linux-kernel - Re: GPLv3 Position Statement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1159563043.9543.39.camel@mulgrave.il.steeleye.com>
Date:	Fri, 29 Sep 2006 16:50:43 -0400
From:	James Bottomley <James.Bottomley@...elEye.com>
To:	Sanjoy Mahajan <sanjoy@...o.cam.ac.uk>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>, tridge@...ba.org
Subject: Re: GPLv3 Position Statement

On Fri, 2006-09-29 at 13:08 +0100, Sanjoy Mahajan wrote:
> > However, once they comply with the distribution requirements,
> > they're free to do whatever they want with the resulting OS in their
> > printer ... including checking for only HP authorised ink
> > cartridges.  You can take exception to this check and not buy the
> > resulting printer, but you can't tell them not to do the check
> > without telling them how they should be using the embedded platform.
> 
> I don't see where the GPLv3 forbids such checks.  Which section are
> you thinking of?  In my understanding, it says only that HP must give
> users the keys to install modified software.  From section 1 (of the
> July draft):

This was an illustration of the difference between use and distribution.
I don't claim GPLv3 limits these activities; I was just using the
example I was given.

>   The Corresponding Source also includes any encryption or
>   authorization keys necessary to install and/or execute modified
>   versions from source code in the recommended or principal context of
>   use, such that they can implement all the same functionality in the
>   same range of circumstances.
> 
> So the user, having the keys, can remove the cartridge check.  HP
> might not like it and may choose not to distribute GPLv3 software with
> the printer, but that's a separate story.

Under GPLv3, yes.  That's one of the fulcrums of the argument.  As one
of the copyright holders, I don't want to get into the business of
dictating terms for uses to which linux (or other open source software)
is put.  I fundamentally don't want to require in the copyright licence
that device manufacturers using embedded linux have to give me the key.
I'd love to persuade them why modifiable hardware is a good thing
(linksys WRT54GL) and give them market reasons for allowing it.  But I
don't want to compel them.  The pragmatic reason is that to impose
compulsion I have to forsee all the end uses (this is why we get
drafting issues with the GPLv3).   However, the moral reason is that I
believe this type of compulsion to be wrong in principle: it acts as a
damper on innovation if everyone has to keep looking over their shoulder
and considering what my wishes might be in software they use.
Fundamentally, I want people to do things I never even dreamed of with
my software.

James

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/