Open source licence violations manual published

The GPL Compliance Engineering Guide details how to take apart bootloaders and firmwares, using tools such as Hexdump, Strings and Grep.

It even includes soldering instructions to attach a serial cable to a router, as sometimes that is the only way to get access to the system's software.

Hemel works at Loohuis, an IT consultancy in the city of Utrecht and is active in the GPL Violations project.

In the past three years he tinkered with hundreds of computer devices, to find out if the manufacturers use open source software without making available the source code.

He has uncovered about three hundred such licence violations, he says, including in Apple's Iphone, Cisco's Linksys equipment, and in a certain type of projectors produced by HP.

Last year he helped take Skype to court over a handset produced by SMC.

Most manufacturers do not take the time to check their products for licence issues. Compliance can takes months and the margins in the consumer electronics market are already thin, Hemel suspects.

Tracking licence violations is important, he says. "Open source is not equal to public software. If we do not defend the licence, then one day a judge might decide we apparently do not care."

He first became interested while trying to update the firmware of a network-attached storage device.

Hemel found the producer had not published certain parts of the Linux source code, one of the requirements of the kernel's software licence, and he contacted the GPL Violations project. "It was pretty exciting, actually."

Taking apart firmware has since become a routine. The guide should ensure his expertise lives on, he says, in case he gets hit by a bus after a beer fest. "Also, there are far more licence violations than we can we muster."

Hemel hopes that other open source enthusiasts will use his manual to start taking apart computer devices. "We need more reverse-engineers that like to get to the nitty-gritty before accusing manufacturers of licence violations. Simply voicing suspicions on a public mailing list is often not a good idea. False accusations are close to libel."