? I'm not sure what other events , unless they're talking about the license issues with ATT/BSD in the very early 90s? This is not alike any of that at all.
If they're misattributing or not giving license for code they've written, that's one thing - and that's a problem. It's not a problem that's going to go away by changing the license: clean room implementations are both fast, and easy. (IME, I can often produce better code overall with AI than the original).
The fact is, copyright protection has gotten very complicated with AI, and it's not going to get any easier. It's not going to go away, and to no small degree, it's made a lot of nuanced software licensing for open source irrelevant: the cost to re-implement is negligible, it's the ideas which are going to hold financial value.
If you're contributing hand-written code to an open source project, I appreciate that you'd want to do that as a hobby you enjoy. Go for it. But also don't be upset when people continue to do the same thing with newer tools.
Sadly, this largely sounds like farriers complaining about automobiles. Yes, shoeing horses is a real, valuable skill (one still needed). So is writing code. But it is no longer prestigious in and of itself, and is debatably as professionally useful as being able to solve sudoku.
Re: (Score:2)
Let's just be honest what this is: you're making defensive efforts to avoid AI contributions.
I feel like you are fundamentally misunderstanding the issue here. GPL doesn't prevent AI contributions, not to your code, and not your code to someone else's here. Also the MIT license doesn't prevent you from banning AI contributions either. It remains your project (just ask the people at Gravity Linux)
The question isn't one of typical exploitation. This has been done in one way or another for a long time (again, see Gravity Linux). This is now down to outright cloning but with automation to prevent trigg
Re: (Score:2)
Um... that is literally the purpose of Open Source. Every license allows this to one degree or another.
Absolutely false. The license gives you specific rights. If you do more with the code than the license says you can, that is pilfering and exploitation.
does it matter? (Score:5, Interesting)
"It's FOSS" doesn't know that much about GPL (Score:2)
> You can't legally build a closed, paid Apple Silicon distro on top of GPL code.
Yet it is alright to sell "open" GPL based software. And code doesn't have to be public, it has to be provided, on request, to software *users*. It doesn't have to be public nor live updated repository. AOSP is mostly Apache, but the tactics Google is recently using against project trying to release un-googled Android, would also work with GPL licenced "open" projects.
> And if a product's source has to be public, the copy
It's almost like... (Score:3)
It's almost like RMS was right all along about all that freedom stuff. Cue howls of outrage!
How is it compared to Intel Macs? (Score:2)
Is it prime time ready for production?
How about CC? (Score:2)
Do not use GPL either, use CC IMO
Everything old is new again (Score:3)
In other news, kids rediscover something adults knew thirty years ago courtesy of TiVo.