Building an IoT product - what is the best way to avoid sharing in-house proprietary code?

Question

I think it was hard for me to formulate the title. However, I can still explain my problem in more detail in here.

I am designing an embedded product which consists of cloud service and embedded hardware. The cloud service will have a REST-api (though it being available is not the selling point) and it will communicate with the embedded hardware. Ideally, the embedded hardware would also have a REST-like interface for communication. The problem is finding good software stack for it (or that's what I think is the problem).

The best option in my opinion would be some kind of embedded Linux distribution with its own web app installed inside (Ubuntu Core + Django...?). Is it somehow possible to use this combination in a commercial product but at the same time keep the webapp inside closed?

The Ubuntu website provides multiple supported platforms and some of them look ideal for my use case. Like I said before, my main concern at the moment is licensing.

Answer 1

First of all, note that I'm not a lawyer. Get one if you think you need legal advice. Licensing is one such area where I'd recommend one.

Open source licenses vary greatly in what they allow. Let's use the example of a library that you're using (unmodified) in your project. Two common licenses you might find are GPL and LGPL, which vary on how they treat this issue. From this article, for example:

The GNU Project has two principal licenses to use for libraries. One is the GNU Lesser GPL; the other is the ordinary GNU GPL. The choice of license makes a big difference: using the Lesser GPL permits use of the library in proprietary programs; using the ordinary GPL for a library makes it available only for free programs.

Other license examples which are a bit more open in this regard include MIT and BSD.

A lot of Linux software is GPL, and this will likely include components of any OS you select (e.g. Ubuntu Core). However, as long as your project isn't considered a derivative work from these projects you shouldn't be affected. More info in this answer.

From this perspective, using Ubuntu Core for your product shouldn't affect whether or not the application you ship on it is open or closed. Indeed, packaging your application as a snap is a good way to distribute binary blobs.

You've probably considered this, but from a technical perspective, if you ship a Python snap using Django, the snap won't be binary blobs-- by default your code will be sitting there for anyone who wants to see it (either by dumping the disk contents or by gaining shell access somehow). You may want to obfuscate or ship bytecode instead, etc.