Copyright infringement and GPL violation in tinypeap

[Alan DeKok-4]

-----BEGIN PGP SIGNED MESSAGE-----

  Your web site http:/www.tinypeap.com (hosted at the Georgia
Institute of Techology, machine "rhampora.cc.gatech.edu") is
distributing programs built at least in part from code that is derived
from the FreeRADIUS server project (http://www.freeradius.org).  I
refer you to the following URL's:

http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=5649

  This message contains text with error messages "rlm_eap_tls:
SSL_read failed inside of TLS ".  The "rlm_eap_tls" module is part of
FreeRADIUS, is copyright by me personally, and is licensed under the
terms of the GPL.

  However, in the forum post at:

http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=4533

  You claim that tinyPEAP is "closed source".  You further do not
acknowledge my copyright on code that you distribute.

http://www.tinypeap.com/bin/peapd-beta1.zip

  This URL points to a file which contains "peapd.exe".  That file
contains at least the following text strings, which are either
identical to strings included with FreeRADIUS, or substantially
similar:

- --
rlm_eap_tls: FATAL SSL error ..... %d
rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails.
rlm_eap_tls: %s failed in a system call (%d), TLS session fails.
handshake_send
rlm_eap_tls: Application Data
In SSL Connect mode
In SSL Accept mode
Before SSL Handshake Phase
In SSL Handshake Phase
SSL Connection Established
SSL_read
 rlm_eap_tls: Requiring client certificate
rlm_eap_tls: Error creating new SSL
- --

  This code is part of the FreeRADIUS project, and you are infringing
on our copyright, and violating the GPL by copying it without
following the terms of our license.

  Nothing under copyright law gives you permission to use our
copyrighted code without our permission.  The only license terms
available for the code in question is the GNU GPL, which is
distributed with the FreeRADIUS server source.  The terms of that
license require you to make the source code for derived works
available under the same terms as the the original code.  I refer you
to section 2 (b):

- ---
    b) You must cause any work that you distribute or publish, that in
    whole or in part contains or is derived from the Program or any
    part thereof, to be licensed as a whole at no charge to all third
    parties under the terms of this License.
- ---

  We have tried contacting the public email address for tinypeap:
"[hidden email]".  We have yet to receive a response.  We are
sending this message to the contact address listed in "whois", and to
the Georgia Institute of Technology Office of Legal Affairs, as you
are distributing the infringing material from a machine hosted at that
institute.

  You have 24 hours to remove all infringing binaries (tinypeap.exe,
and any Linksys firmware containing the infringing code) from your
website, or to comply with the terms of the GPL by releasing the
source code to tinypeap under the GPL.

  If you do not choose to release the source under the GPL, you must
remove the infringing code from any version of tinypeap that is
released in the future.  This removal may be done by re-writing the
code in question.  A simple edit of the text strings will not suffice,
as our copyright applies to the binaries produced from the C source
code, in addition to the text strings.

  If you do not comply within 24 hours, we will send a DMCA
"take-down" notice to you personally, and to the office of the legal
affairs.  We hope you take our concerns seriously.

  Alan DeKok.
  The FreeRADIUS Server Project
  http://www.freeradius.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQCVAwUBQqdpEakul4vkAkl9AQF02wP7BBA3R4Kfc79NNvBGX7R7h2xh2uxto816
CuYAuI51ArqqhjzKmB189Lz9xgMXN4ic0OL1CWuO2iAw5qY8occ2g7LVGwGUYbKM
9BxNSTPola0zzjFAwYK0aEgBU3wJnES3PBzwCOFQo9f16ks1oXHhrx8v2FFV//Ix
eIOlG/+hitY=
=OsyM
-----END PGP SIGNATURE-----

  Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

[DeanAnderson]

Alan, you should be sure to review the instructions at
http://www.gnu.org/licenses/gpl-violation.html

I suggest notifying GNU, even though it isn't GNU code. I don't know if
GNU will offer legal assistance but I suggest letting them know.

You should pretty quickly retain counsel, at least to discuss your
approach. Email notifications are a good measure but not necessarilly
official notice. Its easy to ignore email.

I also suggest that if Frank Cusak is not a lawyer, he shouldn't contact
GATech.  You've already sent a deadline; our lawyers always advise against
specific deadlines until you've established all the facts, ultimately in a
lawyers conference. I suggest you tell them what you think the facts are
and ask them to respond to your assertions.  They either explain an
alternate view or agree to your version. If they agree, problem is nearly
solved. If they give an alternate view, that has to be sustained.  If they
ignore your email, try phone calls, faxes, and ultimately, get the lawyers
involved.  Also, keep a written log of all contacts.

It sounds like they are ignoring your emails. Try phone calls.

But you really need to have a lawyer "looking over your shoulder" as it
were.  Saying/Doing the wrong thing can cost you.

                --Dean

On Wed, 8 Jun 2005, Alan DeKok wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
>   Your web site http:/www.tinypeap.com (hosted at the Georgia
> Institute of Techology, machine "rhampora.cc.gatech.edu") is
> distributing programs built at least in part from code that is derived
> from the FreeRADIUS server project (http://www.freeradius.org).  I
> refer you to the following URL's:
>
> http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=5649
>
>   This message contains text with error messages "rlm_eap_tls:
> SSL_read failed inside of TLS ".  The "rlm_eap_tls" module is part of
> FreeRADIUS, is copyright by me personally, and is licensed under the
> terms of the GPL.
>
>   However, in the forum post at:
>
> http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=4533
>
>   You claim that tinyPEAP is "closed source".  You further do not
> acknowledge my copyright on code that you distribute.
>
> http://www.tinypeap.com/bin/peapd-beta1.zip
>
>   This URL points to a file which contains "peapd.exe".  That file
> contains at least the following text strings, which are either
> identical to strings included with FreeRADIUS, or substantially
> similar:
>
> - --
> rlm_eap_tls: FATAL SSL error ..... %d
> rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails.
> rlm_eap_tls: %s failed in a system call (%d), TLS session fails.
> handshake_send
> rlm_eap_tls: Application Data
> In SSL Connect mode
> In SSL Accept mode
> Before SSL Handshake Phase
> In SSL Handshake Phase
> SSL Connection Established
> SSL_read
>  rlm_eap_tls: Requiring client certificate
> rlm_eap_tls: Error creating new SSL
> - --
>
>   This code is part of the FreeRADIUS project, and you are infringing
> on our copyright, and violating the GPL by copying it without
> following the terms of our license.
>
>   Nothing under copyright law gives you permission to use our
> copyrighted code without our permission.  The only license terms
> available for the code in question is the GNU GPL, which is
> distributed with the FreeRADIUS server source.  The terms of that
> license require you to make the source code for derived works
> available under the same terms as the the original code.  I refer you
> to section 2 (b):
>
> - ---
>     b) You must cause any work that you distribute or publish, that in
>     whole or in part contains or is derived from the Program or any
>     part thereof, to be licensed as a whole at no charge to all third
>     parties under the terms of this License.
> - ---
>
>   We have tried contacting the public email address for tinypeap:
> "[hidden email]".  We have yet to receive a response.  We are
> sending this message to the contact address listed in "whois", and to
> the Georgia Institute of Technology Office of Legal Affairs, as you
> are distributing the infringing material from a machine hosted at that
> institute.
>
>   You have 24 hours to remove all infringing binaries (tinypeap.exe,
> and any Linksys firmware containing the infringing code) from your
> website, or to comply with the terms of the GPL by releasing the
> source code to tinypeap under the GPL.
>
>   If you do not choose to release the source under the GPL, you must
> remove the infringing code from any version of tinypeap that is
> released in the future.  This removal may be done by re-writing the
> code in question.  A simple edit of the text strings will not suffice,
> as our copyright applies to the binaries produced from the C source
> code, in addition to the text strings.
>
>   If you do not comply within 24 hours, we will send a DMCA
> "take-down" notice to you personally, and to the office of the legal
> affairs.  We hope you take our concerns seriously.
>
>   Alan DeKok.
>   The FreeRADIUS Server Project
>   http://www.freeradius.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
>
> iQCVAwUBQqdpEakul4vkAkl9AQF02wP7BBA3R4Kfc79NNvBGX7R7h2xh2uxto816
> CuYAuI51ArqqhjzKmB189Lz9xgMXN4ic0OL1CWuO2iAw5qY8occ2g7LVGwGUYbKM
> 9BxNSTPola0zzjFAwYK0aEgBU3wJnES3PBzwCOFQo9f16ks1oXHhrx8v2FFV//Ix
> eIOlG/+hitY=
> =OsyM
> -----END PGP SIGNATURE-----
>
>   Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
>
>

--
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000  



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

[Paul "TBBle" Hampson]

On Thu, Jun 09, 2005 at 01:13:40AM -0400, Dean Anderson wrote:
> Alan, you should be sure to review the instructions at
> http://www.gnu.org/licenses/gpl-violation.html

> I suggest notifying GNU, even though it isn't GNU code. I don't know if
> GNU will offer legal assistance but I suggest letting them know.

> You should pretty quickly retain counsel, at least to discuss your
> approach. Email notifications are a good measure but not necessarilly
> official notice. Its easy to ignore email.

The guys at http://www.softwarefreedom.org/ would probably good people
to ask. Eben Moglen gave a keynote at linux.conf.au 2005 and this sounds
like the sort of thing they like to get involved in. If I understood
correctly, they have large companies paying for them to exist so they
can take on things like this without cost for FOSS software projects.

Of course, that's only if legal counsel is needed and not already
retained. ^_^

(I thought the original email looked fine, but thought I'd chime in
before anyone suggests that legal representation is too costly.)

--
Paul "TBBle" Hampson, on an alternate email client.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

[Alan DeKok]

Dean Anderson <[hidden email]> wrote:
> You've already sent a deadline; our lawyers always advise against
> specific deadlines until you've established all the facts, ultimately in a
> lawyers conference.

  Email notices from non-lawyers are a polite "wake the heck up", with
the hope that they will do the right thing.  They have meaning to
polite people, but little meaning to intentional thieves.

  The next step, as you said, is to bring in the big sticks.  We will
be doing that.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

[Paul "TBBle" Hampson]

On Thu, Jun 09, 2005 at 12:40:18PM -0400, Alan DeKok wrote:
> Dean Anderson <[hidden email]> wrote:
> > You've already sent a deadline; our lawyers always advise against
> > specific deadlines until you've established all the facts, ultimately in a
> > lawyers conference.

>   Email notices from non-lawyers are a polite "wake the heck up", with
> the hope that they will do the right thing.  They have meaning to
> polite people, but little meaning to intentional thieves.

>   The next step, as you said, is to bring in the big sticks.  We will
> be doing that.

And for those who've never heard of it (I hadn't):
http://www.gpl-violations.org/
which is slow to load initially, but might be worth a look.

The events page is out of date, but the news items are current.
Also, the webmaster's blog at
http://gnumonks.org/~laforge/weblog/linux/gpl-violations/index.html
is active, so the project's not dead or even stalled.

--
Paul "TBBle" Hampson, on an alternate email client.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html