Snort, GPL, open source, Cobia and copyright

Marty Roesch of Sourcefire/Snort put up a long blog post today explaining some recent actions by the Sourcefire team on the legal front in terms of GPL licensing and copyrights.  For those who remember, I have written here and here about what I believe is a change in the licensing of Snort with the forthcoming 3.0 version. For those who may also remember, I was taken to task by some for daring to question the infallibility and pure intentions of the Sourcefire folks.

Well in Marty's post today he talks about three recent events.  From Marty's blog here there are:

1) GPL v2 lock that we put in place on June 29th.
2) "Clarifications" in Snort's license language (Snort 3.0).
3) "Clarifications" with regard to assignments of ownership for contributed code (Snort 3.0).

Lets have a look at these. The first deals with the fact that with the release of GPL v3, Sourcefire put a caveat in place saying that Snort could only be distributed under version 2 of the GPL.  Frankly, they are perfectly allowed to do this for the code they own.  I have two issues with this though:

1. Instead of saying that they don't like the v3 of the GPL, Marty says that he got a heads up about people being able to change versions of GPL just 3 weeks ago and the Sourcefire folks have not had a chance to look at version 3 but they know Linus was not moving Linux too it.  I don't know about you, but if my code was released under the GPL, I probably would have been following it for at least the last year and the many draft releases that were sent out.  Its not like version 3 snuck up on anyone.  Sourcefire is a public company now, you would think they would be all over this. Is Marty really the only one watching this and until he found out no one there had a clue?

2. More importantly, it seems that Sourcefire does not own the copyrights to all of the code in Snort. In making the change prohibiting the use of GPL v3, Sourcefire took it upon themselves to change the source file header preambles of all the source for Snort, including parts they did not own.  Obviously some of the folks who owned and contributed the code were not made aware and did not give their permission.  Marty claims there was not time.  Again, it was not a secret that v3 was coming out, but he acknowledges this was a mistake and apologizes. Marty says they will fix this.

Next and most important to me is the changes in 3.0 licensing.  Marty comes out and says that plainly the "clarifications" they have made in the 3.0 license is aimed at "companies that are using Snort as a part of their product or service. Many of them seem to expect us to work on this technology and improve it continuously so that their offering is cutting edge but contribute nothing to the project and complain bitterly whenever we do something that might cost them some money to continue to use a best-of-breed technology like this."  Marty goes on to say that they are just clarifying what the GPL says all along.  I have already written on this.  I and the attorneys I have spoken to don't believe that. I think the clarification put forth by Marty and Sourcefire is plainly a change to the GPL.  I don't care if NMap has done it or anyone else for that matter.  It is a change. I do not begrudge Sourcefire the right to charge for their software.  I just say don't use the GPL as a shield. 

Marty and Sourcefire however are in a difficult position.  They are kind of stuck with the GPL because they took code from others under the GPL and now if they want to change the license away from a GPL license they are stuck with.  So they have no choice but to say the GPL means what they want.  In my mind this is no better than what Marty accuses others of, namely claiming the GPL gives them the right to do what they want. 

This is exactly the reason we did not use it with Cobia.  At the end of the day, what Marty and team are seeking to do is exactly what we wanted. That if you are not making money selling the product, it is yours to use for free and you get source code. If you are making money you should use a commercial license.  Bitch and moan all you want about open source or not, but Marty and we are trying to accomplish the same thing.  Marty is constrained by the GPL and we choose not to be.

Lastly Marty talks about something which has raised some comments on the snort list.  It seems if you contribute code to Sourcefire, they in essence "own" the code. I am not sure if this was always clear to everyone who contributed code in the past.  My impression is that it was not, based upon the reaction to this.  Again, I don't begrudge Sourcefire being able to do this and Marty gives some good reasons why they need to. I just think you need to be open and upfront about this from the beginning, like we are with Cobia, again. 

So what can Sourcefire and Marty do about this. I think they are faced with either paying the people who wrote code in the product and buying them out or rewriting portions of the code so they own it all.  Anything less is just plain messy.

In the meantime, Marty posted his comments to the Snort list.  I responded with my take on this. I am pleased to see that several other members of the list have responded as well.  So far they seem to agree with my take on it.  In fact one post actually used our Strata Guard Free as an example of what looks like a legitimate use of Snort under the GPL that Sourcefire would probably like to change.

So in spite of comments and admonitions of others, it would appear I was not so crazy after all.  I will keep an eye on this and write more about it as it happens.