←back to thread

Winamp deletes entire GitHub source code repo after a rocky few weeks

(arstechnica.com)
431 points dangle1 | 2 comments | 16 Oct 24 16:34 UTC | HN request time: 0.001s | source
Show context
fsflover ◴[16 Oct 24 17:19 UTC] No.41861478[source]▶
Related: https://news.ycombinator.com/item?id=41662105

Winamp contained modified GPL code, violating the GPL (github.com/winampdesktop)

18 points by mepian 19 days ago | 6 comments

replies(2): >>41861657 #>>41861961 #
bscphil ◴[16 Oct 24 18:11 UTC] No.41861961[source]▶
I can't see the original issue, but it's interesting that the title chooses to highlight the fact that the GPL code was modified. Actually, under the GPL, this fact is immaterial. If the Winamp player contained any GPL code at all, modified or not, then it is a derivative work of that GPL code and anyone receiving a copy of Winamp is entitled to demand the full corresponding source be provided under a GPL license.
replies(4): >>41862254 #>>41862325 #>>41863354 #>>41864002 #
kccqzy ◴[16 Oct 24 18:36 UTC] No.41862254[source]▶
The original issue was complaining about libdiscid which is under the LGPL license not GPL. With that license, linking to an unmodified library in proprietary software is fine. What's not fine is to link to a modified library without releasing the source code for that modification. (Of course here the modification is extremely simple so some concludes this is a nothing burger.) The original poster likely knew the LGPL difference and that's why everyone became fixated on finding the modifications to the library rather than the fact of linking itself.
replies(2): >>41863210 #>>41863572 #
1. leni536 ◴[16 Oct 24 20:35 UTC] No.41863572{3}[source]▶
> With that license, linking to an unmodified library in proprietary software is fine.

Was it linked dynamically? Static linking to an LGPL library from a proprietary application is also possible, but way trickier.

replies(1): >>41866341 #
2. skissane ◴[17 Oct 24 04:09 UTC] No.41866341[source]▶
> Was it linked dynamically? Static linking to an LGPL library from a proprietary application is also possible, but way trickier.

For a "shared source" app (i.e. source available but under restrictive non-open source terms), static linking is generally a non-issue, provided you give people permission to recompile the app from source with a modified library version, and you actually built the binaries you ship from the source you provide them (as opposed to some separate internal repo containing changes missing in the source you provide to your customers or the public). So, WinAmp currently would not be infringing even if it were statically linking modified LGPL libraries (assuming their source repo includes the source to the modifications) – although this may be evidence of past non-compliance.

Static linking is really only a big problem for proprietary apps where you don't give people the source code. Even there, so long as you ship them object files so they can relink it with an updated LGPL library version, you are fine. Once upon a time, linking at the customer site was not an uncommon strategy for enterprise software, in fact last time I worked with Oracle RDBMS (7+ years ago) it was still using that strategy for a standard install.

For LGPL 2.1, you don't even need to ship the object files or offer them for download – you just need to make an offer, valid for at least 3 years, [0] to supply them on request. LGPL 3.0 removed that provision, with LGPL 3.0 you have to either ship them or offer them as a separate download.

[0] I believe the "3 years" is from the date you ship each individual copy of the software. So if you released version 1.0 in 2001, and it contained a "valid for 3 years offer", if you are still offering version 1.0 for download from your website in 2024, that offer is valid until 2027 for someone who downloads it today. But if you removed version 1.0 from your website in 2005, and since then have not given anyone a copy, then the offer would have expired in 2008.