Slashdot Mirror
Advocacy Prompts Reconsideration of Anti-GPL Letter
As far as I can tell, it started with this Newsforge story (Newsforge is also part of OSDN, Slashdot's corporate parent). The Newsforge story was excerpted and copied by an Australian newspaper, and from there, it was off and spreading. The headline chosen, "Washington State Congressman attempts to outlaw GPL", is not particularly accurate, but it did a great job at stirring up outrage. Outlaw the GPL! Over my dead keyboard!
From there it really started making the rounds. It was repeatedly submitted to Slashdot with all sorts of flaming, incorrect commentary - in fact, after reading a dozen different submissions, I didn't think any of them were even close to accurate. I picked one and posted it, trying to do my best to a) provide an accurate headline and b) provide an accurate summary of the issue at stake in a few sentences. To recap again: when the Federal government creates computer code (or any copyrightable work) directly, it gets no copyright whatsoever and the work is true public domain (quirk of the U.S. copyright laws - the 50 states, corporations, individuals, and other legal entities all get copyrights automatically, but the Federal government does not). If you want to copy, reproduce, or sell an .mp3 of the U.S. Congress singing "God Bless America" after September 11, go right ahead: there is no copyright on it whatsoever. (Actually, the song itself is still under copyright, but Congress' performance of it wouldn't be...)
However, when the Federal government hires a non-employee to create code or copyrighted works, there is no clear rule regarding the copyright status of the work. Sometimes the contract calls for rights to the work to be assigned to the Federal government (the Feds don't get original copyrights, but if someone else gets an original copyright, the Feds can acquire it). Sometimes the contractor keeps the copyright and gets to do whatever they want with it. Sometimes the contract doesn't specify. Note that this is NOT a BSD-vs.-GPL dispute, not by a long shot. Very little code financed by the Federal government is ever licensed under either of these two licenses - the choice is basically agency-proprietary (the Federal agency asked for the rights in the contract, and kept them) or company-proprietary (the agency didn't ask for the rights, and the contractor kept them).
And most of the time it doesn't matter. I've written code for the Federal government as both a contractor and an employee, and 99% of it was so specific and customized that it would be of use to no one else, regardless of its licensing or copyright status. Probably the majority of code written for the Federal government falls into that category - internal use software for very specific needs.
But some of it is undoubtedly useful. Some major projects funded by the government in conjunction with academia have escaped from licensing purgatory, typically through the efforts of the researchers working on them who approach the issue from an academic freedom viewpoint and want to see their work widely adopted. GRASS is one major one that I know of. A commenter pointed out ADA as an example. For code which is useful to others, either a BSD-like or GPL-like license would be truly beneficial and easily defensible as a public policy choice. In the non-code world, the government makes choices like that all the time - it might choose to purchase a particular piece of land and commit to making it available to everyone forever by declaring it a National Park and committing to maintain it, a GPL-like philosophy; alternately, it might choose to just dump a particular piece of property on the market, putting it up for auction and letting the purchaser do what he wills with it, a BSD-like philosophy.[1] Either of these two options might be optimal; but paying for code which ends up remaining proprietary is like buying a new stadium to benefit a very specific corporation which owns a very specific sports team: the type of use of public funds which is generally seen as sleazy and the opposite of good governance.
Either of the first two choices can be appropriate in certain situations. What does not seem appropriate is paying for proprietary code, although this is generally what happens when the government contracts for code. Since the government has the ability to provide a benefit to the public (open code) at essentially zero cost, it should do so. An example which has struck me several times over the past few years: every airport in the world has the same problem, coordinating planes taking off and landing and keeping them from running into each other. Yet each nation (and often each airport) solves the problem over and over, paying heavily for custom-designed, one-shot software development. Imagine if the world's airports could simply install GNU-AirTrafficControl 2.7, and have a complete, working, bug-free and cost-free air traffic control system. It would cost every nation less to do it this way, but it would also make a lot less money for the consultants retained to develop these systems.
But leave off the advocacy for moment - I was following the story itself. As noted above, the outcry has prompted many of the other Representatives who originally signed the letter to reconsider. The AP story even suggests that some of the signatories were actively misled - that the letter they thought they were signing didn't mention the GPL at all. However it actually played out, some good has been done.
That's good. What's not so good is that much of the outcry was probably generated by stories titled "Washington State Congressman attempts to outlaw GPL". The right outcome occurred, but for the wrong reasons and in the wrong manner. I am left wondering whether the community would have made the same sort of response on this issue if every story that had been posted about it was 100% accurate and non-inflammatory.
[1] If you're not familiar with the BSD-like and GPL-like classes of software licenses, this won't make a lot of sense to you, so please read up if necessary.
...because the BSD license is essentially no license at all. So, when the government releases the SuperFoomatic 1.0, anyone can do with it as they please.
If we want a GPL'ed SuperFoomatic, we just take that code and release it under the GPL license. No point in having it release originally under the GPL as the released code can be GPL'ed "retroactively".
The only addiition I can think of is that perhaps it should be dual licensed, so that corporations have to pay for its use, with those monies paying for additional governmental software research.
If the code is good, it doesn't matter whose hands it falls into. Odds are that if it falls into bad hands that find an exploit, it will also fall into good hands that find that same exploit, and alert the developers.
Forcing the government to release code under GPL is *removing* competition from the market. Public domain is much better. The code can be taken up by private companies and they can improve and sell it. And nothing I am aware of keeps that same code for forming the basis of a GPL and/or BSD project.
So turn the code loose with no strings at all, and let the best licensing system win!
The only good weather is bad weather.
I think this analogy is completely flawed. Under the BSD license, the original piece of code will always remain free for everyone to use. When the government sells a piece of property, it's no longer available to the public. FreeBSD didn't go away when Apple incorporated pieces of the code into OS X.
Both the BSDL and GPL keep the original code free for all, the difference is in the derived works - the GPL stipulates that they, too, must remain free, wheras the BSDL doesn't. I think a more appropriate analogy would be: the BSD license would allow a photographer to take a picture of the sunset in a national park, and retain all rights to it. Under the GPL, the photographer could still make and sell the photograph, but he couldn't stop people who bought the photograph from making copies and giving them away, or selling them.
social sciences can never use experience to verify their statemen
Adam Smith supports legislation that increases barriers to entry? My Econ teacher is probably having convulsions right now.
This is a weird subject, really. GPL is good, but when you really think about it, source code for government software isn't really something that should fall into the wrong hands...
Security through obscurity doesn't work. Ask Microsoft.
Code, Hardware, stuff like that.
see, the gpl license is very much like modern encryption alogrithms. prior to the days of RSA, ala world wars, encryption and security was based around the fact that people can hide secure algorithms well enough to keep things secret. in other words, if anyone found out the algorithm, the encryption scheme became utterly pointless.
relatively recently, encryption has undergone a complete turn-around in ideology. now, most every cryptologist believes that the algorithm should not only be simple but also VERY OPEN. the more eyes that look at it, the more errors can be spotted, and as time has told, today's crypto systems, for example RSA, are much more secure than the enigma. everyone and their dog knows how it works, and still no one can break it.
the same thing goes for software. the whole "falls into the wrong hands" argument works exactly the same as crypto-systems. if a crypto-system falls into the wrong hands (as someone else noted), it will also fall into the right hands, and errors will be fixed.
licensing government software under the gpl opens it up, and in the long run reduces the error rate and effectively, it's security, etc. people still think that if they hide the source to the software, it will be more secure. PLEASE look at what happened to cryptology in recent times and act accordingly.
BSD is for people who love UNIX. Linux is for those who hate Microsoft.
NASA uses and produces software under the GPL license.
Any number of of projects funded by NSF, and other Governmental Agency, grants end up licensing software under the GPL.
There is an aspect to this discussion that I don't think gets enough play. The GPL is a great boon to academics who don't have to purchase costly software, and risk throwing obstacles in the way of those who would reproduce their work, or reinvent wheels. This boon comes with the very small cost that the software so produced should be shared with others. I think that this is in harmony with the spirit of Scientific Research, the "standing on the shoulders of Giants" as Newton said.
Software doesn't kill people, people kill people.
Okay, maybe that's too glib, but the song remains the same. Anything that would be considered a serious security threat would be classified as such; The mechanisms to do this with governmental data already exist.
I would hate for something as artistic as software to fall into an anti-terrorist mantra, because there's a forest-for-the-trees problem. Sometimes a cigar is just a cigar, and sometimes an MTA application is just an MTA application, even though it could be used to deliver mail with contents that aren't in the best interests of the commonwealth.
The problem with the 'wrong hands' argument is that we need to trust whomever is entrusted with the definition of 'wrong hands.' If that is a large, bureaucratic judicial system, it's probably inefficient, if it's an efficient corporation, the chances of ever seeing the code is nearly non-existent. :)
Emmett Plant
CEO, Xiph.org Foundation
If you release it under the GPL, all derived code must itself be released under the GPL. Like it or not, this *does* interfere with commercialization of the software, nobody is going to spend millions of dollars writing code they'll have to give away, under most circumstances.
On the other hand, BSD or Public domain carries no such strings. Someone can pick up the BSD or PD code, alter and adapt it, and make the result proprietary, *and* someone else can take the same original PD/BSD code, alter and adapt it, and release it under the GPL or a similar required open-source liscense. The best of all possible worlds, if making something government-generated generally useful requires a lot of up-front investment, in ways that don't appeal to OSS communities, someone can take that opportunity and make an investment with reasonable hope of return. And if something of benefit can be derived in ways that "scratch an itch", the result can be released or recreated under the GPL and kept available.
The problem is that some systems should never be made public. I don't want the command computer source code for the ICBM system running around loose, "many eyes" security methods are a bad thing when intrusion impacts are measured in megatons. So, like it or not, some code will have to remain forever closed.
--Dave
While I agree that some pieces of software that have security concerns for one reason or another might not be best released as open code, but the vast majority of government funded code is for more mundane applications and could be useful to the general public without potential harm from security issues. I have spent the last couple of months working on a piece of software for a government contract that has been written literally dozens of times before but is considered proprietary by the contractors that developed it. The cost and inefficiency is staggering. That is my opinion at least.
Sig? What if I prefer Glock?
Someone who actually understands the issue at hand, in context, even, and is able to give a relatively straightforward and largely unbiased review of what has occurred and why you should care. Crazy!
And for the record, if there were a GNU-AirTraffic piece of software, it would take about 10 years to get to anything resembling 2.7; it would probably spend most of that ten years at version 0.9.x or whatever. What is up with OS projects being totally unwilling to actually go up in versions? Sheesh.
I don't feel that the government should GPL all its code on principle. But should the government be forbidden to make modifications to a mature GPL software project if that software fills the requirements of some particular project? Imagine that the government wants to use Linux for a particular application, because they feel it's the best tool for the job-- should they be forbidden from adapting it to suit their particular needs (as companies like Tivo have), or even releasing bug-fixes?
It strikes me that in many cases the public and the government can both benefit from this sort of transaction. It's certainly far more efficient than the typical "pay a contractor to develop something and then let them retain the copyright" scenario.
The relationship between security and obscurity is a complex one. Naive people often equate them, slightly more educated people make more complex errors, but errors they remain.
The fact is that obscurity can be a valuable impediment to potential attackers, but only if adequate effort can be applied to make sure that the underlying security is good. Most companies, for example, do not have the resources required to adequately ensure the security of complex systems (i.e. pretty much anything running on a computer), which means that they're far better off publishing and allowing the public security community to find their holes for them.
However, public scrutiny is not a magic bullet, because it's not uncommon that something gets published but it doesn't get that much attention. In the case of an organization like the U.S. Government, the resources are available to hire teams of top analytical talent and have them focus 100% on a particular system for years on end, or even in perpetuity. No published code gets that kind of scrutiny.
For example, the NSA practices obscurity but have you ever met a cryptographer who thinks they'd be better off publishing their cipher designs for the community to pound on? The NSA has a huge pool of very talented people and is perfectly capable of doing thorough security reviews completely internally. Adding a layer of obscurity on top of that has all sorts of bonuses for them, such as allowing them to avoid revealing their capability in cipher design (which would imply things about their capabilities in cryptanalysis, for example).
I think the case of the ICBM C&C system is comparable. The DoD can afford to have extensive review by talented people, and then keeping the software secret adds an additional layer of complexity for any would-be attacker. Even more important, of course, are the policies, procedures, clearances, vault doors and armed guards that stand between a potential attacker and the system, and various security and obscurity mechanisms applied to those.
I work a great deal with another class of systems in which obscurity is important. Obscurity slows the defect-discovery process for both white and black hats, and that's usually a bad thing because when white hats find a problem, even though the black hats also find out about it, it gets fixed and is no longer a problem. But what about when you know in advance that if someone finds a defect it will not be *possible* to correct it? White hat security research will essentially hand the keys to the system to the black hats because we can't update the system to correct the problem.
So the logical approach in this case is to (1) do as good a job on the security as you can, (2) keep the software secret, to slow the inevitable discovery of defects, (3) keep an internal team of security analysts working continually to find defects (they can see the code and are more efficient than the black hats, even though they're probably vastly outnumbered) and (4) devise and integrate audit procedures into the initial system security design so that if a bad guy does break it (a) you will find out, so you can try to respond and (b) you have an evidentiary trail that can lead to arrest and prosecution of the attacker.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.