linux-kernel - Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <or1wgefmyn.fsf@oliva.athome.lsd.ic.unicamp.br>
Date:	Thu, 14 Jun 2007 14:46:40 -0300
From:	Alexandre Oliva <aoliva@...hat.com>
To:	Robin Getz <rgetz@...ckfin.uclinux.org>
Cc:	"Daniel Hazelton" <dhazelton@...er.net>,
	"Linus Torvalds" <torvalds@...ux-foundation.org>,
	"Alan Cox" <alan@...rguk.ukuu.org.uk>, "Greg KH" <greg@...ah.com>,
	"debian developer" <debiandev@...il.com>, david@...g.hm,
	"Tarkan Erimer" <tarkan@...one.net.tr>,
	linux-kernel@...r.kernel.org,
	"Andrew Morton" <akpm@...ux-foundation.org>, mingo@...e.hu
Subject: Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3

On Jun 14, 2007, Robin Getz <rgetz@...ckfin.uclinux.org> wrote:

> On Thu 14 Jun 2007 01:07, Alexandre Oliva pondered:

>> then maybe the small 
>> company could have been more careful about the regulations.  There are
>> various ways to prevent these changes that don't involve imposing
>> restrictions of modification on any software in the device, all the
>> way from hardware-constrained output power to hardware-verified
>> authorized configuration parameters.

> As a person pretty familiar with the hardware in these types of
> devices - this just isn't practical.

I actually left out the most obvious one: store the program in ROM.
Is that not practical?

You're claiming that adding hardware locks and chains and bolts,
implemented with help from the loader software, is simpler than just
using ROM?

Well, then, ok: do all that loader and hardware signature-checking
dancing, sign the image, store it in the machine, and throw the
signing key away.  This should be good for the highly-regulated areas
you're talking about.  And then, since you can no longer modify the
program, you don't have to let the user do that any more.  Problem
solved.

-- 
Alexandre Oliva         http://www.lsd.ic.unicamp.br/~oliva/
FSF Latin America Board Member         http://www.fsfla.org/
Red Hat Compiler Engineer   aoliva@...dhat.com, gcc.gnu.org}
Free Software Evangelist  oliva@...d.ic.unicamp.br, gnu.org}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/