linux-kernel - Re: GPLv3 Position Statement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1159512998.3880.50.camel@mulgrave.il.steeleye.com>
Date:	Thu, 28 Sep 2006 23:56:37 -0700
From:	James Bottomley <James.Bottomley@...elEye.com>
To:	Neil Brown <neilb@...e.de>
Cc:	tridge@...ba.org, linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: GPLv3 Position Statement

On Fri, 2006-09-29 at 14:40 +1000, Neil Brown wrote:
> You seem to be saying that including software in a product that you
> then distribute is *both* a USE and a DISTRIBUTION of that software.

Sort of ... I'm asserting that producing something (an appliance say, or
a PCI card) that runs linux to achieve its function is a "use" (an act
of running the program) within the meaning of GPLv2 clause 0.  Selling
the Box (or card, or whatever) also becomes a distribution.

> So if the software is obtained under the GPL, and the GPL asserts "no
> restrictions on use" then it should also not restrict distribution.
> It can place requirements that must be met before distribution is
> allowed, but they shouldn't be so onerous as to inhibit distribution.
> Does that sound right?

Not exactly.  Under v2, there are specific duties that go along with the
act of distributing (providing access to the source code and all
modifications), but explicitly none on end use.  You can't get out of
the distribution requirements simply by claiming it's also a use.

However I claim that, the GPLv3 requirement that you be able to "execute
modified versions from source code in the recommended or principal
context of use" does constitute an end use restriction on the embedded
system because the appliance (or card, or whatever) must be designed in
such a way as to allow this.

If my claim is valid, it means that GPLv3 violates the spirit of GPLv2
because it specifically goes against one of its terms (clause 0).  This
is the reason the FSF sees the act of running embedded Linux in
something to be a distribution; so they can apply the additional
restrictions without going against the spirit of GPLv2.

James

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/