Re: [gentoo-dev] Guidance on distributed patented software

[Rich Freeman]

On Sun, Sep 26, 2021 at 1:09 PM Peter Stuge <peter@×××××.se> wrote:
>
> There's not neccessarily a conflict between a patented idea and a
> public domain implementation of that idea.

It kind of depends on what you mean by "conflict."

>
> Take a fictional example:
>
> You and I independently invent the same thing. You patent it, then
> write and publish an LGPL implementation. I, ignorant of your
> accomplishment, later write and publish a different implementation,
> placing it in the public domain.
>
> You having a patent doesn't neccessarily matter to me publishing my
> implementation.

Sure it does.  Depending on the claims of the patent, your publication
of the completely independent implementation is basically a public
confession that you violated the original patent.  Now, if you didn't
obtain any commercial value from it and were ignorant it is pretty
unlikely that somebody would actually go after you for it or get
damages, but you can infringe on a patent while being completely
ignorant of it and doing all your own independent work.  The patent
covers the idea, no matter how many times it is independently
invented.

> What users have to do is determined by the terms set forth in the
> patent. E.g.: the QR-code patent has (I believe) not expired yet but
> has always permitted using the idea without any explicit license under
> the condition that all use is actually spec conformant.

Generally patents, like copyright registrations, do not have "terms"
for how you are allowed to use the patented technology.  The patent
just makes claims as to what is covered.  For something completely new
those claims often are pretty broad covering anything somebody could
imagine the technology being used for.  For something repurposed the
claims tend to be narrow, as the inventor didn't actually come up with
the original idea but claims the new application of it is novel in
some way, and if you use it for anything else you're more likely to be
free and clear.

What you are talking about is a patent license, which is similar to a
software license.  You don't "copyright software under the GPL" - you
just copyright the software full stop.  Then, as a separate act, you
issue however many licenses you wish to anybody you wish allowing them
to do things that would otherwise infringe on the copyright.  In the
same way all a patent does is stake a claim on an idea, and then any
licenses are a completely separate matter.  If a patent holder wants
to sue somebody they would point to what they're doing and then to the
patent, and the court would determine if the action infringed, but the
defense would be free to provide any license they believe they
legitimately have from the patent holder that makes the action legal.

> You seem to expect some due diligence from libtomcrypt authors before
> having decided to publish their work and I don't find that reasonable.
> I hope I've managed to explain why?

So, I can't speak for libcrypt at all specifically, but I wouldn't
assume that somebody has actually done due diligence before publishing
anything.  For all you know the authors of some random piece of
software live someplace the patent is unenforceable and don't even
care if it infringes, or they're protected by anonymity online.  Back
in the PGP ITAR days I believe somebody went through some loopholes to
publish the software outside the US, and it is probably debatable
whether that was legal under US law, but presumably the people who did
it didn't care, and enforcement was unlikely at all, and especially
unlikely if you didn't have plans to visit the US after bragging about
distributing it.

Really the same is true of software patents in general.  For random
individuals other than your own conscience it is pretty unlikely for
there to be any kind of enforcement.  For a business or concern of any
size though it obviously is a risk that is probably not worth taking.
This is arguably one of the value-adds a commercial distro could add:
providing an assurance that anything in the distro is systematically
and competently screened.  Whether commercial distros actually due
this in practice is something I don't know, though if they make
promises and have the appearance of a decent program it might
accomplish the CYA needs of due diligence for most companies...

-- 
Rich