Google Jigsaw's product "Outline" used code from shadowsocks-libev but used an incompatible license

[PeterCxy]

Dear contributors of shadowsocks-libev,

Recently a team at Google published a new "VPN" tool called "Outline" (https://getoutline.org/en/home). As it turned out, it was only another GUI wrapper around shadowsocks, and specifically, shadowsocks-libev. The client side of their software (https://github.com/Jigsaw-Code/outline-client) directly included source code from shadowsocks-libev and other related projects, some of which licensed under GNU General Public License version 3. However, the outline-client was licensed under Apache 2.0, which is not a compatible license with GPLv3.

Since the source code are directly included to the repository, I'm afraid that this could be a copyright offence. However, I haven't looked into whether it could actually be a derivative work of the Shadowsocks project. I am writing here for attention of you, the Shadowsocks contributors, who have done great work on fighting censorship, in case that further action should be taken on this issue.

Regards.

[broncotc]

Interesting.

[linusyang]

I am no expert in License. But I doubt if this project is ever worth trying. For example, why still use Cygwin to build the project, as we have a much better, highly efficient (IOCP-based), plugin-enabled full Windows port? Why contain the Cygwin dll binaries but not other pre-built third party apps? Why not use Git submodule but directly copy the source code? This is more like a project created by a group of unprofessional developers but not a Google-based company.

[greenbambooaaron]

Hopefully it means that "Jigsaw" will work to improve the code and contribute back to the community...

[madeye]

Generally, I'm happy to see more forks from our project. I described the detailed reason in an old post: https://maxlv.net/open-source-and-forking/

As long as Outline runs shadowsocks-libev in a separate process, I don't think there is any serious violation of GPL. However, the current code structure of their project doesn't follow GPL well.

Hope we'll see more direct contributions from them in the future.

[anthonywong]

Apache 2.0 is compatible with GPL v3, see https://www.gnu.org/licenses/license-list.en.html#apache2.

[PeterCxy]

@anthonywong It is not compatible the other way round, i.e. you COULD use Apache 2 projects as dependencies of a GPLv3 project, but you CAN'T use GPLv3 code in an Apache 2 project

[xiuluo]

@anthonywong But GPL v3 is not compatible with Apache 2.0，so you can't fork this project then change license to Apache 2.0.

[anthonywong]

@PeterCxy @xiuluo Right, both of you are correct. Looks like Outline does not fork and change the license, but includes shadowsocks-libev and runs it as a separate process (https://github.com/Jigsaw-Code/outline-client/blob/master/cordova-plugin-outline/android/java/org/outline/shadowsocks/Shadowsocks.java#L40. Not saying this is okay, but just wants to point out how Outline works with shadowsocks-libev is debatable.

[RedL0tus]

@anthonywong Outline‘s maintainer says they are contacting their legal counsel to verify that they are complying or not. See https://github.com/Jigsaw-Code/outline-client/issues/14#issuecomment-375728834

[xnoreq]

@linusyang

we have a much better, highly efficient (IOCP-based), plugin-enabled full Windows port?

Do you mean the code that was merged into the forked libev and reverted again last week? I don't know the reasons for that but libev's paradigm is not really compatible with IOCP ... but libev is needed for Linux with its messy and broken polling and event mechanisms.

[linusyang]

@xnoreq We recently re-add MinGW support (w/ TCP Fast Open). See #1962 #1965.

We use wepoll to provide epoll-like backend for libev on Windows. The patched libev doesn't go upstream yet and is in the customized mingw branch, not the master branch (which was a mistake when merging the wepoll patches).

Please refer to the latest readme document on building the MinGW port.

[Per0x]

Is there currently an advantage to using Outline compared to shadowsocks-libev ?

[ghost]

@Per0x Server side or client side? They're optimized for different scenario.

[rogers0]

I'm regular shadowsocks(-libev) user. I'm wondering whether we can use shadowsocks-libev on server side, and use outline as client side.

If it's feasible, could anyone kindly share the detailed steps? Thank you!

[ghost]

@rogers0 You need generate access key from ss-libev config by yourself.

http://shadowsocks.org/en/spec/SIP002-URI-Scheme.html

[rogers0]

@studentmain Thanks so much! I think we need to add a script to generate the access key automatically, in shadowsocks-libev package.

Any volunteer to do the work? :-P

[ghost]

@rogers0 Maybe also QRCode. Maybe I'll write one, but probably in C...

[Per0x]

@Per0x Server side or client side? They're optimized for different scenario.

Both. There are several projects emerging, and I don't think I'm the only one who's a little lost on each other's directions.

[ghost]

@Per0x

Outline Client:

• Use ss-libev
• Pros:
  • Easy to use (copy url and click connect)
  • Full VPN on Windows
• Cons:
  • No plugin
  • Can only configure via ss url
  • Only full VPN mode, no pac mode
  • Server should support UDP.

Outline Server:

• Use outline-ss-server (modified ss-go2)
• Pros:
  • Multi key on one port
  • Built-in monitoring
  • Auto update
  • Easy to deploy
• Cons:
  • You need Outline Manager, which require GUI
  • No plugin support too.
  • Require Docker, sometimes too heavy.

IMO, Outline is optimized for bussiness scenario, their target user is not IT professional, just like their website said. Shadowsocks is designed for personal use (when it born, there is only one user, that's why ss haven't "user name").

[Per0x]

@studentmain Thank you !

[ghost]

@rogers0 a little works, still a prototype, will be open source when it ready 一点微小的工作，还在修，修好了会开源

[rogers0]

@studentmain thanks for letting us know. No need to be perfect, please kindly submit your code by pull request. Open source code evolves when the community is able to review and patch it.

[ghost]

@rogers0 FYI https://github.com/studentmain/ss-share , need improve, but should work.

[fortuna]

@studentmain nice comparison!

A few things I'd like to clarify:

• The Outline Client no longer requires the server to support UDP. It will work even if the network blocks non-DNS UDP traffic. The downside is that you won't be able to proxy UDP traffic. DNS falls back to TCP.
• The Outline Server does not require a UI. You can manage it using the server management REST API
• If you don't want to run Docker, you can run outline-ss-server directly, which is based on a configuration file (example). You will lose the automatic secret generation when creating keys, but that may work for you.