ASRock pirating software, illegally distributing IPMI firmware

This blog entry is more of a reminder and/or a warning about ASRock, rather than a normal blog article.

Basically, I bought an ASrock board (the C2550D4l, which is used a backup server and currently has 21 SATA disks attached. Very flaky, but when it runs it runs).

This board comes with an IPMI/BMC controller, actually quite full-featured one using a horribly broken java interface with a proprietary VNC protocol and most likely easily hackable as well, after all, it there to make access easier...

Of course, it runs GNU/Linux and busybox, and probably other GPL software:

# ssh 10.0.0.95
root@10.0.0.95's password:
X11 forwarding request failed on channel 0

BusyBox v1.13.2 (2016-01-13 17:56:43 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

It's also quite obviously descended from the same AMI garbage that Supermicro and many other vendors rebrand.

Those other vendors, while often reluctant, usually do publish (some) source code, and can usually be asked to follow the license of the software, even though they rarely fulfill the requirements of the GPL.

ASRock, on the other hand, quite clearly doesn't even try.

How do I know? Well, after downloading an BMC firmware upgrade and failing to find corresponding sources, as required, I contacted ASRock support:

Subject: RE: $C2550D4l$ Sourcecode for Megarac Firmware (Germany)

Model Name: C2550D4l

Hi!

I bought the mentioned product, and found out that the BMC runs Linux,
busybox, and probably other GPL programs.

I was surprised to not find the sourcecode with the board, or the
written offer to receive source code, as is required by the license.

I also tried to find the sourcecode on asrocks website, to no avail.

Please advise me on how I can get the sourcecode for the GPL software
delivered (and offered for download) with the board, as required by
law.

The somewhat unexpected reply was quite clear:

From: AsrockRack EU <AsrockRack_Eu@asrock.nl>
Message-ID: <007a01d1a9e9$e089b3d0$a19d1b70$@asrock.nl>

Hi Marc

The BMC source code is not publicly available since we bought it from
AMI, (the company). This is like Red Hat Linux.

If you think you need the source code for your special use, please
contact our sales team at <mailto:ASRockRack_sales@asrockrack.com>
ASRockRack_sales@asrockrack.com they will inform you further..

Right, that's just like Red Hat Linux, you buy a CD and then just pirate it, because licenses are only for others to abide to.

Now, as confused as the reference to Red Hat Linux is, the supporter obviously had an official story to share here, and that is, no, you don't get it, because the GPL doesn't count.

I explained the case more clearly, and also tried to contact the sales team, and the even less expected reaction was - complete silence.

As such, one can say quite honestly and officially, ASRock is an unethical company that illegally pirates software and illegally distributes IPMI/BMC images that they don't own the right to distribute (this follows from the GPL, which states that you lose the the right to distribute a program if you can't satisfy the license).

And that is, unfortunately, all there is to that.