> <i>I then decided to contact Insulet to get the kernel source code for it, being GPLv2 licensed, they're obligated to provide it.</i><p>This is technically not true. It is an oversimplification of the common case, but what actually normally should happen is that:<p>1. The GPL requires the company to send the user a <i>written offer</i> of source code.<p>2. The user uses this offer to request the source code from the company.<p>3. If the user does not receive the source code, the user can sue the company for not honoring its promises, i.e. the offer of source code. This is not a GPL violation; it is a straight contract violation; the contract in this case being the explicit offer of source code, and not the GPL.<p>Note that all this is completely off the rails if the user does not receive a written offer of source code in the first place. In this case, the user has no right to source code, since the user did not receive an offer for source code.<p>However, the copyright holders can immediately sue the company for violating the GPL, since the company did not send a written offer of source code to the user. It does not matter if the company does or does not send the source code to the user; the fact that the company did not send a written offer to the user in the first place is by itself a GPL violation.<p>(IANAL)
This is an open legal question, which the Conservancy v Vizio case will hopefully change; in that case, Conservancy is arguing that <i>consumers</i> have the right to enforce the GPL in order to receive source code.
This got buried on HN a few days ago which is a shame:<p><a href="https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ" rel="nofollow">https://social.kernel.org/notice/B1aR6QFuzksLVSyBZQ</a><p>Linus rants that the SFC is wrong and argues that the GPLv2 which the kernel is licensed under does NOT force you to open your hardware. The spirit of the GPLv2 was about contributing software improvements back to the community.<p>Which brings us to the question: what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel? Of which there are likely none. Try and run custom software on his medical device which can likely kill him? More than likely.<p>The judge's comments on the Vizio case are such that should this guy get his hands on the code, he has no right to modify/reinstall it AND expect it will continue to operate as an insulin pump.<p>This is about as ridiculous as buying a ticket on an airplane and thinking you are entitled to the source code of the Linux in-seat entertainment system.
There are a lot of people hacking on insulin pumps and they are <i>lightyears</i> ahead of commerce. If you want a very interesting rabbit hole to dive into try 'artificial pancreas hacking' as google feed.<p>One interesting link:<p><a href="https://www.drugtopics.com/view/hacking-diabetes-the-diy-bionic-pancreas-is-here-to-stay" rel="nofollow">https://www.drugtopics.com/view/hacking-diabetes-the-diy-bio...</a><p>I would trust the people that hack on these systems to be even more motivated than the manufacturers to make sure they don't fuck up, it's the equivalent of flying a plane you built yourself.
Why is it ridiculous? If the license says you have the right to obtain the source code to software that was distributed to you, then you have the right to obtain the source code. It doesn't matter what your intended use of it is.
Rather crucially, the license itself does <i>not</i> say that you have the right to the source code. It is only the separate written offer which gives you that right. If you did not receive such an offer, you don’t have any right to it. But then, the company has <i>already, unquestionably, violated the GPL</i>, and the company can be sued immediately. Specifically, you don’t have to first ask the company for the source code! The lack of a written offer is in itself a clear violation.
> But then, the company has already, unquestionably, violated the GPL, and the company can be sued immediately.<p>You were right up to this point. Medical devices requiring a prescription must be obtained via specialized suppliers, like a pharmacy for hardware. These appliances are not sold directly to end users because they can be dangerous if misused. This includes even CPAP machines.<p>In theory, that written offer only needs to go to the device suppliers. Who almost universally have no interest in source code. When the device is transferred or resold to you, it need not be accompanied by the offer of source.<p>If that was true, anyone reselling an Android phone could open themselves up to legal liability. Imagine your average eBayer forgetting to include an Open Source Software Notice along with some fingerprint-encrusted phone.
> <i>If that was true, anyone reselling an Android phone could open themselves up to legal liability.</i><p>That’s only an appeal to ridicule. If those are valid, here’s an opposing one:<p>If this is <i>not</i> true, then any company can violate the GPL all it likes just by funneling all its products through a second company, like a reseller.
Here's an appeal to the law, the doctrine of copyright exhaustion (also known as the first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor) and they have no rights to control or prevent further sales.<p>That the GPL potentially fails to achieve what it intends to is neither a legal argument, nor particularly surprising.
> first sale doctrine) dictates that copyright is exhausted upon the first sale of the device (i.e. to the distributor).<p>The copyright doesn’t go away when copies are sold to a distributor. Someone (probably the manufacturer) still has legal obligations to the copyright holder.
Wouldn't that imply that end-user license agreements are all unenforceable because the software was sold through a retailer, and even if it wasn't you could just a get a secondhand copy?
By my understanding EULAs are based on contract law and having a clickwrap agreement that requires you agree to it before using the software, not copyright law. Except perhaps to the extent that copyright law would prevent you from creating a derivative work that doesn't require you to agree to that clickwrap agreement prior to using the software.
> In theory, that written offer only needs to go to the device suppliers.<p>The GPL clearly specifies users, it doesn’t say anything about suppliers.
> When the device is transferred or resold to you, it need not be accompanied by the offer of source.<p>This is false. The person transferring the device must either pass along the offer they received (GPLv2 clause 3(c), and only if performing non-commercial redistribution), or pass along the source code (GPLv2 clause 3(a)).
By my understanding under US law first sale doctrine means that 3 (both (a) and (c)) doesn't apply, copyright has been exhausted and the intermediate party here doesn't need a license at all to sell the device on. Even if you want to argue the GPL is a contract and not just a license the intermediate owner has never been required to become a party to it. Even if for some reason they agreed to the contract - and somehow it was a binding contract despite the complete lack of consideration - it seems unlikely that the courts would interpret 3 to apply because reselling a device isn't "distributing" within the meaning of copyright law because of first sale doctrine.
My Android phone does come with an explicit written offer of source. It's in Settings>About>Legal.
It's a medical device that requires a prescription. You can't buy it off the shelf. They're not distributing software to you either. You must go through a medical equipment supplier who transfers the device to you after insurance has paid for some or all of it.<p>For the same reason you can't find an airplane entertainment system in the trash and call up the company and demand source code.
It doesn't matter what form it takes. Compiled binaries of GPL code are being distributed. The recipients of that binary are entitled to the source of the GPL portions in a usable form:<p><pre><code> "The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable."
</code></pre>
The GPL here doesn't extend beyond the kernel boundary. Userland is isolated unless they have GPL code linked in there as well. If they were careless about the linkage boundaries then that's on them.
The recipient of that object code is the medical device supplier, not the end-user.<p>It's subsequently transferred to you after presenting a prescription, without any accompanying offer of source code.<p>In other words, assume you are the second owner in all cases when it comes to certified medical equipment.<p>AFAIK if you find an Android phone in the trash, you are not entitled to source either since you never received the offer of source during a purchase transaction. You know that little slip of paper you toss as soon as you open some new electronics that says "Open Source Software Notice".
> purchase transaction<p>The licensee has to offer code to users. It doesn’t say they have to purchase anything to be a legitimate user.
> In other words, assume you are the second owner in all cases when it comes to certified medical equipment.<p>By that logic, _any_ company can effectively ignore the GPL constraints by just selling it to a reseller, first; one that they have a contract with to _not_ offer the source code when they re-sell it.<p>It is my understanding that, if I use GPL in my code, and I distribute it to someone that then re-distributes it to someone else... the GPL is still binding. I don't see why that wouldn't be the case with hardware using GPL'd software.
So when I buy a product with GPL code via Amazon, Amazon is the one with the rights to receive the source? That medical supplier is getting paid via the medical coverage the end user is <i>paying</i> for.
Big disagree, if they distribute the code they’re on the hook for the gpl source, too!<p>That’s about as ridiculous as buying a plane and knowing you’re entitled to the gpl sources used.
> what is this guy going to do with (presumably) the kernel source? Force the Chinese to contribute back their improvements to the kernel?<p>As the original Reddit comment explains, Insulet is an American company.
> Linus rants<p>Linus is arguing against a strawman that Conservancy never actually argued. See <a href="https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelevant-ruling/" rel="nofollow">https://sfconservancy.org/news/2025/dec/24/vizio-msa-irrelev...</a> for details.<p>> Which brings us to the question: what is this guy going to do with (presumably) the kernel source?<p><a href="https://openaps.org/" rel="nofollow">https://openaps.org/</a>
The argument here is that, if there is an offer, they already do under standard contract law.
If you carefully read what I wrote, you will notice that I never claimed otherwise. Whether or not third parties have standing to sue on a GPL violation is immaterial to my point, none of which is “an open question”.
Are you saying that in the general case if you send someone a written offer for something and then don't honour it, you are in breach of contract?<p>That doesn't sound right to me.<p>A written offer is not the same thing as a contract.
The written offer is part of the licence, as is the need to respond to that offer with the source code offered. It is all part of the same agreement.<p>A written offer <i>on its own</i> would not normally be directly enforceable in many (most?) jurisdictions, for the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise) except where other laws/regulations (anti bait&switch rules for instance), or the desire to avoid fighting in the court of public opinion, come into effect.<p>But in this instance, the written offer and the response to that offer are part of the wider licence that has been agreed to.
> the same sort of reason that retailers can't be held to incorrectly published prices (in the UK at least, a displayed price is an “invitation to tender”, not a contract or other promise)<p>The hell? Over here, the price tags <i>are</i> a sort of public contract, to which the seller pre-commits. The seller forgot to change the tags? That's not the buyer's problem.
I don’t think so; I can’t recall any support for such a connection between the written offer and the GPL itself written into the GPL license text.
From section 4 [1]<p>> If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.<p>Similar clauses in Sec 6.<p>[1] <a href="https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html" rel="nofollow">https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html</a>
The customer spends money to buy the product along with the source code offered. It's part of the transaction. Not honoring part of the transaction is a breach of contract.
Maybe it’s not technically “breach of contract”, and an offer might or might not be a contract. But if you don’t honor an offer you made, you must surely be guilty of something. Otherwise, all offers would be meaningless and worth nothing.
And what are the damages?
I think they're just saying the GPL doesn't really cover consumer/distributor (dis)agreements, it only covers copyright. While the spirit of the GPL is user-first, it still has to be realized within the confines of copyright law. Even though many people might conflate the spiritual goal and the legal agreement, it doesn't grant "users" any extraordinary legal powers.<p>It's not illegal to not honor written offers, it's illegal to distribute copyrighted material in violation of it's license.
That's not what they're saying.<p>On the shelves are three insulin pumps: one with a 5-year warranty, one at a bargain barrel price that comes with no warranty, and one accompanied by a written offer allowing you to obtain the source code (and, subject to the terms of the GPL, prepare your own derivative works) at no additional charge any time within the next three years.<p>Weighing your options, you go with pump #3. You write to the company asking for the GPL source. They say "nix". They're in breach.
So gpl is a licensor-licensee contract, if code and license is not shared to the user, then there is no contract to which the user is a party, rather the user is a beneficiary.<p>The offer of source code seems to be a way to facilitate the conveyance of source code through opt-in means separately from the object code rather than some legal trickery to create a user-licensee contract.<p>While the offer may indeed convey a licensee-user obligation, a compliant distribution would attach a license anyway, converting the user into a licensee and licensor to licensee in a recursive fashion<p>I wonder if lawyers specialize in this, it sounds very cool and not at all standard law, but somehow compatible with contract law<p>IANAL
The written offer with a limited term of three years is just <i>one</i> permitted method of distribution. If an offer was never made then they're not covered by that clause and are bound to comply by other means without the protection of the three year window.
Yes. I did not cover these cases because approximately <i>nobody</i> does that.<p>I mean, the absolutely simplest, and cheapest, way for companies to comply with the GPL is to ship the source code together with the software. Stick it in a zip file in a directory somewhere. The company can then forget the whole thing and not worry about anyone contacting them and ranting about source code and the GPL. But no company does that.<p>The other simple way for companies to comply with the GPL is for companies to provide a link to download the source code at the same place that users download the program itself. If the user did not download the source code when they had the chance, that’s the user’s problem. This will also let the company ignore any GPL worries. No company does this, either.<p>(The GPL provides a third way for individuals and non-profits, which is not relevant here.)
In America, maybe this is the case. In Germany, it seems an end user can sue them directly for source code.
> This is not a GPL violation; it is a straight contract violation<p>But GPL is a contract<p>I think the distinction you are pointing would be between a gpl licensor-licensee contract, rather than a licensee-user contract.<p>(IANAL)
> <i>But GPL is a contract</i><p>Not according to the original reasoning by its creators, but opinions differ wildly. However, this is irrelevant to the point; the <i>written offer</i>, which is separate from the GPL, is what is failing to be honored, not the GPL. If you did not receive such a written offer, the GPL, in itself, makes no guarantee that you have the right to the source code.
Be sure to read the top comment where someone who claims to have worked for the company provides some inside information.<p>In my experience, this is quite common when the development of hardware is viewed as a cost center and is outsourced to various providers and teams. Those providers and teams churn a lot and nobody who worked on that is likely still involved with the company via contracts or direct employment.<p>Front line support people aren’t equipped to respond to these requests. If you’re lucky they’ll get bounced around internally while project managers play hot potato with the e-mail until it gets forgotten. You might get lucky if you go the corporate legal route, but more likely is that the lawyers will do the math on the likelihood of you causing them actual legal trouble for anything and decide it’s best to ignore it.<p>When I worked at a company that had a history of GPL drama one of the first things I did was enforce a rule that every release had a GPL tarball that was archived and backed up. We educated support people on where to forward requests. I handled them myself. 7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to <i>all</i> of our source code and they were disappointed when they only found GPL code in the tarball. It really opened my eyes to some of the craziness you get exposed to with these requests (though clearly not the polite and informed request in this Reddit thread) which is probably another reason why support staff are uneasy about engaging with these requests.
> <i>7 out 10 times, the person on the other end was angry because they assumed the GPL entitled them to all of our source code and they were disappointed when they only found GPL code in the tarball.</i><p>Well, if your non-GPL code was directly linked to, or closely interoperated with, any GPL code, those users would have been right.
As always, the solution is to contact their legal department, preferably via a lawyer. Engineers and support staff are not going to risk their jobs making legal decisions about giving away company property.<p>The FSF could help a lot here by publishing demand letter templates outlining the statutory and precedential basis for license enforcement and recovery of damages.
If the only GPLed component used is the Linux kernel, you probably aren't entitled to any noteworthy source code. It's well established that using the kernel doesn't create a GPL requirement userspace software running on the same device, and the most likely arrangement here is a completely-uncustomized kernel paired with an open-source userspace program that does all the interesting bits.
Then it should be trivial for them to provide the source code.
It's trivial in terms that it will cost them nothing, because it's very likely there are no changes to the kernel, or nothing of value nor commercially-sensitive anyway.<p>It's not trivial in terms of big company bureaucracy - this request will have to go through so many levels of red tape that they (correctly) decided not complying to random people's requests is more profitable.<p>I'm sure if you actually sue them <i>then</i> they will comply right away, because at that point paying for some engineer's time to tar up the source tree and send it to you now becomes cheaper than lawyer time.<p>But their analysis is correct in that nobody will waste time/money suing to get what is effectively a stock kernel they can get from the official source anyway. Which is why these complaints are also a bit stupid - they're not asking for anything of value or using the GPL to advance software freedom by freeing up some valuable code, they're just wasting both theirs and others' time asking for something they can already download directly.
It also doesn’t apply to driver modules if you use gpl shim (eg nvidia drivers and many others) so i dont get why author thinks they violate anything
I get mad triggered by software license violation discussions.<p>Please for the love of all that the FSF thinks is holy - just file a damn lawsuit if you are telling me they are violating the law. State your claim and have a court sort it out.<p>It costs hundreds of dollars. For a medical device? Seems like a good deal.
If they built the kernel directly from tree, just pointing out the correct <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/" rel="nofollow">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...</a> should be enough...
Since a company building it themselves hasn't gotten it in the form of a binary from someone else that they're just passing along to you and their use is commercial, they don't satisfy either condition of GPLv2 3(c), but they'd need to satisfy both in order to be able to exercise that option.
Let me guess. Omnipod. They've had some pretty bad recalls too. Never in a lifetime would I trust my well-being to their p.o.s. hardware / software combo. Apologies that person in this thread that worked there, but I hope you are working for a better company now.
So can someone tell me - a non-insulin-dependent individual - why would an insulin pump need to be (controlled by?) a phone (in this case, the Nuu phone referenced)?<p>Surely there is a way to cheaply obtain bluetooth and a controller without saying "we'll just use this already existing hardware - that happens to be a whole-ass phone - because it's $5 from China"?<p>Kinda feels like that just screams data-stealing, regardless of where it was made.
Security… The PDM is walled off completely, it cant install apps, its not on wifi, you cant change any settings. The issue is that a PDM technically could easily kill you, by giving you a lethal dose of insulin.<p>Funny thing is that the newer Omnipod 5 from the same company works with regular phones now, but only in th US.
Until recently, if you offered a pump that _could_ be controlled by another device (such as a phone) you would have to offer your own "controller" device, even if 99.9% of your customers have a phone already.<p>So, this companion device is kind of a thing that Insulet had to release. You'll see this with CGM's too -- there's a small companion device sold with the Dexcom G7 (the "controller"), even though everyone just uses their phone.<p>This is kind of a regulatory quirk; basically from the FDA's point of view you had to have a complete standalone system, that did not include the phone, in order to be able to prescribe it. I think they do not require companion devices any more, it's OK to release something that requires the user to have a phone.
So essentially, it's like this?<p>"we plan on users having a phone to connect to it and use primarily. FDA requires a primary/backup. well it's already phone-controlled, go find a phone that works with it. needs to be cheap, cuz no one will really use it anyway"<p>That makes a little more sense. I was imagining the development process involving both devices, rather than one device first, then determining what the second would be later.<p>Thanks for the insight!
Its also for security.. outside the US, you still cant use a regular phone with the omnipod.
Out of interest is there a process to petition the FSF to take up something like this?<p>How do they triage and decide what to pursue?
TL;DR: Not the FSF, but SFC; email compliance@sfconservancy.org<p>The dominant legal theory is that the GPL can only be enforced by the party holding the copyright. SFC's lawsuit against Vizio is strategically trying to establish precedent changing that; establishing that end-users are "third party beneficiaries" under the GPL, so others can enforce the GPL; but for now the copyright holder is the only one who can enforce it.<p>So the FSF could only take it up if the violation is on projects that do copyright-assignment to the FSF (i.e.: most GNU stuff). If you do find a violation of GNU stuff, the process is "email license-violation@gnu.org". I do not know what process Craig and Krzysztof use when triaging reports and deciding what to pursue.<p>Many Linux-kernel contributors (also, SFC member projects such as OpenWrt, Git, Qemu) have assigned their copyright to SFC or named SFC as their legal representative (also, SFC member projects; so SFC <i>can</i> take up something like this. Similarly, you can report violations to them by emailing compliance@sfconservancy.org (see <a href="https://sfconservancy.org/copyleft-compliance/help.html" rel="nofollow">https://sfconservancy.org/copyleft-compliance/help.html</a> for more info).<p>Now, SFC is aware of more violations than they could ever possibly pursue, so they're strategic about pursuing ones that are high-impact. I'm not sure how they decide that. But I can say that medical devices are near-and-dear to them, between executive-director Karen Sandler's implanted defibrillator and policy-fellow Bradley Kühn's blood glucose monitor.
> Bradley Kühn's<p>I saw that spelling for the first time last week, I think.<p>Did he change his name? Has he always been Kühn, but went with Kuhn, because Umlaute are hard for Americans?
Oh well. The whole thing has already been reverse engineered. Look up Loop or Trio or OpenAPS. Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices. This isn’t really that big a deal. What we need right now is help REing the Omnipod 5
I’m aware of a few people working on REing the Omnipod 5. The furthest issue that I have seen is that when a PDM/Omnipod 5 app signs into your insulet id, it gets a private key from the API which is stored in the keychain (and uses SSL pinning to prevent MiTM retrieval of the private key). When pairing with the pod they exchange public keys and then a derived key from the devices private key+pods public keys, but haven’t been able to get a copy of a private key yet to make further progress.
Not all though, I've been looking at Minimed pump reverse engineering (which would be just reading glucose data, not controlling the pump), and that's not solved yet, at least not for the 780G. But I hope it will be, and perhaps I'll be able to contribute.
I don't work for Medtronic. But it's extremely unlikely that will happen. It's not merely a matter of reverse engineering -- after the original medtronic "hack" / reverse engineer efforts (the ones that lead to the original openAPS system being developed) the FDA put out new guidance on cybersecurity protections for insulin pumps.<p>The communication between your phone/pump or glucose sensor/pump is encrypted now for all newer devices.<p>> Diabetic companies like Insulet have been very lax when it’s come to the hacking of their devices<p>Absolutely not true, not any more.
Good luck trying to enforce the GPL against a Chinese company
Well it looks like insulet is the primary offender here, and Nuu (the Chinese company) is just the hardware manafacturer
An actual good use case for tariffs.
Is linking to the "old" reddit a sign of being superior to those who use the current version of reddit? I've spotted that numerous times over past few weeks here.
Why would you come to that conclusion instead of the obvious one being that the kind of people to use Hacker News are the same kind to prefer old Reddit?
Some of us just prefer the old version, so when we copy the link from our URL bar it's to the old version.