> We have found that neither company complies properly with the GPL. Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points, even when we repeatedly asked over the course of several weeks, starting more than 30 days ago.
Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code.
The mentioned GPL in the article is v2, so lifting from there, the valid parts are probably:
> a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
> b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
The sfconservancy is quite well versed in GPL enforcement. They typically have someone who has purchased the device send a request or they just buy a device.
They say that aren't litigating, so it's moot for now, but I wonder... If they do want to sue, they will have to find someone with standing in order to do so. I suppose that won't be difficult for them, but I'm curious how they might go about it.
Conservancy represents various Linux kernel and other developers who hold copyright on parts of the Linux kernel and other projects. In other cases developers reassign their copyright directly to Conservancy. Then Conservancy performs copyleft compliance actions, aimed at code release, with lawsuits being a very last resort reserved for wilfully non-compliant organisations.
I was wondering: what if I am able to extract the firmware from a device, or download the firmware from their website? Should I then also be able to ask for the source? AFAICT, the answer to this question is: Yes.
IANAL but yes, distribution is distribution. If one distributes GPLed code, one is subject to GPL terms towards whoever received such software.
I guess the exception would be malice or misrepresentation, e.g. faking you are a customer in order to download the firmware, or hacking servers and grabbing stuff. In that case the vendor is not wilfully distributing, and hence not subject to GPL terms.
In the case of extracting firmware, though, one might run afoul of anti-reverse-engineering provisions in laws like DMCA.
They don't have to buy a device - Ubiquity has distributed a a device with a copy of the copyrighted thing without fulfilling the GPL conditions (since neither the code nor a legally binding offer to provide the code was attached).
That's a simple copyright violation (making and distributing copies without a valid license to do so), and since Conservancy represents copyright holders (some of the developers) whose copyright has been violated, they have standing to sue.
No, that language is in both GPLv1 and GPLv2 (in GPLv3 it’s “anyone who possesses the object code”).
Yes, it’s one of a list of alternatives. The GPLv1 and GPLv2 sole applicable alternative to the written offer is to send the source code together with the compiled code; i.e. to all customers, in the box. Which they presumably didn’t do, so I don’t know why you bring it up.
(GPLv3 adds the allowable alternative to point to a web page or similar where the source code may be downloaded. I.e. you don’t have to waste money by shipping a CD, you can just print the URL on a note or in the manual. But this was the GPLv2, not v3, so it’s not applicable here, nor has anyone said that any such URL was provided.)
My mistake, you are right in that the same language appears in v2.
My point is that the op commented:
> No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
...and I am agreeing to this position, against fuzzyh. Specifically "anyone" != "any third party" != "any third party... unless you've abided by a) or b), which don't require distribution to 'anyone' either."
That’s correct, in case they actually ship the source code with the hardware, they’re complying. I very much doubt they do that. As such, option b) comes into play.
The GPL FAQ is very clear on the point that "any third party" means exactly that: Anyone that gets a hold of the offer (which you’re required to provide, otherwise probably also a violation) can request the source code.
Also, while Ubiquiti is failing to provide the source code for AmpliFi, they do comply in other areas. Their claim that they don't provide the GPL licensed code at all is flat out false.
I wanted to download the archive for Unifi nanoHD, the GPL archive is mentioned in the download blurb, but there's no link to it and the normal download shows classic proprietary EULA, including no reverse engineering.
I thought they were compliant for UniFi AP firmware but not 100% sure on that. I've seen in the past where upon a new release being published they would forget to update the GPL archive on the site. Just email support@ui.com and they do have it internally. At the very least I found a current copy on the downloads page for EdgeMax and I've seen others mention it for UniFi, mFi, and airMax. The only thing Ubiquiti seems to be openly flaunting the GPL on is AmpliFi where I've personally emailed them, escalated the request to their "Development team" and received a response more or less equating to "go pound sand".
They seem to be skirting their requirements in not providing the full git repository for the GPL portions which might be a bit of a gray area but AFAIK the GPLv2 stipulates "The source code for a work means the preferred form of the work for making modifications to it." which I would think would encompass the git repo as well but IANAL.
In the past they also refused to provide the source code for their modified version of uboot claiming some nebulous security reasons but that stopped a little while back.
The EULA doesn't apply to the entirety of the download.
> c. i. Certain software included in, distributed with or downloaded in connection with the Software may comprise third party proprietary software products that are subject to separate license terms (“Third Party Software”). All such Third Party Software may include software or software components that are derived, in whole or in part, from software that is distributed as free software, open source software or under similar licensing or distribution models (“Open Source Software,” together with Third Party Software, “External Software”).
> c. ii. Your use of External Software is subject in all cases to the applicable licenses from the External Software provider, which shall take precedence over the rights and restrictions granted in this EULA solely with respect to such External Software.
So they've just bundled the GPL software along with the not, and you can freely use the GPL'd software within the context of what the GPL allows.
The GPL does not actually force anyone to give out source code. The GPLv2 requires to either give out source code to customers, or to give customers a written offer (valid for anyone, not just customers). It is this optional offer, which, being a promise, forces the giving out of source code to anyone in possession of this offer. Failure to honor such an offer is probably not a GPL violation, but a simple breach of contract/promise.
If no such offer was given, then the GPLv2 was violated, full stop. The Conservancy had really no need to ask for source code, since the GPLv2 violation occurred when no offer nor source code was given to customers. The fact that the Conservancy did offer the violators a way out by asking for source code is a pure nicety on their part, since they really didn’t have to.
> Some of the software in the firmware is licensed under the GNU General Public License and other Open Source and Free Software licenses. You can find the complete and corresponding source in the GPL archive. [0]
They seem to have plenty of GPL sources available for download when you grab the firmware (and without having a device to test, it may actually include the source code with itself), so it seems they do offer up this source code. (The firmware download does come with a EULA, but the EULA specifically spells out it only applies to the proprietary bits, and not GPL and other Open Source software.)
So it seems that the claim "Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points..." needs more information before we can be certain that it is correct.
Again, technically, GPLv2 does not allow the source code to be made available only for download. Only GPLv3 allows that. And, since Linux is GPLv2 only, the GPLv2 applies.
Therefore, the source code has to be either a) shipped with the product (it obviously wasn’t) or b) available upon request as specified in a written offer, which must be shipped with the product. If neither option a) nor b) was used, Ubiquiti unambiguously violated the GPLv2, and has no defense.
> Unless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code.
They don't represent users, they represent copyright holders. A copyright holder does not need to buy a violating product in order to enforce their copyright.
Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL.
GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
> Correct, but they aren't enforcing their copyright, they're claiming a breach of GPL.
Which is the same thing. The only way to "claim breach of GPL" is to enforce copyright. These companies have no right to use the respective copyrighted software without a license, and as they are not using it under the terms of the GPL, they have no right to use it at all, which is why their use of the software is a violation of copyright.
> GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
They wouldn't be. But they are still in violation of copyright, so they better do what the copyright holder demands to rectify that situation if they don't want to be sued over that copyright violation.
They are distributing software that they don't own the copyright to, and as they are violating the GPL by not providing the source or a valid offer to provide the source on request with the software, they have voided their rigfhts under the GPL as well, so they are illegaly distributing that software. The copyright owners therefore probably could get their products pulled from the shelves to stop that copyright violation. Instead of doing that, the copyright owners are offering them the option to reinstate their rights under the GPL if they provide them with a copy of the source code they would have to provide their customers under the GPL and get compliant with the terms of the GPL.
What GPL projects are Ubiquity using? I would have thought they would be using something FreeBSD derived as they sell networking gear which leads me to believe that whatever the infringement entails it’s not related to the core networking components or software.
Ubiquiti's stuff is all based on Debian Linux. You can even SSH in, enable the upstream repos, and apt-get stuff. But they patch a bunch of packages and of course the kernel is their own build for their hardware.
Everything is Linux based. Debian specifically if I’m remembering correctly on the access points. The routers are based on the vyatta code that brocade open sourced.
Repeaters are put where your signal is already low (not right to the router's antenna). This means they will just repeat signal that is already low, and the further you get from repeater itself the signal will get even worse.
Ie. You put repeater where your signal is at 50%. When you stand near it with your phone, it will show full wifi, but it will be just at 50% of the original one. Then you move away from repeater and you see that your signal is at 50%, which in reality means it's just 25% of the original... so yea, that sucks.
Try UniFi or edgerouter from Ubiquiti and return it if you don’t like. Despite the recent bad press, it’s a wonderful ecosystem. They are like the Apple of pro-sumer network gear and catch as much flack as Apple.
MikroTik is cheap but lacking on the software and UI side. There are lots of complaints about RouterOS and SwitchOS on forums. I will be getting a 10gb switch for my backbone in the near future due to price.
I have top to bottom UniFi gear in my house and a family vacation home. I also use UniFi protect which is their video option. Tons of PoE APs, switches, and cameras available. Setting up dynaDns, home VPN, subnets, and automatic updates are a breeze with UniFi.
If you have specific questions I’d love to answer it.
I searched for alternatives and still went with ubiquiti. They exist in an interesting zone of technically competent, reasonably priced, and able to function without internet access. It is hard to find a competitor that hits all those marks.
41 comments
[ 2.8 ms ] story [ 70.3 ms ] threadUnless sfconservancy first purchased a router, I don't believe that the GPL forces them to hand over the source code.
The mentioned GPL in the article is v2, so lifting from there, the valid parts are probably:
> a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
> b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,
No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
https://sfconservancy.org/copyleft-compliance/ https://sfconservancy.org/copyleft-compliance/principles.htm...
I guess the exception would be malice or misrepresentation, e.g. faking you are a customer in order to download the firmware, or hacking servers and grabbing stuff. In that case the vendor is not wilfully distributing, and hence not subject to GPL terms.
In the case of extracting firmware, though, one might run afoul of anti-reverse-engineering provisions in laws like DMCA.
That's a simple copyright violation (making and distributing copies without a valid license to do so), and since Conservancy represents copyright holders (some of the developers) whose copyright has been violated, they have standing to sue.
It is also part of a list of 'or' options. You can abide by one of the other options and not need to adhere to this one.
Yes, it’s one of a list of alternatives. The GPLv1 and GPLv2 sole applicable alternative to the written offer is to send the source code together with the compiled code; i.e. to all customers, in the box. Which they presumably didn’t do, so I don’t know why you bring it up.
(GPLv3 adds the allowable alternative to point to a web page or similar where the source code may be downloaded. I.e. you don’t have to waste money by shipping a CD, you can just print the URL on a note or in the manual. But this was the GPLv2, not v3, so it’s not applicable here, nor has anyone said that any such URL was provided.)
My point is that the op commented:
> No part of the GPL, as far as I'm aware, requires distribution to anyone who isn't a customer.
...and I am agreeing to this position, against fuzzyh. Specifically "anyone" != "any third party" != "any third party... unless you've abided by a) or b), which don't require distribution to 'anyone' either."
That’s correct, in case they actually ship the source code with the hardware, they’re complying. I very much doubt they do that. As such, option b) comes into play.
The GPL FAQ is very clear on the point that "any third party" means exactly that: Anyone that gets a hold of the offer (which you’re required to provide, otherwise probably also a violation) can request the source code.
https://dl.ui.com/firmwares/edgemax/v2.0.x/GPL.ER-e300.v2.0....
All you have to do is click on "GPL Archive" on the download page for the firmware.
I wanted to download the archive for Unifi nanoHD, the GPL archive is mentioned in the download blurb, but there's no link to it and the normal download shows classic proprietary EULA, including no reverse engineering.
They seem to be skirting their requirements in not providing the full git repository for the GPL portions which might be a bit of a gray area but AFAIK the GPLv2 stipulates "The source code for a work means the preferred form of the work for making modifications to it." which I would think would encompass the git repo as well but IANAL.
In the past they also refused to provide the source code for their modified version of uboot claiming some nebulous security reasons but that stopped a little while back.
> c. i. Certain software included in, distributed with or downloaded in connection with the Software may comprise third party proprietary software products that are subject to separate license terms (“Third Party Software”). All such Third Party Software may include software or software components that are derived, in whole or in part, from software that is distributed as free software, open source software or under similar licensing or distribution models (“Open Source Software,” together with Third Party Software, “External Software”).
> c. ii. Your use of External Software is subject in all cases to the applicable licenses from the External Software provider, which shall take precedence over the rights and restrictions granted in this EULA solely with respect to such External Software.
So they've just bundled the GPL software along with the not, and you can freely use the GPL'd software within the context of what the GPL allows.
The GPL does not actually force anyone to give out source code. The GPLv2 requires to either give out source code to customers, or to give customers a written offer (valid for anyone, not just customers). It is this optional offer, which, being a promise, forces the giving out of source code to anyone in possession of this offer. Failure to honor such an offer is probably not a GPL violation, but a simple breach of contract/promise.
If no such offer was given, then the GPLv2 was violated, full stop. The Conservancy had really no need to ask for source code, since the GPLv2 violation occurred when no offer nor source code was given to customers. The fact that the Conservancy did offer the violators a way out by asking for source code is a pure nicety on their part, since they really didn’t have to.
you left out an important word after "offer":
> a written offer, valid for at least three ...
So it's not just requiring an offer be made, it's requiring a offer being made which is valid (with certain conditions)
If you make an offer you have no intention of honouring, surely that's not a valid offer?
They seem to have plenty of GPL sources available for download when you grab the firmware (and without having a device to test, it may actually include the source code with itself), so it seems they do offer up this source code. (The firmware download does come with a EULA, but the EULA specifically spells out it only applies to the proprietary bits, and not GPL and other Open Source software.)
So it seems that the claim "Specifically, in our analysis of the facts, we have found that both Cambium and Ubiquiti fail to provide any source code for their respective routers and access points..." needs more information before we can be certain that it is correct.
[0] https://www.ui.com/download/edgemax/default/default/edgeswit...
Therefore, the source code has to be either a) shipped with the product (it obviously wasn’t) or b) available upon request as specified in a written offer, which must be shipped with the product. If neither option a) nor b) was used, Ubiquiti unambiguously violated the GPLv2, and has no defense.
They don't represent users, they represent copyright holders. A copyright holder does not need to buy a violating product in order to enforce their copyright.
GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
Which is the same thing. The only way to "claim breach of GPL" is to enforce copyright. These companies have no right to use the respective copyrighted software without a license, and as they are not using it under the terms of the GPL, they have no right to use it at all, which is why their use of the software is a violation of copyright.
> GPL doesn't force you to upstream your changes, and so, within the context of GPL v2, where would they be forced to hand over source code on request to sfconservancy?
They wouldn't be. But they are still in violation of copyright, so they better do what the copyright holder demands to rectify that situation if they don't want to be sued over that copyright violation.
They are distributing software that they don't own the copyright to, and as they are violating the GPL by not providing the source or a valid offer to provide the source on request with the software, they have voided their rigfhts under the GPL as well, so they are illegaly distributing that software. The copyright owners therefore probably could get their products pulled from the shelves to stop that copyright violation. Instead of doing that, the copyright owners are offering them the option to reinstate their rights under the GPL if they provide them with a copy of the source code they would have to provide their customers under the GPL and get compliant with the terms of the GPL.
What are good alternatives?
At the same time if you want something more customer friendly simply search for "mesh system" (all major brands have one).
P.S. Zero affiliation to them.
Repeaters are put where your signal is already low (not right to the router's antenna). This means they will just repeat signal that is already low, and the further you get from repeater itself the signal will get even worse.
Ie. You put repeater where your signal is at 50%. When you stand near it with your phone, it will show full wifi, but it will be just at 50% of the original one. Then you move away from repeater and you see that your signal is at 50%, which in reality means it's just 25% of the original... so yea, that sucks.
MikroTik is cheap but lacking on the software and UI side. There are lots of complaints about RouterOS and SwitchOS on forums. I will be getting a 10gb switch for my backbone in the near future due to price.
I have top to bottom UniFi gear in my house and a family vacation home. I also use UniFi protect which is their video option. Tons of PoE APs, switches, and cameras available. Setting up dynaDns, home VPN, subnets, and automatic updates are a breeze with UniFi.
If you have specific questions I’d love to answer it.
https://web.archive.org/web/20170430232455/http://libertybsd...
and
https://web.archive.org/web/20161209121359/http://libertybsd...
These specific issues have been resolved...