Tivoization: When is software really free?

Tivoization? It was some time ago when this term was on everyone’s lips. However, with the increasing spread of “embedded devices” based on Linux, the discussion has recently flared up again.

Tivoization describes the process whereby free software is used on devices on which only software signed by the manufacturer can run. According to the license, the user then has the right to obtain the source code and change it according to his ideas, but not the technical possibility to install the software changed by him on the manufacturer’s device. The device would refuse service or at least no longer function properly (Wikipedia). Technically, there are many ways to detect modified code and react accordingly. For example, the hardware sometimes checks the installed software with a checksum and shuts down if it does not match an expected signature.

The term is coined by the manufacturer of the Tivo digital video recorder, which is based on Linux. As required by GPL 2, the company discloses the source code of the TiVo software. You can view them, change them, recompile them, but you can’t put them on the TiVo anymore, because then it won’t run: The firmware only accepts system images that the TiVo makers have digitally signed.

This triggered a heated discussion in the open source world: For Linus Torvalds, initiator of Linux kernel development, the manufacturer’s behavior is not a problem: the code is open, any user can look at what the TiVo makers have programmed and use this code themselves. Chief ideologue Stallman, founder of the Free Software Foundation (FSF), on the other hand, emphasizes the freedom of users to change the overall system of hardware and software at will. The FSF has defined the following four essential freedoms¹:

0. The freedom to run the program as one wishes, for any purpose (freedom 0).

1. The freedom to study the functioning of the program and to adapt it to one’s own data processing needs (freedom 1).

2. The freedom to redistribute the program and help other people with it (freedom 2).

3. The freedom to improve the program and to release these improvements to the public so that the whole society can benefit from them (freedom 3).

With Tivoization, what the FSF considers to be an important possibility to change the free software in TiVo at will is lost.

A compromise was found in the now accepted version of the GPL 3, in which the possibility of “technical subversion” of the license is addressed: The GPL 3 explicitly states that “installation information” must also be provided when code is modified. In addition to the “TiVo case”, the authors of the license have also thought here of the ever-increasing use of PDAs, smartphones or similar, which are usually supplied with their own operating system and where the possibility of further development or adaptation of the software is only slight or non-existent. The licensor must ensure here that it is technically possible for the licensee to actually be able to implement the rights that he obtains through the GPL 3.

The preamble of GPL 3 is largely identical to that of GPL 2, but the linguistically revised text also includes this occasion-related section 6, which deals with embedded systems and the “TiVo” case:

“User Product” means … an “End User Product”, by which is meant a tangible personal property … that is … used in a household …
“Installation Information” for a User Product means any method, procedure, authorization key, or other information required to install and execute modified versions of a Covered Work in that User Product from a modified version of its Corresponding Source Code. The information shall be sufficient to ensure that the continued operation of the modified object code is not prevented or interfered with in any way simply because a modification has been made.

Eben Moglen, a professor of law and legal history at Columbia Law School in New York and a consultant on the development of GPL3, commented:

All future versions of the GPL will fully protect the [four aforementioned] freedoms that the Free Software Foundation defined decades ago and that we believe should be guaranteed to all software users everywhere.

Developers of “embedded devices” must therefore be particularly mindful when using open source under the GPL 3 and ensure that not only the source code itself is published, but also all additional information to allow users to make changes and also to re-execute the code they have changed on the device. This finally satisfies freedoms 0 to 3.