Debian DPL Threatens to Leave SPI Over Sun Java

An anonymous reader writes "A three-week-long flame war in debian-devel over the new Java Distribution License has culminated in Anthony Towns, the newly elected Debian Project Lead, offering to separate Debian from its legal representative, SPI. This came as a response to SPI member John Goerzen's objections to the Debian project's interaction with Sun's legal team around the new JDL license without review from SPI's lawyers."

Comments

Weird Coincidence!

[Anonymous Coward]

That's why my wife left me!

Re:Weird Coincidence!

[Anonymous Coward]

That's why my wife left me!

She probably left you for a well-hung guy named Ubuntu, am I right?

A lot of nerve

[stymyx]

If SPI is Debian's legal representative, it is perfectly reasonable for them to expect to be consulted about potentially problematic legal actions taken by Debian, let alone to simply be informed when such actions take place.

SPI wasn't trying to take the place of Debian's "governing body", it was simply trying to act as their legal representative.

Re:A lot of nerve

[NormalVisual]

That's what it looked like to me also. Towns is getting worked up about a perceived control issue from SPI, but if SPI is the one that is going have to foot the bill for defending Debian's actions, it's quite understandable for them to be concerned about the licensing issues brought about by including a package in a distribution.

From the thread: "...if SPI are not willing to endorse the standard methods by which Debian operates -- having the archive administrators review licenses of new packages -- and the standard methods by which Debian reviews decisions -- public discussion with the original decision makers empowered to change their minds, and overview by the technical committee and the developers as a whole by general resolution, then we need to change Debian's relationship with SPI so that is not an issue."

This sounds to me like a fairly dangerous way to operate, unless the archive admins or others in the chain are qualified attorneys, and if Debian is effectively committing SPI to questionable legal obligations without consulting with them first, then SPI would be fools for not trying to get a handle on that. Resolving things technically is one thing, but playing fast and loose with licensing is a good way to find yourself on the wrong end of a lawsuit. Towns is coming off looking like a petulant child, IMHO.

Re:A lot of nerve

[joostje]

I guess I'm not a target user of their system since I just want Java to work on my system without being strip searched and violated.

The discussion here is about including non-free software in the non-free archive. This is done on a regular basis by the Debian ftp-masters team, and each time they themselves read the lisence, judge it, and decide whether it can be allowed into the non-free archive.

So the adding of the java packages to non-free looked just like a routine job, that ftp-masters handed the way they do with all non-free software. This time they even took more precausions, and asked the sun team if inclusion in the debian non-free archive was OK. And it seems that that is when the discussions on debian-flamware started.

Re:A lot of nerve

[KiloByte]

Check out this post. If it doesn't deserve to be put in Wikipedia as an example in the "ad hominem" article, I don't know what does.

The whole flamewar is quite one-sided: there is only a few people who support Java in non-free, and the whole rest opposes them. Too bad, the proponents are the DPL and more than one FTPmaster.

The current Java license is obviously unacceptable; the FAQ is ok. Too bad, the FAQ explicitely says that it doesn't bear any legal relevance, and, even worse, the license explicitely says that it can't be overridden by things like that FAQ. Thus, I'm afraid that Anthony Towns' argument that says "the FAQ makes the license fine" doesn't stand.

Fortunately, it appears that, albeit slowly, Sun actually exhibits a sliver of good will. Let's hope they'll change the license soon.

Re:A lot of nerve

[Raphael]

The current Java license is obviously unacceptable;

Is it? The main problem seems to be the indemnification clause. But Java is not the only package in the standard archive or in non-free that has such a clause. And it appears that nobody complained about these other packages.

Here is a quote from another message from the Anthony Towns (DPL) in that thread:

From the xorg-x11 copyright file:

] 11. Indemnity. Recipient shall be solely responsible for damages arising,
] directly or indirectly, out of its utilization of rights under this License.
] Recipient will defend, indemnify and hold harmless Silicon Graphics, Inc.
] from and against any loss, liability, damages, costs or expenses (including
] the payment of reasonable attorneys fees) arising out of Recipient's use,
] modification, reproduction and distribution of the Subject Software or out of
] any representation or warranty made by Recipient.

From the openoffice.org copyright file:

] Therefore, if
] a Contributor includes the Program in a commercial product offering, such
] Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
] every other Contributor ("Indemnified Contributor") against any losses, damages
] and costs (collectively "Losses") arising from claims, lawsuits and other legal
] actions brought by a third party against the Indemnified Contributor to the
] extent caused by the acts or omissions of such Commercial Contributor in
] connection with its distribution of the Program in a commercial product
] offering.

Re:A lot of nerve

[NMerriam]

As a "legal representative" -- you serve your client. While SPI may have preferred to be in the loop sooner, they can't "expect" or "demand" it. They are supposed to assist Debian. If Debian (as a body) chooses not to seek assistance / advice -- so be it!

That's somewhat akin to saying that just because an accountant works for you, he should support your embezzlement. On the contrary, an accountant has legal responsibilities that go beyond doing whatever you say, and so does legal counsel. An attorney who didn't advise their client not to take legal advice from the opposing party would be not just a bad lawyer, but possibly personally liable, and could potentially lose their license to practice law.

As you say, if Debian chooses not to be represented by the SPI, that's their choice, but until SPI is told, they have responsibilities.

Re:A lot of nerve

[Jussi K. Kojootti]

ftp-masters handed the way they do with all non-free software.

Excuse me? I'm not Debian expert but as far as I know the normal process for new packages is to issue an ITP (intent-to-package) stating among other things the license of the package and send a copy to debian-devel -- this is all documented in the developers-reference. New licenses are typically sent to debian-legal for review.

None of that happened this time. There may be good reasons for that, but stating that this case was handed just like any other sounds like a lie to me... but, like I said I'm not an expert, please enlighten me.

Re:A lot of nerve

[dnoyeb]

Funny. I had this same argument over the eclipse license. The license makes things unclear. Which normally is not unacceptable for a legal document. Yet compared with the GPL and LGPL that make things clear, it then makes the EPL clear that things omitted are NOT included.

The argument against mine was that the FAQ clarified this, which I found laughable. Seems like Sun is not the only one trying to pull this stunt.

My main problem is that a vague license means the entity with the best lawyers has a huge advantage. So big companies like Sun or IBM couldn't care less. I don't think its a coincidence that the GPL/LGPL are much less vague given their objective and who they are intended to protect.

Re:A lot of nerve

[joostje]

Excuse me? I'm not Debian expert but as far as I know the normal process for new packages is to issue an ITP (intent-to-package) stating among other things the license of the package and send a copy to debian-devel -- this is all documented in the developers-reference. New licenses are typically sent to debian-legal for review.

You are absolutely right, for packages in main. I'm not sure about packages outside main (those in non-free). However, as you notice, none of the above includes asking SPI for permission, so even if licenses of non-free packages need to be sent to debian-legal etc, that still wouldn't have been a need to consult SPI.

It may well be that errors have been made, I just don't see how SPI can be so offended about being sidelined, when there wasn't a need to consult SPI anyway.

Re:A lot of nerve

[muellerr1]

And it seems that that is when the discussions on debian-flamware started

flamware (flâm'wâr) adj. 1. Copyrighted software that is available free of charge with the condition that users harshly criticize each other and their respective mothers.

Re:A lot of nerve

[DragonWriter]

Its fairly common for lawyers -- even ones getting paid -- to split with clients because their clients persist in not taking the lawyers' advice and doing things they were advised not to.

This isn't about reporting criminal wrongdoing at all, so that's not an issue. Its about whether a particular client and their legal representative can effectively work together, and, if the client is doing deals consulting the other sides lawyers and not their own, and can't be convinced that's not the right way to do business, well, its pretty easy to see there is a fundamental problem there.

Re:A lot of nerve

[Bob9113]

If SPI is Debian's legal representative, it is perfectly reasonable for them to expect to be consulted about potentially problematic legal actions taken by Debian, let alone to simply be informed when such actions take place.

SPI wasn't trying to take the place of Debian's "governing body", it was simply trying to act as their legal representative.

I concur - and I think the right thing to do now is to relax. Take a step back and take a deep breath. Then ask, "Does the SPI help Debian? Is SPI benefitted by it's association with Debian?" I think the answer to both questions is yes.

So the next step is to recognize that this is something that happened in the past. It's over now. Learn from it. Come up with some guidelines for how to act in the future. Talk about the roles that each partner ought to play and the authority that each partner should have.

Don't get distracted with "You should not have done this." That is accusatory. The DPL didn't do it to piss off SPI, nor because he doesn't have respect for SPI. He did it because it seemed like the right thing to do at the time. And that was a reasonable judgement call for him to make at the time and in context. How do I know that? Because he's not stupid and I sincerely doubt he's a dick.

So SPI would like to provide further explanation of, or expand, its role for Debian. OK, cool. So do that now. Figure out what the guidelines will be going forward. Learn from it and move on.

non-free is not part of debian

[joostje]

The java packages are (if at all) only included in non-free, and that isn't part of the official debian. So yes, it may be a big fight, AFAIK the cause of the fight (the java packages in non-free) is only about an extra service Debian provides to it's users, not about debian itself.

Re:non-free is not part of debian

[ThePhilips]

I have read once BlackDown.org's license. The license is flat out prohibit redistribution. End of Story.

From the mail lists, my impression (developers refused to discuss directly the contract with Sun under which they do port Java to Linux - they seem to be under NDA) was that most of the restrictions came from Sun, not from BlackDown people. Debian cannot give you BlackDown's port of Java, you have to go to BlackDown.org to get it: that's part of license.

And now it seems that Sun's JRE/JDK license has the same problem: it prohibit redistribution. Or as I have understood from the discussion, it attach conditions to redictribution, making Debian (and consequently SPI) legally liable for potential damages. Getting Sun's JDK from Debian and getting Sun's JDK from Sun are two _legally_ different things. As long as restrictions there, no way (even in non-free) such package can appear. Sun's people reacted and said they will fix the problem with license. We just need to wait couple of weeks to see what will come out of that.

P.S. Try to imaging your position as Debian Project Leader (DPL). You have responsibilities. In fact you are responsible for all decisions made during the time you are in power. Someone (behind your back) includes package with long list of restriction into the Debian. And then company whose work got included sues SPI for damages from illegal distribution of the software package. SPI would of course blame responsible - not the guy uploaded the package - but project leader, DPL. The Debian policies exist to avoid such situations - to avoid needless legal risks. You just can't ignore them, because you potentially jeopardize others.

Debian DPL

[Nighttime]

So that would be the Debian Debian Project Leader?

This post brought to you by the Department of Redundancy Department.

A flamewar on the Debian Mailing lists?

[Whiney Mac Fanboy]

Thats unpossible!

Politics

[ClamIAm]

Hmm ok I'm kind of surprised that the anti-Debian folks haven't jumped on this already. So....anyway, I guess that I'll inject my opinion anyway

Personally, I'm really glad we do have Debian. They don't shy away from politics, and I think that's a good thing. Why? Well, the Free Software/Open Source ideals are inherently political things. To shut up and just allow stuff to happen is almost completely opposite to the movements themselves.

Sure, you can claim that discussions like this hamper development. Maybe they do (although I doubt it). You can claim Debian is behind the times compared to Ubuntu or Gentoo or even Slackware depending on what you value. But these things do need to be discussed.

It might seem like a cop-out, but the following quote really stands out in my mind: "Geeks like to think that they can ignore politics; you can leave politics alone, but politics won't leave you alone.". RMS said that. I think it sums up the situation rather well.

Re:Politics

[SqyD]

"you can leave politics alone, but politics won't leave you alone." ...sounds a lot like Ralph Nader two US presedential elections ago:
"If you're not turned on by politics, politics will turn on you..."

On the other hand...

[cranesan]

One the one hand, SPI works for Debian. So they should go along with whatever Debian says. On the other hand, how can Debian expect SPI to do its job right if they are not included in legal discussions. Both sides have merit. Wow, and I haven't even read the article yet!

Re:On the other hand...

[zsau]

Whereas I have, and from what I understand ... Debian doesn't *exist*, so Software in the Public Interest doesn't work for Debian; to the extent that Debian can get sued, it's SPI that gets sued. (Of course, it could be the individual debian developers that get sued in a certain circumstance.) Anyway, Goerzen is concerned that Debian developers have put SPI into a legally vulnerable position, and is objecting to the fact that SPI was never even consulted.

OTOH, as far as Debian and the SPI are concerned, they *are* distinct, and the SPI isn't meant to get involved in the inner workings of Debian.

So perhaps both sides do have *some* merit, but the arrangement sounds pretty precarious to me, and before it all topples over I think it needs to be re-thought, either with Debian split out from SPI, or Debian developers understanding their obligations to the SPI.

So basically...

[SargeantLobes]

... the new debian project leader acepts a legal arangement with Sun, without running it by their legal consultants. And when their legal consultants complain that they would like to have been consulted. The new Debian project leader says something like if you don't like it, you an pack up your sh*t and leave.

SPI is right to be pissed. They're Debians legal representation, and if some guy makes a stupid decission, without consulting them, it'll look baad for THEM (and not Debian). The legal implications of this thing could be huge.And as the guy said, you can't trust Sun to look iut for Debians best interests.

Re:So basically...

[joostje]

the new debian project leader acepts a legal arangement with Sun

From my reading of the thread, the project leader accepted a legal argument from sun, when sun confirmed it's OK to distribute java. The project leader (or ftp-masters) then went on to add java to the non-free archive, without consulting SPI. This is BTW the same as ftp-masters does with other non-free packages (they themselves deside whether to include them in non-free or not). Usually debian doesn't really care very mutch what goes into non-free, as that isn't an official part of debian anyway.

Debian Stable

[zaguar]

Anthony Towns, the newly elected Debian Project Lead, offering to separate Debian from its legal representative, SPI.

Bet they're regretting not running stable on Andy Towns now.

java

[wjsroot]

Some people will do anything for a good cup of coffee.

A bit confused

[Umbral Blot]

Let me get this straight, the programmers behind Debian are threatening to give their legal team the boot? So it could be good, because sometimes lawyers suck, or it could be bad, because it implies Debian is about to make a huge legal mistake. Does anyone have a link to what the actual dispute is about, because the summary is lacking in details? (although it does have more than its fair share of alphabet soup: DPL, SPI, JDL)

Re:WTF?

[/ASCII]

You mean unlike the non-fundamentalist distros like Fedora, Gentoo and Ubunto who have decided thatSUNs Java is not free enough to distribute and hence won't do it at all?

Re:WTF?

[joostje]

I guess I'm not a target user of their system since I just want Java to work on my system without being strip searched and violated.

Of cource, that's the reason Debian is arguing: to ensure that *you* can use the distribution without being strip searched. The sun java licenses do have some strange clauses.

Thank God for Debian

[XanC]

First, without Debian, Ubuntu would be nothing. More importantly, as long as Debian exists, we know that we have access to an unencumbered, workable, and complete operating system / userspace. Should everything else hit the fan, we know there's still Debian.

Plus, stable's great for servers.

Debian is violating Sun's licensing is the issue.

[Anonymous Coward]

These are the problems:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70245

The US places export restrictions on certain types of software (mostly encryption related stuff), which Sun has reflected in it's license. Since Debian can't/won't control which country has access to US-based mirrors then that means that they can't fuffill the obligation to screen out illegal downloads from certain countries and such. According to this license the work around Debian has used in the past is to have non-US for exported restricted software. Which is basicly you can only have the software on non-US based mirrors.

Debian has gotten rid of non-US for Sarge due to the relaxation of export controls by the U.S. government. But it would still violate Sun's licensing.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70295

This is Sun's obnoxiousness showing with this one:
""" (c) you do not combine, configure or distribute the Software to
        run in conjunction with any additional software that implements
        the same or similar functionality or APIs as the Software;"""

The bug author mentions the Java version of Python, but basicly it would make things like a distro shipping GCJ and Sun's java would be a licensing violation.

Obviously (in My eyes) Sun chooses this for two reasons:
A. To keep it's java runtime pure and functional. Avoids bug-inducing conflicts.
B. Help kill off Free software java implimentation.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70296

In Sun's License states that you can't modify any sort of copyright notices and whatnot. But by splitting the package up like Debian does they can't avoid modifying this stuff. Thusly Debian is violating Sun's distribution license.

Debian can ship non-free stuff in non-free obviously according to their bylaws.. but Debian doesn't have the authority to break OTHER people's licenses.

Sun says that this is OK and it's legal mumbo jumbo they can ignore. Debian's lawyer are basicly saying we can't violate Sun's licenses... ESPECIALLY without a discussion and you should pull the package from non-free until Sun fixes it's licensing so that Debian can use it legally.

This has happenned before with other software. Sun's license is shit and should be avoided by any sort of sane Linux distribution.

Re:WTF?

[Antique Geekmeister]

You are a target user of the software authors, such as Sun in this case. Debian is, correctly, noticing that the licensing of Sun does not permit them to distribute software they way they normally do it, with intact and compilable source and automatic compilation as needed.

These are not small matters: supporting such packages is a security and software management problem for Debian and other distributions, who often haven't included the Java packages for exactly this reason. Fedora Core 5, for example, seems to have discarded the jdk and jre (or whatever they're called this week) that they included in older OS releases. And Sun has been doing weirdness like slapping their installable RPM inside an executable binary, then renaming the basic packages, then insisiting on jumping through licensing agreement hoops simply to download the software. It's not appropriate in Linux or other open source systems, and is a compelling reason for extensive development of genuinely open source Java software, such as the gcc/Java projects.

Sun is duplicating, badly, what Adobe attempted to do with Postscript in creating a "public" but heavily licensed standard that only they can control the standards for. It's understandable, but is helping actually sideline Sun's particular Java version in favor of more robust ones such as IBM's, and fostering the same sort of open source replacement that ghostscript became for Postscript, and with gaining popularity of the open source version to the point where Sun will want to come up with a new software to license, much as Adobe is dumping Postscript and proceeding to PDF wherever feasible.

not really

[sentientbrendan]

>Why? Well, the Free Software/Open Source ideals are inherently political things.

Nothing about using linux or writing OSS, requires me to jump on your political bandwagon.

I'm sure that open source is an ideal to you, but to most people it is not. It is software, and it is a business model to me and many others. It isn't inherently political to use it, and it's annoying when people try to drag the rest of us into their political battles.

Personally, as much as I use and love some open source software, I think that it is a good thing that developers have the freedom to release their software under whatever licensing they want, including a closed source one. I don't even think it would be a good thing if all software was open source. I think that closed source development is an important business model for many people.

Re:not really

[halfcuban]

I'm sure that open source is an ideal to you, but to most people it is not. It is software, and it is a business model to me and many others. It isn't inherently political to use it, and it's annoying when people try to drag the rest of us into their political battles.

No one's dragging you into anything. I'm tired of everytime someone states their support for the ideals of OSS and the general concept of copyleft, DRM-less, etc etc styled licensing, that everyone starts getting their panties in a bunch that someone else is dragging them into some sort of political battle. No one's holding a gun to your head and making you donate to the FSF or the Xiph Foundation.

What the parent says is true, however. The ideals are political things even if the software, in and of itself, isn't, or its potential uses (Linux can be used to host pirate movie servers just as easily as a Naval computer for missle targetting) are all over the map. The concepts Debian as a distro expounds upon are distinctly in favor of those said political ideas, and most people who choose Debian as a distro also share it.

Personally, as much as I use and love some open source software, I think that it is a good thing that developers have the freedom to release their software under whatever licensing they want, including a closed source one. I don't even think it would be a good thing if all software was open source. I think that closed source development is an important business model for many people.

The parent is not suggesting that at all, and you're setting up a straw man argument, not unlike whats his name who sued the FSF, that OSS is somehow out to artificially rig the game by forcing all software to be free/open source/or under some sort of GNU public license.

Re:not really

[ClamIAm]

Nearly any time there is a choice between different things, one's choices are political. When you buy something, you are in effect giving support to its production. The same is true for software, even if you aren't "buying" it.

Re:not really

[bfree]

You espouse the political ideals as your own yet claim that your should not be dragged in to them. The very idea that a programmer could choose to distribute Free Software is in political danger (dmca/eucd, idea patents) and non-free software is being threatened at a political level (government purchasing rules primarily). If you

think it is a good thing that developers have the freedom to release their software under whatever licensing they want

then you should consider how your vote might change the future of these "business models".

In most areas of politics there are no Free Software implications. In fact never forget that things like the Debian Free Software Guidelines make absolutely explicit that the community can never try to cut out any group of people, even terrorists. Free Software is free for all whatever your political ideals, but do not think that this means Free Software is not political, it just limits it's politics to a few key areas which are required for it's continued existence.

Re:not really

[darthwader]

Upon re-reading the post, I think I'm being sucked in by a troll. But since I've put so much effort (almost 10 minutes) into writing my reply, I'll post it anyway:

With all due respect, that's a load of crap.

Before white people and black people walked on the same land, one clan of white people killed and enslaved another group of white people in one land, and one tribe of black people killed and enslaved another tribe of black people in a different land. Race (or tribe, family, clan, gender) discrimination has existed for as long as there have been people and weapons that people could use on each other.

Before computers existed, there was copyright law, because people who made a living creating "intellectual property" had a right to control how the fruits of their mental labour were distributed, in order to ensure that they could benefit from their work.

Why should you have the right to enjoy? If I put a year's work into creating a beautiful garden, why should you automatically have the right to enjoy it? If I want to charge $10 per head admission, what's wrong with that? I deserve to be rewarded for my effort in creating the garden that you are enjoying.

Why should you have the right to inspect or study? If I spend years of my life trying to solve a problem, and during that year I manage to create a solution that nobody else has thought of, why should you get the benefit of that? Why can't I ask (or require) you to pay me to use that solution which I have worked so hard to create? And the only way I can be sure that people are fairly paying me for the use of my solution is for me to keep it secret.

Why should you have the right to share? That's got to be the silliest "right" I've heard of. If I spend a year of my time creating something, I'd like to be rewarded for that year of effort. Ideally, I'd like to be rewarded somewhere around $100,000 for that year of my life. I could try to sell one copy of my work for $100,000, but nobody wants it that much. So I want to sell 10,000 copies for $10. That way, I get rewarded, and 6000 people get to benefit from my work. Everyone's happy. But if you pay $10 for my work and then "share" it with the 9999 other people, I only get $10 for a year's work. That's good for your and your friends, but not good for me.

We live in a society where we exchange "money" for "things of value". As long as software is a "thing of value", people have a right to want to have "money" exchanged for it.

Re:not really

[swillden]

Before computers existed, there was copyright law, because people who made a living creating "intellectual property" had a right to control how the fruits of their mental labour were distributed, in order to ensure that they could benefit from their work.

Stop right here, because the rest of your post is based on this assumption, and it's wrong.

Modern copyright (I use the adjective "modern" to distinguish it from the original formulation of copyright, whose primary purpose was censorship by the British Crown) was not created because people have any implicit or explicit right to benefit financially from their intellectual creations. In fact, the reason we have copyright law today is because enlightened government leaders felt that the *public* has a right to benefit culturally and intellectually from the work of authors, painters, composers, etc.

Let me say that again: The purpose of copyright law is to benefit the public, not the copyright holder.

The reason society invests in granting and enforcing the inherently artificial monopoly that is copyright is to ensure that creations are distributed far and wide, so that they can spark other creations and enrich the public domain. Any benefits that accrue to the creator are incidental. All human intellectual creations are presumed to ultimately belong to the entire human race, which is why copyrights must expire and why the granted monopoly is full of holes (fair use, compulsory licensing, etc.).

That's the theory underlying US copyright law. The fact that the law on the books no longer reflects the theory very well is a problem we need to fix, not reinforce.

Re:Fighting ideologic wars

[drsmithy]

The upcoming Ubuntu distribution is threatening to replace Debian as the leading distribution.

Er, leading distribution of what ?

Re:Debian is violating Sun's licensing is the issu

[Umbral Blot]

They should hire you to write the summaries instead.

Re:Debian is violating Sun's licensing is the issu

[Antique Geekmeister]

Similar things happened with Pine, which has similarly restrictive licensing. But Sun doesn't even publish source, which makes it even harder to deal with legally.

Those inanities are discussed in good depth at http://www.asty.org/articles/20010702pine.html. I highly recommend it as a good discussion of how bad licensing of "free" software can actually prevent it from being "open" and deliberately hinder people who want to work with it. Sun's licensing is similarly restrictive, with that caveat that Sun doesn't develop source code for Java. Washington University at least publishes their source code, even if you're not allowed to publish modifications of it under any circumstances.

Control Freak

[Anonymous Coward]

Towns is turning this into a control issue when the Goerzen is just saying "Hey, it's not that tough to just run it buy our lawyers. Forewarned is forearmed."

I was part of a project that ended up blowing up. I was in SPI's position, just trying to keep everyone on the same page and help the person in control acheive goals. The person in control turned it into a control issue. It never was and I made every effort to make that clear. There was never any history to even suggest control issues. Finally, after much abuse, I left and so did several other people important to the project who knew what was going on. It turned out there were ideological problems, with the controller essentially wanting things one way while telling people things were to be another way in order to keep those people around.

Towns reminds me of the control freak of our own project. That was how it began - an irrational unwillingness to even hear what was being said and attributing everything as an attempt to control the project. Towns needs to step back and take a break. He needs some perspective. If there is anything he's not telling folks, he needs to come out with it. Because until that happens, anything he does is probably going to be to the detriment of Debian.

Re:Fighting ideologic wars

[ndogg]

It matters to the ideologues to set forth the definitions of Open Source. It matters to the people to called their OS Debian GNU/Linux rather than just Linux. It matters to the people who continue to call their OS Debian GNU/Linux.

Ideology may not be practical, but practicality without ideology has no direction.

Where would OpenBSD be without the likes of Theo de Raadt?
Where would open source be without the FSF?

Re:Fighting ideologic wars

[mverwijs]

I've simply got tired of all this ideologic stuff.

Folks, this is coming from a guy who wrote:
Just imagine that if every application and every game were coded cross-platform everybody just could go into any shop and buy any computer they like.

Tired of ideologic stuff indeed.

What??

[mr_tenor]

Ideologic war?

A small group of people has, it seems, in secret put Debian into a very dangerous legal position, without consulting the people who have the relevent legal expertise.

Great to see that the developers break free

[john_sd1]

Great to see that the Debian developers start to break free from the strangulation of debian-legal and their overly religious OSS zealotry. It is usually debian-legal who pretends to act "in the name of the user" whereas the opposite is true and explains in large parts the success of Ubuntu.

There are two types of OSS developers out there:

• the Linus type "have fun and cooperate" and
• the RMS type "OSS is religion"

The group of the relgious people however manages to silence the more pragmatic ones in the name of "higher ideals". But what is worse is that the concept of meritocracy fails too. Most of the people on debian-legal are no lawyers at all but amidst the blind the one eyed is king - even if color blind and short sighted.

Example from debian-legal of a discussion about postgres:

> What sort of legal advice has Debian consulted that came to a > different opinion? There is a sizable pool of people that regularly examine licenses for Debian, looking for problems. Debian does not regularly consult practicing attorneys on these issues. debian-legal

How could the situation be better exposed: "people (without any merits) looking for problems". That's what they are. All developers would reject a mailing list "debian-techadvice" where clueless people could make binding technical decisions, i.e. whether to use gcc 4.0 or 4.1.

One has to go through a notorious process to become a developer but it just needs an email client and a subscription to debian-legal in order to strangle 1500 developers. Time to change Debian back from a supermarket thing to one of the leaders of technology. Congrats Anthony!

Re:Great to see that the developers break free

[NMerriam]

How could the situation be better exposed: "people (without any merits) looking for problems". That's what they are. All developers would reject a mailing list "debian-techadvice" where clueless people could make binding technical decisions,

Yeah, inexperienced people bringing attention to potential problems! What a hoot.

Next thing you know Debian will let people report bugs in software without first completing a CS degree and providing a source diff that patches the problem! Imagine the nightmare such plebians would cause in software development...

Re:Great to see that the developers break free

[killjoe]

Yes it's very important to remember that.

1) People who disagree with you are zealots. Only zealots can possibly disagree with your obviously rational and well thought out opinions.
2) People who hold other values then you are doing it because they think it's a religion. You (and the people who agree with you 100%) are the only rational people on the planet.

Re:Great to see that the developers break free

[Kjella]

Great to see that the Debian developers start to break free from the strangulation of debian-legal and their overly religious OSS zealotry. It is usually debian-legal who pretends to act "in the name of the user" whereas the opposite is true and explains in large parts the success of Ubuntu.

The reason that Ubuntu has success on the desktop is that they're trying to be exactly what Debian is not - Debian on the desktop. Almost nothing about Debian is desktop-oriented... "unstable, testing, stable" "hmm, I want a stable desktop, what do I choose? stable?" "oh sorry that's old super-stable packages for 24/7 servers, use testing". The whole release cycle is based around a server OS, 18 months is too long for a desktop and there's no "point releases" matching a desktop. Being on testing is a rollercoaster with tons of changes right after a release, and glazier slow before a release.

Ubuntu is doing this perfectly correct for a desktop system - the releases match the Gnome releases, meaning every new version brings "the latest and greatest" and some new eyecandy. The last Debian stable doesn't even have a splash screen, as far as I can tell. You can't really claim it's a compatibility issue when it's set up to boot into X anyway. From what I've understood, the last Ubuntu as of breezy will also recognize my widescreen properly, something Debian does not (but I did it myself instead).

I mean, none of these are really big issues, but they've marketed themselves completely different. Plus a few cheap marketing stunts like changing from orange to brown default theme. Seriously, does it matter? It does get press, forum talk and of course a new round of screenshots though. I wonder what slashdot would say if the new "feature" of WMP11 was a new skin... Or something as trivial as comparing Debian's and Ubuntu's homepages, which looks most like a "for geeks" server OS with no pictures and a really square layout? (yes, this is a leading question)

Let me give you a typical language example:
Debian: "Debian GNU/Linux provides more than a pure OS: it comes with over 15490 packages, precompiled software bundled up in a nice format for easy installation on your machine."
Ubuntu: "Ubuntu is a complete Linux-based operating system, (...) Ubuntu includes more than 16,000 pieces of software,"

Most people wouldn't know what a "pure OS" is if you beat them with a stick, Ubuntu simply smooths over the details and says "whatever you understand by operating system, Ubuntu has it all". Debian spends a full sentence introducing the concept package, which it explains using words like "precompiled" where 99% of normal computer users who've never touched a compiler has fallen off already.

I could go on all day but there's no point. Ubuntu acts and communicates better in relation to desktop users than Debian does, and it's absolutely no surprise to me that Ubuntu is a success. Debian has this great potential but there nobody seems to be "trying", if you understand what I mean.

Including java without discussion was stupid

[Error27]

It's pretty obvious that discussing java's license was going to be slow and painful and so it's also obviously why people would want to short circuit the whole process. But once you think about it for 5 seconds that's a really stupid plan. People are still going to discuss it but now they're going to be more pissed off.

Also this email is stupid. Debian needs SPI and when people start suggesting otherwise that means they are taking a vacation in retardo-land.

Here's the other thing. When I heard Debian had included java into their distro, I was like, "Wow. That must be a really improved license. Debian doesn't just include any old license into the distro." But a week later, I learned that 3 debian leaders had rammed java through without any discussion and really the license was very questionable. Debian is basically going off the informal Sun FAQ when they included. Does anyone even know that the FAQ was written by a lawyer or was it written by an intern in the PR dept?

Re:Including java without discussion was stupid

[Anonymous Coward]

Well that's easy to say. From Sun's perspective though they spent more than 5 years and ridiculous amounts in legal fees trying to get an agreement that everyone was happy with. They never claimed that new the license was the end of the process, but they did say (rightly) that it was a significant step forward and that it had the support of some Linux distrots, including Debian. As someone who writes a lot of code in Java and deploys a lot of it on Linux (as well as Solaris, AIX, and even occasionally Windows), I'd be delighted if my Linux customers didn't have such a hard time installing Java since I think it holds back adoption of Linux in the datacentre.

yur a retard

[Error27]

You have to make nice to anyone doing you a favor for free, that includes lawyers.

Re:Fighting ideologic wars

[Tom]

As much as I dislike these legal discussions, I see the point. Debian is a kind of afraid of all the DRM, IP lawsuit, patent law and other bullshit and tries to stear well clear of it. Debian people realize that these things don't hit you in isolated spots - they're like dum-dum bullets, they expand inside the body.

Look at SCO or any patent claim. There's maybe 1% or less of your code that is possibly in violation of someone else's thing. And yet it threatens your entire product.

The following scenario is unlikely - but if it ever does come to pass, we will all thank whatever gods we believe in for Debian to be there and for having been as strict as they are:

Imagine MS or possibly a small group of likewise evil, selfish companies whose only way of "winning" in the marketplace is to destroy their opponents. Imagine them banding together and using a combination of software patents, DRM and DMCA lawsuits and a couple copyright disputes to drag Linux into an endless legal battle. Imagine that different from the SCO they can somehow construct a case that at least appears solid enough to a judge that Redhat and SuSE and whoever you have get slapped with a preliminary injunction. Maybe it's just 2 packages that are a problem, but the judge orders a stop to the distribution until the entire thing can be resolved. You don't think MS would have much haste in getting it resolved, would you?

This or any other scenario like it wouldn't mean the end of Linux - you'd still be able to get your copy from some FTP in Sweden or China, but it would bring Linux progress into the enterprise market to a halt.
Unless there is a Debian that can point to documentation and lawyer papers and to the fact that they always acted with so much dilligence that it is very certain none of their stuff ever got tainted.

That's the error of this argument.

[hummassa]

SPI is Debian, not the "legal representative". Debian, as a legal entity, Does Not Exist. When aj and the ftpmasters initiated distribution of the JDK, SPI was being contracted to the indemnification clause. If there is something to indemnify, SPI will have to shell out the dollars -- or sell out Debian's server farms, domain names and other assets, including copyrights and trademarks: all assets are SPI's, not Debian's.
That's the beauty of aj's bluff: hell yeah, Debian can detach itself from SPI (after some constitution change) but, oh, it cannot be called Debian anymore (the trademark belongs to SPI), nor use the twirl mark (ah-ha), huh, and it cannot use SPI's servers and other equipment either. This would amount to the separatist cabal being exiled from Debian, really.

Re:That's the error of this argument.

[Jason Earl]

I've witnessed my share of Free Software projects that fork over control issues, and it is never a pretty sight. Most projects never really recover. A fork of Debian would be especially problematic because quite a few Debian developers are the sort of license purists that would remove GFDL documentation from the distribution because it isn't free enough. So a splinter-Debian would not only have to come up with new infrastructure, a new name, new ftp sites, and all of the rest of the stuff that makes Debian GNU/Linux work, but it would also have to convince enough developers that the new splinter-Debian is the new "real" Debian.

Quite frankly, I lurk on the debian-devel and debian-legal lists and I don't think that there are enough people that care enough about including Sun's Java in non-free to make that happen. I think that it would be possible to create yet another splinter of Debian (a la Ubuntu) that borrows heavily from Debian and includes a few extra packages, but I would be very surprised if a splinter would ever become more than just another package repository that tracked stable and testing.

Re:WTF?

[kfg]

I guess I'm not a target user of their system since I just want Java to work on my system without being strip searched and violated.

Well, then you better go talk to Sun, as Java is their product under their license and if you are being strip searched and violated it is by the Sun legal team.

And, oddly enough, that's exactly the step that Debian took, although they might have been wise to allow the persons legally responsible for certain terms of the license to be the ones to do the talking.

KFG

There's a riot in the bazaar!

[linvir]

There's a riot in the bazaar!
Quick! Let's hide in the cathedral!

Re:Debian is violating Sun's licensing is the issu

[Tim C]

But Sun doesn't even publish source

That's FUD, pure and simple - the source is available for download right on the same page as the rest of the JDK download links. You have to agree to one of two licences and have a (free) Sun Download Center account to get it, but it *is* available.

Well that explains that.

[mpcooke3]

I had wondered how debian could possibly agree to include that software in non-free with those license conditions.

see: http://linux.slashdot.org/comments.pl?sid=186539&c id=15398000

I guess they "forgot" to check with the lawyers...

Not nerve, naivite

[hey!]

I think the other point of view is that Debian isn't a legal entity, it's just a bunch of cooperating people, and SPI exists to handle some formalities like owning servers and whatnot.

There seems to be an assumption that being amorphous, legally speaking, is some kind of shield. It's not. It's an invitation to drop the shit-bomb and cover everybody in sight. The way this works is that when the legal successors to Sun in owneship of Java (see below) have a legal hissy fit, their lawyers sue everybody in sight. The the judge dismisses the suits against every tom dick and harry and makes them go after the legal entity, unless somebody has made a very bad mistake. That's why corporations exist. They're the equivalent of legal fortesses for the individuals in an enterprise.

What should happen then is if SPI wins, great, if it loses, the individuals can continue on under a new corporation because of the open source licenses. The problem is that this is very close to legal chicanery. You're not supposed to protect yourself with legal fictions. Thus for the protection to work, people have to cooperate -- which sometimes means not doing what they want right away. If they don't then they expose everybody directly involved with the project, and everybody transitively involved for good measure. That's what lawyers do when they're looking to make money for their clients: they throw shit on everything and see what is allowed to stick. Even if it doesn't stick, it's an unpleasant experience.

Success in any enterprise depends on predicting the future, which is a dicey proposition at best. The main reason you need to consult lawyers is to avoid what other people's lawyers will do to you if your prediction turns out false.

In this case, take Sun. They are not doing so well as a business for the last several years. They're losing money. Let's hope they'll turn it around. But one thing that happens if this keeps going is that the stockholders decide they'd better cash out; the large stockholders can't do this because they own too much. So they start looking at selling the whole company, or liquidating its assets to turn them into cash. Java is currently the property of Sun. Next year it could be the legal property of another company, and one thing that company buys is the right to sue over uses of that property.

Now imagine a company that has a lot of cash that would have a strategic interest in gaining a hold over Java licensees. It's not hard. Imagine what they could do with their power to sue licensees and copyright infringers, not just for the immediate cash value but for the strategic value. Are they going to be reaonable and just go after the ftp maintainers?

I've been through this kind of thing before. Without consulting me, my business associate, who had a majority interest, entered into a casual legal relationship with an outside party. The arrangment seems reasonable and we're all reasonable likable folks. Then the outside party got into some trouble of his own not related to us at all. Suddenly he becomes less reasonable and likable. Next thing his lawyers were suing everybody in sight. We are getting hit with lawsuits from people we have no relationship with, who are really going after him, but since their lawyer's already working on the case the marginal cost of a second third and fourth lawsuit is nil. At that point I was very glad to have a corporation between me and them to take the liability.

Re:Not nerve, naivite

[myowntrueself]

You're not supposed to protect yourself with legal fictions.

Like the notion of 'intellectual property' for example...

Re:WTF?

[Cal Paterson]

Gentoo doesn't actually distribute Sun Java. It's not hosted on any of the servers. The users must download and place the files themselves.

Just because an ebuild is in the tree, doesn't mean that Gentoo distribute it. Gentoo simply allows the user to use it, much like any other distribution.

As soon as GLEP 23 gets put into place, this kind of confusion will disappear.

It feels that DD and Debian-legal is out of sync

[Pecisk]

Let's be honest - most developers don't give a white sh@$#%t about what clauses and doubtful legal situations can arise of use of software, so Debian-legal thoughts are usually have been taken with lot of anger and confusion. Devs just want to work with software and apps, but D-L is full of idealists and clever individuals in legal field, who see things quite differently (and it is NOTHING bad about that), and so conflict is in full force.

But in this case, I *think* it is totally overblown and feels like that Debian-legal just want to say big f12#$%k off to Java usage in Debian - non-legal arguments like "I don't use non-free", "there are ALMOST working free software implementation in main", etc says almost everything about discusssion - it is not about LEGAL situation, but about fears that if Java will be aviable in non-free and will be supported by DD, CLASSPATH and other Java projects will slowly loose momentum they achieved so far now (Again, it is just my thougts after reading almost half of thread).

I can understand both sides, but thinking "We will get free implementation, we don't need stinkin Sun official implementation" sounds like too much dreaming. Let's be honest - it is simply not possible. Oracle won't use CLASSPATH, they will insist to use JRE. Other software will too. Yes, there will be desktop apps which will run on Free Software versions just fine - like Eclipse, lot of different small aps, but for enterprise it will be big NO-NO.

Re:It feels that DD and Debian-legal is out of syn

[Svartalf]

Here's a hint:

      A lawyer should be consulted on a license- NOT a developer. It's a legal matter, not a coding matter.

There's a legal gotcha on the Java license that SPI, being the legal interface for the Debian
project, that if things go wrong, they'd have to absorb and deal with. Without SPI, each of
the devs involved with the project would be held individually liable for potentially millions
of dollars each (And that is exactly what is possible with the new licensing from Sun on Java).

Do you now see WHY devs shouldn't be the final call on a license?

Your attorney does not control you.

[Distan]

Maybe (probably) I'm missing some subtlety specific to Debian/SPI, but when I compare this situation to what I encounter in my professional life, it appears that SPI is in the wrong.

I work for a corporation. In my position, I frequently negotiate deals with software vendors, and this includes negotiating the contract terms. I am not a lawyer, however, so I work with our corporate attorneys in negotiating these contracts. They are responsible for understanding and explaining the legal ramifications of the contract terms, and I am responsible for understanding and explaining the business objectives of why we are trying to license the software.

Indemnification in particular is often a sticky subject in these negotiations. We usually get the indemnification clause that makes our lawyers happy, but in rare cases we do not.

In the end, however, it is notthe lawyer's job to decide whether or not we accept the terms of any contract. It is their job to advise me (and my managers) what risk we are taking with any given contract. It is then up to management to decide of that risk outweighs the business benefits we are trying to seek.

If somehow the Debian developers have gotten themselves in the position of needing permission from their attorney to sign a contract, then something has gotten seriously screwed up in their relationship. That would be like the CEO of McDonalds needing permission from some random fry cook to enter into a legal agreement. The attorney is to be an advisor, not a decision maker.

Re:Your attorney does not control you.

[James McP]

Debian is a *project* not an entity or person. Projects cannot be held legally accountable or own things.

SPI is not a legal firm full of lawyers. SPI is a corporation that provides the legal entity that can own property & purchase services for the Debian developers. SPI is the entity that OWNS the name "Debian", the servers the files are hosted on, and that contracts the attorneys that protect Debian developers. (Without knowing the twisty history, I wouldn't be surprised if Debian wasn't the project that caused SPI to be created.)

In human terms, SPI is Debian's legal guardian. SPI is legally responsible for Debian's debts, obligations, and will be the one against the wall if Debian does something bad. However Debian admins can agree to legal terms and contracts which put SPI on the spot.

I quote one of the posts: SPI projects shouldn't be taking advice from Sun's attorneys. We should be taking advice from SPI's attorneys.

In other words: "don't take legal advice from the attorneys who may be suing you tomorrow, especially when those attorneys may be suing you, me, and two dozen other people in the process."

Darn good advice.

Re:WTF?

[metamatic]

And the irony is, by forcing the open source community to develop GCJ-based Java solutions, they're destroying the supposed raison d'etre of Java, to be able to take the same binary and run it anywhere.

Goerzen shares the blame

[alienmole]

Regardless of whether he's right, Goerzen made it a control issue when he wrote:

> I am becoming increasingly concerned at the unilateral method in which
> you and/or the archive maintainers have taken this decision.
>
> The ability to enter into a legal contract to indemnify a third party
> should be, and arguably IS, reserved solely for the SPI Board of
> Directors.

It seems that part of the problem, at least, is that Towns may not fully understand the nature of the Debian/SPI relationship. Goerzen could have been much more diplomatic about it, but the way he put it, he highlights the control issue in an extreme way, i.e. essentially saying "you have no authority to do what you're doing". Regardless of whether that's true, Goerzen could be more diplomatic about it. In fact, he has an obligation to be more diplomatic about it, as President and Chairman of SPI, in the interests of serving the organizations which SPI exists to serve.

Re:My favorite redundancy

[jdgeorge]

NT itself stood for "Net Technology"

I think you are a bit confused. At the time NT was release, most people didn't really know what a network was. My recollection was that NT stood for "New Technology". There are various other explanations for the NT designation, of course, some of which do not result in the redundant "technology"; see this article in Wikipedia for details.

Re:Relationship between Debian and SPI?

[Arker]

Debian is a distributed community project with no real existence in a legal sense.

SPI (Software in the Public Interest) is a non-profit organisation created to handle things for Debian that require a legal existence. Like, for instance, having legal staff available.