Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenSSL Receives FIPS 140-2 Validation

Posted by CmdrTaco on from the it's-11am-do-you-know-where-your-bits-are dept.

Argon writes "Close on heals of NewsForge reporting about Government Agency dragging its heels on OpenSSL validation comes the news that OpenSSL receives FIPS Certification. More details are available at the Open Source Institute site which has been driving the effort to get OpenSSL certified. FIPS 140-2 certification allows software using the certified version of OpenSSL to get into various Government departments previously not possible, thus increasing penetration of Free Software in Government."

46 comments

  1. "Pending" for 2 weeks by nealmcb · · Score: 5, Informative

    Congrats and thanks to the team - I can only imagine what a struggle this has been.

    From http://www.oss-institute.org/

        Two points to remember please: a) the validation is still considered
        "pending" until it is posted on the NIST site...in no more than 2
        weeks from the announcement date -- NIST official protocol, and b)
        the validation does not immediately solve all FIPS 140-2 compliance
        issues.

    The big thing available now is "OpenSSL Security Policy Version 1.0"
        http://oss-institute.org/images/OpenSSL_SecurityPo licy_FINAL.pdf

          This document is required as a part of the FIPS 140-2 validation
          process. It describes the OpenSSL FIPS cryptographic module in
          relation to FIPS 140-2 requirements. The companion document
          OpenSSL FIPS 140-2 User Guide (Reference 14)is a technical
          reference for developers using, and system administrators
          installing, the OpenSSL FIPS software, for use in risk assessment
          reviews by security auditors, and as a summary and overview for
          program managers.

    The "validated OpenSSL USER GUIDE" will be available within two weeks
    of the announcement date.

    No sign yet of OpenSSL 0.9.7j on the openssl site.

    There is an email list available for updates:

      http://mail.oss-institute.org/mailman/listinfo/fip s-nist-update_oss-institute.org

    --

    --Neal
    Go IETF!

  2. Annoying license by duffbeer703 · · Score: 2, Informative

    OpenSSL is one of those cool projects that would be so much cooler if it weren't for the stupid license that makes it a PITA to actually employ in a product.

    OpenSSL essentially uses the BSD license w/attribution, which makes it difficult to use with GPLd projects, unless you use the version provided by your distro -- which isn't always desireable.

    --
    Conformity is the jailer of freedom and enemy of growth. -JFK
    1. Re:Annoying license by nacturation · · Score: 2, Insightful

      You have such a problem giving credit to the people whose work you use? You don't even need to release source if you don't want. Just using it and saying thanks in your documentation and/or credits is all that's required.

      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    2. Re:Annoying license by pyite69 · · Score: 1

      Are you serious? The artistic license allows you to copy the code and put a GPL license on it if you want... there is no issue at all.

  3. So will this end gnutls ? by Anonymous Coward · · Score: 2, Interesting

    I mean... I do think it to be good that the market offers multiple solutions to certain issues, freedom of choice is a good thing. However I sometimes don't understand why sometimes people are very desperate to re-invent the wheel "just because". It usually starts with "its not free / open sourced" (as they say about Java), "its too complicated", and I guess there are numerous of other reasons. Don't get me wrong; I'm not claiming that those reasons are nonsense perse.

    But what I do find frustrating is when the original software is very usable, has earned its spurs multiple times and as such deserves some credit. Instead people desperatly try to mimick it sometimes, even resulting in an environment which doesn't even come close to working as the original. Resulting in "yet another environment". On Linux for example you can basicly say that it has 2 TLS solutions: openssl and gnutls.

    Personally I think this is silly, and basicly no different from what the big companies do. Many people whine about how many different standards there are and how this should be made easier and more free, only to end up doing exactly the same.

    Kudo's to openssl! Very impressive and still my personal favorite when it comes to providing SSL based solutions.

    1. Re:So will this end gnutls ? by Slashcrap · · Score: 1

      But what I do find frustrating is when the original software is very usable, has earned its spurs multiple times and as such deserves some credit. Instead people desperatly try to mimick it sometimes, even resulting in an environment which doesn't even come close to working as the original. Resulting in "yet another environment". On Linux for example you can basicly say that it has 2 TLS solutions: openssl and gnutls.

      I know it's terrible isn't it? You've got FreeBSD, NetBSD, OpenBSD and all the others - what a total waste of effort! Sorry, what was that? You were only complaining about there being GPL software that does the same thing as BSD software? Oh, I do apologise.

    2. Re:So will this end gnutls ? by juergen · · Score: 2, Insightful

      It is not "just because". Appearantly some people find the license annoying (scroll up slightly for a proof).

      You yourself listed beeing not free (enough) as one of the reasons you do not claim nonsense ...

      I personally don't mind there beeing 2 projects, if any one dies we still have the other one.

    3. Re:So will this end gnutls ? by Anonymous Coward · · Score: 0

      Nah, that is the kind of freedom of choice which is a good thing. Besides; all of those environments still follow certain standards, in this case being Posix compliant (or closely as possible).

      Ok, lets get to a specific example; Sun Java (JDK) and Kaffe, the "open source variant". I find it frustrating that very basic code can be compiled on both environments, but when you try to run it with Kaffe if gives exceptions. While running it on Linux, Windows, BSD, OS X, OS/2, etc. with Sun's JRE gives you no problems what so ever. Thats frustrating and making me wonder why we'd need "yet another java environment", especially when it doesn't even do what its suppose to do.

      There is a difference between innovation and trying to reinvent already existing solutions "just because". Sometimes its best to comply to a certain standard, and sometimes its not. In this case I think going the openssl way would be wiser.

    4. Re:So will this end gnutls ? by micheas · · Score: 3, Insightful
      However I sometimes don't understand why sometimes people are very desperate to re-invent the wheel "just because".


      Think of it as the computer equivilent to a kit car. Impractical and done mainly for the benifit of the person doing it. Every once in a while someone creating a one off car comes up with something really innovative, but most of the time it is just a single persons hobby that no one really cares about.

      With the nominal distribution and reproduction cost of software however, each creation has a remote chance of being a market leader.

      Observers seem get caught up on market share and conservation on talent, when a lot of computer work is the scale of a really impressive hobby. That is not to say that people do not create software for other reasons. That is obviously false, but writing a *n*x clone from scratch when BSD already existed to get to learn about the 80386 was a waste of time if one only looks at efficiency of resources, but that was not the goal. The goal was to learn about the 80386, Linux having a sizable market share was an unintended consequence that did not factor in its origination.

      (I hope this is not way to pedantic, but the we shouldn't waste resources statements seem to get passed around as truth with out any discussion.)
      --
      Work bio at MMWD
    5. Re:So will this end gnutls ? by Anonymous Coward · · Score: 0

      It is not "just because". Appearantly some people find the license annoying (scroll up slightly for a proof).

      Yeah, but I wonder if the license being used is also one of the reasons for its success. Would this have been possible under the flag of the GPL ? I doubt it.

  4. Is the end of RSA Security (the company)? by Anonymous Coward · · Score: 3, Interesting

    OpenSSL has long been the choice crypto library for many commercial applications. When such products need to be sold into government they invariably face the issue of FIPS 140-2 certification. Does an OpenSSL FIPS 140-2 module signal the end of RSA Security. Other than their SecureID tokens RSA do not seem to have a lot more to offer.

    1. Re:Is the end of RSA Security (the company)? by Halo- · · Score: 2, Interesting
      Let me answer that with a resounding: "Huh?"

      Does an OpenSSL FIPS 140-2 module signal the end of RSA Security. Other than their SecureID tokens RSA do not seem to have a lot more to offer.

      FIPS 140-2 is basically a standard correctly and security of an algorithm. OpenSSL implements things like the RSA algorithm, and their implementation has been certified as "safe" for government use to a certain level of assurance. This doesn't have anything to do with RSA Security (the company), SecureID, or anything like that.

      RSA the (algorithm) is still very, very much alive and doesn't show any sign of going anywhere for many years. This is due in part to the fact that the only other option is elliptic curve, (ECC) which is patented, and will be for some time to come.

    2. Re:Is the end of RSA Security (the company)? by Anonymous Coward · · Score: 0

      You have missed my point, but I may not have been clear as I was assuming some knowledge of RSA's business activities, given that FIPS 140-2 certification is an important aspect of their products.

      RSA's core business is their crypto libraries, RSA BSAFE for example. The major difference between OpenSSL and BSAFE is that BSAFE has FIPS 140-2 certification. With this difference now removed there seems to be less reason to pay RSA Security vast sums of money to license BSAFE.

      Although you understand the difference between RSA Security (the company) and RSA (the algorithm) you seem to have missed that I am talking about the company, not the algorithm.

  5. YAY by mnmn · · Score: 1, Funny

    YAY. Woohoo! Go OSS!

    What is FIPS Validation?

    --
    "Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
  6. I assume.... by Slashcrap · · Score: 1

    ....that there is some way in which you can run OpenSSL in FIPS compliant mode then? Or is it a special FIPS distribution of OpenSSL?

    Because under FIPS, the only allowable algorithms are 3DES-CBC for encryption and SHA1 for HMAC.

    If you allow anything else to be used, it is not "FIPS compliant".

    1. Re:I assume.... by Schraegstrichpunkt · · Score: 4, Informative
      Because under FIPS, the only allowable algorithms are 3DES-CBC for encryption and SHA1 for HMAC. If you allow anything else to be used, it is not "FIPS compliant".

      Could you cite your sources? From what I can tell, the FIPS 140-2 list of Approved Security Functions includes AES, and Triple-DES, as well as (curiously) DES and Skipjack[1].

      For AES, the ciphers can be operated in the ECB, CBC, CFB, OFB, CTR, CMAC, and CCM modes of operation.

      Approved hash functions include SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512. Keyed hashing must be done using HMAC, but you can use various DES MACs, as well as CCM mode, for message authentication.

      Interestingly, what this basically means is that FIPS 140-2 compliance does not imply that your system is secure. All it means is that the government can use it.

      [1] Can somebody please check this? I vaguely remember DES and Skipjack being withdrawn, but I can't find the documentation for that.

      --
      http://outcampaign.org/
    2. Re:I assume.... by nickovs · · Score: 3, Informative

      ....that there is some way in which you can run OpenSSL in FIPS compliant mode then? Or is it a special FIPS distribution of OpenSSL?

      Because under FIPS, the only allowable algorithms are 3DES-CBC for encryption and SHA1 for HMAC.

      If you allow anything else to be used, it is not "FIPS compliant".

      Two issues. Firstly, AES is acceptable these days for the symmetric cipher and that is supported in TLS. Secondly, the strict requirements about what ciphers are available does not, as far as I know, apply if it's just a FIPS 140-2 level 1 validation which is basically a validation that the FIPS certified ciphers in the library function as required. If they have gone for FIPS 140-2 level 2 then then any key management functionality (such as key wrapping) must use FIPS certified ciphers but one can usually still allow users to use other ciphers. This is important since SSL requires both MD5 and SHA-1 for some of it's obscure MAC functions.

      --
      If intelligent life is too complex to evolve on its own, who designed God?
    3. Re:I assume.... by Slashcrap · · Score: 1

      Could you cite your sources?

      Memory, which in this case appears to have been slightly faulty.

      Anyway, my point was that OpenSSL supports an awful lot of stuff that you're not going to be able to use in a FIPS compliant system.

      How is that going to be handled? Some kind of switch or a separate distribution? I know that where I work we have our own distribution of OpenSSL without any of the funky ECC stuff (because it's patented up the wazoo by Certicom and we don't want to get sued) or the really weak algorithms.

    4. Re:I assume.... by Anonymous Coward · · Score: 0

      DES is allowed for a limited time when used to
      communicate with *legathy* systems.
      http://csrc.nist.gov/cryptval/DESTranPlan.pdf

      Skipjack is still approved, and I believe there
      is nothing announced about the security of it.

  7. Level 1 by swillden · · Score: 2, Interesting

    The article notes that OpenSSL has achieved level 1, "the lowest of four possible validation levels". It should be noted, however, that level 1 is also the only level achievable by a software implementation. Level 2 requires physical "tamper evidence", which isn't achievable without something physical on which the tampering would be evident. Just for completeness, level 3 and level 4 require different degrees of "tamper resistance".

    --
    Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    1. Re:Level 1 by nickovs · · Score: 1

      he article notes that OpenSSL has achieved level 1, "the lowest of four possible validation levels". It should be noted, however, that level 1 is also the only level achievable by a software implementation. Level 2 requires physical "tamper evidence"

      This is not the case. There are several software implementations that have achieved FIPS 140 level 2 validation, more notably the Netscape Security Services (NSS) library which is now maintained by the Mozilla team: http://www.mozilla.org/projects/security/pki/nss/f ips/

      --
      If intelligent life is too complex to evolve on its own, who designed God?
    2. Re:Level 1 by keath_milligan · · Score: 3, Informative

      It's possible for software to achieve higher than level 1, but you have to presume a standard hardware platform to run it on. They probably just picked a machine that met level 2 physical requirements and ran it through the process using it, so technically, it probably isn't certified unless it is running on that particular machine. This is pretty common.

    3. Re:Level 1 by swillden · · Score: 2, Informative

      Sort of. To be tested, a software module has to be deployed on some specific piece of hardware conforming to some defined tamper evident/resistant properties. A level 1 certification means that the selected platform didn't have the requisite properties. That doesn't have anything to do with the quality or security of the software, however, it just means that whoever was paying for the certification didn't want to pay for the more expensive hardware and testing.

      So I guess I should have said "a software module deployed on any random PC with no special security hardware" can't get higher than level 1.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  8. Not true by HBI · · Score: 1

    It is true that SHA-1 is required for hashing but AES in various incarnations is a permissible encryption algorithm.

    --
    HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
  9. This could be BIG by $ASANY · · Score: 4, Informative
    I've noted before that this was the really important missing piece for open-source systems, the other being Commmon Criteria accreditation. In U.S. federal government (and especially DoD) programs, not only do you need to be EAL3 or better, but interoperate with FIPS 140-2 crypto systems in a FIPS 140-2 compliant manner when encryption is used, which is almost all the time. We have open-source systems certified under common criteria, but we couldn't use them with DOD PKI, so the utility of these systems was severely limited.

    As a side note, it never seemed as if Microsoft's failure to get CC validations promptly ever slowed down IIS or XP deployments, but it's been a major roadblock for any other systems to get through DITSCAP if there was any possible reason to deny the request.

    FIPS accreditation removes the final roadblock for open source in the federal government. Now there is not a single valid policy or security requirement that can block deployments of open source systems.

    Also of note is that since anyone can use OpenSSL, small development shops are no longer held hostage to Certicom's expensive licensing schemes if they want to deploy FIPS compliant solutions. It used to be financially daunting to sell software to the government that included crypto, and this created a nice, safe sandbox for the small set of approved vendors to charge outrageous prices for FIPS compliant solutions. Now they have to compete with open source, which will likely bring costs down considerably for anyone required to deploy only FIPS compliant solitions.

    Another poster mentioned that this restricted the choice of encryption algorithms to 3DES. That is incorrect. FIPS 140-2 is an AES implementation, specifically because of concerns over 3DES' long-term viability. There are no approved 3DES implementations under FIPS 140-2.

  10. Watch out for homonyms by Anonymous Coward · · Score: 0

    It's "heels" not "heals", sheesh.

  11. non-Viral == Annoying??? by mosel-saar-ruwer · · Score: 4, Insightful

    OpenSSL is one of those cool projects that would be so much cooler if it weren't for the stupid license that makes it a PITA to actually employ in a product. OpenSSL essentially uses the BSD license w/attribution, which makes it difficult to use with GPLd projects, unless you use the version provided by your distro -- which isn't always desireable.

    Okay, maybe this is a question of semantics, but since when did a non-viral open source license qualify as "annoying"?

    1. Re:non-Viral == Annoying??? by frodo+from+middle+ea · · Score: 1

      On that note, name one "VIRAL" open source license.

      --
      for the last time people, I am "frodo from middle eaRTH", not "middle eaST".
    2. Re:non-Viral == Annoying??? by TheRaven64 · · Score: 1

      The advertising clause has been dropped by the rest of the BSD community, including the original BSD code base. It is unworkable, since it requires you to advertise every piece of code you use that uses the clause. Eventually you end up with such a large number of other people's adverts on your promotional material that people can't see what you are actually advertising. The addition of this clause to the license was the reason the entire F/OSS community ditched XFree86 in favour of x.org.

      --
      I am TheRaven on Soylent News
    3. Re:non-Viral == Annoying??? by swillden · · Score: 1

      Okay, maybe this is a question of semantics, but since when did a non-viral open source license qualify as "annoying"?

      The OpenSSL license is just as "viral" as the GPL (actually, it's copyright that's viral, but I'll ignore that). The attribution clause "infects" any software which uses OpenSSL. In many cases, OpenSSL's restriction is less constraining than the restrictions in the GPL, but it is a restriction, and it does annoy some people -- mainly those using free software licenses that don't allow the attribution requirement to be added. It also annoys makers of proprietary software who don't want to admit they didn't write all their own code. Poor babies.

      One of the nice things about the draft GPLv3 is that it will eliminate the annoyance to GPL projects, since it allows projects to add some licensing requirements, like attribution.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
  12. Mod parent uninformative by ivoras · · Score: 1
    Can you quote paragraph against paragraph, side by side, why are those two licenses incompatible? Which paragraph in the GPL license prevents use of BSD licenseed code inside a GPL project?!

    BSD License is strictly less demanding, and you CAN use any BSD library or project inside a GPL project without ANY problems with licenses. This is because BSD License doesn't prevent distribution of source code with a product, and GPL requires it. BSD License doesn't care about the software-is-free dogma thingy in the GPL, and if you want to apply it, so be it - it won't violate the BSDL. Think of it this way: GPL is kind of a superset of the BSDL - it adds things about which the BSDL just doesn't care.

    If it were the other way around - using GPL code inside a BSD-licensed project would create major problems because either the BSD code would be automatically (virally) upgraded to the GPL or the GPL code would be stripped of some of its clauses (for example "you MUST distribute source code" semantics would be downgraded to "you MAY distribute source code if you wish so").

    --
    -- Sig down
  13. Re: Mod Reply clueless by duffbeer703 · · Score: 2, Informative

    The original BSD license included an "Advertising Clause". That advertising clause is incompatabile with the GPL (because it adds additional restrictions to your use and distribution of the software) and is a rather annoying and useless artifact.

    The University of California removed the advertising clause in 1999. OpenSSL and its predessessor, SSLeay, require attribution on all marketing material.

    Here is the original BSD license... clause 3 is the advertising clause:

    * Copyright (c) 1982, 1986, 1990, 1991, 1993
    * The Regents of the University of California. All rights reserved.
    *
    * Redistribution and use in source and binary forms, with or without
    * modification, are permitted provided that the following conditions
    * are met:
    * 1. Redistributions of source code must retain the above copyright
    * notice, this list of conditions and the following disclaimer.
    * 2. Redistributions in binary form must reproduce the above copyright
    * notice, this list of conditions and the following disclaimer in the
    * documentation and/or other materials provided with the distribution.
    * 3. All advertising materials mentioning features or use of this software
    * must display the following acknowledgement:
    * This product includes software developed by the University of
    * California, Berkeley and its contributors.
    * 4. Neither the name of the University nor the names of its contributors
    * may be used to endorse or promote products derived from this software
    * without specific prior written permission.
    *
    * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
    * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
    * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
    * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
    * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
    * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
    * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
    * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
    * SUCH DAMAGE.
    --
    Conformity is the jailer of freedom and enemy of growth. -JFK
  14. Cool! by Spy+der+Mann · · Score: 2, Interesting
    I hope now they can use that as a legitimate reason to finish documenting the libraries...


    # openssl(1): [STILL INCOMPLETE]
    Manual page documenting the openssl command line tool.

    # ssl(3): [STILL INCOMPLETE]
    Manual page documenting the OpenSSL SSL/TLS library.

    # crypto(3): [STILL INCOMPLETE]
    Manual page documenting the OpenSSL Crypto library.

    # HOWTO: [STILL INCOMPLETE]
    HOWTO documents to introduce concepts or explain them in a way that is not possible in the manuals.

  15. Free Software "penetration" by raddan · · Score: 1

    It's about time we finally penetrated the government. They've been fucking us for years.

  16. Yes, LINUX SUX, but YOU SWALLOW. by mmell · · Score: 1

    (n/t)

  17. Which version was passed? by Anonymous Coward · · Score: 0

    So if I compile it with all the ASM and patented algos for speed then I'm not FIPS compliant or did they change things? I thought the holdup was that OSSL was trying to get source code validated rather than just binaries but with all the f-n options it would take forever??? I guess I'll have to wait 2 weeks for the announcement. If the source was validated then WOOHOO! like everyone else. This is a major step for compatibility! and provides OSS with a superior advantage to commercial software. Otherwise this is another like what took them so long article. I think Crypto++ had FIPS for awhile now... see: Crypto++ Fips 140-2 level 1 Conformance

  18. Re: Mod Reply clueless by ivoras · · Score: 1

    http://www.gnu.org/philosophy/bsd.html
    Though it's inconvenient, I don't see how the clause makes it strictly incompatible with GPL. Anyone know why it says so in http://www.gnu.org/philosophy/license-list.html ?

    --
    -- Sig down
  19. Why no 1.0 by Vellmont · · Score: 1

    OpenSSL is one of the most widely used pieces of software out their. Why is it still at version 0.9.x? I don't understand why this well proven pieces of software STILL hasn't decided that it's good enough for a 1.0 release. Can somone explain the version number strangeness?

    --
    AccountKiller
  20. Re: Mod Reply clueless by duffbeer703 · · Score: 1

    The thing that should jump out at you is this passage from your first link:

    "NetBSD comes with a long list of different sentences, required by the various licenses for parts of the system. In a 1997 version of NetBSD, I counted 75 of these sentences. I would not be surprised if the list has grown by now."

    Say Apache required those 75 attribution sentences, and say someone at IBM working on the IBM HTTP server (based on Apache) erroneously mangled or deleted a few of those attributions. Now IBM can be sued for violating the license, because they sell products that are bundled with their Apache-derived webserver.

    If you want recognition for your Open Source work, release it via the GPL or some other license -- that way your contributions are actually visible to other programmers when it gets embedded in other products. BSD w/attribution simply ensures that your name will appear in small print in the preface of a computer manual that nobody reads.

    --
    Conformity is the jailer of freedom and enemy of growth. -JFK
  21. Re: Mod Reply clueless by Intron · · Score: 1
    No. IBM could not be sued. You could write them a nice letter (or a nasty one if you prefer) and they would fix their distribution. If they refused to fix their distribution (unlikely) then you could sue. But in US courts, you can't sue until you have shown that the defendent is refusing to comply with your legitimate request.

    Besides, which is more restrictive, the "obnoxious BSD advertising clause" or the GPL "conspicuously" clause?
    You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.
    --
    Intron: the portion of DNA which expresses nothing useful.
  22. Church of Newsforge by StikyPad · · Score: 1

    Newsforge is healing people? Hallelujah!

    --
    https://www.eff.org/https-everywhere
  23. Re: Mod Reply clueless by ivoras · · Score: 1

    I'm still waiting for a quote from the GPL where it says it's incompatible with the advertising clause...

    --
    -- Sig down
  24. Re:Annoying license - So Fork It by Anonymous Coward · · Score: 0

    It's BSD, so if you want to make it GPL just Fork It.

    Free as in Free To Pursue Happiness - whatever that happens to be.

  25. Re: Mod Reply clueless by Anonymous Coward · · Score: 0

    You are REQUIRING the user to post their copyright notice. By itself, that is a restriction. You are imposing a new rule that doesn't exist in the GPL, which the GPL specifically prohibits.

  26. Re: Mod Reply clueless by ivoras · · Score: 1
    From the GPL (as other people have noticed also):

    1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.
    Is this different, and why?
    --
    -- Sig down