GPL violations by D-Link and Boxee
infinityoverzero.com/bbox/
infinityoverzero.comPosted Apr 18, 2011, 2:18 PM UTC
28873
infinityoverzero.comI'm a long term linux user and I use Boxee. Suddenly I realise why GPLv3 matters.
22
The boxee team are a set of cunts, good luck getting any response from them. I bought this up on jira some months ago and also my suggested improvement was allowing support for other operating systems (specifically XBMC); they closed the issue and said I should create a poll on their forums. Avner has stated the boxee box will support alternate operating systems; it doesn't.
Another thing this link mentions is the wait between updates; jira currently has 650 bugs (it was 3000+ last time I checked), these are bugs boxee users are forced to live with for two more months until they're updated, granted the critical ones get top priority, but we aren't likely to face a bug free system at the next release cycle. Improvements can also no longer be committed via jira, so the concept of having users choosing what they want to see is now gone (this is kind of supported by the ui change post beta). I've seen issues opened and closed almost immediately on jira (segfaults, ui issues, lack of hardware support, issues with the legality of the subtitles plugin, scraping issues). If problems with the system aren't being dealt with properly and we have to wait 3 months before an update, this is going to be disorganised chaos.
The boxee project is a disgrace and I'm disgusted that it's gone this way. It looked to be a successful, fun, easy to use product and it's become a heavily locked down system which entirely focuses on revenue. I'm sure the boxee devs aren't totally to blame (no doubt dlink are pushing for big profits), but I'm still disappointed. In typial failed open source project fashion, Avner has now removed traces of his email address from goog, so direct contact is no longer possible. I can see the boxee box dying in the water unless they either make more deals and thus more profits or commit to having an entirely open system and allowing 'better' operating systems to run on it such as XBMC.
Can someone make sure avner reads this and pulls his finger out, this kind of shit should come up on the forums but it gets banned and/or deleted at the drop of a hat, any dislike towards the system is met with aggressive criticism usually resulting in "well if you don't like it, don't use it" which is fine, but considering most people have already spent the money on the fucking thing, the concept of not using it still makes it a useless paperweight.
16
It appears this is indeed a violation and I have just sent a request to Boxee for information.
13
At the end of the day it doesn't make any difference if they violate the gpl if they can get away with it. We need someone who can take legal action against these companies!
5
It's up to the copyright holder of the GPL code to defend their rights. http://www.gnu.org/licenses/gpl-violation.html
1
Most individuals and smaller developer organizations don't have the money or resources to take on a corporation that is abusing the GPL
1
Totally. The FSF say copyright holders should contact them in this case. They might be able to help, perhaps if they think it's an important enough case.
1
Probably should have posted this to r/opensource, it's probably a little more releavent there.
8
Agreed, since most people on the Linux subreddit don't seem to give a damn about free software....
8
I bet you $money that there are back doors on these things.
2
So the FBI can monitor my Law & Order habits ?
3
For $800 get the fully fleshed 4100CE dev unit, that uses the same cpu/chipset that the Boxee Box uses. Then finding a backdoor should be easy peasy.
1
One fear I hear from companies which mix closed and open programs in products is that GPLv3 seems to suggest that if one program in the system is GPLv3 all the code in the system must also be GPLv3. Yet, I do not believe that GPLv2 code could be shipped next to GPLv3 if this was true.
Does anyone have insight into the validity of this belief on GPLv3?
1
GPLv2 makes no requirement that the entire toolchain and all auxilary data (such as signing keys) be released along side the source. In fact, this was part of the reason for GPLv3, to stop companies from using FOSS on hardware which would then be impossible to update without proprietary tools and/or signing keys. For one program to be GPLv3 while all the rest are GPLv2 the company must provide the means to modify and install that part of the system. However, the means to install that program are often the same means required to install the GPLv2 programs and so having one GPLv3 program doesn't chance the license on the on the other software from GPLv2 to GPLv3 but in standard cryptographic cases (to date) it exposes the means of signing and installing the GPLv2 software even though the company is not legally required to disclose them for non GPLv3 software.
9
No it functions basically like the GPLv2 does in spirit: it includes updated descriptions of some inventive new mechanisms of restricting user freedom, but its spirit and application are basically the same. And the license doesn't cover any separate part of the system that the GPLv2 did not cover, period. The key difference here is that the GPLv3 prohibits breaking the spirit of the GPLv2 by including sneaky, external means of restricting the freedoms the GPLv2 is designed to protect.
6
One fear I hear from companies ... if one program in the system is GPLv3 all the code in the system must also be GPLv3.
I doubt this is the case. But if one program in the system is GPLv3 then you can no longer lock users out of the system.
If they can modify that component then effectively they can upload any complete firmware they like - it only takes one GPLv3 program to spill the whole can of beans.
I don't think this should affect proprietary components. The manufacturer only needs to offer GPL source on their weboage, and the manufacturer can ship proprietary components only in the complete images. I don't think this makes the proprietary components any easier to pirate.
However I think what Boxee are trying to do is get Hulu and Netflix on their devices, and those companies won't allow them to ship their apps on unlocked devices.
3
You could make a cryptographic protection scheme that specifically allows to upgrade the gpl v3 components, and only them.
0
How do you do that, exactly?
1
"In principle", you could for instance design a system where a signed software which runs at boot, mounts the main partition, checksums some of the files and not others, and refuses to boot if one of the checksums is wrong.
You put in there critical pieces under gplv2, et voilà: you are a bad person.
1
The simplest solution I can think of is to allow the users to provide an unsigned secondary image that contains the GPLv3 software.
0
I agree with all the comments here in theory, but this is a fear real companies have. Most embedded companies will not even touch GPLv3 with a ten foot pole. Regardless of what everyone says here, this is only your interpretation and until someone takes it to court and their is a ruling on a case the risk is too high for companies to risk using GPLv3 code.
If the Boxee does have GPLv3 code I bet someone at Boxee messed up during a license audit or they are just plain foolish.
If someone could post source to a court decision on this topic which verifies what everyone is saying that would be interesting.
1
Just got a reply from D-Link on a question about this:
Products: DSM-380
Please ensure to include in your reply your company name, serial number, store, date of purchase, hardware and firmware versions.
If your issue has been resolved there is no need to reply to this email.
The Boxee Box’ software is mostly licensed under GPLv2 and all open source code for it is available for download on the Boxee website (http://www.boxee.tv). We have confirmed that some erroneous utilities under GPLv3 were included but never used in the pre-release version of Boxee Box, and have now been removed from the software. D-Link is working closely with Boxee to ensure that all software within Boxee Box is fully licensed and we have already put new processes in place to better document existing and new open source code to the Boxee Box.
Boxee has undertaken very innovative open source development projects over the last few years, and continues to contribute extensively to the >community and in particular the XBMC code. As a partner of Boxee, D-Link is also committed to supporting the open source community so that it >can continue to work and produce some of the most exciting and secure software available today.
If you have further questions, please feel free to follow up with Boxee directly at [email protected]
Should you require further assistance with your D-Link products, please reply to this message, or call toll free at 877-453-5465.
Thank you for networking with D-Link.
Sincerely, John M D-Link Technical Support
1
Hey this is Andrew from Boxee - I wanted to reach out personally and say that we take the GPL very seriously. The utility in question was never used and was removed months ago from the Boxee Box (which is why you had to go back to the initial firmware to see it).
All of Boxee continues to be under GPLv2 (rock on), and we've already seen quite a few companies using and hacking our software for their own purposes (which we think is pretty awesome).
We put up a blog post on the matter where you can read more / respond if you've got any other questions. http://blog.boxee.tv/2011/04/19/boxee-and-open-source-software/
We continue to rely on the open source community for the foundations of our code, we contribute back on a frequent basis, and without F/OSS, we would never have been inspired to build Boxee in the first place.
Cheers, Andrew
-2
Thanks for sending this link Andrew. Now I've read and you've officially concluded that boxee will not run XBMC I'm going to switch to something more 'open'. Regardless of how you've managed to manipulate the GPL, the end result is the same: four updates a year, the jira team being wankers, the focus being on bought content, a huge wait for 'improvements' voiced on jira. Lots of my original issues have been closed with a shit explanation.
Even the paid content is poorly supported, look at this issue raised four months ago, no updates at all from the guys at jira. Not even a "will be fixed in x", so this basically means another 2 month wait for the next update, then my issue will be addressed (possibly) and then another 4 month update. So in roughly 6 months time the UK content won't remain utterly shit, thanks.
You guys either need to improve your software significantly (focusing on improvements) or "leak" a method of getting root access to the bloody thing, this is just daft now. All the sales blogs and explanations as to how you've managed to fight GPL in the World won't make your software any better.
One final word. The sales content for users outside the US is almost none existant, you should of just sold this thing to US customers.
2
The GPL v3 license meddles with the hardware. This is NOT what a software license should do. I stand by Linus's opinion on this whole GPL v3 ordeal:
The Linux kernel is under the GPL version 2. Not anything else. Some individual files are licenceable under v3, but not the kernel in general.
And quite frankly, I don't see that changing. I think it's insane to require people to make their private signing keys available, for example. I wouldn't do it. So I don't think the GPL v3 conversion is going to happen for the kernel, since I personally don't want to convert any of my code. ...
No. You think "v2 or later" is the default. It's not. The default is to not allow conversion.
Conversion isn't going to happen.
Linus
And also:
[Stallman] calls it "tivoization", but that's a word he has made up, and a term I find offensive, so I don't choose to use it. It's offensive because Tivo never did anything wrong, and the FSF even acknowledged that. The fact that they do their hardware and have some DRM issues with the content producers and thus want to protect the integrity of that hardware.
-4
The Boxee hardware meddles with the software. This is NOT what hardware should do.
FTFY.
Its ludicrous to throw around such empty assertions as if somehow because the restrictions on user freedom are implemented in hardware that they're not restricting user freedom.
16
It's offensive because Tivo never did anything wrong, and the FSF even acknowledged that.
Tivo never did anything illegal. And like a chess tournament where the rules allowed punching your opponent, the FSF saw the problem and fixed it for the next time.
11
Tivo never did anything wrong
Sorry but, if a company is telling me what I can do and what I can not with my own damn hardware, that I've bought with my own hard earned money, then they are doing something wrong.
9
But is it the responsibility of the GPL to determine this? Is the GPL overreaching by doing this? I think that's thomas41546's point.
1
The hardware is implementing control over the software. This is against the spirit of the GPL and thus GPLv3 was written to make this explicitly not allowable if you choose to use that software.
Hardware makers don't have to choose to use GPL software. But if they do they should respect the wishes of the people who wrote that software and opened up the source code. The fundamental wish of those developers, enshrined in the GPL, is to take no freedom away from the users of the software.
9
But is it the responsibility of the GPL to determine this? Is the GPL overreaching by doing this?
If not GPL then what/who will?
I'm not entirely convinced that a software license should dictate hardware terms, however as there is no other viable alternative I shall support GPLv3 with both of my hands and legs.
4
If you don't like their product then don't give them your money.
-2
[deleted]
-2
Go build your own DVR with your own hardware and software and stop bitching. Baby ...
Do you even realize that you've proved my point?
Let's say I have my own hardware. A Boxee box. I bough it and it's mine. And I have my own software. Now, I would really love to build my own DVR, but I can't, as the hardware producer tells me that I can't, even thought it's my own hardware.
Don't you see how ridiculous it is? It's like Intel would forbid you from using any other web browser than Internet Explorer just because you got an Intel CPU. Want to use Firefox? Nope, sorry, as Intel doesn't want you to run any other browser than IE, you need to stick with IE, as Intel won't let you even install Firefox, even if their CPUs are perfectly capable of running it.
3
[deleted]
-3
You are making a confusion between wrong and illegal and between the spirit of the license and the license.
The GPLv2 was written to allow people to distribute software for free, with the only condition that people who would benefit from it would have to provide others with the same freedom of changing the software. This is what this deal is about: I give you the software I wrote, you give me back changes you make.
Tivo, and other aficionados of cryptographically protected hardware, wants to benefit from open source (i.e. making cash in that case) and at the same time taking the freedom away from people. I wonder how anybody can in good faith claim that this is not a blatant violation of the spirit of the GPLv2.
6
It sounds like there actually is a GPLv3 violation, but I really hope they don't get sued. In terms of the market, they are FAR more open then any other device in its category, and as a user myself, I am glad it exists. Boxee should be doing a better job on the software than they are, and they absolutely should do a better job at making the device open, but suing them over what is realistically a fairly trivial violation doesn't strike me as a way to solve anything. I hope for the sake of open devices this lawsuit doesn't get anywhere.
-7
... they are FAR more open then any other device in its category ...
Really? You can install any firmware you like on the PlayOn HD series.
4
What about Netflix or any other such service (granted, Boxee is a bit lacking in that area, but netflix is the big one)? Those might not be significant to you, but for most people they are. The draconian level of restrictions that these services place on set-top boxes really does set it apart from something like the PlayOn. The guy who is complaining about GPL violations here wrote a telnet app and installed it without going through any approval process; really, that doesn't mean it is too open, but it is more than you can ask for with most devices that stream Netflix.
1
What about Netflix or any other such service?
What about them?
It may be that no device that ships with GPLv3 software can legally also support Netflix streaming until Netflix changes their unreasonable policies. That's not a problem, that's the intent of the license.
4
What about Netflix or any other such service ...
Well, I guess in that we debate the definition of "in this class".
However, when it comes to openness, the PlayOn clearly wins. I don't see how the Boxee is really "open". Using open-source software doesn't make you open if you lock people out from changing the software on hardware which they own.
The guy who is complaining about GPL violations here wrote a telnet app and installed it without going through any approval process ...
Actually, he didn't. He just hacked an old version of the firmware to enable the already-installed telnet daemon.
The Boxee seems to allow 3rd-party plug-in "apps", but these would seem to be somewhat limited, and Boxee locked them out from enabling the telnetd in current updates.
The app that this guy used is Python, but according to wikipedia these Boxee plug-in "apps" are now based on the Firefox XUL (XULRunner) framework.
I would imagine that is a change in response to this telnetd hack (and the possibilities like it) but AIUI these apps are now basically just CSS and Javascipt. Thus they're of limited usefulness, and I question whether you would call the ability to install little more than a webpage on your Boxee as "open".
Apparently one of the features that Boxee originally promised was a BitTorrent client (probably available for years in the original XMBC that Boxee was based on), so you could download directly to a hard-drive connected to the device. After getting in bed with D-Link / Netflix / Hulu / whoever, Boxee decided (understandably) to scupper this feature.
If the plug-ins were to still to use Python then they'd be able to write to the filesystem, and you could write a BitTorrent client to run on the Boxee. But I don't think Boxee could continue to secure the device against tinkering if they continued to allow Python apps to run on the device. Thus the move to XUL, which AIUI is a lot less powerful and less useful. With current versions of the firmware you can (I think) write a weather or train timetable applet for the Boxee, but not an ftp server or an audio / video codec.
3
That's unfortunate. I didn't realize they stripped out their old API as part of that move.
Look, I don't disagree with what you are saying. The boxee box really isn't open in most ways, but you can largely make the same criticism of android. Android is largely installed on locked up phones that require hacks to circumvent, and for various reasons, there are binary blobs you just have to live with if you want to have a functioning phone, but I still think it is fair to call an android phone much more "open" than an iPhone. If Android was the work of a smallish start-up still, I would say the same thing about a potential GPL violation case. My hope is that "open" devices will eventually lead the average consumer to demand truly open devices, and I am willing to sometimes accept a BS concept of openness as a result.
-1
they are FAR more open then any other device in its category
What do you mean by "open" here ?
1
[deleted]
-8
Boxee is GPL2, not GPL 3.
This also has nothing to do with Linux.
-21
You did not read the article. They are shipping gnupg (commnd: gpgv2) on the box, which is gplv3.
16
The article is poorly written. It is not possible from what he gives to tell if there is a violation or not.
Since gpgv2 is GPLv3, and ships with the box, they have to provide a way for the user to install his own versions of gpgv2. They are NOT required under GPLv3 to provide a way to replace the kernel and other GPLv2 code.
The article does not make it at all clear what is actually covered by the signing requirement. He should spend less time on dumb rants and more time actually presenting the relevant details.
Uh, can you clarify, please? I doubt Boxee took some non-GPL licensed code and put that header on there for a laugh.
If there's no way to modify the gpgv2 code and then upload it to the device then there is a violation. If the firmware images are signed then there is no way to upload the modified code to the device.
That seems fairly academic, as it's the same mechanism - firmware signing - that prevents both the GPLv2 and the GPLv3 code being modified. (Ironically, it could well be the very gpgv2 that's being contested that's used to check the signature of the firmware image.) If you can sign your own firmware images you can put whatever you want in there, and you can get kernel sources from wherever you like.
This is incredibly short-sigted of someone. What are they protecting? Are they worried that a few people may pirate their software? And run the Boxee interface on cheaper hardware? They should be pleased that tech enthusiasts may buy Boxees to run whatever they like on them, to buy the Boxee hardware (on which Boxee presumably make a profit) to run their own distros on them.
In a word: Netflix.
This is one of the reasons why it took so long to get Netflix support on the Boxee box. For some reason on set top boxes (unlike desktop versions) they have very specific requirements about preventing other software from running that could be used to rip the stream that Netflix is sending. I have no idea why they're so particular about this on set top boxes, since the desktop versions can't be anywhere nearly as locked down on OS X or Win XP (Vista/7 have more DRM integrated into the OS that prevent tampering, not sure if they use this). The release of Boxee firmware that added support for Netflix added this signing functionality.
I'm guessing they could just migrate to an earlier version of GPG v1 that doesn't use GPL v3 (latest 1.x version has a v3 license), or find some other tool to handle this signing. It'll be interesting to see how this plays out. On the one hand I'm not a fan of how locked down they've made the platform, but on the other hand I also find licensing restrictions like this to be counterproductive. For a company in this sort of situation with contractual obligations with content partners they're not going to open the platform more. If the copyright holders on GPG drop things after the cessation of violation, I expect the'll just stop using gpgv2 and use something else with a less restrictive license. If they go to court over this and the GPG holders win, I'd expect the same thing will happen with the addition that they might change all their keys when they move up a version and provide keys for the old version and the new version will be required in order to keep using Netflix.
Besides, who the hell would go to the trouble of ripping a netflix stream? There's about 100 easier methods of accomplishing the same thing.
Yeah, including one that would work through their system as well: "Add to queue", get DVD next day, rip. And, If you were desperate to do this, you could use a screen capture program on a Mac or PC. The real problem I would figure that would prevent people from ripping Netflix streams in the first place is that, well, the quality scales with bandwidth and you aren't going to get a consistent stream necessarily each time.
In reality it's a bit like trying to plug holes in the dike when there's a torrent (haha..) of water coming through a section not 10 feet away. I never claimed that the logical argument made sense when considering the broader context :-)
That is already possible through their site. I use it all the time for my media desktop.
Sure!
Correct.
The article does not make clear what images are signed. Since one of his steps to show that gpgv2 is on the device is to install a telnet server application onto the device, clearly it is possible to load code onto the device without signing.
All the article tells us is that the device contains some code that cannot be replaced, and it contains some code that is under GPLv3.
I'm pretty sure he's just enabling an existing telnet server. Apparently the Boxee allows you to install add-on plugin "apps" to enable additional functionality, and Unboxed is one of these that merely calls
'/etc/init.d/telnetd start'.However, the Boxee must be downgraded to the previous release in order to allow this hack to work, as D-Link have now fixed the vulnerability, and placed better restrictions upon plug-in apps. So whilst the previous firmware allowed one to replace the software on the device (via a 3rd-party hack), the current firmware does not. Since Boxee are distributing the current firmware, they're in violation if the firmware still contains gpgv2.
I don't think the author of this piece is trying to prove the violation himself, but only to bring attention to the problem - I think that he feels it to be self-evident and established. I have to confess that googling around, I can't find proof that the current image does contain gpgv2, but it may be that I'm not looking hard enough, and that the small band of enthusiasts hacking the Boxee simply don't make a big enough impact on Google to make its front page. You'll see plenty of other allegations of violations by Boxee over the last 2 or 3 years - those were during their alpha releases, so it may simply not have been politic to take further action against them until recently.
Assuming the images are only signed (and not encrypted/compressed), a simple analysis of the image should be pretty quickly reveal the presence of gpgv2.
Even if it is compressed, 'strings | grep' may still reveal the (textual portion of the) compression dictionary -- again, making searching for GPLv3 text easier.
Failing that, depending on the nature of the storage on the boxee (don't have one), you could probably rip out the flash/hdd and scan the resultant (now uncompressed/encrypted, presumably) image -- if the media is removable at least.
[deleted]
You're right, but Boxee's problem is that they don't allow the user to only change a part of the distribution, the whole ISO is signed.
Boxee can also fix this by removing gpgv2, or by giving the users someway to change only the GPLv3 licensed software.
I hope the copyright holders of gpgv2 wouldn't settle for that. I don't believe they're obliged to - it's quite common for a GPL copyright holder to settle for a ceasing of infringement, but they're not obliged to.
The copyright holders could litigate for damages, which might constitute the value of a commercial license for the software. One might pin that at $10 per unit, which would be a good amount of money. Furthermore it wouldn't be difficult to establish that Boxee should have known better and that their infringement was egregious, which (I think) would increase their liability.
I can't see how it would be possible to give the users some way to change only the GPLv3 software, because the unit will surely look at the whole uploaded image to see if it's signed. If you allow any unsigned code on your system you've permitted a vulnerability. This all-or-nothing dilemma is a good thing for users, as they'll want to be able to replace both GPL v2 and v3 components, and probably Boxee's proprietary code, too; if a violation suit succeeds they'll be able to do whatever they want with their Boxees.
I have no expertise with copyright enforcement, you're probably correct about it all.
Technically it would be possible to allow the user to change only the GPLv3 software by separating it into an unsigned package that the user can change. However, it would open up a huge hole and it would be fairly straight to leverage that into replacing the whole OS.
Edit: I use 'You're right' way too much in my comments. I need to stop being so polite.
How is this the case? There are plenty of systems (including every PC) which allow unsigned code to run on them, and that isn't an inherent vulnerability. If you allowed the box to run any code pushed to it then there may be a vulnerability, but simply allowing the bootloader to execute unsigned system images from a USB stick or similar is not going to have a negative effect. If the attacker has to physically sit at the box and stick a USB stick into it to run unsigned code, there is essentially no security issue. It's only a box for watching TV.
Edit: To clarify, I suppose allowing any code anywhere to run is in some ways a vulnerability, but certainly in terms of software security lexicon "vulnerability" has a specific meaning which suggests that the system can be compromised in an undesirable way. If someone has to have physical access to the system to compromise it, then in the case of the boxee box (which contains essentially no sensitive data), whether or not they can run unsigned code is irrelevant. They could also steal your box, or steal your TV...
The "vulnerability" is in that Boxee are trying to lock people out of the system, and they won't be able to do that if they try to allow some components to be replaced.
Currently their firmware is cryptographically "secure" in locking out users and it's that in which the "vulnerability" would be created.
You understand about "the bootloader execut[ing] [un]signed system images", so it's that the vulnerability is in. That's why I say it's a good thing for users. I hope this makes sense.
gpgv2 is being used to secure the system by checking that the operating system image is the "correct" one made by boxee.
If I can replace gpgv2 with another version, I can replace it with my own version that simply says "Yeah this operating system image is totally legit guys!" the whole time instead of actually checking. Then I can put whatever OS image I like on there and boot it.
[deleted]