Debian DPL Threatens to Leave SPI Over Sun Java

An anonymous reader writes "A three-week-long flame war in debian-devel over the new Java Distribution License has culminated in Anthony Towns, the newly elected Debian Project Lead, offering to separate Debian from its legal representative, SPI. This came as a response to SPI member John Goerzen's objections to the Debian project's interaction with Sun's legal team around the new JDL license without review from SPI's lawyers."

Comments

Weird Coincidence!

[Anonymous Coward]

That's why my wife left me!

Re:Weird Coincidence!

[Anonymous Coward]

That's why my wife left me!

She probably left you for a well-hung guy named Ubuntu, am I right?

A lot of nerve

[stymyx]

If SPI is Debian's legal representative, it is perfectly reasonable for them to expect to be consulted about potentially problematic legal actions taken by Debian, let alone to simply be informed when such actions take place.

SPI wasn't trying to take the place of Debian's "governing body", it was simply trying to act as their legal representative.

Re:A lot of nerve

[NormalVisual]

That's what it looked like to me also. Towns is getting worked up about a perceived control issue from SPI, but if SPI is the one that is going have to foot the bill for defending Debian's actions, it's quite understandable for them to be concerned about the licensing issues brought about by including a package in a distribution.

From the thread: "...if SPI are not willing to endorse the standard methods by which Debian operates -- having the archive administrators review licenses of new packages -- and the standard methods by which Debian reviews decisions -- public discussion with the original decision makers empowered to change their minds, and overview by the technical committee and the developers as a whole by general resolution, then we need to change Debian's relationship with SPI so that is not an issue."

This sounds to me like a fairly dangerous way to operate, unless the archive admins or others in the chain are qualified attorneys, and if Debian is effectively committing SPI to questionable legal obligations without consulting with them first, then SPI would be fools for not trying to get a handle on that. Resolving things technically is one thing, but playing fast and loose with licensing is a good way to find yourself on the wrong end of a lawsuit. Towns is coming off looking like a petulant child, IMHO.

Re:A lot of nerve

[joostje]

I guess I'm not a target user of their system since I just want Java to work on my system without being strip searched and violated.

The discussion here is about including non-free software in the non-free archive. This is done on a regular basis by the Debian ftp-masters team, and each time they themselves read the lisence, judge it, and decide whether it can be allowed into the non-free archive.

So the adding of the java packages to non-free looked just like a routine job, that ftp-masters handed the way they do with all non-free software. This time they even took more precausions, and asked the sun team if inclusion in the debian non-free archive was OK. And it seems that that is when the discussions on debian-flamware started.

Re:A lot of nerve

[Raphael]

The current Java license is obviously unacceptable;

Is it? The main problem seems to be the indemnification clause. But Java is not the only package in the standard archive or in non-free that has such a clause. And it appears that nobody complained about these other packages.

Here is a quote from another message from the Anthony Towns (DPL) in that thread:

From the xorg-x11 copyright file:

] 11. Indemnity. Recipient shall be solely responsible for damages arising,
] directly or indirectly, out of its utilization of rights under this License.
] Recipient will defend, indemnify and hold harmless Silicon Graphics, Inc.
] from and against any loss, liability, damages, costs or expenses (including
] the payment of reasonable attorneys fees) arising out of Recipient's use,
] modification, reproduction and distribution of the Subject Software or out of
] any representation or warranty made by Recipient.

From the openoffice.org copyright file:

] Therefore, if
] a Contributor includes the Program in a commercial product offering, such
] Contributor ("Commercial Contributor") hereby agrees to defend and indemnify
] every other Contributor ("Indemnified Contributor") against any losses, damages
] and costs (collectively "Losses") arising from claims, lawsuits and other legal
] actions brought by a third party against the Indemnified Contributor to the
] extent caused by the acts or omissions of such Commercial Contributor in
] connection with its distribution of the Program in a commercial product
] offering.

Re:A lot of nerve

[Jussi K. Kojootti]

ftp-masters handed the way they do with all non-free software.

Excuse me? I'm not Debian expert but as far as I know the normal process for new packages is to issue an ITP (intent-to-package) stating among other things the license of the package and send a copy to debian-devel -- this is all documented in the developers-reference. New licenses are typically sent to debian-legal for review.

None of that happened this time. There may be good reasons for that, but stating that this case was handed just like any other sounds like a lie to me... but, like I said I'm not an expert, please enlighten me.

Re:A lot of nerve

[joostje]

Excuse me? I'm not Debian expert but as far as I know the normal process for new packages is to issue an ITP (intent-to-package) stating among other things the license of the package and send a copy to debian-devel -- this is all documented in the developers-reference. New licenses are typically sent to debian-legal for review.

You are absolutely right, for packages in main. I'm not sure about packages outside main (those in non-free). However, as you notice, none of the above includes asking SPI for permission, so even if licenses of non-free packages need to be sent to debian-legal etc, that still wouldn't have been a need to consult SPI.

It may well be that errors have been made, I just don't see how SPI can be so offended about being sidelined, when there wasn't a need to consult SPI anyway.

Re:A lot of nerve

[muellerr1]

And it seems that that is when the discussions on debian-flamware started

flamware (flâm'wâr) adj. 1. Copyrighted software that is available free of charge with the condition that users harshly criticize each other and their respective mothers.

Debian DPL

[Nighttime]

So that would be the Debian Debian Project Leader?

This post brought to you by the Department of Redundancy Department.

Politics

[ClamIAm]

Hmm ok I'm kind of surprised that the anti-Debian folks haven't jumped on this already. So....anyway, I guess that I'll inject my opinion anyway

Personally, I'm really glad we do have Debian. They don't shy away from politics, and I think that's a good thing. Why? Well, the Free Software/Open Source ideals are inherently political things. To shut up and just allow stuff to happen is almost completely opposite to the movements themselves.

Sure, you can claim that discussions like this hamper development. Maybe they do (although I doubt it). You can claim Debian is behind the times compared to Ubuntu or Gentoo or even Slackware depending on what you value. But these things do need to be discussed.

It might seem like a cop-out, but the following quote really stands out in my mind: "Geeks like to think that they can ignore politics; you can leave politics alone, but politics won't leave you alone.". RMS said that. I think it sums up the situation rather well.

Debian Stable

[zaguar]

Anthony Towns, the newly elected Debian Project Lead, offering to separate Debian from its legal representative, SPI.

Bet they're regretting not running stable on Andy Towns now.

Thank God for Debian

[XanC]

First, without Debian, Ubuntu would be nothing. More importantly, as long as Debian exists, we know that we have access to an unencumbered, workable, and complete operating system / userspace. Should everything else hit the fan, we know there's still Debian.

Plus, stable's great for servers.

Debian is violating Sun's licensing is the issue.

[Anonymous Coward]

These are the problems:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70245

The US places export restrictions on certain types of software (mostly encryption related stuff), which Sun has reflected in it's license. Since Debian can't/won't control which country has access to US-based mirrors then that means that they can't fuffill the obligation to screen out illegal downloads from certain countries and such. According to this license the work around Debian has used in the past is to have non-US for exported restricted software. Which is basicly you can only have the software on non-US based mirrors.

Debian has gotten rid of non-US for Sarge due to the relaxation of export controls by the U.S. government. But it would still violate Sun's licensing.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70295

This is Sun's obnoxiousness showing with this one:
""" (c) you do not combine, configure or distribute the Software to
        run in conjunction with any additional software that implements
        the same or similar functionality or APIs as the Software;"""

The bug author mentions the Java version of Python, but basicly it would make things like a distro shipping GCJ and Sun's java would be a licensing violation.

Obviously (in My eyes) Sun chooses this for two reasons:
A. To keep it's java runtime pure and functional. Avoids bug-inducing conflicts.
B. Help kill off Free software java implimentation.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 70296

In Sun's License states that you can't modify any sort of copyright notices and whatnot. But by splitting the package up like Debian does they can't avoid modifying this stuff. Thusly Debian is violating Sun's distribution license.

Debian can ship non-free stuff in non-free obviously according to their bylaws.. but Debian doesn't have the authority to break OTHER people's licenses.

Sun says that this is OK and it's legal mumbo jumbo they can ignore. Debian's lawyer are basicly saying we can't violate Sun's licenses... ESPECIALLY without a discussion and you should pull the package from non-free until Sun fixes it's licensing so that Debian can use it legally.

This has happenned before with other software. Sun's license is shit and should be avoided by any sort of sane Linux distribution.

Re:Debian is violating Sun's licensing is the issu

[Umbral Blot]

They should hire you to write the summaries instead.

Re:So basically...

[joostje]

the new debian project leader acepts a legal arangement with Sun

From my reading of the thread, the project leader accepted a legal argument from sun, when sun confirmed it's OK to distribute java. The project leader (or ftp-masters) then went on to add java to the non-free archive, without consulting SPI. This is BTW the same as ftp-masters does with other non-free packages (they themselves deside whether to include them in non-free or not). Usually debian doesn't really care very mutch what goes into non-free, as that isn't an official part of debian anyway.

Control Freak

[Anonymous Coward]

Towns is turning this into a control issue when the Goerzen is just saying "Hey, it's not that tough to just run it buy our lawyers. Forewarned is forearmed."

I was part of a project that ended up blowing up. I was in SPI's position, just trying to keep everyone on the same page and help the person in control acheive goals. The person in control turned it into a control issue. It never was and I made every effort to make that clear. There was never any history to even suggest control issues. Finally, after much abuse, I left and so did several other people important to the project who knew what was going on. It turned out there were ideological problems, with the controller essentially wanting things one way while telling people things were to be another way in order to keep those people around.

Towns reminds me of the control freak of our own project. That was how it began - an irrational unwillingness to even hear what was being said and attributing everything as an attempt to control the project. Towns needs to step back and take a break. He needs some perspective. If there is anything he's not telling folks, he needs to come out with it. Because until that happens, anything he does is probably going to be to the detriment of Debian.

yur a retard

[Error27]

You have to make nice to anyone doing you a favor for free, that includes lawyers.

That's the error of this argument.

[hummassa]

SPI is Debian, not the "legal representative". Debian, as a legal entity, Does Not Exist. When aj and the ftpmasters initiated distribution of the JDK, SPI was being contracted to the indemnification clause. If there is something to indemnify, SPI will have to shell out the dollars -- or sell out Debian's server farms, domain names and other assets, including copyrights and trademarks: all assets are SPI's, not Debian's.
That's the beauty of aj's bluff: hell yeah, Debian can detach itself from SPI (after some constitution change) but, oh, it cannot be called Debian anymore (the trademark belongs to SPI), nor use the twirl mark (ah-ha), huh, and it cannot use SPI's servers and other equipment either. This would amount to the separatist cabal being exiled from Debian, really.

Re:Great to see that the developers break free

[killjoe]

Yes it's very important to remember that.

1) People who disagree with you are zealots. Only zealots can possibly disagree with your obviously rational and well thought out opinions.
2) People who hold other values then you are doing it because they think it's a religion. You (and the people who agree with you 100%) are the only rational people on the planet.

There's a riot in the bazaar!

[linvir]

There's a riot in the bazaar!
Quick! Let's hide in the cathedral!

Not nerve, naivite

[hey!]

I think the other point of view is that Debian isn't a legal entity, it's just a bunch of cooperating people, and SPI exists to handle some formalities like owning servers and whatnot.

There seems to be an assumption that being amorphous, legally speaking, is some kind of shield. It's not. It's an invitation to drop the shit-bomb and cover everybody in sight. The way this works is that when the legal successors to Sun in owneship of Java (see below) have a legal hissy fit, their lawyers sue everybody in sight. The the judge dismisses the suits against every tom dick and harry and makes them go after the legal entity, unless somebody has made a very bad mistake. That's why corporations exist. They're the equivalent of legal fortesses for the individuals in an enterprise.

What should happen then is if SPI wins, great, if it loses, the individuals can continue on under a new corporation because of the open source licenses. The problem is that this is very close to legal chicanery. You're not supposed to protect yourself with legal fictions. Thus for the protection to work, people have to cooperate -- which sometimes means not doing what they want right away. If they don't then they expose everybody directly involved with the project, and everybody transitively involved for good measure. That's what lawyers do when they're looking to make money for their clients: they throw shit on everything and see what is allowed to stick. Even if it doesn't stick, it's an unpleasant experience.

Success in any enterprise depends on predicting the future, which is a dicey proposition at best. The main reason you need to consult lawyers is to avoid what other people's lawyers will do to you if your prediction turns out false.

In this case, take Sun. They are not doing so well as a business for the last several years. They're losing money. Let's hope they'll turn it around. But one thing that happens if this keeps going is that the stockholders decide they'd better cash out; the large stockholders can't do this because they own too much. So they start looking at selling the whole company, or liquidating its assets to turn them into cash. Java is currently the property of Sun. Next year it could be the legal property of another company, and one thing that company buys is the right to sue over uses of that property.

Now imagine a company that has a lot of cash that would have a strategic interest in gaining a hold over Java licensees. It's not hard. Imagine what they could do with their power to sue licensees and copyright infringers, not just for the immediate cash value but for the strategic value. Are they going to be reaonable and just go after the ftp maintainers?

I've been through this kind of thing before. Without consulting me, my business associate, who had a majority interest, entered into a casual legal relationship with an outside party. The arrangment seems reasonable and we're all reasonable likable folks. Then the outside party got into some trouble of his own not related to us at all. Suddenly he becomes less reasonable and likable. Next thing his lawyers were suing everybody in sight. We are getting hit with lawsuits from people we have no relationship with, who are really going after him, but since their lawyer's already working on the case the marginal cost of a second third and fourth lawsuit is nil. At that point I was very glad to have a corporation between me and them to take the liability.

Re:It feels that DD and Debian-legal is out of syn

[Svartalf]

Here's a hint:

      A lawyer should be consulted on a license- NOT a developer. It's a legal matter, not a coding matter.

There's a legal gotcha on the Java license that SPI, being the legal interface for the Debian
project, that if things go wrong, they'd have to absorb and deal with. Without SPI, each of
the devs involved with the project would be held individually liable for potentially millions
of dollars each (And that is exactly what is possible with the new licensing from Sun on Java).

Do you now see WHY devs shouldn't be the final call on a license?

Re:Your attorney does not control you.

[James McP]

Debian is a *project* not an entity or person. Projects cannot be held legally accountable or own things.

SPI is not a legal firm full of lawyers. SPI is a corporation that provides the legal entity that can own property & purchase services for the Debian developers. SPI is the entity that OWNS the name "Debian", the servers the files are hosted on, and that contracts the attorneys that protect Debian developers. (Without knowing the twisty history, I wouldn't be surprised if Debian wasn't the project that caused SPI to be created.)

In human terms, SPI is Debian's legal guardian. SPI is legally responsible for Debian's debts, obligations, and will be the one against the wall if Debian does something bad. However Debian admins can agree to legal terms and contracts which put SPI on the spot.

I quote one of the posts: SPI projects shouldn't be taking advice from Sun's attorneys. We should be taking advice from SPI's attorneys.

In other words: "don't take legal advice from the attorneys who may be suing you tomorrow, especially when those attorneys may be suing you, me, and two dozen other people in the process."

Darn good advice.

Goerzen shares the blame

[alienmole]

Regardless of whether he's right, Goerzen made it a control issue when he wrote:

> I am becoming increasingly concerned at the unilateral method in which
> you and/or the archive maintainers have taken this decision.
>
> The ability to enter into a legal contract to indemnify a third party
> should be, and arguably IS, reserved solely for the SPI Board of
> Directors.

It seems that part of the problem, at least, is that Towns may not fully understand the nature of the Debian/SPI relationship. Goerzen could have been much more diplomatic about it, but the way he put it, he highlights the control issue in an extreme way, i.e. essentially saying "you have no authority to do what you're doing". Regardless of whether that's true, Goerzen could be more diplomatic about it. In fact, he has an obligation to be more diplomatic about it, as President and Chairman of SPI, in the interests of serving the organizations which SPI exists to serve.