[Libav-user] FFmpeg License Violation - What Are My Remedies?

classic Classic list List threaded Threaded
18 messages Options
Reply | Threaded
Open this post in threaded view
|

[Libav-user] FFmpeg License Violation - What Are My Remedies?

Matthew Lawrence
I recently purchased an app from Google Play that incorporates the FFmpeg library.  Because the app is a derivative work under the LGPLv2.1, I believe I am entitled to a copy of the source code for the entire app.  I have e-mailed the developer's support staff, but they are refusing to release the source code.  I have cited the LGPL to them, but hey claim they are required to provide only the source code for the FFmpeg library.  I believe that they are in violation of the license and are violating both my legal rights and those of the FFmpeg team.

What are my remedies in this situation?  What steps can I take (other than hiring a lawyer) to assert my rights?  Who at FFmpeg can I notify of this violation so that they can enforce their rights?

The app is Paper Camera by JFDP Labs.  https://play.google.com/store/apps/details?id=com.dama.papercamera

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Gonzalo Garramuño
El 10/10/2012 02:34 p.m., Matthew Lawrence escribió:
> I recently purchased an app from Google Play that incorporates the
> FFmpeg library.  Because the app is a derivative work under the
> LGPLv2.1, I believe I am entitled to a copy of the source code for the
> entire app.  I have e-mailed the developer's support staff, but they
> are refusing to release the source code. I have cited the LGPL to
> them, but hey claim they are required to provide only the source code
> for the FFmpeg library.  I believe that they are in violation of the
> license and are violating both my legal rights and those of the FFmpeg
> team.

They are right.   Under the LGPL they only need to release the source
code to any changes to ffmpeg.  Under GPL they would require to release
source code to all their code.

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Phil Turmel
In reply to this post by Matthew Lawrence
On 10/10/2012 01:34 PM, Matthew Lawrence wrote:
> I recently purchased an app from Google Play that incorporates the FFmpeg
> library.  Because the app is a derivative work under the LGPLv2.1, I
> believe I am entitled to a copy of the source code for the entire app.  I
> have e-mailed the developer's support staff, but they are refusing to
> release the source code.  I have cited the LGPL to them, but hey claim they
> are required to provide only the source code for the FFmpeg library.  I
> believe that they are in violation of the license and are violating both my
> legal rights and those of the FFmpeg team.

If in fact they only shipped an LGPL binary of ffmpeg, you are *not*
entitled to their entire source code.

Please re-read the LGPL, noting that LGPL != GPL.

Also, you might re-read http://ffmpeg.org/legal.html

IANAL, etc.

Phil
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Eric P. Mangold
In reply to this post by Matthew Lawrence
You could start by CC'ing the party in question.


On Wed, Oct 10, 2012 at 12:34:16PM -0500, Matthew Lawrence wrote:

> I recently purchased an app from Google Play that incorporates the FFmpeg
> library.  Because the app is a derivative work under the LGPLv2.1, I
> believe I am entitled to a copy of the source code for the entire app.  I
> have e-mailed the developer's support staff, but they are refusing to
> release the source code.  I have cited the LGPL to them, but hey claim they
> are required to provide only the source code for the FFmpeg library.  I
> believe that they are in violation of the license and are violating both my
> legal rights and those of the FFmpeg team.
>
> What are my remedies in this situation?  What steps can I take (other than
> hiring a lawyer) to assert my rights?  Who at FFmpeg can I notify of this
> violation so that they can enforce their rights?
>
> The app is Paper Camera by JFDP Labs.
> https://play.google.com/store/apps/details?id=com.dama.papercamera

> _______________________________________________
> Libav-user mailing list
> [hidden email]
> http://ffmpeg.org/mailman/listinfo/libav-user

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Nicolas George-2
In reply to this post by Matthew Lawrence
Le nonidi 19 vendémiaire, an CCXXI, Matthew Lawrence a écrit :
> I recently purchased an app from Google Play that incorporates the FFmpeg
> library.  Because the app is a derivative work under the LGPLv2.1, I
> believe I am entitled to a copy of the source code for the entire app.  I
> have e-mailed the developer's support staff, but they are refusing to
> release the source code.  I have cited the LGPL to them, but hey claim they
> are required to provide only the source code for the FFmpeg library.  I
> believe that they are in violation of the license and are violating both my
> legal rights and those of the FFmpeg team.

As other have pointed out, since this is the LGPL and not the GPL, they are
not required to give away their full source code, only the source code of
FFmpeg as they have built it.

They are also required to provide anything you might need to rebuild their
application using a modified version of ffmpeg. In this particular case,
FFmpeg is likely loaded as a shared library, so they would only have to
provide the possible JNI glue they have included in said library, and
possibly only as pre-built object files.

Also note that you are not legally party of the LGPL violation, only the
FFmpeg copyright holders are entitled to seek reparation in such a case.

Regards,

--
  Nicolas George

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user

signature.asc (205 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Matthew Lawrence
In reply to this post by Gonzalo Garramuño
Can you provide a citation for your claim?

Section 5 of the LGPLv2.1 states in part:

"5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.

However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. "

Under the first paragraph, the app is a "work that uses the Library".  However, because the work is distributed together with the Library in a single executable (DEX file within an APK), the work is not "in isolation" and is therefore not outside the scope of the License.  Instead, the second paragraph applies.  When they build the APK from source, they are statically linking the "work that uses the Library" with the Library.  The final product (the APK and the DEX file inside it) is a derivative work because it contains the Library.  This is precisely the condition covered by Paragraph 2 of Section 5.  As a result, the APK is covered by the License, and they are bound by Section 6 which requires them to distribute the source of their "work that uses the Library" to anyone who requests it.

What am I missing?

Matthew

On Wed, Oct 10, 2012 at 12:45 PM, Gonzalo Garramuño <[hidden email]> wrote:
El 10/10/2012 02:34 p.m., Matthew Lawrence escribió:

I recently purchased an app from Google Play that incorporates the FFmpeg library.  Because the app is a derivative work under the LGPLv2.1, I believe I am entitled to a copy of the source code for the entire app.  I have e-mailed the developer's support staff, but they are refusing to release the source code. I have cited the LGPL to them, but hey claim they are required to provide only the source code for the FFmpeg library.  I believe that they are in violation of the license and are violating both my legal rights and those of the FFmpeg team.

They are right.   Under the LGPL they only need to release the source code to any changes to ffmpeg.  Under GPL they would require to release source code to all their code.

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user


_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Edward Richards
Then talk to a lawyer about your rights to sue if that's your interpretation.

Do you even know if it is statically linked? Because the free software foundation consensus is that runtime linking is ok since YOU the user is doing the violation not the deployment media.
Besides...Bringing it up here isn't going to do anything.  

How dare anybody try to improve the global economy by developing and selling a product using LGPL - which was designed to make the commercial use of open source viable. The gaul!
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Camera Man
In reply to this post by Matthew Lawrence
On 10/10/2012 03:09 PM, Matthew Lawrence wrote:
Under the first paragraph, the app is a "work that uses the Library".  However, because the work is distributed together with the Library in a single executable (DEX file within an APK), the work is not "in isolation" and is therefore not outside the scope of the License.  Instead, the second paragraph applies.  When they build the APK from source, they are statically linking the "work that uses the Library" with the Library.  The final product (the APK and the DEX file inside it) is a derivative work because it contains the Library.  This is precisely the condition covered by Paragraph 2 of Section 5.  As a result, the APK is covered by the License, and they are bound by Section 6 which requires them to distribute the source of their "work that uses the Library" to anyone who requests it.

I'm not familiar with DEX semantics; but if it's  a single standalone executable (like .exe), that you are right. Both the spirit and the letter of the LGPL require that you are able to recompile the LGPLed lib yourself and use your version with the provided executable. This is usually done with .dll or shared libraries of some sort on Windows and Linux respectively.

However, assuming that is indeed the case and they are, indeed, in violation of the LGPL - only the copyright holder can take any action or has any rights in this matter. Unless you hold a copyright over ffmpeg, you have no legal standing (inspite of the fact the LGPL was designed to protect YOUR rights; since it is implemented through copyrights, only the rights owner has legal standing)

I think the EFF runs "name and shame" campaigns, but I don't know if they'll bother unless contacted by the rights holder. (And they will only pursue legal action if you assign copyright to them).

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Alex Cohn
In reply to this post by Matthew Lawrence
On 10 Oct 2012 21:09, "Matthew Lawrence" <[hidden email]> wrote:

>
> Can you provide a citation for your claim?
>
> Section 5 of the LGPLv2.1 states in part:
>
> "5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.
>
> However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. "
>
> Under the first paragraph, the app is a "work that uses the Library".  However, because the work is distributed together with the Library in a single executable (DEX file within an APK), the work is not "in isolation" and is therefore not outside the scope of the License.  Instead, the second paragraph applies.  When they build the APK from source, they are statically linking the "work that uses the Library" with the Library.  The final product (the APK and the DEX file inside it) is a derivative work because it contains the Library.  This is precisely the condition covered by Paragraph 2 of Section 5.  As a result, the APK is covered by the License, and they are bound by Section 6 which requires them to distribute the source of their "work that uses the Library" to anyone who requests it.
>
> What am I missing?
>
> Matthew

Technically you are almost right.

But the prevailing tradition is that packaging of LGPL library inside
an APK is not considered violation of the License. Note that the Java
part (the DEX file you mentioned) is forced to use dynamic linking
(which follows section 5) by the limitations of the Android platform.

In my eyes, the practice of bundling binaries into APK has one
specific problem with the spirit (but not the letter) of LGPL: while
replacing the library with another one, that the end user built
him/herself from the open sources, is possible, but requires root
access.

I have proposed an alternative mechanism elsewhere
(http://stackoverflow.com/questions/12744849/android-library-engineering/12753468#12753468),
which would allow anyone to replace the LGPL component on Android, but
the adoption rate is rather slow.

BR,

Alex Cohn
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Carl Eugen Hoyos
In reply to this post by Matthew Lawrence
Matthew Lawrence <matthew.c.lawrence@...> writes:

> I recently purchased an app from Google Play that
> incorporates the FFmpeg library.  Because the app is a
> derivative work under the LGPLv2.1, I believe I am
> entitled to a copy of the source code for the entire app.

Apart from what was already said (LGPL does not require
them to ship source code, the packaging should not make
any difference, even static linking is ok if you can
relink by them providing object files):
Do they forbid reverse engineering in their EULA?
(That would make the software LGPL-incompatible.)

Carl Eugen

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Michael Bradshaw
In reply to this post by Matthew Lawrence
On Wed, Oct 10, 2012 at 11:34 AM, Matthew Lawrence
<[hidden email]> wrote:
>[...]

> What steps can I take (other than hiring a lawyer) to assert my rights?

Pretty much nothing. You can ask for it all you want, and they can say
no all they want. IANAL, so I've no clue who's in the right, but if
you really want it and they say no, pretty much the only thing you can
do is take them to court and let the court decide if you're entitled
to the source or not.

> Who at FFmpeg can I notify of this violation so that they can enforce their rights?

 I can't speak for FFmpeg, but I doubt there's anything anyone in the
FFmpeg project can/will do (aside from putting them on a wall of shame
or hiring a lawyer and suing).

--Michael
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Michael Bradshaw
On Wed, Oct 10, 2012 at 5:33 PM, Michael Bradshaw
<[hidden email]> wrote:

> On Wed, Oct 10, 2012 at 11:34 AM, Matthew Lawrence
> <[hidden email]> wrote:
>>[...]
>
>> What steps can I take (other than hiring a lawyer) to assert my rights?
>
> Pretty much nothing. You can ask for it all you want, and they can say
> no all they want. IANAL, so I've no clue who's in the right, but if
> you really want it and they say no, pretty much the only thing you can
> do is take them to court and let the court decide if you're entitled
> to the source or not.
>
>> Who at FFmpeg can I notify of this violation so that they can enforce their rights?
>
>  I can't speak for FFmpeg, but I doubt there's anything anyone in the
> FFmpeg project can/will do (aside from putting them on a wall of shame
> or hiring a lawyer and suing).

Sorry, I meant the only two things I see as options for the FFmpeg
project is putting them on a wall of shame or hiring a lawyer and
suing, neither of which I expect to happen. I didn't word that very
well.
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Lou
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Lou
On Wed, Oct 10, 2012 at 5:33 PM, Michael Bradshaw wrote:

> Sorry, I meant the only two things I see as options for the FFmpeg
> project is putting them on a wall of shame or hiring a lawyer and
> suing, neither of which I expect to happen. I didn't word that very
> well.

The Hall of Shame no longer exists (a page exists without entries, but
I think it is orphaned from the menu/legal page). It was a maintenance
burden, its effectiveness was questionable, and it was getting really
long.
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Michael Bradshaw
On Thu, Oct 11, 2012 at 11:53 AM, Lou <[hidden email]> wrote:

> On Wed, Oct 10, 2012 at 5:33 PM, Michael Bradshaw wrote:
>
>> Sorry, I meant the only two things I see as options for the FFmpeg
>> project is putting them on a wall of shame or hiring a lawyer and
>> suing, neither of which I expect to happen. I didn't word that very
>> well.
>
> The Hall of Shame no longer exists (a page exists without entries, but
> I think it is orphaned from the menu/legal page). It was a maintenance
> burden, its effectiveness was questionable, and it was getting really
> long.

Which is why I don't expect it to happen :)
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Nicolas George-2
In reply to this post by Michael Bradshaw
Le nonidi 19 vendémiaire, an CCXXI, Michael Bradshaw a écrit :
> Sorry, I meant the only two things I see as options for the FFmpeg
> project is putting them on a wall of shame or hiring a lawyer and
> suing, neither of which I expect to happen. I didn't word that very
> well.

In this particular case, there may be a more efficient way: the application
in question is sold on Google Play, any copyright holder of the distributed
version of ffmpeg would be entitled to get it taken down by the market
authorities.

Of course, it would require very careful examination to be sure that there
is indeed infringement. A verbatim copy of the mails requesting the source
code and their replies would be an absolute prerequisite.

Regards,

--
  Nicolas George

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user

signature.asc (205 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Carl Eugen Hoyos
In reply to this post by Lou
Hi Lou!

Lou <lou@...> writes:

> The Hall of Shame no longer exists (a page
> exists without entries, but I think it is
> orphaned from the menu/legal page).

> It was a maintenance burden,

Sorry, but this is simply not true.

> its effectiveness was questionable,

>and it was getting really long.

And I am not sure I understand this argument:
Do you mean if there are enough license
violators, we should ignore them?
;-)

Carl Eugen

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Michael Zucchi
In reply to this post by Matthew Lawrence
On 11/10/12 04:04, Matthew Lawrence wrote:
> I recently purchased an app from Google Play that incorporates the
> FFmpeg library.  Because the app is a derivative work under the
> LGPLv2.1, I believe I am entitled to a copy of the source code for the
> entire app.  I have e-mailed the developer's support staff, but they are
> refusing to release the source code.  I have cited the LGPL to them, but
> hey claim they are required to provide only the source code for the
> FFmpeg library.  I believe that they are in violation of the license and
> are violating both my legal rights and those of the FFmpeg team.

In essence, LGPL requires that you are able to 1: obtain the complete
and compilable source code of the LGPL components they used (imo this
wouldn't include any jni stuff and certainly not the application
itself), and 2: replace the binary components of the LGPL compiled
source (at least here in australia, compiled code has the same legal
standing as the source itself - as it is only a machine translation of
the original expression) - either the .so file or the .o files if it is
statically linked - in the specific application you have installed.

Of course, apk's and the android shop are somewhat problematic wrt to
the second point.  If you used the 'shop', then you actually got the
application from google.  So you are quite entitled to ask google for
the source as they were the ones who `distributed' or 'conveyed' the
software to you.  They are required to supply source if asked for, and
if they don't *they* lose the right to distribute it at all (which would
cover the FFmpeg source components used - and impact on all 'apps' which
used them).  The (L)GPL only comes into effect once distribution occurs,
which is why you can do basically anything if you link with it privately
- distribution creates all the obligations.  TBH i'm surprised they
allow any of the (L)GPL licenses at all, since they don't even have a
mechanism for distributing source and are thus automatically violating
all L?GPL2.* source code regardless of whether the guys creating the
apps are or not.

e.g. in the preamble:

"To protect your rights, we need to make restrictions that forbid
distributors to deny you these rights or to ask you to surrender these
rights. These restrictions translate to certain responsibilities for you
if you distribute copies of the library or if you modify it.

For example, if you distribute copies of the library, whether gratis or
for a fee, you must give the recipients all the rights that we gave you.
You must make sure that they, too, receive or can get the source code."

Note this part says nothing about linking (that is the next sentence).
It only says 'distribute' and 'distributor', an "app store" is
definitely a distribution channel, as much as a cd or a yum server is ...

But they're richer than you: so, well, "sucked in" if you were the
author, and as a customer you don't even get that much of a look-see.

The LGPL seems to be the most misunderstood of all the licenses,
although quite why is a mystery - the language is quite clear and
thoroughly explained.  One presumes much of it is just FUD for
commercial gain.

  Z
_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user
Reply | Threaded
Open this post in threaded view
|

Re: FFmpeg License Violation - What Are My Remedies?

Nicolas George-2
Le primidi 21 vendémiaire, an CCXXI, Michael Zucchi a écrit :
> Of course, apk's and the android shop are somewhat problematic wrt
> to the second point.  If you used the 'shop', then you actually got
> the application from google.  So you are quite entitled to ask
> google for the source as they were the ones who `distributed' or
> 'conveyed' the software to you.

This is an interesting point. I believe Google could seriously argue that
their "app shop" acts as a service provider to allow the editor to
distribute the app.

To compare it with another situation:

If company A is producing and selling in its shop a physical device with its
firmware infringing the GPL, there is no doubt that its is doing the
distribution and therefore responsible for the infringement.

If said company A sells by mail order, is the delivery service responsible
for the infringement? I do not believe so.

If said company A sells to big resellers (hypermarket chains and so), are
the resellers responsible for the infringement? This is less obvious than
the previous case, but they should not be, as they have no way of knowing
they are infringing.

On the whole, I believe that no judge would hold someone responsible if they
infringe unknowingly because they themselves are victim of the same
infringement.

OTOH, I really do not like the policy of Google's "app shop", especially
(but not only) with regard to their (lack of) handling of Free software
licenses, so if there was a way to force them to fix it, it would be nice.

Regards,

--
  Nicolas George

_______________________________________________
Libav-user mailing list
[hidden email]
http://ffmpeg.org/mailman/listinfo/libav-user

signature.asc (205 bytes) Download Attachment