linux-kernel - Re: GPLv3 Position Statement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1159559443.9543.23.camel@mulgrave.il.steeleye.com>
Date:	Fri, 29 Sep 2006 15:50:43 -0400
From:	James Bottomley <James.Bottomley@...elEye.com>
To:	tridge@...ba.org
Cc:	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: GPLv3 Position Statement

On Fri, 2006-09-29 at 18:53 +1000, tridge@...ba.org wrote:
>  > > If the "entire patent portfolio" consists of a small group of patents
>  > > which specifically deal with what the code has been posted by the
>  > > company deals with, then sure.
>  > 
>  > So we agree that the statement is true for a company that has only a
>  > software patent portfolio.
> 
> No, we don't :)
> 
> The company can consist of only a patent portfolio, but additionally
> all of those patents (ie. the "entire patent portfolio") would need to
> be implemented by the program being distributed them.

But until you've done the due diligence, you have the potential to
compromise your entire portfolio, if it is all software patents.  That's
what the phrase "...potentially jeopardise the entire patent portfolio
of a company simply by the act of placing a GPLv3 licensed programme on
their website" means.  Just because their exist companies that have more
than just software patents doesn't affect the truth of the statement.

> That caveat is important, and changes it from a misleading statement
> to a true statement. It also is a statement which is true for the
> GPLv2, which makes it not such a useful statement to make when
> considering the relative merits of the two licenses.

Well, this is the whole point.  Today, you can distribute GPLv2 packages
without much patent worry ... if you develop GPLv2 packages, that's
different, but if you simply act as a conduit, you're not going to have
too much trouble..  If I take the broad interpretation that I give a
licence to every patent practised by every package I distribute, then I
don't know what my liability might be until I've done an IP assessment
of everything that's distributed from the website.  That means not just
what I'm working on, but also what support put up there to assist a
customer, and also what the engineers are putting up in their private
areas.  

> I'd also like to note that I don't have much sympathy for companies
> that consist of only a patent portfolio. They are pretty much scum in
> my view. If they don't make any products at all and live on only
> patent revenue then the world would be better off without them :-)

Sure, we can differ in opinion, and argue over the value of software
patents, but that wasn't what was addressed in the paper.

Realistically, most companies have no choice but to play in the business
arena we have today, which includes patents.  Even Red Hat has a
position statement acknowledging this.

James

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/