Matthew Garrett ([personal profile] mjg59) wrote2017-11-13 08:43 am
Entry tags:

Eben Moglen is no longer a friend of the free software community

(Note: While the majority of the events described below occurred while I was a member of the board of directors of the Free Software Foundation, I am no longer. This is my personal position and should not be interpreted as the opinion of any other organisation or company I have been affiliated with in any way)

Eben Moglen has done an amazing amount of work for the free software community, serving on the board of the Free Software Foundation and acting as its general counsel for many years, leading the drafting of GPLv3 and giving many forceful speeches on the importance of free software. However, his recent behaviour demonstrates that he is no longer willing to work with other members of the community, and we should reciprocate that.

In early 2016, the FSF board became aware that Eben was briefing clients on an interpretation of the GPL that was incompatible with that held by the FSF. He later released this position publicly with little coordination with the FSF, which was used by Canonical to justify their shipping ZFS in a GPL-violating way. He had provided similar advice to Debian, who were confused about the apparent conflict between the FSF's position and Eben's.

This situation was obviously problematic - Eben is clearly free to provide whatever legal opinion he holds to his clients, but his very public association with the FSF caused many people to assume that these positions were held by the FSF and the FSF were forced into the position of publicly stating that they disagreed with legal positions held by their general counsel. Attempts to mediate this failed, and Eben refused to commit to working with the FSF on avoiding this sort of situation in future[1].

Around the same time, Eben made legal threats towards another project with ties to FSF. These threats were based on a license interpretation that ran contrary to how free software licenses had been interpreted by the community for decades, and was made without any prior discussion with the FSF (2017-12-11 update: page 126 of this document includes the email in which Eben asserts that the Software Freedom Conservancy is engaging in plagiarism by making use of appropriately credited material released under a Creative Commons license). This, in conjunction with his behaviour over the ZFS issue, led to him stepping down as the FSF's general counsel.

Throughout this period, Eben disparaged FSF staff and other free software community members in various semi-public settings. In doing so he harmed the credibility of many people who have devoted significant portions of their lives to aiding the free software community. At Libreplanet earlier this year he made direct threats against an attendee - this was reported as a violation of the conference's anti-harassment policy.

Eben has acted against the best interests of an organisation he publicly represented. He has threatened organisations and individuals who work to further free software. His actions are no longer to the benefit of the free software community and the free software community should cease associating with him.

[1] Contrary to the claim provided here, Bradley was not involved in this process.

(Edit to add: various people have asked for more details of some of the accusations here. Eben is influential in many areas, and publicising details without the direct consent of his victims may put them at professional risk. I'm aware that this reduces my credibility, and it's entirely reasonable for people to choose not to believe me as a result. I will add that I said much of this several months ago, so I'm not making stuff up in response to recent events)

(Anonymous) 2017-11-13 06:35 pm (UTC)(link)
> Around the same time, Eben made legal threats towards another project with ties to FSF.

What project was this? Has this been revealed publicly?


(Anonymous) 2017-11-13 07:03 pm (UTC)(link)
Then don't include such fruitless commentary in your flame piece to someone. If you can't back a statement up with facts because it's supposedly still "behind closed doors" then don't bring it up at all.

Re: ...

(Anonymous) 2017-11-13 07:20 pm (UTC)(link)
(For the record, that reply was from a different commenter. As the original person who asked the question, I find it reasonable that some legal issues may not be public yet, and I was only asking for what details *were* already public.

Re: ...

(Anonymous) 2017-11-14 02:00 pm (UTC)(link)
Shut up you spiteful p r i c k.

"Reported violation"

(Anonymous) 2017-11-13 06:56 pm (UTC)(link)
"At Libreplanet earlier this year he made direct threats against an attendee - this was reported as a violation of the conference's anti-harassment policy."

The wording of this sentence is very vague. Was the reported violation taken care of by the anti-harassment team? Did the anti-harassment team take any action against him?
If you toss "direct threats" stories (was he swinging a mace?), you might want to back them up at least with your recollection of the events.


p.s. I usually sign with name+site, as a (tiny) form of accountability. I see no option to do that here, do you think you can allow that? If the answer is "no, for spam reasons", I'd totally understand. Thanks.

[personal profile] paulv 2017-11-13 09:40 pm (UTC)(link)
Thanks for posting this.

Karl Fogel and Neil McGovern have both written about the dispute as well, their perspectives may be informative to others reading this post.

FSF, SFC, and the SFLC

(Anonymous) 2017-11-14 03:43 pm (UTC)(link)
When will the FSF deal honestly with the so-called "GPLv2 Death Penalty"?

We all know that the German courts (in Welte vs. Sitecom; 2004) ruled quite clearly that the license offer is *always* available to everyone ... including former license violators. Why doesn't/didn't the FSF discuss this aspect of the decision when they hailed the verdict as a vindication of the GPL? My answer: The FSF is dishonest. If we can't trust the FSF to be open about something as obvious as this, what else are they hiding?

Instead the FSF continues to push the GPLv3 and assert that the enforcement component (Section 8) is more forgiving that the enforcement component of the GPLv2 (Section 4). To be clear: In terms of "copyright violation" it is more forgiving ... but in terms of "permanent revocation of license" it is not. IMO they can provide their view ... but if they provide that view without discussing actual relevant rulings that contradict that view, they are dishonest.

I've brought this up to you before two years ago (/u/redrumsir on reddit) and had hoped that, as a member of the board, you would at least bring this up and we would see a clarification in a FAQ somewhere.

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-14 07:20 pm (UTC)(link)
There doesn't seem much the FSF can do about that. The intention of the GPLv2 termination clause was indeed that a violator needed their rights explicitly reinstated. This also seems to be the case in jurisdictions like the US. But it might not work in some European jurisdictions. The FSF agreed that termination clause was too harsh and so fixed in in GPLv3. The GPLv3 termination clause should work in all jurisdictions to reinstate the rights when a copyright violation is cured.

If you are worried about the GPLv2 death penalty and the project cannot be upgraded to the GPLv3 then you could request a clarification like the kernel did. For more explanation see

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-14 09:31 pm (UTC)(link)
> The intention of the GPLv2 termination clause was indeed that a violator needed their rights explicitly reinstated.

That's just not true. The original license grant does not require a signature and makes it clear it is available to *all*. Not only that, if you are a licensee and distribute, you must also license your work to *everyone* with the GPLv2 license. The first anyone ever heard of "explicit reinstatement" was when they were drafting the GPLv3. If you read that contemporaneously with the Welte vs. Sitecom decision, you can see that the "explicit reinstatement" was *purely* a marketing ploy.

Every judge who has ever mentioned anything about re-licensing has validated that the GPLv2 death penalty is bullshit. I maintain that it was *intentionally* made up by Eben and the FSF as propaganda to promote the GPLv3.

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-14 11:02 pm (UTC)(link)
You seem to confuse what judges have ruled on in some jurisdictions with the original intent and what several legal legal scholars (in the US) believe the termination clause says. See what Harald Welte says about it in his article about the enforcement statement.

It is certainly not the case that this only came up when the GPLv3 was released. As far back as 2000 the FSF has reinstated the rights to distribute when a party permanently forfeited their rights to distribute the code because of GPL violations. The most famous case is that of KDE described here:

The FSF realized this situation doesn't scale when multiple copyright holders have rights on the same work. That is the reason they cleared this up in GPLv3.

I think we are all in agreement that the original dead penalty in GPLv2 was a mistake in hindsight. It doesn't work in some jurisdictions and where it does, it doesn't scale and has unwanted consequences. It is a good thing it got cleared up in GPLv3. And that The Principles of Community-Oriented GPL Enforcement policy says Community-oriented compliance processes should extend the benefit of GPLv3-like termination, even for GPLv2-only works. Like the kernel recently did.

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-14 11:28 pm (UTC)(link)
It is both plain reading of copyright law and the license when you grant a license without signatures and make it clear that it is an offer it to all parties. In the end, the only thing that *does matter* is what judges say. In Germany, that's clear. While not precedence, the US judge in MySQL vs. Progress in 2000 also made it clear that returning to compliance allowed them to continue distributing when she ruled against a motion to stop distribution (and that returning to compliance had "cured" the breach.

And what I find disturbing is that after all of these rulings ... the FSF does not acknowledge that their current interpretation might be wrong or even mention these rulings as a footnote. I call that dishonest!

Eben got it wrong and that bad idea has propagated through a handful of US lawyers who worked with him. *Every* judge that has ruled on the matter has shown that the GPLv2 Death Penalty is a myth/lie.

In regard to Welte ... I'm not familiar with what you are talking about -- do you have a link? Of course his lawyer in the Sitecom case (Till Jaeger) is also adamant that the GPLv2 death penalty is not valid.

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-21 03:29 pm (UTC)(link)
When you distribute a work under the GPL 2.0, you aren't sub-licensing. A new original license is granted by the copyright holders. By distributing copies or derivative works, you agree to the terms at a particular point in time. By violating the GPL after that time, creates an obligation not to distribute the covered work. Even if you consider and new license to be offered upon every distribution, there is nothing in the GPL that would free anyone of prior existing obligation to the copyright holder.

Re: FSF, SFC, and the SFLC

(Anonymous) 2017-11-27 01:30 am (UTC)(link)
> By violating the GPL after that time, creates an obligation not to distribute the covered work.

A license that requires no signatures is *always* on offer to everyone unless it explicitly says otherwise. It doesn't ... and, in fact, the text reinforces the view that it is always on offer by the use of the word "all" in section 2b as well as almost every aspect of Section 6. You can accept that offer as long as you are not currently violating it. This was a clear ruling in Germany (2004; Welte vs. Sitecom) and was implied in the US (2000; MySQL vs. Progress) when the judge ruled to not force Progress to stop distributing since they had likely cured their breach and could now accept the license again.

Do you have any contrary rulings? Do you have any actual law to site?

> Even if you consider and new license to be offered upon every distribution, there is nothing in the GPL that would free anyone of prior existing obligation to the copyright holder.

To be clear, even if they came back into compliance and were able to continue distributing, they would still be guilty of violating copyright during the period of non-compliance. This was also the substance of the Welte vs. Sitecom decision ... which the FSF hailed while simultaneously ignoring the fact that the decision was contrary to their "GPLv2 Death Penalty."


(Anonymous) 2017-11-14 04:59 pm (UTC)(link)
Objections to ZFS are morally voided by the distribution and promotion of the non-free Nvidia and Radeon software.

ZFS is more free in all respects than several things already in common distro. Go fix the real problems first.

Hopefully this will cause another replacement of uncooperative whiners like what happened with systemd.

Re: Hypocrisy

(Anonymous) 2017-11-20 11:57 pm (UTC)(link)
Objections to ZFS are not necessarily on moral grounds, they're mostly on purely legal grounds. The license ZFS is under, the CDDL, was designed in a way that is legally incompatible (many suspect intentionally) with the GPL. Mixing code under the CDDL with GPL'd code opens one up to copyright infringement claims by those with copyrights on the CDDL code in question.

Re: Hypocrisy

(Anonymous) 2017-11-26 09:29 pm (UTC)(link)
I think you are mistaken here. The CDDL is just a slightly modified MPL and inherited the GPL incompatibility from the MPL. As the CDDL is a weak copyleft, it does not forbid mixing with GPL or any proprietary license. The incompatibility comes from GPL clauses.

Re: Hypocrisy

(Anonymous) 2017-11-21 03:37 pm (UTC)(link)
The kernel-space part of the AMD driver for Vega is open-source, with an option of using closed or open user-space components.

You definitely could get into trouble if you redistribute with the modules installed.
squirrelitude: (Default)

[personal profile] squirrelitude 2017-11-15 01:20 am (UTC)(link)
Thank you for posting this, Matthew. Nasty business.