nProbe and GPLv2

BaconZombie

Hey,

I was looking to roll out a test install of nProbe in work and since it is GPLv2 I did not think there would be any licensing issues.

But when I when to download the source/binaries I was directed to "pay" for the download......

nProbe is available under the GPLv2 licence for a little fee, that's used for running the project and funding the new developments. You can purchase online your copy of nProbe at the ntop e-shop site. After the transaction is completerd you can download your nProbe copy immediately.

Now I know OS projects need funding but is this not a violation of the GPLv2 licence ? Also if somebody does pay the "little fee"* I take it they can post the code online freely ?


*NTops idea of a "Little Fee" is :



http://www.ntop.org/nProbe.html
http://www.nmon.net/shop/cart.php

aidan_walsh

No violation that I can see. The sources are all freely available from here. They might be charging for compiled binaries, but there is nothing in the letter of the GPL against that (IIRC) though it could be said to be against the spirit of it. You can download the sources and compile them yourself however.

BaconZombie

Hey AW,
That's what I thought but only the nTop, n2n & PF_Ring are available for download on that page, nProbe is not listed.

There is also a thread on FreshMeat.net about it as well:

http://freshmeat.net/projects/nprobe/comments

aidan_walsh wrote: »

No violation that I can see. The sources are all freely available from here. They might be charging for compiled binaries, but there is nothing in the letter of the GPL against that (IIRC) though it could be said to be against the spirit of it. You can download the sources and compile them yourself however.

croo

If you suspect a violation, you can always ask the Free Software Foundation
http://www.fsf.org/licensing/licenses/gpl-violation.html

They have a load of legal types who can answer most questions.

While open source is Free, this of course does not refer to the price - though typically it is free in price too. The interesting point re nprobe is that

"Note that for nProbe OEM, reselling, repackaging (including device embed) you need a written commercial licence that's available on request from its author. This because this is considered as "derived work" as specified in the GPL license."

As GPL I understood you were free to distribute the source yourself once it was acquired (this is usually why open source if free in price terms)... this seems to say you cannot!

I notice they sell a "professional version". These days I, personally, avoid projects that employ dual licensing. I cannot help feeling this so called "Commercial Open Source" is little more than cheap viral marketing and using open source as a beta testing ground for their "professional" version. Also companies that dual license do not accept work from outside of the companies development team as this would pollute their copyright and hence their ability to dual license.

BaconZombie

I thought this is why people use the BSD licence since it allows you to fork the project and release a paid and free version, but the GPL does not.

croo wrote: »

"Note that for nProbe OEM, reselling, repackaging (including device embed) you need a written commercial licence that's available on request from its author. This because this is considered as "derived work" as specified in the GPL license."

As GPL I understood you were free to distribute the source yourself once it was acquired (this is usually why open source if free in price terms)... this seems to say you cannot!

I notice they sell a "professional version". These days I, personally, avoid projects that employ dual licensing. I cannot help feeling this so called "Commercial Open Source" is little more than cheap viral marketing and using open source as a beta testing ground for their "professional" version. Also companies that dual license do not accept work from outside of the companies development team as this would pollute their copyright and hence their ability to dual license.

croo

Well you can fork with either license.

The key difference is with BSD (or Apache) you are not required to release your code for the versions you distribute but for GPL you must.

Which would make BSD seem more commercially friendly, but actually many of the "commercial open source" projects release under GPL. As GPL, any derived work, that is distributed, must include the source... so they can be sure all enhancements made by the community *can* come to to them (too).

But the key is who owns the copyright... if the commercial backers own all the copyright then they can dual license the product. This is how the professional/enterprise versus community versions of many projects work. But this necessitates they do not include any contributions of work from the community at large as it would pollute their copyright. Which kinda defeats one of the key benefits of open source as per Eric Raymonds.

croo

ps. GPL does not disallow paid versions... hmm double negative! Let me rephrase. You can release paid versions of GPL. The only real must is that you MUST release the source code for any distribution you make. The only provisio re pricing is (and it's a while since I read the small print) you must only charge a reasonable amount to cover costs in the supply the source code.

BaconZombie

On a side note since it is GPLv2'd I take it if I'm supplied a copy of the source I can do free what I want with it once it does not violate the GPLv2 ?

croo

that would be my understanding too, yes.

They do seem to imply that might not be the case but unless they have modified the gpl text!? It wouldn't gpl then of course ~ but I once saw a project that was worded such that actually you couldn;t legally distribute the source (you were not permitted to distribute the tm logo, but also not allowed to remove it!)... but they had to change it to maintain an OSI compliant license. The only way to know for sure is read their actual license.

BaconZombie

Hmm,

The Source code does not have a copy of the GPL into, the readme has :

Copyright (C) 2002-2010 - Luca Deri <deri@ntop.org>

But all the main .c files start with:

/* 
 *        nProbe - a Netflow v5/v9/IPFIX probe for IPv4/v6 
 *
 *       Copyright (C) 2002-10 Luca Deri <deri@ntop.org> 
 *
 *                     http://www.ntop.org/ 
 * 
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License along
 *  with this program; if not, write to the Free Software Foundation, Inc.,
 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

These is a folder called "third_Party", which has the following in the .c file:

// QuickLZ data compression library
// Copyright (C) 2006-2007 Lasse Mikkel Reinhold
// lar@quicklz.com
//
// QuickLZ can be used for free under the GPL-1 or GPL-2 license (where anything 
// released into public must be open source) or under a commercial license if such 
// has been acquired (see http://www.quicklz.com/order.html). The commercial license 
// does not cover derived or ported versions created by third parties under GPL.

croo

re: well if it licensed with just a link to the FSF version then I think you are free to modify and/or distribute.

re: QuickLZ
That reads a little vague in that you are free to USE - not strictly speaking open source in the it doesn't mention distribution. But I suspect that is the intent just the wording is not explicit... I say that because further on it precludes distribution of derived versions under the commercial license.

So I think you are free to re-distribute as GPL that which you have.

kvitaly2005

Just in case anyone still interested in nProbe source code (after 5 years , I have bought it and legally obtain source code from the owner. nProbe is a registered trademark, so I forked it under the name of LibreProbe (lprobe). You can find repository on github. I can't put URLs as a new user, but if you know what is nprobe, you will be able to find it on the site without slightest problem.

Johnboy1951

kvitaly2005 wrote: »

Just in case anyone still interested in nProbe source code (after 5 years , I have bought it and legally obtain source code from the owner. nProbe is a registered trademark, so I forked it under the name of LibreProbe (lprobe). You can find repository on github. I can't put URLs as a new user, but if you know what is nprobe, you will be able to find it on the site without slightest problem.

There ye go

https://github.com/kvitaly2005/lprobe

esan_br

Apparently founder of ntop asked pro github remove the new project

Johnboy1951

Hopefully kvitaly2005 will post back about what the problem is.

croo

esan_br wrote: »

Apparently founder of ntop asked pro github remove the new project

That's strange for a GPL application - did the source you purchased also have GPL in the headers? I found the FSF useful in queries like this - they offer free legal advise. They did to the Adempiere project when we forked Compiere anyway.

Kinir

Hi,

First of all, thank you for making this available to us.

I'm new to this, so please bear with me

I tried compiling your lprobe package (on a virtualized/vmware Debian 8 64 bits)

I had to fix your autogen.sh for the updated nDPI URL:

NDPI_URL=https: github.... ntop/nDPI

(I also add to alter the ./nDPI/src/lib/.libs/libndpi.a line to ./nDPI/trunk/src/lib/.libs/libndpi.a )

So in the end, i managed to make the autogen.sh work, but the make fails with the following errors:

engine.c: In function '_intoa':
engine.c:106:11: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
     ret = (char*)inet_ltop(AF_INET6, &addr.ipType.ipv6, buf, bufLen);
           ^
engine.c: In function 'setPayload':
engine.c:225:18: error: incompatible types when assigning to type 'u_int16_t' from type 'ndpi_protocol'
       ndpi_proto = ndpi_find_port_based_protocol(readOnlyGlobals.l7.l7handler,
                  ^
engine.c:242:18: error: incompatible types when assigning to type 'u_int16_t' from type 'ndpi_protocol'
       ndpi_proto = ndpi_detection_process_packet(readOnlyGlobals.l7.l7handler,
                  ^
engine.c: In function 'exportBucket':
engine.c:2822:16: error: incompatible types when assigning to type 'u_int16_t' from type 'ndpi_protocol'
     ndpi_proto = ndpi_guess_undetected_protocol(readOnlyGlobals.l7.l7handler,
                ^
Makefile:696: recipe for target 'engine.lo' failed
make[2]: *** [engine.lo] Error 1
make[2]: Leaving directory '/home/doc/Downloads/lprobe/lprobe-master'
Makefile:732: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/home/doc/Downloads/lprobe/lprobe-master'
Makefile:508: recipe for target 'all' failed
make: *** [all] Error 2

Edit: I would also add the following info , from the official ntop/nProbe website:

FAQ

Q: Do your release nProbe™ source code?
A: We have decided not to release the source to everyone as in the past some people made some buses. Requests will be evaluate on a case-by-case value if the requestor qualify (e.g. research institution).
Q: Is nProbe™ able to operate on Gbit networks at full speed?
A: Yes. Note that for exploiting the Gbit packet capture you need a 64-bit PCI Gigabit Ethernet interface.
Q: Can I redistribute the nProbe source or build a derivative product?
A: No source code cannot be redistributed and it is only for educational purposes and private use. If you plan to build a product or sell nProbe-based solutions you need to contact us.
Q: What do you do with the money you get charging for nProbe™?
A: This money is invested for doing research in ntop, nBox and nProbe™ projects.

What do you think about these statements? This is so confusing.
I'm no expert, so I don't know if using lrpobe would be allowed or not.
If not, I'll try to find another netflow software. *sigh*

Johnboy1951

nProbe is available under the GPLv2 licence for a little fee, that's used for running the project and funding the new developments. You can purchase online your copy of nProbe at the ntop e-shop site. After the transaction is completerd you can download your nProbe copy immediately.

There is no problem at all in charging a fee for GPLv2 software.
Such a fee helps defray costs of hosting and providing the download.

If it is truly GPLv2 then the source code must be made available on request.

Q: Can I redistribute the nProbe source or build a derivative product?
A: No source code cannot be redistributed and it is only for educational purposes and private use. If you plan to build a product or sell nProbe-based solutions you need to contact us.

This is in direct contravention of the GPLv2 licence, as I understand it.

croo

I had a quick look at the ntop.org site and there it indicates it is distributed under a EULA. And it specifically states that they do not distribute code... now.

Q: Do your release nProbe™ source code?
A: We have decided not to release the source to everyone as in the past some people made some buses. Requests will be evaluate on a case-by-case value if the requestor qualify (e.g. research institution).

So they did in the past and whatever version that was. is still GPL now and it can be used & distributed as you wish... just so long as you always distribute the code too!

So my view would be the current version is not GPL but some older versions were... and as I said way back, so long at one or two people own the copyright of ALL the code then they can re-licence whenever they wish as copyright holders. Which is why I try to avoid such projects.
But the releases they made under the GPL still stand even if they decide that new releases will be made under a new license.

Kinir

Ok, thanks for your answers guys.

I gave up on ntopng anyway, it was a nightmare to setup under Debian 8 with the free packages provided (no source code available anymore), and it seems the author is moving everything from free, to commercial licenses.
Also, it's way too expensive for a home project.

I'm now testing FlowViewer (from NASA) with silk (from Cert). It kinda works.
It's not very pretty, but I can analyze netflows from my Mikrotik router.
It's free/open source btw.

Now I wish there was a good , free/open source software similar to Solarwinds or prtg etc...