Exploring Open Source Licensing with Tidelift’s Luis Villa

This is Textron tv. Hey guys. Thanks Ur.

We're here with Louis Villa, who is general counsel for Tide Lift, and we're talking about a lawsuit that's gonna impact the open source community. It's being brought by an outfit called the Software Freedom Conservancy, and they're suing Vizio about their use of general public licenses. And I'm gonna let Louis explain to us what's going on in the court case itself, but it sounds like we should all be paying a lot more attention to it.

Louis, welcome the show. Yeah, thanks Michael. Uh, thanks for having me.

Yeah, this is one of these things that's, it's simultaneously very quiet and small, and the impact is potentially huge. So let me, let me step back a little bit. And, you know, for those of your listeners who aren't, uh, super into the details of open source, all of open source, uh, software is distributed under, uh, licenses of some sort.

Some of them say just, yeah, do whatever you want as long as you give me credit. Some of them, most famously the guo General Public License require you to give back your changes to those who get the software from you. And, uh, that's sometimes called copy left.

There are a couple other copy left licenses, including the Mozilla public license, which I helped write version two of. But, uh, the big one is the, the, the granddaddy of 'em all is the Goodo Journal public license. It's used amongst other things by the Linux kernel as, uh, your listeners probably do know.

The Linux kernel is in everything these days. It's in my printer, it's in my tv critically, in this case it's in Vizio TVs Vizios, a really big smart TV vendor. Uh, they sell a lot of TVs here in the US and they all have Linux in them.

Software Freedom Conservancy is a small, uh, New York nonprofit and, uh, a lot of the staff there have been involved in free software for a very long time. Uh, some of them for, uh, 30 years almost. And so basically, as long as there has been a Linux kernel, uh, some of these folks have, have been involved over on the staff there and they, uh, like a lot of dedicated free software people, I think have gotten increasingly frustrated at how many people use the Linux kernel without necessarily complying with those license terms that, you know, the share and share alike or copy left license terms.

And the thing is, is that those terms traditionally have required the participation of the authors of the software in order for a lawsuit to go forward, right? So imagine if you think herding caps to get them to write a operating system kernel is hard. Uh, at least they enjoy writing an operating system kernel, uh, getting, herding them to sign onto a lawsuit, which is something that it's not really fun, uh, is, uh, is pretty hard.

And so conservancy innovate is a, is an overly used word, but they did, they came up with a creative way to try to enforce the license that doesn't require the participation of the authors. And last week we got a ruling on that very preliminary stages, but it did, if this ruling holds up, it changes the game because it changes. Who can enforce the license on the Linux colonel from only the authors to anyone who buys a device with the colonel inside of it?

Why do they care about this particular issue? Because if the authors aren't willing to fight about it, then why is there somebody else who's essentially claiming they have standing in a court case making the effort? Uh, well that's a good, I mean, there's a sort of simple reason, and this is what the court is gonna pay attention to or not, uh, which is that the license literally says the point of the license is to benefit other people, right?

It's to benefit the people who buy the things with the code in it. Uh, the license, I think mostly by coincidence, I can't say that it was strategic genius on the part of the drafters, but the license specifically talks about the third parties who might, uh, come into possession of some code with the Lenox curlin. And it says that those third parties are supposed to get the source code, right?

Like that's part of the philosophy behind the license, behind free software, is that I'm supposed to be able to get it so that I can modify it or I can pay somebody realistically more likely so I can pay somebody else to modify it. So since the license uses those words about the third parties who are supposed to benefit the doctrine of state law, uh, that is so old, actually, some parts of it go back to the 16 hundreds in England. Uh, is that sometimes when you have a contract, sometimes third parties can sue to enforce that contract.

Now, very common. Uh, it doesn't happen a whole lot, especially in the modern era. We try to be pretty precise about who benefits from our contracts.

Uh, but uh, state law, again, dating back to the 16 hundreds, says things like, well, hey, if I buy a cake and I say it is to be delivered to my mom 'cause it's her birthday. Hi mom. Sorry I didn't call until late on your birthday last week.

Um, the, uh, the court says that not only can I sue if the cake is not delivered, my mom can sue if the cake is not delivered. 'cause she is an intended beneficiary of the contract, even though she didn't sign it. She, in the ca case, supposed to be a surprise she didn't even know, right?

But then at the end of the day, the contract is intended to benefit her. Similarly, the general public license is intended to benefit the public, right? The people who buy these TVs for various reasons, that has always been there in the language of the GPL.

Um, but we've never taken that seriously as an enforcement mechanism until now. So theoretically, how big an issue can this be? 'cause I feel like there's a lot of people who have taken Linux and stuck it in embedded systems and then used it or sometimes even tweaked or extended it, but they have not necessarily made that available to other folks.

So, um, would they all be compelled? Yeah, I mean, potentially it's very big, right? Something I have tried to stress when talking to people about this is that at some level, this doesn't change the license at all, right?

We're not creating new, um, obligations for these vendors. Visio always had this obligation. The only question was who could enforce it?

And uh, but as you say, this is a lot of vendors and a lot of people didn't take that obligation very seriously because, uh, the number of people who could enforce it was small. And in fact, because enforcement is sometimes controversial, it's not just the number of people who could enforce it as small. Those people have a lot of almost peer pressure not to enforce, right?

Like Linux kernel folks. Um, I mean, as you say, or as you, you sort of hinted at some people who contribute to GPL code actually don't want to enforce it. And depending on where you are, like what country or state you're trying to enforce the GPL in, you may actually need to have not just one author, but all of the authors, uh, get together to enforce the license as a copyright license.

And this theory sort of blows that out the window and says essentially anybody who has the resources to file a case could enforce it. Now, that's a big if right there, right? Uh, these cases are expensive.

Uh, Vizio has hired one of the highest profile, uh, law firms in the country to defend themselves. Uh, and under this theory of contract, one of the interesting things, the difference between contract and copyright, copyright law, if you win a copyright case, what you get is money. You can't force people to do a specific thing at the end of the, at the end of a copyright case other than stop distributing the thing.

Uh, in contract law, there's something called specific performance. Specific performance means a court can say you do the specific thing, perform the specific thing that is called for in the contract, but usually not financial penalties. So contract law.

So copyright lawsuits tend to be sort of self-funding, right? Like if I got Visio on a copyright claim, they'd have to gimme money. That's the nature of copyright law.

And I could use that to then fund the next set of lawyers, the next set of lawsuits. It becomes a sort of snowballing thing because of the money, this case. Uh, and part of why I think what, whatever else this may do, uh, you at least can't say that this is a case brought for financial game by the conservancy folks, right?

They are very much doing this. 'cause they genuinely believe the world will be better with a lot more source code out there, a lot more GPL source code out there, right? So if they win this case, what they could get is source code to the Visio tv, but they probably won't get a lot of money out of it.

They might at best get some of their costs. So, you know, so, so this does at least in theory, broaden the number of people who can bring these kinds of lawsuits, but it doesn't necessarily create a huge financial incentive to do so. What will be the impact on development teams in general?

And I'll cite an example. It's fairly common for people to take an open source project and kind of tweak it and fork it, and then they use it internally and then they embed it into some sort of application somewhere that other people use and nobody blinks an eye. But in this, if this case goes through, would then it become an issue where if I did not make that code available or contributed back to the original project, then uh, that I would be open to this kinda legal jeopardy?

Yeah, I mean, as I said, the legal jeopardy was always sort of there. And so this is one of these things where lawyers sometimes do a bad job of distinguishing for their clients between, uh, what their obligations are and what the probability that they'll be called on to ask to, to do the thing, right? The lawyers sometimes we're in a hurry, retired, whatever.

We sometimes conflate the two and we say, ah, no problem. Well, what we mean is very low probability of a problem. But if the problem happens, bad outcomes, right?

So this is gonna change that probability. Absolutely. If, if it holds still very early, we're several years away from getting anything if It holds, am I gonna like see all these, um, you know, I live in Florida, so there's, you know, every third commercial is about a lawyer asking people the, if they got a case that's worth bringing and you know, we're gonna make a billion dollars.

So is this gonna create a cottage industry of lawyers who are gonna go poking around? Uh, I grew up in Miami. I've seen those ads.

Uh, you know, I don't, um, uh, and my dad's a doctor, so, you know, he thinks about medical malpractice a lot. That's what a lot of those ads are about. The thing with those kinds of cases is that the lawyers get a chunk of the financial penalty, right?

And so they use that to buy ads. It's that snowball that I was talking about earlier. I don't think we're gonna see that here.

But of course, because for any one company, uh, that's involved in selling embedded devices, that the penalty might be high. If they become involved in a case, we'll certainly see more compliance efforts internally, right? There's already a pile of tooling to help companies comply with this sort of thing.

Like honestly, I'm a little surprised at Vizio of all companies. They're not fly by night tiny kind of company, right? They're a big sophisticated company with a fairly big sophisticated software, uh, team.

So little surprising that they don't already have a lot of these best practices in place. In fact, it wouldn't surprise me if that's part of why Conservancy targeted them is that Conservancy sort of did an audit of all the smart TVs. And I wouldn't surprise, again, I don't know, I've, I've not spoken to them directly.

Uh, you know, I bet that they sort of looked around and said, okay, well who's got the most egregious violations? Uh, 'cause if you look at the details of the court docs, it's a pretty clear cut violation of the license. And the only question, the big question is not did they violate, but the question is, first, can conservancy bring it, uh, bring the case about the violation, and then what are the da what are the penalties?

Assuming that there was a violation, and I think it's pretty clear, pretty clear there was a violation. And so the only question is what's the scope of that? There are best practices companies can do that, but we will, I'm sure, see some pushback, right?

It wouldn't surprise, for example, uh, you know, as some of your listeners may know there are alternatives. Uh, MAC OSS is based on the bsds, uh, the Berkeley systems, distribu, Unix Unixes, which are under a more permissive license. Wouldn't necessarily surprise if some smart TVs start switching from Linux to BSD if this case goes through.

But we don't know it's early. Do you at all worry this might have a chilling effect on people's usage of open source? 'cause they're gonna be like, this stuff's getting a little too hard to navigate legally, and maybe we'll just do something small and proprietary and not worry about it.

You know? Um, I think that would've been true 20 years ago, right? Uh, it might have a chilling effect specifically on the GPL, um, but it's, um, you know, but it wouldn't be.

Uh, but, but the outcome wouldn't be that people will switch away from open source altogether. It's that they'll just look around for alternatives to G based code, right? So they'll look at bsds to replace Linux, or there's already a thriving community of people replacing a lot of the, uh, GPL tools that go above Linux.

There's already a lot of people replacing those with permissive licenses, like for funsies, right? Like, there's literally like a whole community who's like, we like rust, rust is cool. Let's learn to write rust by, um, let's, let's learn to write rust by replacing the canoe tools with permissively replace their very old sea, very old, possibly insecure sea with, um, uh, you know, with cool new secure permissively licensed rust.

Wouldn't surprise if we get a lot of, uh, investment in that, for example, which happens to coincide with security, which is of course the industry's other big concern these days. All right, folks. Well, you heard it here.

We don't know what the ultimate outcome is gonna be, but I think there's a song out there that needs to be updated. It's, I think it was by Alvis Costello and it was about lawyers, guns, and money. And maybe it should have been lawyers coding money.

'cause that's where we're all headed. Yeah. Yeah.

I mean, I, I think, uh, yeah, it, it's funny. I think the one last thought that I would have on this is that we've all, for a long time sort of pretended that lawyers aren't involved in this, right? Like we, we, we created our constitutional documents, we slapped them on all this code, and then we're like, okay, great.

Thank you lawyers. Your role here is done. And this is a reminder that that's still a dynamic ongoing thing.

And we're gonna see that a lot, not just with this, but with AI and, and privacy as well. So it's, it's a very real interaction, which is fun for me. I'm sorry for everybody else.

I apologize. All right. Hey Louis, thanks on the show.

Yeah, thank you, Michael. All right, back to you guys in the.