Telstra have issued a PR statement about their GPL compliance. The statement is a promising sign, but I’m afraid it is somewhat misguided.

Update 9/11: Today Netgem have posted a new version of their GPL source, labelled “T-Box”. I’ve also been contacted personally today by a Telstra representative about the T-Hub product. Both things are excellent to see, Telstra do appear to be taking this very seriously. Will post any more developments as they occur.

However, now I know. If you want an answer from a massive multi-billion dollar company like Telstra, you don’t waste your time with customer service. You carefully research and publish a blog post shaming them, then hope that the tech media will pick it up and bring it to their attention.

I’m so glad that’s clarified.

Actually, the follow-up to yesterday’s “Telstra violating GPL in their T-Hub product” post has been awesome. Big thanks to Renai LeMay for noticing and reporting on it via his news site Delimiter this morning, from where it seems to have spread.

The follow up was so awesome that this afternoon Telstra released a PR statement. To my knowledge they haven’t released it publicly, and they didn’t send it to me (*sadface*), so I can only quote from Delimiter:

“We’re currently talking with our T-Hub vendor to work out whether software used in the product is subject to [the] General Public License (GPL),” said the company. “Should we find a lack of compliance, we promise to work with our supplier to correct it.”

This is excellent. I think it’s commendable that Telstra have reacted to this, and I eagerly await news of further progress.

Clearly, I would have rather that they (a) checked well before they launched the product back in April, and (b) had an effective customer service system so I could have gotten this answer when I first tried to contact them privately about it. However, nonetheless, it’s excellent news.

T-Box

Telstra also weighed in on their T-Box, a set-top box & IPTV product which is manufactured by Netgem but branded and sold by Telstra:

“T-Box owners can find licensing information about the open source software incorporated into their device by visiting the settings menu,” Telstra said. “The source code for the open source material is available from our vendor’s website and we believe all GPL code is identified and is available to customers.”

To verify this, I detoured home from work via my local Telstra Shop and took a look at the demo model. Sure enough, you can select Menu -> Settings -> Information -> Licensing & Copyright.

Apologies for my crummy photos:

TBox Licensing & Copyright
Here are the two sections that appear relevant to GPL (my transcription):

FFMPEG License LGPL: Detailed licensing information is available at http://www.gnu.org/licenses/gpl.html.

GPL License: libstdc++ (GPL with run-time exception), dhcpd, iptables, pppoe, madwifi, wpa-supplicant, iwtools, busybox, dosfs tools, e2fs tools, insmod, drivers i2c (partially), USB Sigma.
Detailed licensing information is available at
http://www.gnu.org/licenses/gpl.html

I’m not a lawyer, but this doesn’t look like GPL compliance to me.

In order for this section to constitute GPL compliance, I think it would need at least three things:

  • Actual source code included with the product, or alternatively

    “a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code”

  • The full text of the License, as per GPL Sections 1 & 2, rather than a plain URL.
  • To be accompanied by “an appropriate copyright notice”. The only copyright notice in this document is “©Netgem”, which conveniently ignores the fact that large parts of the product are, in fact, not copyright by Netgem.

In fact, all three of these errors are listed as common mistakes in GPL-Violations’ excellent Vendor FAQ, which I linked to yesterday.

“available from our vendor’s website”

OK, so nothing indicates yet that the T-Box is technically compliant. Maybe Telstra & Netgem have still made an effort at compliance. Let’s check out the assertion that “source code for the open source material is available from our vendor’s website”.

Update 9/11: Today Netgem have posted a new version of their GPL source, labelled “T-Box”. This is excellent to see.

Netgem does have a GPL download page. Unfortunately, it doesn’t actually mention T-Box anywhere. The product on that page is a “Netgem HD”. Are they the same?

I searched Netgem’s site for T-Box, but all I could find were press releases. I searched Telstra’s web site for Netgem, and all I found was a comment written by a customer suggesting a T-Box is a “Netgem 8000”. Not sure how that relates to the “Netgem HD” source, or even if it is true that the two products are 100% identical.

Adding insult to injury, the latest firmware download on Netgem’s site is v5.1.08 (January 2009), and users are reporting T-Box versions like 5.1.96.9 (03-Aug-2010). As my favourite Vendor FAQ reminds us, “The source code has to be 1:1 corresponding to the executable (object) code actually shipped.”

User Guide

I also looked in the T-Box User Guide, which is available via download from Telstra.

The user guide contains no reference to the “License & Copyright” section that is available in the user interface. It does, however, contain a “Legal Notification” section. This section has completely different text, and no open source mentions. Ironically, it does contain the following passage:

In using your T-Box, you must not violate any intellectual property rights concerning a brand, design, photo, licence, software program, audiovisual work or any other form of intellectual property.
Any violation of these intellectual property rights and, in particular, any act of piracy, will be subject to the penalty applicable within the legislation put in place.

Hmm, yes. OK then.

Conclusions on T-Box

Without physical access to a T-Box it is not possible to say conclusively if it violates GPL. However, I think I can safely say that Telstra’s PR statement is completely misguided if it means to imply that this meager offering constitutes GPL compliance.

From what I have seen, I believe that Telstra and/or Netgem should immediately take the following steps:

  • Amend the “License & Copyright” section of the product so it contains GPL compliant text. For examples of how to do this, look at any Android mobile phone and also read the wonderful Vendor FAQ.
  • Amend the User Guide “Legal Notice” so it contains the same text as the “License & Copyright” section, removing ambiguity.
  • Provide source code under the name “T-Box”, rather than under an obscure OEM name not associated with the product in any way.
  • Provide source code that is up to date with the currently released firmware version.

By the way, if anyone from Telstra would like to talk to me about this, my email address is gus at this domain name. Although you already have my name, phone numbers (twice), email address (twice) and home address somewhere in your databases – courtesy of my attempts to contact you via customer service channels.

I’ve been investigating Telstra’s T-Hub “home phone of the future”. The T-Hub is built with open source software, but Telstra do not seem to be honouring any of their legal copyright or licensing obligations.

Update 3: “Telstra frees T-Hub open source code”

Update 2, 9 Feb: Telstra have posted information about how to request T-Hub source code. I will post more details when my disc gets here.

Update 1: A response to Telstra’s PR statement about T-Hub & T-Box.

(For the non-Aussies: Telstra is Australia’s largest telecommunications company, and is part government owned.)

My T-Hub booting. The screen looks odd because the protective film is still on it.

Short Version

I investigated the T-Hub and found it is built on a variety of open source software, including GPL licensed software like Linux and busybox. However, Telstra are not mentioning this anywhere and are not distributing source code, or notices to obtain source code.

By doing this, Telstra are violating the licenses and also robbing the authors of their rightful attribution. They appear to be regarding open source as a free-for-all that they can exploit without giving back even the small amount required legally by the various license terms.

However, I believe that Telstra can easily take steps to comply with these licenses.

Telstra have a range of other Linux-based products, including the T-Box and a soon-to-be-released “T-Tab” Android tablet. To the best of my knowledge the T-Box is not GPL compliant either, which gives me little hope for the upcoming T-Tab.

What is a T-Hub?

T-Hub is Telstra’s “home phone of the future”. It’s essentially a tablet-like device (think Chumby with less functionality) loosely integrated with a cordless land-line telephone. The OEM product is from Sagem, although as far as I know Telstra is the only vendor world-wide.

GPL Software

The GNU General Public License is an open source “copyleft” license. Vendors are encouraged to freely distribute products built with GPL software, provided that they acknowledge the license and also provide access to the source code (modified or not) for the GPL licensed or derived portions.

A while ago I learned that the T-Hub runs Linux, which is subject to GPL.

Attempting to make contact

For over two weeks I’ve been attempting to find someone at Telstra to talk to about this. Despite best efforts (phone calls, emails), I have been unable to contact anyone with the slightest idea what I am talking about, or with the ability (it would seem) to actually find someone who knows what I am talking about.

Best quote so far, when I was transferred to tech support: “Look mate, noone calls up Microsoft and asks for their source code…” Um, sure.

Finding out myself

Frustrated, I bought an “as-new” T-Hub on ebay. First, I scoured the documentation for any mention of the software license(s):

  • Manual (downloaded online.) No.
  • Quick Start guide (in box.) No.
  • Box itself. No.
  • Inside device itself, when it first boots. No.

Next, I found the URL where the device downloads its firmware. The current firmware can be downloaded directly here. The file is a JFFS2 filesystem image, which can be mounted via mtdram as described here (EDIT: you can skip the jffs2dump step if you’re on a little-endian machine like a PC.)

By browsing the filesystem of the device, I can see a range of GPL or LGPL licensed software contained within. Here is a (possibly incomplete) list. The following components are GPLv2 licensed:

  • Linux kernel v2.6.19.2
  • Busybox v1.1.3
  • GNU Fdisk v2.12

The device appears to be built around a Freescale i.MX31 SoC, which means that it probably also contains a GPL licensed bootloader (u-boot or RedBoot.) I haven’t taken any steps to verify the bootloader, though.

There are also LGPL licensed libraries:

  • GNU C Library
  • gstreamer v0.10
  • Pango
  • Libusb v0.1.4

The following included open source software is not GPL licensed but has a license that requires acknowledgement that it is included in the product. These notices do not appear to be included, either.

  • libcurl
  • OpenSSL (libcrypto)
  • Dropbear
  • ImageMagick v6.5.3-7

What should Telstra do?

GPL compliance is not that hard. GPL-Violations provides an excellent (and simple) vendor FAQ explaining a vendor’s obligations under GPL.

Telstra should review their use of open source in all their products, and amend their ways so they are legally compliant.

For the T-Hub, this includes adding GPL and other license and copyright notices to the product documentation, adding offers for source (or actual source code) for the GPL licensed components, and also making sure that “the tools required to compile and install the GPL licensed components” are made available.

Aside from the time this will take, I don’t see how GPL compliance could negatively impact the T-Hub product in any way. In fact, it may even provide a new market by allowing intrepid users to load different software onto the T-Hub. Of course, this is beside the point – the license terms are clear, and by choosing to use these software products Telstra must commit to honouring their license agreements.

Frequent Responses

There are a few kneejerk responses that always seem to appear in these cases, so I’m going to address them in advance:

“The source code wasn’t modified, so there was no need to comply…”

This is a misconception about GPL. The source code doesn’t need to be modified as a prerequisite for compliance.

However, the vendor doesn’t always need to distribute the source themselves. Under GPLv2 clause 3(c), they can simply redistribute an “offer to distribute corresponding source code” that they themselves received from a third party along with the binary code, provided that the vendor did not modify the source themselves.

EDIT 8/11: Glen points out in the comments that clause 3c only applies to non-commercial distribution, so it seems Telstra can’t copy someone else’s notice – they’d need to provide their own offer for source (3b) or put the source code in the box somehow (3a).

“Sagem made the device, not Telstra. They are responsible for compliance.”

It is true that Sagem made the device. However, Telstra are the legal entity who are distributing (ie selling) it. The customer’s relationship is with Telstra, not Sagem. Whatever private arrangement exists between Telstra & Sagem is not our business.

Of course, in practice, it is Sagem who will probably be responsible for providing source code and documentation in order to allow Telstra to comply. At the moment I think there are two possibilities: one is that Sagem provided enough information to ensure their compliance, and Telstra ignored that information. The second is that Sagem did not provide enough information, and are themselves in violation of the license. However, as I said before, this is Telstra’s business with Sagem, not my business or the business of any of Telstra’s customers.

“This is why I don’t trust GPL… blah blah… open source zealots… blah blah…”

This one always baffles me. Via GPL/LGPL a company can get access to a complete world-class operating system with libraries for almost any conceivable use. They get this at no monetary cost, without needing to negotiate any license agreements or pay a cent to anyone. Better yet, all of the software comes under a single license so the legal department only needs to read and understand one or two documents. The company is then welcome, even encouraged, to build end-user software on top of this OS & libraries, bundle it all into their products and sell it at a profit.

The only thing a company is asked to do is acknowledge the open source components, and make source available. That’s the sole cost to a vendor like Telstra, for an entire software ecosystem. I believe the GPL can make no claim on any of Telstra’s original contributions to the T-Hub, such as the custom HTML UI, which are not derivative works of any open source software. None of that source needs to be released, unless Telstra wants to release it. There’s no risk that Telstra will somehow lose any competitive advantage they have in this product, via open source.

Yet it seems to be all too hard. Why is that?

Alternatives to T-Hub

If you want to buy something like a T-Hub (“kitchenputer”), but want a product that respects copyright law, then I recommend checking out Chumby for starters. Chumby Industries are a terrific company when it comes to open source. Internode sell chumbys in Australia (no Chumby One yet, though. :(.)

What am I doing next?

I’m going to notify as many rights-holders as I can find for the software mentioned above, and encourage them to formally contact Telstra.

I’m not sure what I’m going to do personally with my ebay T-Hub. I’m not a Telstra customer, so it’s more or less useless in its current form. So far I haven’t found any way to load custom firmware, without spoofing Telstra’s update web server (although I haven’t taken mine apart to look for a serial console.)

I thought it might make a good Android tablet, but it has a resistive touch screen and it also probably doesn’t have enough physical buttons for a good Android user experience. Plus for the same money I could buy a OMAP3-based Android tablet with a Cortex A8 in it (newer than the ARM11 CPU in the T-Hub.)

So… it’s probably going back on ebay. Unless anyone wants to buy a nearly-new T-Hub? I can’t guarantee the sale will comply with any licenses, though. :D.