I am writing because I have recent experience with purchasing a Drupal e-commerce module from a 3rd party (not to be named), where the author has apparently recently decided to use nested base64 encryption in an attempt to obscure portions of his module code.
This module is being distributed with the standard GPL v2 license, and the EULA includes this allowance:
(c) Reverse Engineering, Decompilation, and Disassembly.
You may reverse engineer, decompile, or disassemble the SOFTWARE PRODUCT, so long as such alterations are not distributed and the Copyright Notices and License are not altered and remain with the module.
The obfuscation can be circumvented, and doing so reveals that the module is apparently is downloading essential portions of code from the author's website (along with some license validation), possibly on each instance of module execution.
This obfuscation did not exist in the previous major release for this module, and it was comparison with that version which has helped identify what the new module is doing.
I have 2 large concerns here:
1. Withholding portions of source code, and furthermore hiding the fact you are withholding portions of that code, is, to my understanding, violating terms of the GPL.
2. This is an ecommerce module, and it is supposed to handle payment processing. The act of obfuscation pretty effectively erodes any trust I have in the module author, who could very well be tracking my payment amounts and customer identities.
Besides simply not using the module, what are suggested courses of action?
The GPL violation is one thing, but the possibility this module's author is surreptitiously tracking the ecommerce of his customers seems to bring problems to a new level.
Thanks for any guidance.
Revision reverted. Please don't blank out threads you start on d.o. Thanks.
Comments
=-=
Why is this thread in paid services? General discussion is likely a better place for it.
beyond dropping the module the only alternative is to hire an attorney.
I'd imagine the module in question is hosted off d.o ? if on d.o then you can file a webmasters issue where d.o admins and maintainers can look into the issue. Non GPL code should not be distributed on d.o
Authorship
If the author is indeed the author, then the author can provide, or not provide, or obfuscate to his/her liking, regardless of the GPL.
The GPL is a license, not a contract, that grants rights that you would not already have. The author begins with all rights and is not bound by the GPL. You, who do not own the work, are.
_
Sorry y, but I don't think this is quite true. Per http://drupal.org/licensing/faq all drupal modules must be released under the gpl-- therefore the authors of drupal modules are indeed bound by the GPL. But the GPL only kicks in upon distribution of the code-- which is what the author is doing upon selling it.
I would report it as a GPL violation to the drupal association.
Does Drupal's GPL also apply
Does Drupal's GPL also apply to modules not hosted on d.o? Is a Drupal module considered a derivative work just because it is a Drupal module (as opposed to being a derivative of an existing module), regardless of where it is distributed? I understand that selling modules is fine in the sense of "free as in libre," but that withholding source code is not.
=-=
my understanding is only code that directly touches drupal code is required to be GPL, if the developer wrote an entire script that plugs into drupal, the plugin code is GPL the remainder may not be.
My research turns up http://www.wildkatana.com/blog/click2sell-suite-drupal-module-paid-membe...
but without knowing for sure which module is in use and being able to look at it, or others to look at it. .....
I am the author of Click2Sell
I am the author of Click2Sell Suite. That module has no encryption and is completely within the bounds of the GPL. In addition, I run http://www.moneyscripts.net , where I sell some Premium Drupal modules for clients with special needs for e-commerce and money-making websites. None of my modules are encrypted in any part. :)
I've done extensive research into the GPL and my lawyer has advised me on this: Modules can act as a bridge between a third-party, non-gpl program, which can be encrypted and protected by different licenses, disallowing resale or redistribution.
I don't employ those methods, but it IS legal to do so, and is worth mentioning.
Sincerely,
Leighton Whiting
buzzzttt - Wrong answer! sorry contestant No.2
Leighton,
Get a better lawyer. His/er understanding of the GPL is flawed and is easily addressed by either you or him/er upon reading the licensing guidelines issued by the Drupal Foundation, The Free Software Foundation and here on Drupal.org.
I note on your website as retrieved on July 6th 2010 the statement:
Ah... no - GPL is Free Software.
UNDENIABLY - Your current practices directly violate the spirit, the intent and if you care to more carefully read the GPL license, the letter of GPL and specifically an arbitrary (or worse - DRM system) to RESTRICT what a user does with the software violates freedom 0.
GPL - I.E The 4 essential Freedoms:
(see: http://www.gnu.org/philosophy/free-sw.html)
So you need to change your practices to be compatible with GPL conduct with respect to Drupal and the provision of module(s) thereto.
I do not know how wedded your are to your proprietor behaviour - But one alternative would be to write your own CMS and distribute it under a commercial license.
Just saw this reply, sorry
Just saw this reply, sorry for my late reply. The user can of course use the software on as many domains as they want during and even after their updates license expires, but they are only eligible under the terms of the license to receive automatic updates (through the XMLRPC updater I have built in) on up to 5 domains. This is not a violation of GPL.
People who need high quality solutions for e-commerce and other business related uses are willing to pay for a support/updates license because it helps ensure that the software is continually updated and they are given quick support when/if they run into issues.
I also release modules on drupal.org for free, and I am currently building the Project Browser module that will be in Drupal 8 Core if things work out right :) The reason I decided to charge a support/updates license for the MoneyScripts modules is because I wanted to be able to spend more time adding new features and support for them to continue improving them.
The FAQ is about Drupal.org
The FAQ is an excellent explanation of the ground rules for posting modules on d.o., but the original poster referred to a transaction that had nothing to do with d.o.
The better place for the original poster to turn is the Software Freedom Law Center, http://www.softwarefreedom.org/, which might lean on the module author to provide the purchaser with legible source code to his work.
However, they also might tell you this is not a good case to pursue. See http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#MereAggregation and consider whether the author distributed Drupal at all, and whether a derivative was created (and by whom). The GPL says " If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works." See http://www.groklaw.net/article.php?story=20031214210634851, which discusses the difference between a contract and a license, and touches on the (messy) issues of ownership, control, and the creation of derivative works.
For an example of how GPL isn't viral "upstream," consider the existence of closed binary drivers for Linux (which are linked directly to the kernel by the user) and closed-source applications (which depend on the kernel to run, and are clearly written to work with and require it).
There are plenty of people who claim any Drupal module is automatically a derivative work. However, that is just a claim. People, including lawyers, can claim anything they want, and there aren't any court cases to clear it up, and some persuasive counterarguments.
Ultimately you have to ask yourself: What are you trying to accomplish?
_
I advise everyone to reread http://drupal.org/licensing/faq-- it's pretty straight forward as licensing statements go and it's not just applicable to code hosted on drupal.org:
the drupal project is not just what's hosted on drupal.org but the entire project.
Per http://drupal.org/licensing/faq#q7, all modules must be released as GPL not just those hosted on drupal.org. There are paragraphs for bridge modules and themes (which can have CC or other non gpl parts, though everything hosted on d.o must be GPL).
Also, for additional questions see http://groups.drupal.org/legal
Thank you for the detailed
Thank you for the detailed responses. Development and privacy concerns notwithstanding, I believe all questions I had about the GPL's applicability have been answered.
The module is question is not the click2sell mentioned above, and it is not hosted on d.o., although it is a full module that interacts directly with Drupal core.
=-=
I think it's safe to say that until these licenses are physically tested in a court of law to create a path of common law, it's all boy scouts honor code.
This actually answered (I think) my own query...
I was logging in to find out if GPL, thus the Drupal modules listed here as such, can be zipped and redistributed as a package as long as no claims to authorship of the modules are made.
As for this specific topic, Open GL, to the best of my knowledge, is intended to be freeware, thus beg notices for donations to the author, not a "shareware" purchase of a license that is supposed to be granted simply because it's GNU/GPL. As VM stated, it's an honor system.
One thing the net provides to ANY author is a "date stamp" and, if saved to one's computer, even an incept file, thus "poorman's copyright" protection, which is still valid to a degree for say verbatim rips et al, though tougher to complain about derivative work.
Here in America there's a "Reasonable Use" code in effect since the late 80's I think it was. Still, if you cite from another work and include a blurb from it into your own, it's safest to "Give credit where credit is due." Work in America copyrighted prior to 1964 is public domain, still it is one thing for me to say discuss and derive from HG Wells' "The Time Machine," ( http://chronic.tempathy.net/page3.php ) and even use Eloi and Morlocks, since names cannot be copyrighted, where it's another thing to rip the whole book, title it "The Time Machine" and put my own name in the author's slot. The latter action is plagiarism.
As the topic concerns, ethics is the question. Is Open GL international?
=-=
I'd think it's as international as copyright laws in which some abide by and others completely ignore