Slashdot Mirror
Advocacy Prompts Reconsideration of Anti-GPL Letter
As far as I can tell, it started with this Newsforge story (Newsforge is also part of OSDN, Slashdot's corporate parent). The Newsforge story was excerpted and copied by an Australian newspaper, and from there, it was off and spreading. The headline chosen, "Washington State Congressman attempts to outlaw GPL", is not particularly accurate, but it did a great job at stirring up outrage. Outlaw the GPL! Over my dead keyboard!
From there it really started making the rounds. It was repeatedly submitted to Slashdot with all sorts of flaming, incorrect commentary - in fact, after reading a dozen different submissions, I didn't think any of them were even close to accurate. I picked one and posted it, trying to do my best to a) provide an accurate headline and b) provide an accurate summary of the issue at stake in a few sentences. To recap again: when the Federal government creates computer code (or any copyrightable work) directly, it gets no copyright whatsoever and the work is true public domain (quirk of the U.S. copyright laws - the 50 states, corporations, individuals, and other legal entities all get copyrights automatically, but the Federal government does not). If you want to copy, reproduce, or sell an .mp3 of the U.S. Congress singing "God Bless America" after September 11, go right ahead: there is no copyright on it whatsoever. (Actually, the song itself is still under copyright, but Congress' performance of it wouldn't be...)
However, when the Federal government hires a non-employee to create code or copyrighted works, there is no clear rule regarding the copyright status of the work. Sometimes the contract calls for rights to the work to be assigned to the Federal government (the Feds don't get original copyrights, but if someone else gets an original copyright, the Feds can acquire it). Sometimes the contractor keeps the copyright and gets to do whatever they want with it. Sometimes the contract doesn't specify. Note that this is NOT a BSD-vs.-GPL dispute, not by a long shot. Very little code financed by the Federal government is ever licensed under either of these two licenses - the choice is basically agency-proprietary (the Federal agency asked for the rights in the contract, and kept them) or company-proprietary (the agency didn't ask for the rights, and the contractor kept them).
And most of the time it doesn't matter. I've written code for the Federal government as both a contractor and an employee, and 99% of it was so specific and customized that it would be of use to no one else, regardless of its licensing or copyright status. Probably the majority of code written for the Federal government falls into that category - internal use software for very specific needs.
But some of it is undoubtedly useful. Some major projects funded by the government in conjunction with academia have escaped from licensing purgatory, typically through the efforts of the researchers working on them who approach the issue from an academic freedom viewpoint and want to see their work widely adopted. GRASS is one major one that I know of. A commenter pointed out ADA as an example. For code which is useful to others, either a BSD-like or GPL-like license would be truly beneficial and easily defensible as a public policy choice. In the non-code world, the government makes choices like that all the time - it might choose to purchase a particular piece of land and commit to making it available to everyone forever by declaring it a National Park and committing to maintain it, a GPL-like philosophy; alternately, it might choose to just dump a particular piece of property on the market, putting it up for auction and letting the purchaser do what he wills with it, a BSD-like philosophy.[1] Either of these two options might be optimal; but paying for code which ends up remaining proprietary is like buying a new stadium to benefit a very specific corporation which owns a very specific sports team: the type of use of public funds which is generally seen as sleazy and the opposite of good governance.
Either of the first two choices can be appropriate in certain situations. What does not seem appropriate is paying for proprietary code, although this is generally what happens when the government contracts for code. Since the government has the ability to provide a benefit to the public (open code) at essentially zero cost, it should do so. An example which has struck me several times over the past few years: every airport in the world has the same problem, coordinating planes taking off and landing and keeping them from running into each other. Yet each nation (and often each airport) solves the problem over and over, paying heavily for custom-designed, one-shot software development. Imagine if the world's airports could simply install GNU-AirTrafficControl 2.7, and have a complete, working, bug-free and cost-free air traffic control system. It would cost every nation less to do it this way, but it would also make a lot less money for the consultants retained to develop these systems.
But leave off the advocacy for moment - I was following the story itself. As noted above, the outcry has prompted many of the other Representatives who originally signed the letter to reconsider. The AP story even suggests that some of the signatories were actively misled - that the letter they thought they were signing didn't mention the GPL at all. However it actually played out, some good has been done.
That's good. What's not so good is that much of the outcry was probably generated by stories titled "Washington State Congressman attempts to outlaw GPL". The right outcome occurred, but for the wrong reasons and in the wrong manner. I am left wondering whether the community would have made the same sort of response on this issue if every story that had been posted about it was 100% accurate and non-inflammatory.
[1] If you're not familiar with the BSD-like and GPL-like classes of software licenses, this won't make a lot of sense to you, so please read up if necessary.
...because the BSD license is essentially no license at all. So, when the government releases the SuperFoomatic 1.0, anyone can do with it as they please.
If we want a GPL'ed SuperFoomatic, we just take that code and release it under the GPL license. No point in having it release originally under the GPL as the released code can be GPL'ed "retroactively".
The only addiition I can think of is that perhaps it should be dual licensed, so that corporations have to pay for its use, with those monies paying for additional governmental software research.
If the code is good, it doesn't matter whose hands it falls into. Odds are that if it falls into bad hands that find an exploit, it will also fall into good hands that find that same exploit, and alert the developers.
Forcing the government to release code under GPL is *removing* competition from the market. Public domain is much better. The code can be taken up by private companies and they can improve and sell it. And nothing I am aware of keeps that same code for forming the basis of a GPL and/or BSD project.
So turn the code loose with no strings at all, and let the best licensing system win!
The only good weather is bad weather.
Imagine if the world's airports could simply install GNU-AirTrafficControl 2.7, and have a complete, working, bug-free and cost-free air traffic control system.
...and we know what Congress feels about doing a lot of work....
True, but... I assume in this model anyone, anywhere could see the source codebase... with any of its bugs and exploits.... Do we want this for these kinds of software implementations (of which there are many done by/for the U.S. government)?
From what I can tell from the various sources (some good, some bad), the crux of the argument here is to avoid Smith et. al., making GPL or BSD licenses for government-produced/contracted code illegal. And that's only right. However, as far as I'm concerned, this simply starts the sticky discussion on what kinds of licenses/protection should be applied to what kind of projects. That's likely to be a lot more work.
Anyway, one can only hope that this news gets replayed as "X tries to restrict freedom", and these guys don't get re-elected.
I think this analogy is completely flawed. Under the BSD license, the original piece of code will always remain free for everyone to use. When the government sells a piece of property, it's no longer available to the public. FreeBSD didn't go away when Apple incorporated pieces of the code into OS X.
Both the BSDL and GPL keep the original code free for all, the difference is in the derived works - the GPL stipulates that they, too, must remain free, wheras the BSDL doesn't. I think a more appropriate analogy would be: the BSD license would allow a photographer to take a picture of the sunset in a national park, and retain all rights to it. Under the GPL, the photographer could still make and sell the photograph, but he couldn't stop people who bought the photograph from making copies and giving them away, or selling them.
...because it's an important public policy question: it shouldn't be decided by a backroom push from business lobbyists...
Where the hell have you been for the past 50 years?! This is how all policy is decided by governments. Pretty simple equasion:
BribeH^H^H^H^H^Corporate funding + politician = new policy.
Code, Hardware, stuff like that.
social sciences can never use experience to verify their statemen
Adam Smith supports legislation that increases barriers to entry? My Econ teacher is probably having convulsions right now.
This is a weird subject, really. GPL is good, but when you really think about it, source code for government software isn't really something that should fall into the wrong hands...
Security through obscurity doesn't work. Ask Microsoft.
Code, Hardware, stuff like that.
The GPL=National Park, BSD="dump on market" is a completely unfair analogy. If you make land into a National Park, everyone has a right to use them. If you sell the land, only the landowner gets to use it.
However, that is not the case with GPL vs. BSD. I can freely use and modify any code under the GPL or the BSD. It's not like some company can just take over BSD code and never let me use it. They are both free.
The difference is that with GPL if I write a commercial application and 99% of the code is mine and 1% is GPL I am forced to give out my 99% of code. With BSD I don't.
Now this is fair if it is just some Joe Programmer on his own time who wrote the 1% of GPL code. He can let people use (or not use) it as he feels. It is *NOT* fair if that Joe Programmer is being paid to write that code with MY tax dollars! That code should be freely given to the taxpayers to do with it whatever they want, including using it in their closed-source programs and selling it.
It is not "corporate welfare" because it benefits everyone equally! Corporations can use it, individual taxpayers can use it, universities can use it, etc. Corporate welfare is if they give something to corporations that only corporations will benefit from.
Brian Ellenberger
see, the gpl license is very much like modern encryption alogrithms. prior to the days of RSA, ala world wars, encryption and security was based around the fact that people can hide secure algorithms well enough to keep things secret. in other words, if anyone found out the algorithm, the encryption scheme became utterly pointless.
relatively recently, encryption has undergone a complete turn-around in ideology. now, most every cryptologist believes that the algorithm should not only be simple but also VERY OPEN. the more eyes that look at it, the more errors can be spotted, and as time has told, today's crypto systems, for example RSA, are much more secure than the enigma. everyone and their dog knows how it works, and still no one can break it.
the same thing goes for software. the whole "falls into the wrong hands" argument works exactly the same as crypto-systems. if a crypto-system falls into the wrong hands (as someone else noted), it will also fall into the right hands, and errors will be fixed.
licensing government software under the gpl opens it up, and in the long run reduces the error rate and effectively, it's security, etc. people still think that if they hide the source to the software, it will be more secure. PLEASE look at what happened to cryptology in recent times and act accordingly.
BSD is for people who love UNIX. Linux is for those who hate Microsoft.
Lessig has some good commentary on this in his blog. Basically, he says that if you follow the argument of the New Democrats, then proprietary code should not be allowed either, and only code that goes straight to the Public Domain should be sanctioned by the government, as it could then be used by anyone.
Interesting
In Vino Veritas
I haven't found a statement of the rules, but many academic projects funded by the National Science Foundation require that the data collected (or non-confidential bits of it) be made available to the academic community at large. I think that that is a correct policy of the NSF and that the analogy holds for much of software development
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
NASA uses and produces software under the GPL license.
Any number of of projects funded by NSF, and other Governmental Agency, grants end up licensing software under the GPL.
There is an aspect to this discussion that I don't think gets enough play. The GPL is a great boon to academics who don't have to purchase costly software, and risk throwing obstacles in the way of those who would reproduce their work, or reinvent wheels. This boon comes with the very small cost that the software so produced should be shared with others. I think that this is in harmony with the spirit of Scientific Research, the "standing on the shoulders of Giants" as Newton said.
Software doesn't kill people, people kill people.
Okay, maybe that's too glib, but the song remains the same. Anything that would be considered a serious security threat would be classified as such; The mechanisms to do this with governmental data already exist.
I would hate for something as artistic as software to fall into an anti-terrorist mantra, because there's a forest-for-the-trees problem. Sometimes a cigar is just a cigar, and sometimes an MTA application is just an MTA application, even though it could be used to deliver mail with contents that aren't in the best interests of the commonwealth.
The problem with the 'wrong hands' argument is that we need to trust whomever is entrusted with the definition of 'wrong hands.' If that is a large, bureaucratic judicial system, it's probably inefficient, if it's an efficient corporation, the chances of ever seeing the code is nearly non-existent. :)
Emmett Plant
CEO, Xiph.org Foundation
I was offended by the text of the letter, let alone the purpose. I wrote to two congressmen about it because the letter was glaringly, factually wrong but was signed by leaders in our country.
-Paul Komarek
You can't "license" rights that you don't have. The person who takes under a BSD and re-releases under a GPL does not own the copyright - she is not the author, it is not her original work. The only thing the second person can restrict with the GPL is that which she owns, i.e., her own ADDITIONS and CHANGES to the work (if any).
This is a non-issue, surely. Not letting dangerous government information (ie classified information) into the public's hands is covered by secrecy laws that have nothing to do with copyright law, which exists to secure the "rights" (whether you believe them too many, too few, or just right) of IP holders.
If you come across a classified military report, you can't spread it around, regardless of what licence it is under. I'm pretty sure it would be completely uncopyrighted, if it was produced by the government - once they become unclassified, you can copy them as much as you like.
If you release it under the GPL, all derived code must itself be released under the GPL. Like it or not, this *does* interfere with commercialization of the software, nobody is going to spend millions of dollars writing code they'll have to give away, under most circumstances.
On the other hand, BSD or Public domain carries no such strings. Someone can pick up the BSD or PD code, alter and adapt it, and make the result proprietary, *and* someone else can take the same original PD/BSD code, alter and adapt it, and release it under the GPL or a similar required open-source liscense. The best of all possible worlds, if making something government-generated generally useful requires a lot of up-front investment, in ways that don't appeal to OSS communities, someone can take that opportunity and make an investment with reasonable hope of return. And if something of benefit can be derived in ways that "scratch an itch", the result can be released or recreated under the GPL and kept available.
The problem is that some systems should never be made public. I don't want the command computer source code for the ICBM system running around loose, "many eyes" security methods are a bad thing when intrusion impacts are measured in megatons. So, like it or not, some code will have to remain forever closed.
--Dave
While I agree that some pieces of software that have security concerns for one reason or another might not be best released as open code, but the vast majority of government funded code is for more mundane applications and could be useful to the general public without potential harm from security issues. I have spent the last couple of months working on a piece of software for a government contract that has been written literally dozens of times before but is considered proprietary by the contractors that developed it. The cost and inefficiency is staggering. That is my opinion at least.
Sig? What if I prefer Glock?
Someone who actually understands the issue at hand, in context, even, and is able to give a relatively straightforward and largely unbiased review of what has occurred and why you should care. Crazy!
And for the record, if there were a GNU-AirTraffic piece of software, it would take about 10 years to get to anything resembling 2.7; it would probably spend most of that ten years at version 0.9.x or whatever. What is up with OS projects being totally unwilling to actually go up in versions? Sheesh.
So you agree that what MS did with kerberos is OK? I know this is a troll, but what BS.
Let me give an example, say the government funds an email server. I create a plugin that expands on the functionality of the email server and create a small business around this consulting other companies on its use.
You are a large company that markets the email server. If we use the GPL, you can not close me out with proprietary extensions. Same thing would work in reverse, but you would not care that much. If it was a BSD or Public Domain, you could make proprietary extensions that would disallow my plugin from working. What makes you more important than me? Both of our tax money went to this hypothetical project.
By your reasoning it would be ok to leave trash or campfires burning. The parks are GPLed. We don't let companies come in and strip mine Yellow Stone. If we were to use your analogy, we would let loggers cut down the Redwood forest.
The GPL says share and share alike. you want to keep something to yourself, then do all the work yourself. No way are you takeing what is mine. By definition, anything of the Government is partially mine.
Just a Tuna in the Sea of Life
Now consider how tiny the NSF and NASA are in the grand scheme of things. Consider all the software written for a much larger agency like the US Navy. Think you will ever see any chunk of the Yorktown's propulsion system software? Not m a chance, but think of how huge a project that was. Now consider all the Navy's work from design to implementiation. Now consider that the Navy is just one branch of the enormous US Military, which literally supports whole cities of people on land and at sea. Then consider that the US Military only accounts for one fourth of the US Federal Budget and realize how much software goes to the federal government each year that you will never see, but will pay for again and again.
Very little can be thought of as vast but visible next to the incomprehsibly large.
Darn those academicians who seek to educate and otherwise benifit the public by frank and honest publications! Public libraries, hurt publishers. Free software hurts software vendors who would sell us the same crap forever. Yep, they love the GPL. So should the rest of us.
Friends don't help friends install M$ junk.
In the case of GPLing a BSD licensed piece of code, it would have to be a modified version of the GPL to take into account the original requirements of the BSD license - that attribution must be given in the documentation and that the BSD copyright notices must not be removed from the source. The BSD license allows you to add restrictions, but you may not remove the ones that were there.
So far as I know, more lawsuits have been filed in defense of the BSD license than the GPL so far. :-)
You are clearly a troll, but your post is a good springboard for two important memes.
.sig points out, a nonviral guarantee of *your* freedom to restrict the freedoms of everyone else. In this way, it's more like a freedom annhilator than a freedom virus.
1. GPL is a vaccine against proprietary vendor lock-in. It ensures that once code has been released for public use, it is not extinguished by proprietary extensions that render the original obsolete. This benefits all players, from free software purveyors to large commercial companies. Ask IBM.
2. The BSD license allows you to do whatever you like, for good or for ill. It is, as my
The more people who are vaccinated against a contagious disease, the fewer people will catch it. GPL is definitely a vaccine rather than a virus.
microsoftword.mp3 - it doesn't care that they're not words...
I don't feel that the government should GPL all its code on principle. But should the government be forbidden to make modifications to a mature GPL software project if that software fills the requirements of some particular project? Imagine that the government wants to use Linux for a particular application, because they feel it's the best tool for the job-- should they be forbidden from adapting it to suit their particular needs (as companies like Tivo have), or even releasing bug-fixes?
It strikes me that in many cases the public and the government can both benefit from this sort of transaction. It's certainly far more efficient than the typical "pay a contractor to develop something and then let them retain the copyright" scenario.
The relationship between security and obscurity is a complex one. Naive people often equate them, slightly more educated people make more complex errors, but errors they remain.
The fact is that obscurity can be a valuable impediment to potential attackers, but only if adequate effort can be applied to make sure that the underlying security is good. Most companies, for example, do not have the resources required to adequately ensure the security of complex systems (i.e. pretty much anything running on a computer), which means that they're far better off publishing and allowing the public security community to find their holes for them.
However, public scrutiny is not a magic bullet, because it's not uncommon that something gets published but it doesn't get that much attention. In the case of an organization like the U.S. Government, the resources are available to hire teams of top analytical talent and have them focus 100% on a particular system for years on end, or even in perpetuity. No published code gets that kind of scrutiny.
For example, the NSA practices obscurity but have you ever met a cryptographer who thinks they'd be better off publishing their cipher designs for the community to pound on? The NSA has a huge pool of very talented people and is perfectly capable of doing thorough security reviews completely internally. Adding a layer of obscurity on top of that has all sorts of bonuses for them, such as allowing them to avoid revealing their capability in cipher design (which would imply things about their capabilities in cryptanalysis, for example).
I think the case of the ICBM C&C system is comparable. The DoD can afford to have extensive review by talented people, and then keeping the software secret adds an additional layer of complexity for any would-be attacker. Even more important, of course, are the policies, procedures, clearances, vault doors and armed guards that stand between a potential attacker and the system, and various security and obscurity mechanisms applied to those.
I work a great deal with another class of systems in which obscurity is important. Obscurity slows the defect-discovery process for both white and black hats, and that's usually a bad thing because when white hats find a problem, even though the black hats also find out about it, it gets fixed and is no longer a problem. But what about when you know in advance that if someone finds a defect it will not be *possible* to correct it? White hat security research will essentially hand the keys to the system to the black hats because we can't update the system to correct the problem.
So the logical approach in this case is to (1) do as good a job on the security as you can, (2) keep the software secret, to slow the inevitable discovery of defects, (3) keep an internal team of security analysts working continually to find defects (they can see the code and are more efficient than the black hats, even though they're probably vastly outnumbered) and (4) devise and integrate audit procedures into the initial system security design so that if a bad guy does break it (a) you will find out, so you can try to respond and (b) you have an evidentiary trail that can lead to arrest and prosecution of the attacker.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
not be "poisoned" such that businesses and individual programmers would lose their own work, and the rewards from it, if
they used it.
BZZZT! Wrong! You have just stated that the government has the ability to violate copyright law and public-domain something that was copyrighted. This is not true.
You have to realize that the GPL is a granting of additional rights. It lets you do more than you normally can with a copyrighted work. Therefore somebody cannot take GPL code and turn it into BSD code because they are violating copyright and not using one of the exceptions the GPL allows.
Also for this reason I think any code produced by the government must be BSD, becasue apparently the government cannot copyright anything, therefore they do not have the ability to put any of the restrictions on the code allowed by copyright but not by the GPL. However if the government uses GPL code and modifies it, the result must be GPL, since doing that is the only right they have to use the GPL code. They could also go to the original author and ask for the right to BSD it.
Regarding your first point, the OSD reads, "The license must not discriminate against any person or group of persons." Any person or company can make use of GPL'ed software according to the terms of the GPL. In that way, it's completely non-discriminatory. You're complaining that the GPL doesn't allow commercial software creators to use the code in any way they see fit, which is a misinterpretation of the real intent.
Now, if the license expressly stated, "Microsoft cannot use this code for any purpose," or "This code may only be used by the Church of Scientology," then such a license would fail to meet the OSD.
On the second point, the OSD reads, "The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research." Again, you misinterpret the OSD. For one thing, the restriction is talking about "making use of a program," not redistributing a program. Which means that Adobe could run their development on CVS and GCC, but couldn't sell their own versions without complying with the GPL. For another thing, in order to bring the GPL into compliance with your interpretation of the OSD, they would have to be granted special exemptions.
IOW, proprietary software developers aren't being being discriminated against.
You want the truthiness? You can't handle the truthiness!
give GPL to democrats and give BSD to republicants (or vice versa). And wait for upcoming elections. Let the american people to decide what license to use in all software made by the goverment for people's money.
Less is more !