NEWS FLASH The Missing FreePBX GPL Source

[wardmundy]

 

[briankelly63]

"That Damn WM caught us again".

If they don't fix this issue right away I think a boycott of Sangoma products would be in order. These FreePBX guys are doing damage to their and Sangoma's brand.... foolish.

 

[wardmundy]

Tedious...

 

[wardmundy]

Bottom Line:

After release of [our] article, one of the FreePBX developers suggested that the GPL FreePBX Development Tools could be used to build your own Cloud component for FreePBX. There are several problems with that. First, these tools and their output are for development use only and were never intended for use with FreePBX in a production environment. Second, the tools require a (revocable) “key” issued by FreePBX. In and of itself, that makes FreePBX proprietary. Third, this key requires a user to sign a blank check legal indemnification agreement to cover all of Sangoma’s legal expenses (reasonable or otherwise) should they be sued for anything associated with that key. Without a key, unsigned modules (including those from FreePBX’s own GitHub source tree) would generate nasty compromised server messages in the GUI. So, no, providing a toolkit to build crippled source is not the same as providing the actual source code upon which FreePBX relies for proper operation, i.e. the XML and TGZ files hidden in the Sangoma Cloud which in Sangoma-speak is euphemistically described as their content delivery network (CDN).

 

[billsimon]

So is that repo (http://mirror1.freepbx.org/modules/packages/) authenticated by user agent or something? Browsing there in Safari yields a 404.

 

[wardmundy]

billsimon: You have to be extremely careful to ask the "right question" when dealing with the FreePBX folks on this topic (see below). They don't call it a Cloud or a Repo so you get scolded when you suggest that they'd actually hide stuff there. In their lingo, the (hidden) modules stored as compressed tarballs in TGZ format are served up from a CDN, which happens to be 2 servers running at different IP addresses. Rob forgot to mention you also need a (revokable by them) "key" to gen these files and make any of this work correctly with the FreePBX GUI. That's where the blank check legal indemnification of Sangoma and PROPRIETARY come into play.

In layman's terms, it's nothing more than Apache security through obscurity: Options -Indexes. You can download a FreePBX module from either of their servers IF you happen to know the name, version, and location of the file you need. FreePBX's Module Admin handles all of this under the covers using a hidden XML file that also is buried elsewhere in the Cloud.

Here's what the layout of the Cloud component looks like (minus the XML file) if you could actually see it. This is based upon our RealGPL™ repo.

p.s. Trademark symbol represents our feeble attempt to inject a little humor into all of this.

 

[billsimon]

A flow chart of the whole module update process, including URLs and descriptive commentary, could put the whole debate to rest as well as be very educational for us. xrobau would you be up for that? I haven't followed wardmundy's investigative journalism completely (it's summer time and the outdoors are calling) but the evidence points to more than a mere misunderstanding.

 

[wardmundy]

Nothing complicated here other than the fact that Sangoma's (inherited) employees don't want to abide by the Plain English of the GPL:

The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. [Emphasis added.]

 

[wardmundy]

NOTE: FreePBX Community Manager's tweet bragging about being treated like a Gangsta (together with YouTube link) has been removed from public view:

HINT: Maybe you should do what you've agreed to do in your license agreement. Then people wouldn't treat you like a Gangsta.

Following publication of James' tweet plus our HINT (above) and our Nerd Vittles article this week, James' posts on Twitter were removed from public view, not exactly the Sangoma response we had hoped for.

 

[vic555]

Sangoma is listed on the Canadian Venture, for $ .30 a share, and a capitalization of approx. $8 million. Many of the firms listed on the venture have had a rich history, and yes, some have been noted for being loose with the truth, and have had regulatory issues.

Many of these firms provide a concept, a marketing blitz, and value to the corporate officers, through continual dillutive secondary offerings. (These firms are the new wild wild west, ruled by the gunmen or grifter, and not the shareholder, customer. regulator, or occasional plantiff attorney)

So what is new?

 

[atsak]

Well, I guess it's time to drive up there and have a chat with the management (they're 45 minutes from my house). I like Sangoma products - I really do - and I am a VAR for them. I might bring this all up to them again (I have already once).

 

[wardmundy]

Well, I guess it's time to drive up there and have a chat with the management (they're 45 minutes from my house). I like Sangoma products - I really do - and I am a VAR for them. I might bring this all up to them again (I have already once).

I think part of the problem is Sangoma management lives in a bubble. They hear about this stuff (which they really don't understand), and then they ask the Schmoozers what it all means. You can guess the type of answers they get.

The good news is they're about to hear it (publicly) from some sources other than me.

 

[atsak]

It's weird because initially when they bought Schmooze I mentioned the concerns to my sales rep (and some of the, well, complaints from my customers about them), and someone in upper management tried to call me but I wasn't free when they called. They said they'd call back but never did, so I let it go.

Wonder if they asked someone else in the interim about my comments? Probably not but looks suspect I suppose. Well I guess we'll see where it all ends up.

 

[wardmundy]

Another GPL shocker is in store for next Monday on Nerd Vittles. The more we disclose, the more we keep hearing about.

 

[tycho]

<sitting impatiently on edge of seat mode...>

 

[wardmundy]

 

[tycho]

I'm not on Twitter, so what do you mean when you say "the ads on Twitter from the FreePBX Community Manager were removed from public view"? Can you "explain it to me like I'm 5" (ELI5)?

(Are "ads" on Twitter a synonym/Twitter-speak for "posts?" I was reading this literally as advertisements...)

Or, maybe I should just wait 'til Monday.

 

[wardmundy]

These were repetitive, weekly posts on Twitter that advertised the availability of (what turned out to be crippled) FreePBX source code. That turned them into ads from our vantage point even though they weren't paid for. Nothing to do with next week's GPL abuse story.

I guess hiding the ads was one way to avoid being accused of publicly lying about the availability of your (real) source code, but... talk about biting off your nose to spite your face. Poor, Pinocchio!

 

[wardmundy]

They're Baaaack...


Coming on the heels of our Nerd Vittles article, that would appear to be an official FU from Sangoma that they do not intend to release the (real) module source components hidden in their CDN cloud.

 

[briankelly63]

I think its depends on what the meaning of the word "All" is....

Speaker John Boehner ✔ @SpeakerBoehner
When it comes to Hillary Clinton’s #Benghazi-related emails, it depends upon what the meaning of the word "all" is → http://j.mp/1dKgKpO
9:47 AM - 17 Jun 2015

I think we need Trey Gowdy on this..https://twitter.com/SpeakerBoehner