Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #182385 > unrolled thread

Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel?

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Richard Stallman <rms@gnu.org> - 2017-06-19 21:00 +0200
    Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Bruce Perens <bruce@perens.com> - 2017-06-19 21:40 +0200
      Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Bruce Perens <bruce@perens.com> - 2017-06-28 04:10 +0200
        Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Bruce Perens <bruce@perens.com> - 2017-07-10 17:40 +0200
        Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel? "Bradley M. Kuhn" <bkuhn@sfconservancy.org> - 2017-07-14 20:20 +0200
          Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Bruce Perens <bruce@perens.com> - 2017-07-14 22:30 +0200
            funding & viability questions of GPL enforcement. "Bradley M. Kuhn" <bkuhn@sfconservancy.org> - 2017-07-15 19:30 +0200
              Re: funding & viability questions of GPL enforcement. Alessandro Vesely <vesely@tana.it> - 2017-07-16 13:50 +0200
                Re: funding & viability questions of GPL enforcement. Martin Read <zen75502@zen.co.uk> - 2017-07-16 17:20 +0200
                  Re: funding & viability questions of GPL enforcement. Alessandro Vesely <vesely@tana.it> - 2017-07-19 13:20 +0200
                    Re: funding & viability questions of GPL enforcement. Martin Read <zen75502@zen.co.uk> - 2017-07-19 23:20 +0200
                      Re: funding & viability questions of GPL enforcement. Alessandro Vesely <vesely@tana.it> - 2017-07-20 14:10 +0200
                        Re: funding & viability questions of GPL enforcement. Fungi4All <fungilife@protonmail.com> - 2017-07-20 22:20 +0200
                          Re: funding & viability questions of GPL enforcement. Alessandro Vesely <vesely@tana.it> - 2017-07-21 20:40 +0200
                            Re: funding & viability questions of GPL enforcement. Joel Rees <joel.rees@gmail.com> - 2017-07-22 03:40 +0200
                              Re: funding & viability questions of GPL enforcement. Fungi4All <fungilife@protonmail.com> - 2017-07-27 11:00 +0200
                Re: funding & viability questions of GPL enforcement. "Bradley M. Kuhn" <bkuhn@sfconservancy.org> - 2017-07-17 00:50 +0200
                Re: funding & viability questions of GPL enforcement. Joel Rees <joel.rees@gmail.com> - 2017-07-17 03:00 +0200
                  Re: funding & viability questions of GPL enforcement. "Bradley M. Kuhn" <bkuhn@ebb.org> - 2017-07-17 21:40 +0200
    Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel? deloptes <deloptes@gmail.com> - 2017-06-20 00:20 +0200
      Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Joel Rees <joel.rees@gmail.com> - 2017-07-15 06:50 +0200
        Re: Why does no one care that Brad Spengler of GRSecurity is  blatantly violating the intention of the rightsholders to the Linux Kernel? Nick Boyce <nick@steelyglint.org> - 2017-07-20 16:20 +0200

Page 1 of 2  [1] 2  Next page →

#182385 — Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel?

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

I am not trying to study the GRsecurity case because (0) it's
complicated, and it would take a lot of time to think about, (1) the
FSF has no say in the matter (it is about Linux) and (2) I don't think
the copany would heed whatever I might say.

-- 
Dr Richard Stallman
President, Free Software Foundation (gnu.org, fsf.org)
Internet Hall-of-Famer (internethalloffame.org)
Skype: No way! See stallman.org/skype.html.

[toc] | [next] | [standalone]

#182386

[Multipart message — attachments visible in raw view] — view raw

I think I'll be able to write something to inform present and potential
customers of the lawsuit risk and their position as contributory
infringers. This is more effective than writing to the company.

    Thanks

    Bruce

On Mon, Jun 19, 2017 at 11:41 AM, Richard Stallman <rms@gnu.org> wrote:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
> I am not trying to study the GRsecurity case because (0) it's
> complicated, and it would take a lot of time to think about, (1) the
> FSF has no say in the matter (it is about Linux) and (2) I don't think
> the copany would heed whatever I might say.
>
> --
> Dr Richard Stallman
> President, Free Software Foundation (gnu.org, fsf.org)
> Internet Hall-of-Famer (internethalloffame.org)
> Skype: No way! See stallman.org/skype.html.
>
>

[toc] | [prev] | [next] | [standalone]

#182768

[Multipart message — attachments visible in raw view] — view raw

I published an advisory regarding Grsecurity at

http://perens.com/blog/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/

    Thanks

    Bruce

On Mon, Jun 19, 2017 at 11:41 AM, Richard Stallman <rms@gnu.org> wrote:
>>
>> I am not trying to study the GRsecurity case because (0) it's
>> complicated, and it would take a lot of time to think about, (1) the
>> FSF has no say in the matter (it is about Linux) and (2) I don't think
>> the copany would heed whatever I might say.
>
>

[toc] | [prev] | [next] | [standalone]

#183532

[Multipart message — attachments visible in raw view] — view raw

Thank you. I did not have a copy of the Grsecurity Stable Patch Access
Agreement before, and I've linked it to my article
<http://perens.com/blog/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/>.
IMO it's quite imprudent of them to put down in writing how they restrict
your GPL rights.

[toc] | [prev] | [next] | [standalone]

#183689 — Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel?

[ I'm not on debian-user regularly but I was dragged into the thread by a
  large cc list that Bruce started.  Removing individual email addresses of
  possible non-list members, other than Bruce. ]

Bruce, if you haven't looked at the Principles of of Community-Oriented
Enforcement <https://sfconservancy.org/copyleft-compliance/principles.html>,
which were co-published by Conservancy and the FSF, and endorsed by a wide
range of other organizations, including FSF Europe and the OSI, you should
definitely do so.

The most relevant principle regarding your public post referenced in this
thread is: "Confidentiality can increase receptiveness and responsiveness."
You don't indicate in your blog post that you put in efforts to resolve this
matter confidentially and sought compliance in a collaborative and friendly
way first.  That's a mistake, in my opinion.

Conservancy often spends years of friendly negotiations, attempting to
resolve a GPL enforcement matter before making public statements about it.
We have found in our extensive experience of enforcing the GPL that early
public statements sometimes thwarts not just our enforcement efforts, but
the enforcement efforts of others.

Finally, I have an important general statement that those concerned about
violations should consider: With hundreds of known GPL violations going on
around the world every day, we should as a community be careful not to
over-prioritize any particular violation merely because the press becomes
interested.  Rather, the giant worldwide queue of known GPL violations
should be prioritized by figuring out which ones, if solved, will do the
most to maximize software freedom for all users.
-- 
Bradley M. Kuhn
Distinguished Technologist of Software Freedom Conservancy
========================================================================
Become a Conservancy Supporter today: https://sfconservancy.org/supporter

[toc] | [prev] | [next] | [standalone]

#183692

[Multipart message — attachments visible in raw view] — view raw

Hi Bradley,

I was proceeding after others in the community had already made contact and
were rebuffed.

I have definitely looked at the principles of GPL-oriented enforcement that
SFC is currently distributing. I have some issues with your current policy.

Let's discuss the policy of forgiveness of past offenses in exchange for
current compliance. This has worked very well for the non-profit projects
that SFC is actually able to serve, because there is literally no reason
for the well-counseled offender not to settle with SFC. Both of us have
experience with highly visible deep-pockets offenders who have not been
well enough counseled to accept this easy exit from violation.

As you know, I have a compliance business. I have advised every client
without exception to come into compliance with the GPL as soon as possible,
and where allowed I have engineered that compliance. The companies that
reject that advice do not become my customer.

We should remain aware that Richard and Eben made an exception to the
policy of not asking for financial damages in the case of Cisco, for quite
a large settlement.

With the advent of dual-licensing as used by Artifex (Ghostscript) since
1984, MySQL since the 1990's, and others, we have a paradigm that arguably
makes the GPL more fair to more people, especially the GPL developers
themselves. Those who wish to participate in the GPL's partnership of
sharing do, those who do not pay money, and the money goes to paying the
developers to make more good Free Software under the GPL. The developers do
not have to wear hair shirts or spend their days as waiters or as
programmers of proprietary software for big companies, but can support
their families while creating Free Software. This worked for Peter Deutsch
who has been able to enjoy retirement as a composer and musician as a
result, and of course for Michael Widenius and his partners in MySQL. We
are all using the result of these dual-license enterprises.

It seems to me that it would be fair for these dual-licensing companies,
who offered the GPL but made dual licensing available to those who did not
wish to accept the GPL terms, to exact the fees of lost commercial
licensing from commercial infringers. Those infringers clearly had paid
licensing as an option. Dual-licensing is not inimical to the philosophy of
Free Software, and SFC should support the dual-license enterprises in
collecting fair damages.

I am also concerned because in our society there is a right to sue and
collect damages in compensation for violation of your rights, and SFC may
have allowed itself, without planning to, to be in the position of
suppressing developer's rights. Obviously I am aware of the excesses of the
"intellectual property" and tort system, and moderation is necessary. But
entirely suppressing the right to collect damages doesn't sound like a good
solution.

Then we have the issue of SFC's obvious inability to pursue all but a
fraction of one percent of all violators. Besides the obvious cases which
remain untried, I have in my own practice twice witnessed SFC so
short-staffed as to be unable to respond for many months to a company that
was attempting to settle with SFC, and another company that had settled and
was attempting to fulfill its continuing obligation to SFC. So, here SFC is
as the only organization with funding to pursue violations of the GPL,
closing out the avenue for other such organizations to fund themselves
through settlement and take up some of the case load. And the developers
don't get served and get de-motivated by the persistent and un-remedied
infringements. So, unfortunately, the principles of community-oriented
enforcement aren't actually serving the community.

Recently, we have observed:

1. Failure of SFC or its funded parties to attempt to appeal the VMWare
decision or find another plaintiff.
2. A consultation with the Linux kernel developers who are not terribly in
favor of enforcement, I feel due to prejudices so loudly expressed by Linus
Torvalds, who just doesn't accept that lawyers are of any benefit to
society.
3. No visible enforcement for quite a while.
4. Very many egregious violations in our sight that we have no way to cure.

So eventually, Bradley, we lose patience. I have no way to fund enforcement
of GPL violations. I don't have confidence that you can ever handle more
than 1% of them, and you don't tell me what 1% you are working on. I only
have publicity as a tool.

    Thanks

    Bruce



On Fri, Jul 14, 2017 at 11:06 AM, Bradley M. Kuhn <bkuhn@sfconservancy.org>
wrote:

> [ I'm not on debian-user regularly but I was dragged into the thread by a
>   large cc list that Bruce started.  Removing individual email addresses of
>   possible non-list members, other than Bruce. ]
>
> Bruce, if you haven't looked at the Principles of of Community-Oriented
> Enforcement <https://sfconservancy.org/copyleft-compliance/principles.html
> >,
> which were co-published by Conservancy and the FSF, and endorsed by a wide
> range of other organizations, including FSF Europe and the OSI, you should
> definitely do so.
>
> The most relevant principle regarding your public post referenced in this
> thread is: "Confidentiality can increase receptiveness and responsiveness."
> You don't indicate in your blog post that you put in efforts to resolve
> this
> matter confidentially and sought compliance in a collaborative and friendly
> way first.  That's a mistake, in my opinion.
>
> Conservancy often spends years of friendly negotiations, attempting to
> resolve a GPL enforcement matter before making public statements about it.
> We have found in our extensive experience of enforcing the GPL that early
> public statements sometimes thwarts not just our enforcement efforts, but
> the enforcement efforts of others.
>
> Finally, I have an important general statement that those concerned about
> violations should consider: With hundreds of known GPL violations going on
> around the world every day, we should as a community be careful not to
> over-prioritize any particular violation merely because the press becomes
> interested.  Rather, the giant worldwide queue of known GPL violations
> should be prioritized by figuring out which ones, if solved, will do the
> most to maximize software freedom for all users.
> --
> Bradley M. Kuhn
> Distinguished Technologist of Software Freedom Conservancy
> ========================================================================
> Become a Conservancy Supporter today: https://sfconservancy.org/supporter
>

[toc] | [prev] | [next] | [standalone]

#183722 — funding & viability questions of GPL enforcement.

Bruce, your analysis ignores the political forces that have allied to thwart
GPL enforcement efforts.  If Conservancy did not face these anti-enforcement
politics regularly, Conservancy could and would spend more time working on
bringing more companies into compliance.

I hope you'll review my FOSDEM keynote [0] and LibrePlanet talk [1] (the
latter of which was covered on LWN [2]), wherein I discuss the political
efforts by many others who seek to end GPL enforcement.  I hope you'll
assist us in that political struggle, rather than shaming and blaming the
one organization who actually enforces the GPL for Linux, Debian, Samba, and
many other projects.

Bruce wrote yesterday on debian-user:
> [Conservancy] may have allowed itself ... to be in the position of
> suppressing developer's rights.

Rather than suppressing developers' rights (as you accused of us above),
Conservancy has created the only welcoming coalition of Linux copyright
holders [3] who wish to enforce, adhering to community principles.  The
wealthy and powerful who seek to end GPL enforcement view our coalition as
the primary threat to their goal.  That's why they invest inordinate
resources into thwarting Conservancy's enforcement efforts.

Bruce also wrote yesterday on debian-user:
> it would be fair for these dual-licensing companies, who offered the GPL
> but made dual licensing available to those who did not wish to accept the
> GPL terms, to exact the fees of lost commercial licensing from commercial
> infringers. Those infringers clearly had paid licensing as an option.

Meanwhile, these aggressive enforcement-centric business models function
precisely because their central tenant *discourages* sharing and
modification of the code under the copyleft license.  The typical goal of
those models is to frighten "customers" into buying a non-copyleft license.
While you're correct that they generate revenue, I don't believe that the
goal of copyleft was to create an ecosystem where most users operate under a
proprietary license that they were cajoled to accept -- under threat of
overly captious for-profit enforcement.

You also mentioned the "revenue model" of lawsuits.  While perhaps Patrick
McHardy gained some amount of personal wealth (although reports on how much
he's really recovered are unreliable rumors), that was only successful
precisely because McHardy's enforcement did not prioritize encouraging
compliant behavior.  (In fact, his model required discouraging such
behavior, because (in his settlement agreements that I've seen) his larger
recoveries came from confused violators who agreed to pay larger amounts if
found out of compliance again later.)  Such types of lawsuits are a serious
problem.  That's why Conservancy was first to criticize McHardy [4], and why
Conservancy worked with the Netfilter team to encourage them to (a) also
denounce McHardy's activity [5] and (b) endorse the Principles of
Community-Oriented GPL Enforcement [6].

Note that those Principles don't say that damages should never be sought in
lawsuits, but rather, that *prioritizing* revenue over compliance is a
problem.  You can see on Conservancy's past Form 990s that Conservancy has
received revenue from GPL enforcement.  What I think those of you who have
not actually engaged in litigation don't realize is that when you face a
large bankroll on the Defendant's side, you take on real financial risk in
litigation.  Even though most Courts will award attorney's fees and costs
*at the end*, a small charity bringing litigation must consider carefully
what happens while the years of litigation and appeals continue, during
which the Defendant funds the best legal and political power that money can
buy to try to crush you.  The copyright system is rigged against the small
entity, so we must be agile, creative, and twice as diligent to succeed.

So, Bruce, I'm more frustrated than anyone that GPL violations are rampant
and we've not found in our community an effective way to fund enforcement
such that GPL violations become rare rather than common.  But -- even though
every time I walk into an electronics store, I see a rows of GPL-violating
products -- I don't think it justifies abandoning our Principles, or taking
unnecessary risks.  Furthermore, we already have initiatives like McHardy's
and we don't see increased compliance as a result.  Thus, even if we wanted
to pursue enforcement driven by avarice, such has already been shown not to
achieve what matters most -- more software freedom for users and developers.

Bruce wrote further on debian-user:
> 1. Failure of SFC or its funded parties to attempt to appeal the VMWare
> decision

Bruce, please don't spread this disinformation; I know many are saying it,
and you probably heard it from others, but it's just incorrect.  The appeal
in Hellwig v. VMware is active in the German courts [7].  Everyone knows
that legal appeals take a very long time.  We just have to wait and keep
funding the lawyers until it's done.

Bruce wrote further on debian-user:
> 2. A consultation with the Linux kernel developers who are not terribly in
> favor of enforcement

I encourage those interested in this issue to read the email threads
regarding this carefully.  There is a loud but tiny minority of Linux
developers associated with Linux Foundation that do oppose all GPL
enforcement, but there are many people in that same thread, including (but
not limited to) Harald Welte [8], Matthew Garrett [9], and David Woodhouse
[10], who came out in loud support of Conservancy's GPL enforcement efforts.

> 3. No visible enforcement for quite a while.

Publicly admonishing violators before privately giving them ample and
friendly opportunities comply is known to fail as a strategy.  That's the
point I made in my previous email.

> As you know, I have a compliance business.....  you don't tell me what 1%
> you are working on.

Bruce, you've admitted publicly on this thread something that I've known for
some time: at least part, if not all, of the revenue to your business comes
from corporate clients that violate the GPL.  You've even been the
violator's representative party that I've negotiated with in past
violations.  I can't very well reach out to you about third-party GPL
violations, given your business.

While I'm glad that you take your job seriously and seek to get your clients
into compliance when they violate, it also means you'll face difficulty
because you simultaneously seek to be a violator-paid fixer *and* an
advocate for the software freedom of copyleft software users.

> So eventually, Bradley, we lose patience. I have no way to fund
> enforcement of GPL violations.

Bruce, if you're losing patience with the amount of resources Conservancy
can bring to bear to enforcement, then I hope you'll become a Conservancy
Supporter.  Our Supporter program *is* what funds the enforcement efforts
that we have now.  While admittedly that leaves Conservancy only with the
resources to handle 1% of all known GPL violations, the realistic
alternative is to give up and handle 0% instead.  As I've explained, we
don't currently know of a politically- and financially- viable alternative.


Finally, this is probably a good moment -- since this thread has erupted on
a Debian Mailing List -- to let everyone know that Conservancy also
organizes a GPL copyright aggregation project for Debian contributors as
well, see: https://sfconservancy.org/copyleft-compliance/#debian and
https://sfconservancy.org/news/2015/aug/17/debian/.


[0] https://sfconservancy.org/news/2017/feb/13/bkuhn-fosdem-keynote/
[1] https://media.libreplanet.org/u/libreplanet/m/understanding-the-complexity-of-copyleft-defense/
[2] https://lwn.net/Articles/719610/
[3] https://sfconservancy.org/copyleft-compliance/#linux
[4] https://sfconservancy.org/blog/2016/jul/19/patrick-mchardy-gpl-enforcement/
[5] https://www.netfilter.org/files/statement.pdf
[6] https://marc.info/?l=netfilter-devel&m=146887464512702
[7] https://sfconservancy.org/news/2016/aug/09/vmware-appeal/
[8] https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003709.html
[9] https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003583.html
[10] https://lists.linuxfoundation.org/pipermail/ksummit-discuss/2016-August/003628.html
-- 
Bradley M. Kuhn
Distinguished Technologist of Software Freedom Conservancy
========================================================================
Become a Conservancy Supporter today: https://sfconservancy.org/supporter

[toc] | [prev] | [next] | [standalone]

#183737 — Re: funding & viability questions of GPL enforcement.

There are salient discrepancies in copylefting collective work —as there are
mismatches in working as a free software developer in a western economic model.
 Let me just say that this discussion, working out the legal details of the
problem, is very interesting.  I guess that's how every inch of freedom has to
be conquered, and I'm delighted that this list allows me to witness it.

Please go ahead.

On Sat 15/Jul/2017 19:24:56 +0200 Bradley M. Kuhn wrote:
> [...]
> Finally, this is probably a good moment -- since this thread has erupted on
> a Debian Mailing List -- to let everyone know that Conservancy also
> organizes a GPL copyright aggregation project for Debian contributors as
> well, see: https://sfconservancy.org/copyleft-compliance/#debian and
> https://sfconservancy.org/news/2015/aug/17/debian/.

May I ask, in passing, why Debian (for packages like apt, say) as well as Linux
did not switch to GPLv3?  Would such switch ease enforcement?

Thanks
Ale

[toc] | [prev] | [next] | [standalone]

#183748 — Re: funding & viability questions of GPL enforcement.

On 16/07/17 12:47, Alessandro Vesely wrote:
> May I ask, in passing, why Debian (for packages like apt, say) as well as Linux
> did not switch to GPLv3?  Would such switch ease enforcement?

Switching a project over from GPLv2-only to GPLv3-only or GPLv3-or-later 
requires either (a) the consent of all copyright holders who made 
non-trivial contributions or (b) the wholesale replacement of all 
material written by the non-consenting copyright holders.

Thus, for any project which does not require contributors to sign a 
document either ceding their copyright in their contributions to the 
project's proprietor or granting said proprietor authority to relicence, 
it can be *really hard* to make such a transition in a lawful and timely 
manner (and one sufficiently-important non-consentor can basically shoot 
down the entire proposal).

In the particular case of the Linux kernel, *Linus* didn't want to move 
to GPLv3 (because he didn't think certain clauses were a good idea), so 
the move was a dead letter almost from the moment it was proposed.

[toc] | [prev] | [next] | [standalone]

#183887 — Re: funding & viability questions of GPL enforcement.

On Sun 16/Jul/2017 17:17:21 +0200 Martin Read wrote:
> On 16/07/17 12:47, Alessandro Vesely wrote:
>> May I ask, in passing, why Debian (for packages like apt, say) as well as Linux
>> did not switch to GPLv3?  Would such switch ease enforcement?
> 
> Switching a project over from GPLv2-only to GPLv3-only or GPLv3-or-later
> requires either (a) the consent of all copyright holders who made non-trivial
> contributions or (b) the wholesale replacement of all material written by the
> non-consenting copyright holders.

Back to GRSecurity, which is our source of reality in this discussion, they
complain that large corps use their product but fail to return revenues to the
market.  In an attempt to force payments, they withdraw GPL terms and step back
to close-source EULA marketing.  Except that they don't hold the kernel
copyright.  Hmm...  Quite different from double licensing.

One my wonder why GRSecurity is not (optionally) included in Linux.  In fact,
there are kernel features, such as trusted path execution (TPE) whose origin
seems to be related to GRSecurity.  Avoiding feature-creep is a perfectly
legitimate reason to leave some other patches alone.  That way, however, Linux
lets particularly sensitive users experiment --and pay-- for the development of
some patches, which may possibly be introduced in later kernel releases,
according to their popularity.  That's a well known pattern of development of
closed-source stuff.  How are free software developers supposed to go through
it?  I thought that GPLv3's section 7 "additional permissions" could ease such
kind of mutual acknowledgments, but IANAL...

Ale

[toc] | [prev] | [next] | [standalone]

#183930 — Re: funding & viability questions of GPL enforcement.

On 19/07/17 12:17, Alessandro Vesely wrote:
> One my wonder why GRSecurity is not (optionally) included in Linux.

For a variety of reasons relating to the personalities and opinions of 
the people who would be involved - on both sides - in making it happen.

It should be noted that some people who are not part of the grsec 
project *are* trying to incrementally move the less 
performance-impactful features of grsec into the mainline kernel.

[toc] | [prev] | [next] | [standalone]

#183975 — Re: funding & viability questions of GPL enforcement.

On Wed 19/Jul/2017 23:14:35 +0200 Martin Read wrote:
> On 19/07/17 12:17, Alessandro Vesely wrote:
>> One my wonder why GRSecurity is not (optionally) included in Linux.
> 
> For a variety of reasons relating to the personalities and opinions of the
> people who would be involved - on both sides - in making it happen.
> 
> It should be noted that some people who are not part of the grsec project *are*
> trying to incrementally move the less performance-impactful features of grsec
> into the mainline kernel.

Yes, the example I had in mind was this:
https://lwn.net/Articles/725203/

Of course, nobody dislikes security.  Making it neat and clear is another
question, and that's why experiments are needed.  Can we consider Linux and
GRSecurity as entities cooperating with each other in that respect?

Ale

[toc] | [prev] | [next] | [standalone]

#184004 — Re: funding & viability questions of GPL enforcement.

[Multipart message — attachments visible in raw view] — view raw

> On Wed 19/Jul/2017 23:14:35 +0200 Martin Read wrote:
>> On 19/07/17 12:17, Alessandro Vesely wrote:
>>> One my wonder why GRSecurity is not (optionally) included in Linux.
>>
>> For a variety of reasons relating to the personalities and opinions of the
>> people who would be involved - on both sides - in making it happen.
>>
>> It should be noted that some people who are not part of the grsec project *are*
>> trying to incrementally move the less performance-impactful features of grsec
>> into the mainline kernel.
> Yes, the example I had in mind was this:
> https://lwn.net/Articles/725203/
> Of course, nobody dislikes security. Making it neat and clear is another
> question, and that"s why experiments are needed. Can we consider Linux and
> GRSecurity as entities cooperating with each other in that respect?

GRS is a formal hierarchical organization, a very different single endity than the
linux "thing". A community of many different entities, in size and shape. Not
a formal organization, I don't think. How can the two different things communicate,
let alone cooperate? Let's just home each does their thing and share what they
do and leave it at that. Only equals can communicate, coordinate, and cooperate.
So linux as a whole can hardly be imagined to be in communication with anything
else.

> Ale

I vote against such cooperating proposals as such would try to shape and
change what linux is. If grs and debian can cooperate that would be an issue
for them to decide. For linux we all need to agree before we decide.

[toc] | [prev] | [next] | [standalone]

#184046 — Re: funding & viability questions of GPL enforcement.

On Thu 20/Jul/2017 22:18:25 +0200 Fungi4All wrote:
>> > On 19/07/17 12:17, Alessandro Vesely wrote:
>>
>> Of course, nobody dislikes security. Making it neat and clear is another
>> question, and that"s why experiments are needed. Can we consider Linux and
>> GRSecurity as entities cooperating with each other in that respect?
> 
> GRS is a formal hierarchical organization, a very different single endity
> than the linux "thing".  A community of many different entities, in size and
> shape.  Not a formal organization, I don't think.  How can the two different
> things communicate, let alone cooperate?  Let's just home each does their
> thing and share what they do and leave it at that.

Yes, of course.  I didn't mean to propose to change anything "real" of how each
organization works.  My question was meant to check if we can consider GRS to
be good although somehow misguided, and if it could be viable for them to
double-license their code (by some tricky clause, e.g. section 7 of GPLv3?)

Disclaimer: I'm not involved in either organization's copyrights.

Allowing GPL infringements makes "us" look like jackasses :-/

> For linux we all need to agree before we decide.

Yeah, that's a pita.  It's hard to change anything if everyone can veto.

Ale

[toc] | [prev] | [next] | [standalone]

#184052 — Re: funding & viability questions of GPL enforcement.

On Sat, Jul 22, 2017 at 3:29 AM, Alessandro Vesely <vesely@tana.it> wrote:
> On Thu 20/Jul/2017 22:18:25 +0200 Fungi4All wrote:
>>[...]
>
>> For linux we all need to agree before we decide.
>
> Yeah, that's a pita.  It's hard to change anything if everyone can veto.

That's sure indication that everything is getting too big -- the companies,
of course, but also the projects, the software, ...

... and the egos.

-- 
Joel Rees

One of these days I'll get someone to pay me
to design a language that combines the best of Forth and C.
Then I'll be able to leap wide instruction sets with a single #ifdef,
run faster than a speeding infinite loop with a #define,
and stop all integer size bugs with my bare cast.
http://defining-computers.blogspot.com/2017/06/reinventing-computers.html

More of my delusions:
http://reiisi.blogspot.com/2017/05/do-not-pay-modern-danegeld-ransomware.html
http://reiisi.blogspot.jp/p/novels-i-am-writing.html

[toc] | [prev] | [next] | [standalone]

#184298 — Re: funding & viability questions of GPL enforcement.

[Multipart message — attachments visible in raw view] — view raw

> From: joel.rees@gmail.com
> To: debian-user <debian-user@lists.debian.org>
> On Sat, Jul 22, 2017 at 3:29 AM, Alessandro Vesely <vesely@tana.it> wrote:
>> On Thu 20/Jul/2017 22:18:25 +0200 Fungi4All wrote:
>>>[...]
>>
>>> For linux we all need to agree before we decide.
>>
>> Yeah, that"s a pita. It"s hard to change anything if everyone can veto.
> That"s sure indication that everything is getting too big -- the companies,
> of course, but also the projects, the software, ...
> ... and the egos.

Under the same logic how can it all be considered one "big" thing with so
many different participants? Are companies, projects, developers, sysadmins,
and users all equal parties? Do companies have egos? No, they have one
motive to make money and become the only player and decision maker.
What all these different entities need is organization, each with distinct goals
and principles of organization. Then each community will have its own
voice, cooperate with others, and form a direction, if that is possible.
In every industry there ever was when standards (of cooperation) were
developed there was development in the direction the industry had set.
This chaotic system of each one doing their own thing and see where it
gets everyone seems to be coming to an end. And at this end some are
more organized to benefit from the whole than others.
In terms of debian, it is an utopian proposition to expect it to compete as
a semi-democratic institution among the dictatorships. It also unthinkable
that individuals can have an influence among organizations. The
binding licensing agreements will in the future be either abolished or
will not be enforced as much as to matter, as far as being obstacles
to corporations making money.

[toc] | [prev] | [next] | [standalone]

#183759 — Re: funding & viability questions of GPL enforcement.

> On Sat 15/Jul/2017 19:24:56 +0200 Bradley M. Kuhn wrote:
> > [...]
> > Finally, this is probably a good moment -- since this thread has erupted on
> > a Debian Mailing List -- to let everyone know that Conservancy also
> > organizes a GPL copyright aggregation project for Debian contributors as
> > well, see: https://sfconservancy.org/copyleft-compliance/#debian and
> > https://sfconservancy.org/news/2015/aug/17/debian/.

Alessandro Vesely wrote:
> May I ask, in passing, why Debian (for packages like apt, say) did not
> switch to GPLv3?

I discussed in my talk at DebConf10 about how many Debian packages are
already outbound licensed under GPLv3, because Debian carries the default
version of GPL as GPLv3, by symlinking /usr/share/common-licenses/GPL to
GPL-3.  The effect of that is that, for any package that simply says "GPL" or
points to /usr/share/common-licenses/GPL , Debian is licensing it it users
under GPLv3.

Of course, if Debian developers haven't added changes that are
GPLv3-or-later, the downstream user can always go back upstream and get a
copy licensed under GPLv2-or-later (etc.).

I note you asked specifically about apt, which is GPLv2-or-later.  While I
think contributors to apt and other GPLv2-or-later packages should consider
whether GPLv3-or-later is a better license for them (I generally think GPLv3
is a very good licensing choice in most situations), I don't see any urgent
reason that developers should switch to GPLv3, in part because...

>  Would such switch ease enforcement?

... I am not aware of any specific reasons why GPLv3 is more easily enforced
than GPLv2.  The challenges that our community faces regarding enforcement,
which I outlined in my email yesterday, exist in roughly equal measure for
both GPLv2 and GPLv3.

> as well as Linux

As another poster pointed out, most (although not all) of Linux's copyrights
are GPLv2-only, and a change in license to GPLv2-or-later or GPLv3-or-later
would require extensive effort.
--
Bradley M. Kuhn
Distinguished Technologist of Software Freedom Conservancy
========================================================================
Become a Conservancy Supporter today: https://sfconservancy.org/supporter

[toc] | [prev] | [next] | [standalone]

#183760 — Re: funding & viability questions of GPL enforcement.

On Sun, Jul 16, 2017 at 8:47 PM, Alessandro Vesely <vesely@tana.it> wrote:
> There are salient discrepancies in copylefting collective work —as there are
> mismatches in working as a free software developer in a western economic model.
>

There are salient discrepancies in every licensing model, so-called
free/libre, free/open, free-as-in-beer, sell-your-first-child-shrinkwrap,
etc.

Shoot, the entire concept of property is still not worked out well.

It only works if we agree to cooperate.

And people and companies who receive excess and refuse to return
it to the market simply are not cooperating, irregardless of either license
or external economic system. (Excess includes not only money and less
tangible proxies for value, but also control, which is one place where
communism and socialism historically fail.)

The whole idea that they have to protect themselves from users of their
so-called intellectual property is where we, as a society are failing to do
the reality check.

>  Let me just say that this discussion, working out the legal details of the
> problem, is very interesting.  I guess that's how every inch of freedom has to
> be conquered, and I'm delighted that this list allows me to witness it.

I think you meant "fought for" and not "conquered"?

> Please go ahead.
>
> On Sat 15/Jul/2017 19:24:56 +0200 Bradley M. Kuhn wrote:
>> [...]
>> Finally, this is probably a good moment -- since this thread has erupted on
>> a Debian Mailing List -- to let everyone know that Conservancy also
>> organizes a GPL copyright aggregation project for Debian contributors as
>> well, see: https://sfconservancy.org/copyleft-compliance/#debian and
>> https://sfconservancy.org/news/2015/aug/17/debian/.

Crowd-funding without the middleman!

> [...]

-- 
Joel Rees

One of these days I'll get someone to pay me
to design a language that combines the best of Forth and C.
Then I'll be able to leap wide instruction sets with a single #ifdef,
run faster than a speeding infinite loop with a #define,
and stop all integer size bugs with my bare cast.
http://defining-computers.blogspot.com/2017/06/reinventing-computers.html

More of my delusions:
http://reiisi.blogspot.com/2017/05/do-not-pay-modern-danegeld-ransomware.html
http://reiisi.blogspot.jp/p/novels-i-am-writing.html

[toc] | [prev] | [next] | [standalone]

#183783 — Re: funding & viability questions of GPL enforcement.

Joel Rees wrote at 17:50 (PDT) on Sunday:
> The whole idea that they have to protect themselves from users of their
> so-called intellectual property is where we, as a society are failing to
> do the reality check.

This text above is very well said!  The value that Debian has is that it
works very hard as a community to assure its users are liberated when they
copy, modify and share Debian main.

-- 
Bradley M. Kuhn

[toc] | [prev] | [next] | [standalone]

#182388 — Re: Why does no one care that Brad Spengler of GRSecurity is blatantly violating the intention of the rightsholders to the Linux Kernel?

Richard Stallman wrote:

> I am not trying to study the GRsecurity case because (0) it's
> complicated, and it would take a lot of time to think about, (1) the
> FSF has no say in the matter (it is about Linux) and (2) I don't think
> the copany would heed whatever I might say.

Could you explain why it should be complicated? GPL states the rights
obtained should be passed to the recipient, so the recipient should be
allowed to redistribute the code (IMO) even if he/she is paying for
improvements.

It would be really nice if GRSec could help improve the kernel security in
some way acceptable by and for the benefit of all. I don't think someone
wants to punish them for what they are doing. It would be better to have
mutual benefit if possible as the GPL does not prohibit modifying and
redistributing the code and demanding a fee, it however does guarantee the
right to redistribute is passed to the recipient, which is not the case
here.

regards

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web