[blauditore]

One thing I often wonder is how a company providing such open source software can find out (and proof) if someone is using it in a closed-source project. All I can think of is "guessing" based on behavior of the downstream tool.

Also, the article doesn't say much about how that lawsuit came to be. Did Artifex approach Hancom beforehand to notify them about the license infringement or just directly sue? I guess in this particular case, Hancom knew what they were doing, but I can imagine some (smaller) companies not being fully aware of open source license specifics and unknowingly running into a lawsuit.

[mschuetz]

I believe there was a discussion about this in one particular open source project because someone found that the binaries of a proprietary software project contained lots and lots of symbols that were identical to that of the open source project.

[boomboomsubban]

>I can imagine some (smaller) companies not being fully aware of open source license specifics and unknowingly running into a lawsuit

This is not a real problem until there are licensing trolls, where their sole purpose is to make money off of breaches.

If a company receives a lawsuit, they can claim ignorance and start to comply with the contract. This would change it into a minor breach of contract, where they would only be liable for actual damages caused. Actual damages would either be nothing or fairly impossible to prove, so the lawsuit would likely be dropped.

[bluGill]

Note that if the copyright is registered before hand the infringement occurs actual damages changes to triple actual damages. (In the US) registering a copyright is cheap, but for software you have to register each version separately which adds up quick. You have to register copyright before you can sue for violations in any case.

Most of the time lawyers advise the policy that you don't register until you are ready to sue for a violation. You only get actual damages but this is typically enough. However if you believe someone is actually going to violate your copyright (or you want to spend $25 + plus lawyer fees) you should register before you release software: you will get triple damages.

I'm not sure what damages means in terms of the GPL though. In the case of a book you can say the book sold for some amount of dollars so every sale of your illegal copy cost me that amount of dollars.

[blauditore]

> If a company receives a lawsuit, they can claim ignorance and start to comply with the contract.

Are you sure claiming ignorance would make a difference? I tried to google it and found the Wikipedia article on "Ignorantia juris non excusat"[1], which claims that in most countries, not knowing a certain law provides no protection whatsoever.

https://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat

[greenshackle2]

"Usually, whether a breach is material or minor is determined on a case by case basis, with the court using six different guidelines to make its determination. The six guidelines are

1) the extent to which the breaching party has already performed,

2) whether the breach was intentional, negligent or the result of an innocent mistake,

3) how certain it is that the breaching party will perform the rest of the contract,

4) how much of the benefit of the contract the non-breaching party has gotten despite the breach,

5) the extent to which the innocent party can be compensated and,

6) how difficult it would be on the breaching party if the court were to decide that the breach was material and that the innocent party was under no obligation to perform his side of the bargain. "[1]

See point 2. My understanding is that ignorance of the law is basically never an excuse, but ignorance of the facts, for contracts, could be[2].

For example, company X could argue they are ignorant of the fact that software Z is intellectual property of company Y, distributed under GPL. If they stop breaching once informed of that fact they can argue it was an innocent mistake.

But in this case Hancom was advertising that it was using the code under the GPL, so, they certainly can't claim ignorance.

[1]https://nationalparalegal.edu/public_documents/courseware_as...

[2]https://en.wikipedia.org/wiki/Mistake_(contract_law)

[desdiv]

Pretty much all GPL'd code comes with a GPL license header, so you'd need someone to strip that header off.

It would be hard to hide the identity of that someone, thanks to Git.

Once that someone takes the stand, the truth becomes hard to conceal because presumably company X doesn't pay them enough to lie under oath.

[empressplay]

one way is to engineer in obscure but reproducible behaviour, along the lines of A->B->C results in D.

people who are likely to steal code are unlikely to audit it sufficiently to identify esoteric behaviour.

[cryptarch]

That's a good idea, very similar to map makers hiding small deficits to find copiers.

That gets awfully close to DRM, though.

[webmaven]

It's not DRM (or even "close to it"), it's a "canary trap", or a "barium meal test". The modern equivalents in images, audio files, ebooks, etc. are usually called watermarks, even though they aren't visible (so sometimes called an "invisible watermark"), and are used extensively (including by ebook publishers that don't use DRM).

[sqeaky]

It seems like that would be just for the purpose of detection and wouldn't stop people from using either the map or the software.

DRM is bad because it both doesn't stop pirates and hurts normal users. This allows detection of pirates and hurts no one.

[kevindqc]

I imagine if you use strings, like in

printf("Could not open ghostscript project %s", project)

You could find the "Could not open ghostscript project %s" part in the binary?