From: Solomon Peachy via rockbox-dev <rockbox-dev_at_cool.haxx.se>
Date: Sat, 24 Apr 2021 12:23:50 -0400

First, the background:

There's a Chinese DAP maker advertsing Rockbox support for one of their
DAPs. Which is great, except.. they provide a binary build, and nothing
else.

   https://www.aliexpress.com/item/4000068966351.html

This is a variation of a platform I've seen before (STM32 + CPLD +
high-end DAC), but instead of the signature five-button control layout
and a small OLED screen they went with a large resisitive touch screen.

Given the major limitations of this platform, they would have had do
some heavy hacking on our codebase to get this usable.

This hacking may have some significant value, and could be a useful
foundation/reference for future ports. If nothing else it's a new CPU &
SoC family (STM32, ARM Cortex-M3/4/7), and that SoC family is something
I've personally wanted to port for a while. But that's moot since no
sources are provided.

Now I know that given that it's a Chinese company with no US/EU presence
there's fuck-all I or anyone else here can directly do about GPL
violations, but this is something different -- Zishan is using the
rockbox name _for commercial purposes_, listing it as a feature in their
advertising copy, and at least some folks are purchasing it due to that.

On one hand I'm glad to see that someone thinks this matters, but on the
other hand, if they're going to take our name in vain, they need to at
least respect the terms of our license!

With a (US) trademark, we can go after US folks importing and reselling
these devices. On one hand it's not the resellers' fault, but on the
other hand, money talks, and pushback from folks buying in bulk is the
only way I can see to put some pressure on Zishan and others like it.

So. That's the short summary. This leads to some questions, naturally:

1) Putting aside the question of ownership, is having a trademark a good
   idea? Why or Why Not? (In other words, is this really a problem,
   and even if it is, would a TM actually make things _worse_?)

(Every other question assumes the answer is "yes")

2) Who should nominally own this trademark?

   This one's a doozey, and is the real reason behind this email.

   I'm in favor of a neutral third-party foundation (eg the SFC) but
   that's not something that can happen quickly. Until then IMO it
   should be the same folks who own the domain name, as "the Rockbox
   name" is about the only actual asset of "the project" has. (ie every
   contributor retains their own copyrights)

3) When/how should we assert this trademark, keeping in mind the
   letter and spirit of our code license? (ie GPLv2+)

   At the very minimum, anyone using our name commercially [*] needs to
   comply with the source requirements of the GPL. I'd prefer to take it
   a step further and require them to get advance permission, unless
   they are redistributing _unmodified_ versions.

   [*] "commercially" is a broad term, but in this context I consider it
   to be selling something containing rockbox code and/or listing
   rockbox in their promotional materials.

4) Who gets to decide what is or isn't acceptable?

   Ultimately it's up to the "Owner". But back in the day there was a
   Rockbox Steering board. But even that implies a higher level of
   active participation than we've had since.. back in the day. :D

5) How much will this cost? How do we pay for it?

   We've been relying on donations up to this point, and since we don't
   pay for hosting we don't have meaningful ongoing costs, but we will
   have to fork over money to both register a trademark and keep it
   alive. Assuming nobody contests the filng, we're probably looking at
   about $500 up front, and about $250 every 5-10 years to keep it.

   Keep in mind that the over-broad definition of "commercial" works in
   our favor here, simply maintaining the web site (and ongoing
   development) is sufficient to show that we are still using rockbox
   "commercially" -- we don't actually have to be selling anything.

   I think it's reasonable to ask someone seeking to use our code
   commercially to contribute _something_ monetarily but getting that
   right will involve lawyers and cost even more money.

6) What about actual _enforcement_?

   Sending nastygram C&Ds is easy and cheap, and works surprisingly
   well, but following that up with action (filing for an
   injunction/import ban/etc) is likely to require actual lawyers and be
   anything but cheap. IMO this is where being under a foundation like
   the SFC really helps.

7) So why go through with any of this?

   In the short term, ultimately all I really care about is gaining a
   little bit of leverage to help us obtain the complete corresponding
   source code that the GPL requires.
 
   Looking down the line, should we ever produce our own hardware, IMO a
   trademark is necessary because that implies a considerable monetary
   investment. But even putting aside that pipe dream, what are we to do
   if Zishan (or whomever) does more than distribute a hacky, buggy,
   binary-only build of rockbox? What's to stop anyone from selling a
   "Rockbox DAP" that doesn't actually contain any rockbox code?

Maybe I'm overthinking this, but maybe not. Either way, I'd like to
hear everyone else's thoughts on this, especially from the original
Rockbox crew if they're still occasionally listening...

BTW, I recommend reading this, and the comments:

    https://lwn.net/Articles/673677/

 - Solomon

-- 
Solomon Peachy			      pizza at shaftnet dot org (email&xmpp)
                                      _at_pizza:shaftnet dot org   (matrix)
High Springs, FL                      speachy (freenode)

Received on 2021-04-24