The FSF, GPLv3 and DRM

whats-life-without-gpl writes "FSF has a thing against DRM. This article tries to explain why RMS isn't a DRM (Note that NewsForge is also owned by OSTG) fan and how GPLv3 is gearing up to protect against it. "

Comments

Of course RMS is not a DRM!

[Abreu]

One is a person, the other an ill conceived business plan...

Re:Of course RMS is not a DRM!

[vertinox]

And again, RMS is not something you just dump DRM on. It's not an ill conceived business plan...

It's a series of tubes. ;)

Re:Of course RMS is not a DRM!

[Chris Pimlott]

The summary actually says he's not a "DRM fan" but it's interrupted by the awkwardly placed "potential bias" disclaimer. Editors, you can just put that at the end of the summary, no need to jam it in the middle of a sentence where it destroys the flow.

Re:Of course RMS is not a DRM!

[Abreu]

I did see that, btw, I was trying to make a joke, in the best Slashdot tradition of first posts... BTW, this is my first first post, yay!

Re:Of course RMS is not a DRM!

[bohemian72]

You left off a couple airports:

RMS: Ramstein, Germany
DRM: Drama, Greece

Re:Of course RMS is not a DRM!

[quantum bit]

And slashdot isn't a grammar.

Re:Of course RMS is not a DRM!

[maxwell demon]

No, RMS is just a mathematical operation (root mean square).

Re:Of course RMS is not a DRM!

[jfclavette]

Informative ? Oh well, Slashdot is a strange place.

Re:Of course RMS is not a DRM!

[WilliamSChips]

There's really a place in Germany called Rammstein?

Re:Of course RMS is not a DRM!

[jeroendekkers]

Are you sure? According to Microsoft, RMS is a DRM system.

Re:Of course RMS is not a DRM!

[bohemian72]

I originally got it from a website about airport codes but since you've made me look it up (i.e. google it) I see it's a U.S. airforce base/community in Germany.

Ramstein

Re:Of course RMS is not a DRM!

[DittoBox]

I wish another stupid politcian would come up with another retarded description for something technical so all these no-so-funny anymore tubes jokes would rot in the bowels of internets history.

Oh look, another joke that wasn't funny.

Re:Of course RMS is not a DRM!

[ncc74656]

There's really a place in Germany called Rammstein?

The band took its name from Ramstein AB, which is one of our larger overseas bases. There are (or were) more Americans in the Kaiserslautern area than anywhere else outside the United States...when I was in high school there (go Raiders!) in the late '80s, there were maybe 50000 or so of us over there. There was a nasty crash at the Flugtag (the base's annual air show) in 1988 that the band's pyromaniac members thought provided some spiffy visuals...an Italian jet dropped out of the sky after a mid-air collision and plowed into the crowd. 70 were killed and another 347 were badly injured.

Re:Of course RMS is not a DRM!

[LittleBigLui]

Even more surprising, there's actually a city called Chicago, too (albeit not in Germany).

Re:Of course RMS is not a DRM!

[Anonymous Coward]

Editors, you can just put that at the end of the summary, no need to jam it in the middle of a sentence where it destroys the flow.

For future reference, don't bother making suggestions. They've made it perfectly clear that not only do they not want to fix their atrocious English skills they actually think it's a good thing. Apparently, they think it "adds to the charm" of Slashdot.

The problem with signing

[Anonymous Coward]

Linus Torvalds, has a problem with this. He says that he himself signs the Linux kernel, and that that's his way of telling everyone, "You can trust this, it's from me." In an email message to the Linux Kernel Mailing List (LKML) on 23 April, he says that there are two types of keys: "One is an external key that is applied _to_ the kernel (OK, and outside the license), and the other one is embedding a key _into_ the kernel."

GPLv3 says that if any GPLed software carries an embedded key, this key should me made available to the users, but it makes no demands on the first kind of key. Linus has said that he would never distribute his signing keys, but the GPLv3 does not require him to release them. The key he talks about only describe the trustworthiness of the kernel. It in no way affects the freedoms of copyleft. It's only the embedded keys, which can be used to nullify the freedoms offered by copyleft, that need to be released.

Re:The problem with signing

[Anonymous Coward]

Why can't this argument be made about the key that Tivo uses for their system?

No one else can create a "Linus signed" Linux kernel -- that's the entire point. Tivo is doing the exact same thing.

The detail is that the Tivo hardware enforces the authenticity of Tivo's signing key, whereas it's up to the user to enforce the Linus key.

But the effect is the same.

If a company, for example, edicts as policy that they won't accept any kernel save that signed by Linus, then that pretty much leaves everyone else out of the picture for Linux kernels, doesn't it? GPL or no, that company can't get a kernel from anyone else.

I see no difference between Linus' key and Tivo. The former is much more loosely enforced, but that's not the topic at hand. There's nothing stopping you from running Tivo's software on some other compatible hardware platform that does not enforce their key, just like there's nothing stopping folks from running kernels that are not signed by Linus.

Re:The problem with signing

[ichin4]

It's not quite so simple. Suppose a manufacturer were to build a computer that would only run an OS signed with Linus's key. That turns his "signing key" into an "embedded key". The problem here is that there is no fundamental distinction between the two kinds of keys; it's just a question of how they are used.

Re:The problem with signing

[AuMatar]

Its not the same at all. I buy Tivo hardware. I have the right to use it as I wish, since I own the hardware. A hardware mechanism that stops it from booting if unsigned prevents me from utilizing my rights as an owner. If the code Tivo uses is GPLed I'm being denied my rights twice- not only my rights as a hardware owner, but my rights under the GPL.

Linux signing the key is different because its unenforced. Its a way of recognizing that Linux blesses this version of the kernel, but it doesn't stop you from running any other version of the kernel.

Re:The problem with signing

[Anonymous Coward]

If a company, for example, edicts as policy that they won't accept any kernel save that signed by Linus, then that pretty much leaves everyone else out of the picture for Linux kernels, doesn't it? GPL or no, that company can't get a kernel from anyone else.

If the company makes that decision for their own computers then that's fine. Just like I can make that decision for my computer.

The problem arises when someone wants to sell to others a device running GPLd code and prevent those other people from being able to modify the code.

The two situations aren't at all the same. It's silly to pretend that they are.

Re:The problem with signing

[Qzukk]

That turns his "signing key" into an "embedded key".

But it's not an embedded key of the software, it's an embedded key of the hardware. Modified software will run just fine... on any other equipment.

Now, the real question is whether this kind of "entanglement" would require the hardware to be GPL'd itself, including that key, just like linking to a GPL program or library would require the software to be GPL'd.

Re:The problem with signing

[mrchaotica]

The detail is that the Tivo hardware enforces the authenticity of Tivo's signing key, whereas it's up to the user to enforce the Linus key.

But the effect is the same.

If a company, for example, edicts as policy that they won't accept any kernel save that signed by Linus, then that pretty much leaves everyone else out of the picture for Linux kernels, doesn't it? GPL or no, that company can't get a kernel from anyone else.

The difference is that the same entity is both the one releasing the code and enforcing the key. Linus doesn't have to release his key because he is not requiring it to run the code on anything (therefore, he isn't violating the license). Some company can create hardware that will only accept kernels signed with some particular key only if it doesn't actually distribute a modified and signed kernel itself (because it wouldn't be bound by the license in the first place).

This does bring up a flaw in the idea, though: what stops a company like TiVo from creating "unrelated" shell organizations so as to separate the kernel development and hardware development in order to get around this?

(note: I used the kernel merely as an example; there's no need to inform me about issues related to the lack of the "or any later version" clause)

Re:The problem with signing

[sumdumass]

so, suppose Tivo leases the hardware instead of letting you buy it. Then everything would be ok right?

You rights under the gpl require them to let you have the source code for GPLed software they distribute and possibly change it if that is your wish. Nothing in the GPL makes a claim that you are entitled to run that code on any specific hardware, is there? Not any provision that i know of.

Having hardware and not being able to run whatever you want on it is a different story. If you want to do something the manufacturer didn't intend, then you are going to have to work around the limitations of the hardware. This includes limitations purposly implanted by the manufactuer. But, unless the hardware is GPLed, I don't see anything in the GPL guarenteeing this ability.

This is a key example of why manufacturers don't want to provide GPLed drivers. It will be construed before the day is out that there is some fundelmental rights here and assure microsofts possition on the GPL being viral. Stop and really think about it from an angle outside the everything should be free attitude and look for the real issue.

Re:The problem with signing

[Anonymous Coward]

If hardware is released that requires a Linus signed kernel, then does that compel Linus to release his key?

That's the problem here -- if the GPL can affect this at all, it can only really affect the actual signing of the code, not how it is enforced, and that's the concern Linus has as well.

Re:The problem with signing

[Hope Thelps]

so, suppose Tivo leases the hardware instead of letting you buy it. Then everything would be ok right?

Possibly, it would really depend on how the court interprets distribution. However, don't imagine that judges are drooling imbeciles that will fall for a sale dressed up as a lease. They have a lot of experience in this area and generally recognise a sale when they see one.

Re:The problem with signing

[Great_Geek]

It seems to me this loophole is already closed by (all of) the drafts of GPLv3. It does not matter which key owned by whom, the KEY TEST (sorry, can't resist) is whether a modified version will run. If TivoV3 uses Linus' signature as DRM, then TivoV3 must give the user a way to sign using Linus' key; which means TivoV3 would be stuck.

The second draft is very explicit and well thought-out; the question is whether you agree with the intent. On the one side, RMS (and an all-star cast) with a strong philosophical position supported by well thought-out arguments. On the other hand, Linus with some spur of the moment comments opposing RMS (at least I hope Linus' comments are spur of the moment because his position is not well articulated).

Re:The problem with signing

[MadEE]

Where the heck do you get the idea that it's your right for manufacturers to facilitate your desire to modify firmware or embedded software?

Re:The problem with signing

[Hope Thelps]

Stop and really think about it from an angle outside the everything should be free attitude and look for the real issue.

The sensible angle to look at it from is "what am I trying to achieve in licensing my software?"

If you want users of your software to receive the right to modify it then these terms are likely to suit your aims.

If you want manufacturers to be able to limit the ability of recipients to modify your code then the GPL is probably not a good license for you, and never was.

Re:The problem with signing

[DShard]

Even if they lease the hardware to you, they still are distributing licensed software for your use. They can't change the GPL with another licenses agreement. Anyone implementing this scheme is getting away with it do to lack of attention from users. So that ISP who has a DSL modem running linux who isn't offering you the source code is breaking contract law with their vendors, namely the copyright holders.

It doesn't matter what manufactures want. They aren't obligated to support linux. They aren't forced to use linux in their closed embedded systems. But if they do use it, since it means less cost, easier maintenance and higher quality, they are agreeing to the contract under which that code may be distributed. In the case of Windows CE, there is a definite cost and an onerous contract you need to agree to. Linux to has a cost too. You need to offer the source to anyone you give the software to. Leased, bought or free, you still need to offer them that.

Re:The problem with signing

[dnoyeb]

I think the GPL makes it perfectly for you to take that Tivo code modify it, compile it and run it. It does not say you can run it on the Tivo hardware. Hell, was the code born on Tivo, or its its origin some other piece of hardware?

Linus is correct. What hardware you can/can not run on is not something for software license to enforce. Isint this a form of DRM through license?

As you said you have two rights here. The right to the Tivo since you bought it. The right to the software in the Tivo since its GPL. GPLv3 is trying to roll these into one. I think they are going to produce a licence that won't hold water.

Re:The problem with signing

[DShard]

Hate to reply to myself, but the original parent is right. They are under no obligation to let your custom linux kernel to boot on your hardware (that you have an honest to god reciept for the hunk of silicon and plastic sitting below your TV). I largely don't see why this is an issue. They still need to give you the code... including drivers they had to come up with. That get's back to the main kernel and you can use it on a box that isn't locked down. DRM has already failed. Users will only get fscked by it a few times before they avoid the whole scene. The second time loses iTunes music, they will stop buying music from apple and move on to open or illigitimate media.

Re:The problem with signing

[AuMatar]

Not unless Linus creates the hardware. If he did not, he would be a third party and not in violation of the GPL. In that case it would be the person making the hardware who violated the GPL, and they would have to change their hardware (or get Linux to give out his key, but most likely change their hardware).

Re:The problem with signing

[sumdumass]

It doesn't matter what manufactures want. They aren't obligated to support linux. They aren't forced to use linux in their closed embedded systems. But if they do use it, since it means less cost, easier maintenance and higher quality, they are agreeing to the contract under which that code may beye distributed. In the case of Windows CE, there is a definite cost and an onerous contract you need to agree to. Linux to has a cost too. You need to offer the source to anyone you give the stoftware to. Leased, bought or free, you still need to offer them that.

I'm not disputing that. I'm saying that the manufacturer doesn't have to let you run the source code on any of the hardware. You can have it, do whatever you want with it. but they don't have to let you run it in thier hardware. They aren't obligated to support any linux other then thier specific brand they sell.

Re:The problem with signing

[Talchas]

Isint this a form of DRM through license?

Yes, but in a way so is the rest of the GPL - if you want to distribute software that uses a GPLed library (or is based on GPLed software), you must distribute your source with it. It therefore restricts the "right" to distribute a binary in favor of the consumer/user's "right" to modify the code for their own use. The idea behind the modification being that you can then use the modified (and presumably better for your purpose) software. I believe that the idea behind the this restriction in GPL3 is to prevent people from making hardware that only run signed versions of the code. Running only signed versions means that even if you (the user) have the code, its useless to you if you can't run your modified version.

Re:The problem with signing

[AJWM]

I buy Tivo hardware. I have the right to use it as I wish, since I own the hardware. A hardware mechanism that stops it from booting if unsigned prevents me from utilizing my rights as an owner.

Uh, no, it's just that the hardware you bought was damaged by design when you bought it. Tough, you should have bought something else. If I bought a PPC Mac would the fact that it won't boot Windows be violating my rights as an owner? No. (Of course, some of us would see that as a feature rather than a bug.)

Re:The problem with signing

[Anonymous Coward]

I'm saying that the manufacturer doesn't have to let you run the source code on any of the hardware. You can have it, do whatever you want with it. but they don't have to let you run it in thier hardware

If the licensing terms of the software prohibit them from distributing the software with hardware that won't let you run modified versions then then it does seem they would be bound by that. Ultimately it's up to the courts of course, but I don't really see where you're coming from.

They aren't obligated to support any linux other then thier specific brand they sell.

Obviously Linux isn't even licensed under GPL3 but if it were then it still wouldn't oblige them to support anything. sO your statement is true but it seems to be a non sequitur.

Re:The problem with signing

[Registered Coward v2]

Its not the same at all. I buy Tivo hardware. I have the right to use it as I wish, since I own the hardware. A hardware mechanism that stops it from booting if unsigned prevents me from utilizing my rights as an owner. If the code Tivo uses is GPLed I'm being denied my rights twice- not only my rights as a hardware owner, but my rights under the GPL.

The system works as delivered - TIVO has met it its obligation to provide a product that work as advertised; your argument would say that if Windows won't run a a Linux box you bought the at you are being deprived of the right to use the hardware as you see fit.. You are free to modify the hardware to make it run if you can - but no where does the GPL require a company to support modified versions on their hardware.
The GPL only applies to the software - it can't be extended to hardware (or other programs) because the creators of the software have no rights to the hardware design - they didn't do it. That's like saying the manufacturer of a computer can change the GPL license because it runs on their BIOS - they are separate things with separate copyright owners who get to decide how it can be used.

They give you the code; once you change it it's your job to make it work.

Re:The problem with signing

[AuMatar]

THere's a difference between having to make my code work and them preventing any code not coming from them from working. In the first case I know the risks, and if I fuck up the hardware its my fault. In the second, my rights as owner of the hardware are being removed.

And the GPL can easily be extended to hardware- thats what the GPLv3 does. It ensures that if you use GPLed code in your hardware product, that the user must maintain the right to modify the code. It protects the principles of Free Software that the GPL was created for. If the hardware maker wants to take away my rights as a user, they can write their own damn software to do it with.

Re:The problem with signing

[AuMatar]

Simple- I bought the hardware. That means I own it. THat means I can do anything I want with it. Its the manufacturers who have no right- they have no right to purposely prevent me from doing what I want with my own hardware.

Re:The problem with signing

[Anonymous Coward]

It's my right as a software developer to forbid manufacturers to bundle software i wrote if they lock their platform. That's why i'm sooo waiting for the GPL3.

Re:The problem with signing

[madcow_bg]

This does bring up a flaw in the idea, though: what stops a company like TiVo from creating "unrelated" shell organizations so as to separate the kernel development and hardware development in order to get around this?
I guess there is no loophole here. If a company (say, TiVo) sells hardware with DRM that prevents the usage of unsigned kernels, that's OK. No part of the license can possibly influence hardware part, because it has nothing to do with it. However, distribution of the software by another company (say, oViT) that is under GPLv3 requires the whole set of signing keys, otherwise it would be illegal to distribute it, albeit freely (as in beer). If TiVo buys the license, they will still be prohibited to release the software without the source and the signing keys, because that is what the license say. And since oViT is not the copyright owner of the whole thing, they cannot release it to TiVo under a different license either.

We might have a different set of problems, by the way. Many licenses are deemed GPL compattible, namely the new BSD. But are they going to be called and utilized this way with GPLv3, since many licenses does not have similar DRM-preventions clauses? In this connection, will GPLv2 be compatible with GPLv3?

Re:The problem with signing

[Kihaji]

Tivo isn't the hardware, Tivo is the service. You can do whatever you wish with the hardware you get when you purchace a Tivo package, you just can't use their service without using software that they say, and they have every right to say that.

Re:The problem with signing

[arose]

They are under no obligation to let your custom linux kernel to boot on your hardware (that you have an honest to god reciept for the hunk of silicon and plastic sitting below your TV).

Yet.

Re:The problem with signing

[agony_zhou]

Linus sometimes sounds like an asshole, but I think he has a point. There are basically two rights we want to preserved:
1, The right to see, modify and distribute source code. Every users of the software should have it.
2, The right to install modified software on a piece of hardware. The owner of that piece of hardware should enjoy it.
GPLv2 only deals with right #1, but GPLv3 also deals with right #2. This is where it steps out of bound of what a copyright licence should do.
I hate DRM as much as RMS do, but I think GPLv3 either place onerous burden to the hardware vender (think about some hardware that do not have reporgrammability at all) or is hard to enforce (the two entities situation).

Re:The problem with signing

[aardvarkjoe]

In that case it would be the person making the hardware who violated the GPL, and they would have to change their hardware (or get Linux to give out his key, but most likely change their hardware).

How could the person making the hardware violate the GPL without even distributing GPL'd software?

Re:The problem with signing

[Chops]

It's not quite so simple. Suppose a manufacturer were to build a computer that would only run an OS signed with Linus's key. That turns his "signing key" into an "embedded key". The problem here is that there is no fundamental distinction between the two kinds of keys; it's just a question of how they are used.

The manufacturer building that computer is perfectly legal. Linus continuing to develop Linux and sign his copies of it afterwards is perfectly legal.

The illegal act -- and the signifier of the "fundamental distinction" you're after -- is when the manufacturer copies Linux in order to sell it to someone on his special computer. He may only make that copy if he's complying with the terms of the GPL, the same as it ever was, and in order to comply with the GPL, he must ensure that the people receiving software from him receive the same rights he had when he received it -- the rights to modify it for any purpose that suits them. Since he want to deny his customers that right (at least when running on the computer he sold them), the GPL v3 will (correctly IMHO) deny him the right to sell Linus's software along with his shiny new computer.

If he made that computer, and required that his end users download a kernel.org kernel signed by Linus in order for his computer to operate, he would be in the clear, as would his end users (since they aren't copying any GPLed work, the provisions don't have to apply). This situation would make RMS slightly unhappy, since the end user isn't free to modify his computer's software, but it's perfectly legal according to the terms of the GPL v3.

Of course, the DRM provisions aren't designed to attack that farfetched example; they're designed to counter the much more plausible example of Tivo-style DRMization of GPLed works, letting Tivo profit from hundreds of millions of dollars worth of community research without compensating the community in kind.

Re:The problem with signing

[Chops]

This does bring up a flaw in the idea, though: what stops a company like TiVo from creating "unrelated" shell organizations so as to separate the kernel development and hardware development in order to get around this?

I thought of this same thing after I wrote an earlier post in this thread, and when I checked out the GPLv3 draft, I saw that it was very cleverly handled even in that case:

The Corresponding Source also includes any encryption or authorization keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use, such that they can implement all the same functionality in the same range of circumstances. (For instance, if the work is a DVD player and can play certain DVDs, it must be possible for modified versions to play those DVDs. If the work communicates with an online service, it must be possible for modified versions to communicate with the same online service in the same way such that the service cannot distinguish.) A key need not be included in cases where use of the work normally implies the user already has the key and can read and copy it, as in privacy applications where users generate their own keys. However, the fact that a key is generated based on the object code of the work or is present in hardware that limits its use does not alter the requirement to include it in the Corresponding Source.

So it doesn't force Redhat to give away their private signing keys, unless RHEL _refuses_ to install a non-signed binary (as opposed to merely complaining about it) -- the keys must be "necessary to install and/or execute" the resulting binary. It does cover a situtation where Tivo makes the hardware and the "Ovit" company makes a software image which runs on the Tivo:

• If Ovit's software runs only on the Tivo hardware, then the signing key is "necessary to ... execute modified versions in the ... recommended or principle context of use," and Ovit is guilty of copyright infringement (since the GPLv3 does not apply to their redistribution).
  
• If Ovit's software runs on other hardware than the Tivo (with "all the same functionality"), then their software is legal by the terms of the GPLv3, which is correct, because they really are making general-purpose media center software, and the lack of freedom on Tivo hardware is merely an irritation rather than a menace.
  

It's really slick. It's almost like they thought about it for a while before they wrote it :-).

Re:The problem with signing

[AJWM]

Looks like overall you're agreeing with my point.

But an otherwise general purpose computer that will only load specially signed binaries is "damaged by design" in the same way that a 6-slot motherboard that has had two slots filled with glue and sold (cheaper) as a 4-slot mobo is damaged by design. (And before you scoff at this example, review the history of some of the old DEC Q-Bus and VAX systems.) Another example would be a car inherently capable of 120MPH with a manufacturer-installed governor to limit it to 70 MPH.

"Damaged by design" implies adding something extra to limit the hardware's capabilities. Sure, it's the manufacturer's right to do so, and your problem if you're silly enough to buy it.

Re:The problem with signing

[MadEE]

That is right but you do not own the code or the schematics for the design. You have ever right to unsolder the chips and sell them on ebay if you wish or to beat the hardware with a hammer. Your rights end at the hardware; decisions in design belong to the makers of the hardware no matter how entitled you believe yourself to be to it. Your ownership rights end at what you can do with the device you own once it is in your hands it does not force manufacturers to accommodate your whims.

Re:The problem with signing

[MadEE]

Hey that's fine. If you want to forbid that go right ahead however it's rather clear that not all developers think that way. What I take issue with is the parent claiming it's some kind of right to be able to run whatever he wishes on whatever he wishes absent of the new GPL license.

Re:The problem with signing

[AuMatar]

But they did- in your example someone made the hardware that only works with a certain signed versionof linux and sold the hardware and software together. If they sold the hardware to someone else who sold the hardware and software together, that person is guilty. At some point someone sold the hardware software combo, and that person would have violated the GPLv3

Re:The problem with signing

[Anonymous Coward]

That's absolutely right. You own it. You're free to do whatever you want with it.

However, if you _break it_ and it _no longer works,_ it's kinda silly to whine to the manufacturer.

"I attacked my Tivo with a hammer, and now it won't boot! Your refusal to make it hammer-resistant is infringing on my rights as a property owner!"

If Tivo (to use your example) designs their box in such a way that doing what you suggest breaks it, and you then do that, and it breaks, then you're kind of dumb for having done it.

"But they should have designed it differently" is a perfectly acceptable whine, but the fact is, they didn't. And you bought it anyway.

Re:The problem with signing

[AuMatar]

Freedom 2 without freedom 1 is rather useless. Thats why the GPLv3 is coming into existance. ANd no, I don't think it puts any undue burden on hardware manufacturers- if they don't like it, they can write their own code.

Re:The problem with signing

[file-exists-p]

It's how I understand that too, but how can M. Torvald have such a misunderstanding ?

Re:The problem with signing

[Anonymous Coward]

"their hardware" That's the fallacy. You paid for it, remember?

Re:The problem with signing

[Registered Coward v2]

THere's a difference between having to make my code work and them preventing any code not coming from them from working. In the first case I know the risks, and if I fuck up the hardware its my fault. In the second, my rights as owner of the hardware are being removed.

No, they have no obligation to ensure or facilitate code that they do not create runs. If you don't like that don't buy the product.

And the GPL can easily be extended to hardware- thats what the GPLv3 does. It ensures that if you use GPLed code in your hardware product, that the user must maintain the right to modify the code. It protects the principles of Free Software that the GPL was created for. If the hardware maker wants to take away my rights as a user, they can write their own damn software to do it with.

Which is why companies should not use it. If v3 should also ensure those restrictions are not added to any code previously released under an earlier version since to do so would limited authors ability to control how their code is distributed since it would impose limitations that they had not imposed.

Re:The problem with signing

[madcow_bg]

It's not quite so simple. Suppose a manufacturer were to build a computer that would only run an OS signed with Linus's key. That turns his "signing key" into an "embedded key". The problem here is that there is no fundamental distinction between the two kinds of keys; it's just a question of how they are used.

And, as stated in the GPLv3 draft, the people who give you the signed binary of the software must give you the source WITH the keys. If they fail to do so, they do not have the right to distribute the software. That part of GPLv3 is very clear, and that is accomplished just by saying that signing keys are a part of the source.

I think that GPLv3 is trying to target a problem that has already arisen. If it was not for the DMCA and the equivalents in most countries we might hope to reverse-engeneer it, thou it is hard and not always successful. Basically, it boils down to this: Do you want your work released under GPL to be exploited by third parties? The authors should decide.

Re:The problem with signing

[Arker]

If I pay for the hardware, it's mine, however, not theirs.

Re:The problem with signing

[Arker]

In this case the manufacturer would have to release that key. They can't release that key, however, as it's not theirs. Therefore, they cannot comply with the license, and cannot ship the software.

IF they shipped the hardware bare, with no software actually included, that would seem to solve the 'problem' from their point of view. It would be a staggeringly painful system for the purchaser to deal with, however, and thus that dodge seems rather pointless.

Another reason the whole idea here is pointless is because Linus' kernel doesn't have spyware in it, probably never will, and that's what's motivating these companies in the first place, so there's no advantage from their point of view to enforcing a vanilla kernel. They want to enforce their customised software, laden with spyware and crippleware, on their customers. Unless and until Linus' starts putting that crap in his kernels, there's no motivation for them to try and force his kernels on the customers....

Re:The problem with signing

[aardvarkjoe]

But they did- in your example someone made the hardware that only works with a certain signed versionof linux and sold the hardware and software together. If they sold the hardware to someone else who sold the hardware and software together, that person is guilty.

First off, it wasn't my example.

In the example, they made a piece of hardware that will run some software only if signed by a certain person. A perfectly plausible scenario in the future is that you buy a piece of hardware that has built-in DRM protection that will only run kernels signed by a specific person or group of people. It might come with, for instance, a signed Microsoft kernel and run a variant of Windows. The user might want to run Linux, and so he downloads and installs a Linus-signed Linux kernel, which is also on the approved list.

So who was guilty of breaking the GPL here? The hardware manufacturer didn't distribute any GPL'd code, so they cannot have possibly have broken it. Neither did the user, so he didn't either. Did Linus? He seems to think so, which is (one of the reasons) why he is opposed to the GPLv3. On the other hand, the FSF has been claiming that just signing something will not constitute breaking the GPL -- in which case, nobody broke the license, and the GPLv3 just doesn't do squat to stop DRM.

Re:The problem with signing

[sumdumass]

Sure it is yours, and if you bought something that will only boot to a signed binary program then thats what you own. You will have to either get around it on your own (maybe with other helping) or buy something else if you want to run your own software. There is nothing in the GPL that stops this. Also there should be nothign in it ever to stop this.

GPL or not, there is not and should not be any obligation for a vender to allow you to use the equiptment they are selling any differently then thier intended purpose. The GPLv3 will probably end up with hardware venders looking elswere for thier software. It will be a step or two back in getting vender supported drivers for linux or other hardware that can even run for that matter.

I'm starting to see the value of the BSD license at this point.

Re:The problem with signing

[Arker]

Actually the GPL was explicitly designed to make this sort of usage illegal, and arguably already does so. The problem is, this precise method of taking away the users rights was not anticipated when the GPL v2 was written, so there's too much ambiguity and room to argue it. Hence the 'bug-fix' in version 3.

The GPL was always, explicitly, designed to allow free usage of GPL code only to those who are willing to also allow that same freedom to those downstream of them.

Why you think that people "should" be able to strip those downstream of their freedom is a mystery, since you don't support the absurd assertion in any way.

Your assertion that hardware vendors will decline to use GPL v3, to the extent it's to be interpreted as meaning a significant portion of them will do this, is argued against by history. People claimed the same sort of thing about earlier versions of the GPL, but in fact, commercial vendors that are willing to return value have gravitated overwhelmingly to GPL vs BSD projects. And for good reason. BSD is only 'business friendly' to businesses that return nothing, as it allows that, but to anyone that returns value to the community, GPL is much more 'business friendly' as it prevents competitors from taking that work without returning value in turn. If, for instance, IBM contributes code to a GPL project, they can have some confidence that they aren't strengthening their competitors by doing so. The competitors can use the code, certainly, but they are in turn obligated to 'play nice' and return their additions to the community, so IBM as well as everyone else gets value returned. Licensing under BSD, on the other hand, is a black-hole: your competitors can take your contributions, leverage them to create a product that competes with you, and give you nothing back at all.

Companies that view BSD as being more friendly to their interests do exist, of course, but they're the companies we don't want using our code anyway. They're the ones intent on taking our code, tweaking it slightly, and then using it against us. They would never contribute anything back anyway, so who cares whether they like it? They're to be avoided, not helped.

The rest of the companies, the ones that understand that business is about creating value, appreciate the GPL, once they understand it. I see no reason to think that won't be even more true of v3 than it has been of v2.

Re:The problem with signing

[kripkenstein]

It seems to me this loophole is already closed by (all of) the drafts of GPLv3. It does not matter which key owned by whom, the KEY TEST (sorry, can't resist) is whether a modified version will run. If TivoV3 uses Linus' signature as DRM, then TivoV3 must give the user a way to sign using Linus' key; which means TivoV3 would be stuck.

This doesn't answer the issue raised by the grandparent post (which has also been raised before in Slashdot and elsewhere, and to which I have yet to see a good response).

Put simply:

Company A releases a 'Tivo-type' hardware device. Only the hardware. Now, the hardware runs only digitally signed software with some secret key. But since this is only hardware, no problem there.

Company B releases a software package. This software package happens to work perfectly on Company A's hardware, as it happens to have the right digital key signature (and recognize the hardware correctly). But, this is only software (and distributed with source, etc.), so, no problem there.

Now, some retailer offers a 'special discount' if you buy Company A's hardware and Company B's software together. When you get home, all you need to do is stick a CD into the hardware device, and everything installs and is ready to run. But - you cannot modify the software and run it on the hardware. Yet, no GPL3 violation has been made.

I hope I am wrong about this. Please correct me.

Re:The problem with signing

[sumdumass]

Actually the GPL was explicitly designed to make this sort of usage illegal, and arguably already does so. The problem is, this precise method of taking away the users rights was not anticipated when the GPL v2 was written, so there's too much ambiguity and room to argue it. Hence the 'bug-fix' in version 3.

The GPL was always, explicitly, designed to allow free usage of GPL code only to those who are willing to also allow that same freedom to those downstream of them.

Not allowing you to turn an appliance into something other then it was intended or making it work differently then intended has nothing to do with the GPL (any version yet). They are two different things. And no were in the current GPL does it even imply that the source released by some company who uses GPLed code, should be able to run on any specific hardware. This has nothing to do with GPL freedom. You have your source, you are able to make changes to it, you are able to do whatever you want with it. The GPLv3 is trying to dictate to manufacturers that if you decide to use GPLed software, now you have to open up your hardware. The fact that someone makes something that will only run a certain verison of a program or only a signed version isn't even related to your ability to view and modify the source. It is only realted to your ability to run software other than what was intended to be run on it.

Your assertion that hardware vendors will decline to use GPL v3, to the extent it's to be interpreted as meaning a significant portion of them will do this, is argued against by history. People claimed the same sort of thing about earlier versions of the GPL, but in fact, commercial vendors that are willing to return value have gravitated overwhelmingly to GPL vs BSD projects. And for good reason. BSD is only 'business friendly' to businesses that return nothing, as it allows that, but to anyone that returns value to the community, GPL is much more 'business friendly' as it prevents competitors from taking that work without returning value in turn. If, for instance, IBM contributes code to a GPL project, they can have some confidence that they aren't strengthening their competitors by doing so. The competitors can use the code, certainly, but they are in turn obligated to 'play nice' and return their additions to the community, so IBM as well as everyone else gets value returned. Licensing under BSD, on the other hand, is a black-hole: your competitors can take your contributions, leverage them to create a product that competes with you, and give you nothing back at all.

My asertion is based on the current claims vendors are using for releasing propriatary drivers. It is because the competition can find details on thier hardware that wouldn't normaly be availible. With the case of tivo only allowing signed code to run, they can obscure this to a certain extent. But for some reason, people and the GPLv3 now think the hardware should be opened also. Now instead of kust returning the changes, I will have to give up control of my hardware too.

It will be illegal from a licence standpoint to make a chip for sound that has code lockouts that enable parts of the chip so one main board manufacturer could use one chip design in say all thier on board sound cards but only enable 7.1 suround sound on tuse he higher end boards to save on licensing fees. If i offer a opensource driver, i will have to charge full price for the chip because i cannot lock it out without giving that code away under the GPLv3. Another instance might be, if i make a tivo like device that lets you record a show even after the braodcast flag says no because i bought a license from the **aa's that allow it, i cannot use GPLv3ed code because of the propriatary license that i cannot redistibute. Even if the license software only links to LGPL code, GPLv3 will force me not to use it. BSD is about the only way without going with some propriatary vendor.

Companies th

Re:The problem with signing

[5937]

"Isint this a form of DRM through license?"

In the way copyleft is a form of copyright :)

Re:The problem with signing

[5937]

"If I bought a PPC Mac would the fact that it won't boot Windows be violating my rights as an owner?"

A ported one? When the contract says you can run any software? Yes, of course.

Re:The problem with signing

[5937]

"Damaged by design" is fobidden by the GPL. Its the manufactures problem if it is silly enough to run it in this case.

Re:The problem with signing

[5937]

"TIVO has met it its obligation to provide a product that work as advertised"

That product has to advertise "GPL, this are your freedoms". So it does not work as it (should) advertise.

Re:The problem with signing

[giafly]

If he made that computer, and required that his end users download a kernel.org kernel signed by Linus in order for his computer to operate, he would be in the clear, as would his end users (since they aren't copying any GPLed work, the provisions don't have to apply).

Let's take your example a little further. Suppose the computer uses standard Linux but includes DRM in hardware and uses a custom device driver. Are you also saying the manufacturer would be in the clear if he requires end users to download a device driver signed by the DRM manufacturer to play recorded tv programs? NB: signed by the DRM manufacturer, NOT the computer manufacturer. Is this a plausible way to achieve "Tivo-style DRMization of GPLed works"?

Re:The problem with signing

[anandsr]

"The GPLv3 is trying to dictate to manufacturers that if you decide to use GPLed software, now you have to open up your hardware."
No one is dictating that. If you want to obscure the interfaces do it in firmware. Or don't use GPL code. Simple.

"But for some reason, people and the GPLv3 now think the hardware should be opened also. Now instead of kust returning the changes, I will have to give up control of my hardware too."
What kind of control of your hardware are you talking about when you cannot modify the source and use it on the same hardware. What is the point if you can run the modified source on the same hardware. It is not that the company will provide you with another hardware where you can use it. Also there is no way to determine that the source matches with the binary running on the hardware.

"It will be illegal from a licence standpoint to make a chip for sound that has code lockouts that enable parts of the chip so one main board manufacturer could use one chip design in say all thier on board sound cards but only enable 7.1 suround sound on tuse he higher end boards to save on licensing fees."
I would prefer that they don't use this method. If they want to make a price difference, provide different chips. All the CPU makers do differentiate their products in the hardware. Why shouldn't the Sound card manufacturers do the same. Why should they be able to get away cheap, and by using GPL software to boot.

The only trouble I can think of is for future smart cards. The only way to make the code secure in those cards is to make them open source. But when you do GPL then you can not make sure that only your software is running on the smart-card. But then it is a chicken egg problem how does the public make sure that the manufacturer has not made a goof up and has provided the correct source.

In any case DRM is against GPL software anyway. The loophole must be closed.

Re:The problem with signing

[kripkenstein]

If he made that computer, and required that his end users download a kernel.org kernel signed by Linus in order for his computer to operate, he would be in the clear, as would his end users (since they aren't copying any GPLed work, the provisions don't have to apply). This situation would make RMS slightly unhappy, since the end user isn't free to modify his computer's software, but it's perfectly legal according to the terms of the GPL v3.

Of course, the DRM provisions aren't designed to attack that farfetched example; they're designed to counter the much more plausible example of Tivo-style DRMization of GPLed works

But all Tivo has to do is exactly what you stated in your post, in order to comply with the GPL3 (separate the software from the hardware). This won't be 'farfetched' at all, it will become commonplace. Circumventing the GPL3's clause will be a minor inconvenience to people like Tivo. So, why bother with all of this effort? It seems (sadly) futile to me.

Re:The problem with signing

[Arker]

To the contrary, the 'freedom to tinker' has been one of the driving principles behind the GPL from day one. You can't define for me what MY hardware can do, even if it was once yours. I paid for it, it's mine now, what it can do is limited only by it's actual capabilities, and my ingenuity, NOT your idea as to what it was 'intended' to do.

My asertion is based on the current claims vendors are using for releasing propriatary drivers.

What manufacturer, specifically? Nvidia claims that writing drivers is just too complex for anyone outside their team. Utter absurd BS, but nowhere near the level of what you are implying.

Bottom line, usage of GPL software to cut business cost is intended, and has always been intended, to be conditional on those business respecting their customers basic liberty. If they aren't willing to do that, they should be writing their own software, or licensing proprietary offerings. No one can take those options away from them, nor is anyone trying to. But they shouldn't be able to have their cake and eat it too.

Now instead of kust returning the changes, I will have to give up control of my hardware too.

Get this through your head, it's NOT your hardware. Not once I buy it. Once I buy it, it's my hardware, and I'll do whatever the heck I want with it, and you have no say in the matter. Deliberately cripple it before selling it? That you can do. It means that a lot of us won't want to buy it anymore, of course, and it also means you need to start writing your own software instead of stealing GPL sources. Simple as that. Respect the rules, or take your ball and go home. Someone else will be happy to take over the market you're refusing to serve.

It will be illegal from a licence standpoint to make a chip for sound that has code lockouts that enable parts of the chip so one main board manufacturer could use one chip design in say all thier on board sound cards but only enable 7.1 suround sound on tuse he higher end boards to save on licensing fees. If i offer a opensource driver, i will have to charge full price for the chip because i cannot lock it out without giving that code away under the GPLv3.

This is a big ball of confusions, let me try to unravel it a little for you.

You can do what you want if you write your own code. It won't be illegal to do what you're describing, it might be problematic to do what you're describing and also use GPL v3 code.

Second, why on earth would we want to encourage more of this paradigm of 'break some of the hardware and sell it cheaper?' This is utter crap. I know tech companies have been doing it for years, but have you ever thought about whether it's the sort of thing that should be encouraged? It's simply ludicrous, it's like if I made a bunch of chairs, then went around with a hammer and beat 9 out of every 10 up a bit, then stuck outrageous price tags on the ones that weren't damaged.

Lastly, even though I'm not sure why I would care if this WERE made impossible, it's actually not. You don't need to turn the chip off in software, that's just a dumbass way to go about doing it anyway. If you really need to do this (why?) use a soldering iron and disconnect that chip. Otherwise people will just patch your drivers, binary or not, and reactivate it anyway.

Another instance might be, if i make a tivo like device that lets you record a show even after the braodcast flag says no because i bought a license from the **aa's that allow it, i cannot use GPLv3ed code because of the propriatary license that i cannot redistibute. Even if the license software only links to LGPL code, GPLv3 will force me not to use it. BSD is about the only way without going with some propriatary vendor.

Well that's kind of the point, now isn't it? If you want to make a Tivo-like 'device' and make money off the **AAs schemes which are predicated from beginning to e

Re:The problem with signing

[bWareiWare.co.uk]

It is important to remember that Linus has painted himself into a corner anyway. The terminology used on most of the Linux copyright notices, coupled with the lack of complete records of who owns the copyright on which portions (or the lack of centralised copyright assignment) mean that nether Linus nor anyone else can ever change the Linux license to the GPLv3 or any other licence. Whilst I personally agree with Linus' reservations about the GPLv3 DRAFTS, he really has little choice but to criticise them. If the GPLv3 was perceived as superior by the majority of the Linux community, and Linus was unable to adopt it, he would have a serious face saving exercise on his hands.

Re:The problem with signing

[mrchaotica]

IF they shipped the hardware bare, with no software actually included, that would seem to solve the 'problem' from their point of view. It would be a staggeringly painful system for the purchaser to deal with, however, and thus that dodge seems rather pointless.

I realize it's far-fetched, but it could still theoretically happen -- and I just want to point that out to make sure it's fixed so it can't happen in the final GPL v.3.

Also, here's another scenario: The device ships with an unsigned kernel, but is programmed such that the first time it connects to the Internet it downloads a signed kernel, loads it, and writes the key into ROM such that it would subsequently refuse to load unsigned kernels. Does the current draft prevent that?

Another reason the whole idea here is pointless is because Linus' kernel doesn't have spyware in it, probably never will, and that's what's motivating these companies in the first place, so there's no advantage from their point of view to enforcing a vanilla kernel.

I just used Linus as an example. In reality, the scenario would go more as follows: FooCorp wants to build a DRM-infected device, but reduce costs by using Linux. So, it creates two "shell companies," FooCorp A and FooCorp B. FooCorp A makes the hardware, FooCorp B makes the software, and each distributes it separately. People wishing to use the hardware are forced to get FooCorp B's kernel because it's got support for various DRM applications (e.g. "protected [sic]" WMV). Optionally, FooCorp A puts in the kind of booby trap I described in my second paragraph.

See how it could work now (unless we make damn sure the final license prevents this possibility)?

Re:The problem with signing

[Anonymous Coward]

> They are under no obligation to let your custom linux kernel to boot on your hardware

Actually, the way I understood the GPLv2 back when I looked into it (IANAL, I'm an embedded software developer), they are, or at least they should be. The license requires that if I distribute binaries of GPLed software, I need to make available all the components necessary so that the end user can build and run their own modified binary (for instance incorporating bugfixes). I don't know what loophole the TiVos of the world are using to get around letting the user run modified binaries on the same hardware they got the original binaries on, but I would argue that this is a violation of the intention of the GPL, if not the letter.

If you don't want to or can't let your end users run modified binaries on your embedded device, the solution is simple - don't use GPLed code. Hope that the stuff you need is available as BSD or LGPL; if not, implement it yourself or buy.

Re:The problem with signing

[Anonymous Coward]

So what if GPLv3 forces hw vendors to make it possible to run "other code" as well? Why would that scare the hw vendors? All they see is a few extra sales because the geeks buy their product in addition to the main target group. They couldn't care less how the product is used, all they care about is that it sell. After the sale, the box isn't their problem any more.

Re:The problem with signing

[doc modulo]

The GPLv3 is intent on saying legally:

If you sell hardware that is damaged by design in certain ways (DRM) then you're not allowed to install/use/sell GPLv3 software on it.

Or

If the hardware doesn't support software freedom like intended in the GPLv3, then you're not allowed to use/put GPLv3 software on it at all. Accept all or nothing of the philosophy of the GPL, not just the parts that you want to.

Is that a good summary? If it is, I see nothing wrong with GPLv3.

Re:The problem with signing

[Registered Coward v2]

"TIVO has met it its obligation to provide a product that work as advertised"

That product has to advertise "GPL, this are your freedoms". So it does not work as it (should) advertise.

Can you get the source? Yes
Can you modify without restriction? Yes

They've met their GPL obligations. No where do tehy say "you can modify our software and it will work on our boxes."

Re:The problem with signing

[Chops]

Are you also saying the manufacturer would be in the clear if he requires end users to download a device driver signed by the DRM manufacturer to play recorded tv programs? NB: signed by the DRM manufacturer, NOT the computer manufacturer. Is this a plausible way to achieve "Tivo-style DRMization of GPLed works"?

If the end-user is able to modify his Linux kernel, then everything is legal, as it should be, since the customer is in the same situation he would ever be in with hardware that uses a binary driver. If he's not able to modify his Linux kernel (if the DRM prevents it), then the manufacturer is still breaking the law regardless of any separate driver download. See this post of mine for more information about how this works.

Re:The problem with signing

[Chops]

But all Tivo has to do is exactly what you stated in your post, in order to comply with the GPL3 (separate the software from the hardware).

No. In my example, the software is generic software that comes from Linus; if Tivo were to provide a Tivo-hardware-only version of the software, and require it to operate their Tivo hardware, then they'd be guilty of copyright infringement. See this post of mine for more information about how it works.

Re:The problem with signing

[grumbel]

If he made that computer, and required that his end users download a kernel.org kernel signed by Linus in order for his computer to operate, he would be in the clear, as would his end users (since they aren't copying any GPLed work, the provisions don't have to apply). This situation would make RMS slightly unhappy, since the end user isn't free to modify his computer's software, but it's perfectly legal according to the terms of the GPL v3.

How exactly would that be legal under GPLv3? GPLv3 states:

The Corresponding Source also includes any encryption or authorization keys necessary to install and/or execute modified versions from source code...

If the keys are not provided and needed to install and execute modified versions that looks like a clear violation to me.

Re:The problem with signing

[frapsol]

A hardware mechanism that stops it from booting if unsigned prevents me from utilizing my rights as an owner... What you say only holds if "booting as unsigned" is explicitly part of the specification at the time the gear is purchased. Otherwise you are going to buy the wrong piece of hardware.

Re:The problem with signing

[nlago]

The second "summary" (If the hardware doesn't support software freedom like intended in the GPLv3, then you're not allowed to use/put GPLv3 software on it at all. Accept all or nothing of the philosophy of the GPL, not just the parts that you want to) is exactly what it is all about.

The first one is incorrect; DRM may even be useful in some cases (giving warnings before installing software from an unknown source, for instance) and, even when it is bad, that is not the GPL's business. The GPL business is to guarantee that free software remains free, that is, that the receiver of a copy is allowed to see, modify, distribute and run the code.

Re:The problem with signing

[nlago]

Can you modify without restriction? Yes

I must disagree.

I cannot "modify it without restriction", because I cannot make my version do the same things that the original version does (run on top of that specific hardware) in a different way (for instance, with messages in a different language), and this is a restriction.

Now, obviously not every modification is guaranteed to work. If I insert a bug in the code that prevents compilation, or if I try to allocate more memory than the device has, it won't work. These are technical limitations, the license has nothing to do with them. One might try to shoehorn the manufacturer's key "issue" as a "hardware limitation", but I don't think they would be much successful: this is a limitation put in place by design, with the explicit goal of preventing me from modifying the code in certain ways (which is using it modified on that hardware).

Maybe you think that this would be outside the scope of the GPL, but check out section 3 of the GPL2 (yes, version 2):

You may copy and distribute the Program [...] in object code or executable form [...] provided that you also [...] accompany it with the complete corresponding machine-readable source code[...]

For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable [emphasis mine].

Now, the distributor gave me a binary compiled and installed on a piece of hardware. If I cannot compile and install it on that same hardware (note that "install" implies being able to run; if I can't run it, I didn't really install it, I just copied it), then I did not receive at least part of "the scripts used to control compilation and installation of the executable"; this part is the signing key. Either they have to give me their key or (much more reasonable) give me a way to make the device accept my key.

This is the GPL2, this is nothing new; the GPL3 tries to make this clear by citing it explicitly to avoid unecessary confusion (such as that which is hapening now in the community), that's it.

Note that I didn't mention ownership of the device. Wether they, sell, rent, lend, or give away the hardware, this is totally unimportant from the point of view of this discussion: they are redistributing GPL code, they must comply with the license, and preventing me from installing a custom version of the software on the device is breaking the license, even in the case of the GPL2, as I just demonstrated.

Re:The problem with signing

[kripkenstein]

Ok, I read your other post; however, I still don't agree. Quoting your main argument from there:

- If Ovit's software runs only on the Tivo hardware, then the signing key is "necessary to ... execute modified versions in the ... recommended or principle context of use," and Ovit is guilty of copyright infringement (since the GPLv3 does not apply to their redistribution).

- If Ovit's software runs on other hardware than the Tivo (with "all the same functionality"), then their software is legal by the terms of the GPLv3, which is correct, because they really are making general-purpose media center software, and the lack of freedom on Tivo hardware is merely an irritation rather than a menace.

What if Ovit's software DOES run on other hardware, but for some reason, in practice, that is not a good solution. For example, some third party hardware manufacturer can make hardware that works like Tivo, but doesn't check signed code (so Ovit's software will run), BUT the hardware is expensive/unreliable/etc (yet, it still "provides all the same functionality", in a legal sense). So Ovit are complying with the GPL3 (you can run modified code somewhere), but in practice no one will.

The GPL3 says the requirement is to be able to run modified code "in the recommended or principal context of use". Say Ovit even recommend the 3rd party hardware manufacturer and not Tivo. Or, they could even BE that manufacturer, making hardware that runs modified code just fine. But since Tivo is far superior, 99.9% of people buy Tivo + Ovit software, and cannot run modified code on it, but legally all is fine.

Since the GPL3 can't prevent this, I presume that this is exactly what Tivo et al will be doing, making this aspect of the GPL3 powerless (as far as I can tell).

Re:The problem with signing

[Arker]

I realize it's far-fetched, but it could still theoretically happen -- and I just want to point that out to make sure it's fixed so it can't happen in the final GPL v.3.

The thing is, it's really not possible to prevent that in a license. There's no license needed, if they aren't distributing the software. So I'm afraid we'll have to be satisfied with the impracticality of it as a deterrent.

FooCorp wants to build a DRM-infected device, but reduce costs by using Linux. So, it creates two "shell companies," FooCorp A and FooCorp B. FooCorp A makes the hardware, FooCorp B makes the software, and each distributes it separately. People wishing to use the hardware are forced to get FooCorp B's kernel because it's got support for various DRM applications (e.g. "protected [sic]" WMV).

If you can show in court that these are, in fact, shell companies concocted to evade the license requirements, I do believe the court can simply disregard the shell game and enforce it anyway.

Re:The problem with signing

[sumdumass]

"The GPLv3 is trying to dictate to manufacturers that if you decide to use GPLed software, now you have to open up your hardware."
No one is dictating that. If you want to obscure the interfaces do it in firmware. Or don't use GPL code. Simple.

Yes they are. It is saying that i cannot build a device that only runs certified code. They are trying to say that if i want to opensource my OWN CODE, I cannot lock portions of it out in hardware or software in order to apease other licenses i will have to use in order to make My product sell. Think fully functional Blue ray or maybe multi media licenses for high quality full motion video that complies with or gets around the broadcast flags.

Imagine I want to build and sell fully functional media center PCs running on linux and Microsoft says i can only use the new WMP codecs or streaming video services if i use only the signed linux kernel, run it on a P4 2,8 gig or better speed hardware (doesn't have ot be X86 but fst so not to make thier stuff look slow and crappy) and don't redistibute a license to the enduser with the ability to distibute this. So i now cannot include a chip that checks for a linus signed version of ther kernel and if not present, disable portions of the media services. I also cannot check that it is on certain hardware only and do the same. And because it is a media serving appliance, it is a system in whole and not a comilation of programs and the inclusion of propriatary apps or licenses with limit is expresly forbiden. So, in order to do this, I would have to open up all the hardware, not use anything from microsoft under thier conditions and probalby not use any number of other things like streaming media in general because it is pattented and someone tryes to enforce the pattent. Good job at limiting my freedoms in the name or freedom.

What kind of control of your hardware are you talking about when you cannot modify the source and use it on the same hardware. What is the point if you can run the modified source on the same hardware. It is not that the company will provide you with another hardware where you can use it. Also there is no way to determine that the source matches with the binary running on the hardware.

Nothing should ever say you have the right to run any specific software on any specific hardware. Unless you bought a personal computer, your more then likley purchased an appliance designed to do a certain thing. You know this when buying it. Why is it all the sudden the manufacturers resopncibility to allow you ot use it as anything other then it was intended? I mean, a Tivo isn't intended to comile code, run changed code or any code other then thier officialy signed versions. You have the ability to purchase the same parts and put them together just like tivo did and run the source you want. It is almost like ther is some implied "your have to help me do something" attitude. Again, if you buy an appliance that only runs signed code, then thats exactly what you bouhght.

I would prefer that they don't use this method. If they want to make a price difference, provide different chips. All the CPU makers do differentiate their products in the hardware. Why shouldn't the Sound card manufacturers do the same. Why should they be able to get away cheap, and by using GPL software to boot.

What you prefere and what the people putting thier money, reputation, businesses and security on the lines to run a business might be different. Why would they want to do this instead of making different chips, the same reasons Intel or AMD makes the same chips and limits the speed to provide different chips at different pricing levels. You see, it is possible that it would be cheaper to use one chip for every implementation and have the differences in the amount of conectors installed or the abilities not limited by the chip. That benifits the manufacturer of the end product as well as the chip maker were

Re:The problem with signing

[5937]

Can you fix broken tivo-hardware? Yes.
Can you fix broken tivo-software? No.
Thats one purpose of the GPL.
Thats what the freedom to run the code is about.

BTW the argument about running it on something else is related.
Imagine you buy something and when it breaks the dealer says: Well buy another one, which you can repair.

Re:The problem with signing

[AJWM]

Is it really? I don't think so.

Take another hypothetical - instead of just requiring signed binaries, Tivo (for example) contracts with a CPU vendor for a chip with a custom instruction set. Tivo ports GCC, Linux, and whatever else it needs to run Linux under that new architecture. Tivo distributes boxes using the custom CPU and the source to all the GPL'd code that box uses -- but not GCC (it doesn't distribute GCC).

Let's see you run modified Linux binaries, or anything else, on that box without Tivo's custom GCC.

Sure, you're welcome to reverse engineer the binaries to see if you can figure out the instruction set, and modify GCC to match. Good luck.

Perfectly within the GPLv2 or GPLv3.

(Arguably that's not as damaged by design as merely requiring signing, but it still won't let you run binaries that Tivo doesn't want you to.)

Re:The problem with signing

[5937]

In that case they do not distribute all files needed to build this stuff, eg they don't distribute gcc.
Basically the same situation as with a DRM-key: they hold something back which is required, thats a breach of the license. At least of its spirit. IANAL, so don't know how well the GPL-lawyers found the right words.

Re:The problem with signing

[Schraegstrichpunkt]

They are under no obligation to let your custom linux kernel to boot on your hardware (that you have an honest to god reciept for the hunk of silicon and plastic sitting below your TV).

They are perhaps allowed to restrict you, by legal means, from modifying the software that's on the leased hardware (a claim that I would dispute, but I digress). Regardless, they are required to provide you with the Corresponding Source, which effectively means that they cannot use technical means to prevent you from modifying the software that's on the leased hardware.

From GPL3draft2 (with emphasis added):

The Corresponding Source also includes any encryption or authorization keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use, such that they can implement all the same functionality in the same range of circumstances.

Whether or not they place other legal obligations on you, if they do not provide the Corresponding Source, then the copyright holder can sue them for infringement.

Re:The problem with signing

[Schraegstrichpunkt]

Sure it is yours, and if you bought something that will only boot to a signed binary program then thats what you own.

And, in that case, if the distributor doesn't give you the signing key, or a mechanism for transparently changing the signing key that the device accepts, then the distributor hasn't given you the Corresponding Source, and is liable to the copyright holder for copyright infringement.

There is nothing in the GPL that stops this.

The definition of "Corresponding Source" in GPLv3draft2 does, and the definition of "source code" in GPLv2 (arguably) does.

Re:The problem with signing

[Schraegstrichpunkt]

Yes they are. It is saying that i cannot build a device that only runs certified code.

It is saying that you cannot do that and simultaneously distribute GPLv3 code that runs on that device, unless you provide what is "necessary to install and/or execute modified versions from source code in the recommended or principal context of use".

This is just a further clarification of what "source code" in GPLv2 already means (that being, the preferred form of a work for making modifications to it).

Re:The problem with signing

[Schraegstrichpunkt]

So who was guilty of breaking the GPL here?

Assuming a GPLv3 Linux, Linus would be the one violating copyright law, and so would anyone downstream who distributes the binaries. However, that would only occur in the event that he didn't provide the "keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use" (emphasis added).

So, if he signs an ordinary, generic binary, he's okay. However, if he signs a binary that is specifically targeted at this hardware platform, knowing that without his signature, the binary will not run, then he could probably be held liable.

Realistically, the courts would sort out these things on a case-by-case basis. Also, as far as I know, Linus doesn't distribute or sign Linux binaries. It's hard to violate the terms of the GPL when you're only distributing source code.

Re:The problem with signing

[aardvarkjoe]

Also, as far as I know, Linus doesn't distribute or sign Linux binaries. It's hard to violate the terms of the GPL when you're only distributing source code.

Not really. Maybe C code will usually be turned into binaries before signing it for the purposes of DRM, but that's not the case for, say, Perl code. And in any case, nobody really thinks that Linus would get slapped down by the GPLv3, regardless of what happens. He's taking a stand on principles, and as long as there are people with good reasons to sign binaries, his points are valid whether he personally does it or not.

"keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use"

Personally, if we're already saying that the courts will know what was meant, and doing handwaving that it only counts if it is in some vague "principal context of use," it doesn't seem to me that the GPLv3 is off to a very auspicious start. Wasn't a large part of the point of this new license to try to tighten down the languange so we didn't have these problems?

Re:The problem with signing

[Schraegstrichpunkt]

Not really. Maybe C code will usually be turned into binaries before signing it for the purposes of DRM, but that's not the case for, say, Perl code.

That's a fair point.

And in any case, nobody really thinks that Linus would get slapped down by the GPLv3, regardless of what happens.

Agreed.

He's taking a stand on principles, and as long as there are people with good reasons to sign binaries, his points are valid whether he personally does it or not.

Many of Linus' points are irrelevant or based on false premises, as are a lot of his comments about legal issues in general. He's not a lawyer, and unlike the FSF, he doesn't seem to have bothered to consult one before making statements in public forums. I'd be hard pressed to call that a principled stand.

The more I read Linus' comments, the more I become convinced that Linus' objections stem from little more than his (IMHO understandable) personal dislike for RMS. It appears as though Linus wants to take a principled stand against GPLv3, and that's causing him not to be motivated to acquire more than a cursory understanding of the GPLv3 drafts.

Personally, if we're already saying that the courts will know what was meant, and doing handwaving that it only counts if it is in some vague "principal context of use," it doesn't seem to me that the GPLv3 is off to a very auspicious start. Wasn't a large part of the point of this new license to try to tighten down the languange so we didn't have these problems?

What makes you think it's a problem? The entire purpose of any software license (or really any written legal document) is to ensure that the courts will know what was meant. No matter what is written on paper, the license is nothing more than words on paper until one party sues another for copyright infringement, and the other party uses the license as a defence.

Keep in mind that courts have been determining the "principal context of use" of various things for a long time. It's not vague terminology in legalese, although it may look that way to a programmer.

Re:The problem with signing

[Chops]

If the keys are not provided and needed to install and execute modified versions that looks like a clear violation to me.

If the manufacturer isn't redistributing GPLed software (but instead making his end-users download and install it), then there's not a thing in the world that he can do that's a clear violation of the GPLv3. The GPL is an optional license which allows redistribution of software, not a contract -- if you don't need to agree to it, then don't, and you won't be bound by its conditions.

Re:The problem with signing

[Chops]

What if Ovit's software DOES run on other hardware, but for some reason, in practice, that is not a good solution. For example, some third party hardware manufacturer can make hardware that works like Tivo, but doesn't check signed code (so Ovit's software will run), BUT the hardware is expensive/unreliable/etc

... then Tivo hardware is the "recommended or principle context of use" for Ovit's software, so Ovit's redistibution is illegal. There are grey areas, but legal questions are full of grey areas that need to be decided on a case-by-case basis. The Tivo situation, and the situation you describe, are both clear-cut cases by the text of the GPL.

Re:The problem with signing

[Registered Coward v2]

For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable [emphasis mine].

Now, the distributor gave me a binary compiled and installed on a piece of hardware. If I cannot compile and install it on that same hardware (note that "install" implies being able to run; if I can't run it, I didn't really install it, I just copied it), then I did not receive at least part of "the scripts used to control compilation and installation of the executable"; this part is the signing key. Either they have to give me their key or (much more reasonable) give me a way to make the device accept my key.

This is where we disagree - the ability to install is different from the ability to run a specific piece of code. It installs, but the hardware will not allow it to execute because it does not match the originally installed piece of code; and the GPL does not require execution only installation, so they are in compliance with the license.

Re:The problem with signing

[Registered Coward v2]

Can you fix broken tivo-hardware? Yes.
Can you fix broken tivo-software? No.

Sure you can - you just can't run it on the existing hardware.

BTW the argument about running it on something else is related.
Imagine you buy something and when it breaks the dealer says: Well buy another one, which you can repair.

Except you are saying "I made changes to this thing I bought and now it won't work so you sold me something defective."

Re:The problem with signing

[aardvarkjoe]

What makes you think it's a problem? The entire purpose of any software license (or really any written legal document) is to ensure that the courts will know what was meant. No matter what is written on paper, the license is nothing more than words on paper until one party sues another for copyright infringement, and the other party uses the license as a defence.

Well, for starters: while it's the courts and the lawyers who will have to figure things out when there is a lawsuit for copyright infringement (which may never happen -- has there ever been a lawsuit taken to completion over infringement of the GPL?), the vast majority of users of the license are programmers who are not lawyers and won't be able to have one advising them. I, for one, would not be comfortable using a license when nobody can seem to satisfactorily explain what can or can't be done with the code, and I certainly would not cross my fingers and hope that the courts happen to see things the way I think they should.

The big problem is that there are "good" reasons (security, reliability), and "bad" reasons (DRM) to sign code.* From a technical standpoint, the process for either is exactly the same. The FSF would have us believe that their license allows the former and bans the latter, but ignores the fact that there is a huge gray area in the middle of the spectrum.

* That is, from the FSF perspective. I don't really believe that DRM is inherently good or bad.

Re:The problem with signing

[Schraegstrichpunkt]

I, for one, would not be comfortable using a license when nobody can seem to satisfactorily explain what can or can't be done with the code, and I certainly would not cross my fingers and hope that the courts happen to see things the way I think they should.

If you want the license explained, read the FSF's GPL FAQ, Groklaw, or any of the other places where people discuss licenses. If all those places can't "satisfactorily explain" the GPL to you, then you probably won't believe anything except what a lawyer advises you.

Most licenses are vague in some way. Even the n-clause BSD licenses, if you take the strict English interpretation of them, are ambiguous: they basically say that "redistribution is allowed if redistributions of source code must..." without actually saying that "redistributions of source code must..". The reality is that licenses are interpreted by the courts, and all of us have to take some risk and assume that we are interpreting the licenses the same way that the courts ultimately will. Even if you hire a lawyer, there's always the risk that the judge will disagree with your lawyer. There's not much the FSF can do about that.

As for GPLv3draft2, it's really quite clear: You have to distribute (or offer to distribute in designated ways) the Corresponding Source when you distribute binaries. The Corresponding Source includes any "keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use, such that they can implement all the same functionality in the same range of circumstances.". If your package manager has a list of keys that it trusts, but you can change that list, then the keys I use to sign the binaries are not "necessary to install and/or execute modified versions", and thus are not part of the Corresponding Source. If you can't change that list, then trusted keys are part of the Corresponding Source. These two cases are not "exactly the same" as far as the courts are concerned. If I'm distributing binaries without the Corresponding Source, then the permissions granted in GPLv3draft2 don't apply to me, and so I need another lawful excuse to distribute the copyrighted code.

I suggest you re-read the GPLv3 draft, and also read the rationale document (PDF). You have to read it a few times before you'll fully understand it, but it's really not that difficult to grasp.

Re:The problem with signing

[kripkenstein]

There are grey areas, but legal questions are full of grey areas that need to be decided on a case-by-case basis. The Tivo situation, and the situation you describe, are both clear-cut cases by the text of the GPL.

I see your point, and I hope that this will not turn out to be a problem for the GPL3. I suspect, however, that Tivo-type companies will see the grey area as grey enough to be able to be abused. Again, I hope I am wrong.

I do have a more fundamental question, however. Say that there is a single software manufacturer, Soft, and three hardware manufacturers, HardA, HardB and HardC. HardA runs only signed code, HardB and HardC run any code. Say that each hardware company has 1/3 of the market. So Soft is in compliance with the GPL3.

Now, suppose that HardB and HardC vanish from the market - suddenly, only HardA supplies hardware, and it requires signed code. Is Soft suddenly in violation of the GPL3? If so, isn't this odd - that events unrelated to and uncontrollable by Soft cause them to be in violation of the GPL3? What if tomorrow HardB goes back in business, are Soft in compliance once more?

Something about the concept of "recommended or principle context of use" seems 'wrong', if that context of use is not in control of the software manufacturer themselves.

Re:The problem with signing

[5937]

What are you smoking?

In case your english is even bader than mine i try to reword:
Can you fix your broken tivo?
The hardware-part yes.
The software-part not.
Of course that means "on this tivo", not on something else.

Cheating for a free license-lunch you are, no?

Re:The problem with signing

[LuYu]

Why is everybody always talking about this like there is one key? Could Tivo not just sign their binaries with one key and distribute a "general public key", if you will, that the hardware would accept for everybody else?

In this way, they could keep their key -- and their reputation -- and anybody else could create binaries that ran on the hardware -- assuming the key did not limit hardware functionality that the Tivo key provided. Tivo, or whoever, could then disavow responsibility for binaries signed with the "general public key". They could even create an irritating warning message every time the system booted with the public key (although I certainly hope someone sues them for harrassment if they do). This would comply with all versions of the GPL as I read it.

As for patents and other proprietary garbage on the computer, the vendor could claim that running binaries with the "general public key" would violate those licenses and users would do so at their own risk.

As for locking users out of physical functionality on devices that they have purchased, well, that is just downright dishonest. I do not think any legal system should permit it. Certainly, no legal system should prevent the owners of hardware from getting all the fuctionality they can out of their hardware, regardless of what the vendor thinks. There are tons of Windows hacks for nVidia cards that do this. Why should Linux users have to take that crap when Windows users do not?

I have gotten off track, but my point is that this clarification of the GPL should not force people to give up their private signing keys. All that it requires is that a key that does not limit fuctionality is distributed.

Re:The problem with signing

[Registered Coward v2]

The software-part not.
Of course that means "on this tivo", not on something else.

But that is not required by the GPL - nowhere in the license does it require that modified software be able to run on an embedded (or any other) platform.
If you think it does then I submit your smoking something, not I.

You might want it to be that way but it certainly is not part of the license and that is all that TIVO needs to comply with to be able to use the software.

Re:The problem with signing

[5937]

Maybe. Thats what GPL3 is about. Forbidding to run by DRM is new. If the GPL-authors would have anticipated it, it would be in GPL2 already.

http://www.gnu.org/copyleft/gpl.html
"For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have."

I think that says the intention clear enough. You have the right to make the code runnable, the recipients must be able to do that too.

It defines sourcecode as
"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

I think that is clear enough, even in legal speak. You have to supply anything to build a working program. Understanding "modifications" in any other way makes no sense. Except, maybe, if you are a lawyer.
The only problem is they missed "DRM-keys" because they did not exists then. Which gives Tivo a nice gray area.

In which case Tivo must give us a way to modify our copies in-memory, because its ours and
"2. You may modify your copy or copies of the Program or any portion of it" :)

IANAL.

Re:The problem with signing

[sumdumass]

There is nothing of the sorts in GPLv2. The preamble of the GPLv2 is clearly talking only about "programs", section 0 clealry states that it is concerning only copywriten material (programs) and specifcly states that the act of running the program and the output isn't covered by the scope of the GPL. what Section 3 says about source code when dealing with the requiremnts of distibution

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.

Doesn't say anything about signing the code. Signing the code happens after the install and everything else leading up to the executable wich is expresly what the source on the GPLv2 implies.

Making a machine that only runs signed code or specific code isn't anywere covered by the GPLv2. Neither in implied intent from the preamble or in any section of the actual GPL. It is in no way against the spirit or nature of the GPL. A machine that only runs specific Code is just that "a machine that only runs specific or signed code". When you buy that machine, you are purchasing "a machine that only runs specific or signed code". There is no reason for a software license to dictate that manufacturers cannot sell specific hardware in specific configurations because all the sudden people think that the manufacturer should let them run any program they want on all the hardware they sell. Now, you do have the options to build (or have built)the machine and not include the restrictions on running the code. Nowhere in the GPLv2 does it even remotly imply that the source must run on any specific hardware.

Now what have you gaines if you cannot run the xource code on hardware? You have gained any changes they might have made. More importantly, you have the ability to use those changes on different hardware. Also you will have programs and software that weren't GPLed being released as
GPLed software. Under GPLv3, it is questionabley possible that intel's or AMD's practice of locking out overclocking by hardware restrictions would make it against GPLv3 and make it incompatible. Software licenses shouldn't ever require hardware vedors to do anything they don't want to do.

Re:The problem with signing

[Registered Coward v2]

"For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have."

And they have - you can modify it and redistribute as you see fit; which is the rights they were given. No where in the GPL does it require you ensure modified copies are executable on type of hardware; including that which it current uses.

"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

I think that is clear enough, even in legal speak. You have to supply anything to build a working program. Understanding "modifications" in any other way makes no sense. Except, maybe, if you are a lawyer.
The only problem is they missed "DRM-keys" because they did not exists then. Which gives Tivo a nice gray area.

Nothing in that statement requires inclusion of information needed to run a modified version - only the original; and as you point out there is no mention of keys needed to actually execute, the only requirement is what is needed to compile and install; and you still:

"2. You may modify your copy or copies of the Program or any portion of it"

TIVO has not prevented you from doing that. You can modify the program to your heart's content.

You want to expand the GPL to add rights the original user did not have - information needed to make a modified copy that is still executable on specific hardware - as you pointed out, the GPL in fact specifically states that is not required:

"For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have."

Re:The problem with signing

[sumdumass]

And, in that case, if the distributor doesn't give you the signing key, or a mechanism for transparently changing the signing key that the device accepts, then the distributor hasn't given you the Corresponding Source, and is liable to the copyright holder for copyright infringement.

There is nothing in the GPLv2 that reuires that. Code is signed after it is complied and ready to run. The mechanism for checking is totaly independent of the code and if included in a distribution, would be covered by the agregation of programs or if it is in hardware, then would be totaly independant of the program/source entirley. And if using certain tools to sign the code with, it wouldn't even need the source for the signing program to be distributed.

Section 0 of the GPLv2 specifly says Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, how does that translate into running any specific code on any specific hardware? It is not and never should be the GPL's job to ensure any code runs on specific hardware. This provision in the GPLv3 is just wrong on many levels.

Sometimes I wish linus would just branch the GPL into something called the "freGPL" and keep things as they are instead of this evangelical fanaticism. He probably has the most influence and might be able to get the copyright holders in the linux kernel motivated enogh to do so. The GPLv3 is bad news unless it is changed before official adoption.

Re:The problem with signing

[Schraegstrichpunkt]

There is nothing of the sorts in GPLv2.

This is the line that people say might already forbid tivoization:

The source code for a work means the preferred form of the work for making modifications to it.

The contention is that if you haven't been given enough information to actually make modifications to a work and use those modifications, then you haven't been given the source code. It's clearly the intent of GPLv2 (in my opinion) but, as many have pointed out, there are other possible interpretations. GPLv3draft2 attempts to clarify the situation.

It is in no way against the spirit or nature of the GPL[v2].

That is your interpretation. My interpretation (which, incidentally, is the same as the FSF's interpretation) is that the GPL is designed to ensure that all users of the software have the four freedoms enumerated by the FSF. However, a judge might agree with your interpretation rather than mine, and that's why the FSF wants to add a clearer definition of Corresponding Source to GPLv3.

There is no reason for a software license to dictate that manufacturers cannot sell specific hardware in specific configurations because all the sudden people think that the manufacturer should let them run any program they want on all the hardware they sell.

There is no legal mechanism for the GPL (or any copyright licence) to simply dictate terms to hardware manufacturers---it simply can't be done, regardless of what the FSF or anybody else writes on paper. It can, however, dictate the terms under which those manufactuers can use the GPL as a legal defence for what would otherwise be considered actions that constitute copyright infringement.

Linksys distributes a router that runs Linux, and also distributes Linux with this router. This would normally be copyright infringement, but if anyone sues Linksys over copyright infringement, Linksys can point to the GPL (which says, "you are allowed to do X if you also do Y"), and say "yes, we did X, which would normally constitute copyright infingement, but we also did Y, so we have permission".

Similarly, TiVo distributes PVR hardware, and also distributes Linux with that hardware. This would again be considered copyright infringement, if not for the GPL. The idea behind the provisions in GPLv3 is to explicitly state that if you want to distribute a work under the GPL, then it needs to be modifiable in a practical sense.

Now what have you gaines if you cannot run the xource code on hardware? You have gained any changes they might have made. More importantly, you have the ability to use those changes on different hardware.

Big deal. If that was good enough for me, I wouldn't have released my software exclusively under the GPL.

Under GPLv3, it is questionabley possible that intel's or AMD's practice of locking out overclocking by hardware restrictions would make it against GPLv3 and make it incompatible

Not unless e.g. Intel or AMD distribute GPL-covered software (not copyrighted by them) that is capable of overriding the overclocking restrictions, but if I modify that software, it won't be equally capable of overriding the overclocking restrictions.

Part of the reason I release code under the GPL (and will probably release it under GPLv3, when it comes out) is because that I want to give a competitive advantage to the Linksyses and Red Hats of the world over the TiVos and the Microsofts of the world. If you're a hardware manufacturer, and you are willing to give your customers the four freedoms, then you get to save time and money by distributing my software with your hardware. Otherwise, you don't.

GPLv3 will serve my interests as a software developer. If others don't like the terms, then they are free to develop their own software, or negotiate with me separately (i.e. pay me) for a release under different terms. Don't like it? Tough. Ignore the rules and distribute my work anyway? That's copyright infringement; I'll see you in court.

Re:The problem with signing

[sumdumass]

To the contrary, the 'freedom to tinker' has been one of the driving principles behind the GPL from day one.

you have that freedom now.

You can't define for me what MY hardware can do, even if it was once yours. I paid for it, it's mine now, what it can do is limited only by it's actual capabilities, and my ingenuity, NOT your idea as to what it was 'intended' to do.

You see, when you buy hardware you are buying hardware. When you buy appliances like the tivo, you are buying an appliance that a manufacturer made for a specific reason to do a specific funtion. Reguardless of them using the GPL with software or not, you still purchased hardware that had limits. It is in no way the GPL's position curently to force manufacturers to sell hardware other then what they intended to sell for the purposes they are selling it for. I don't understand the idea of buying a caculator and beeing pissed because you cannot use it as a word proccesr even though the PI solving algorith is GPLed. This is like buying a car, Installing a different carburator and then being pissed because it won't pass an emisions test now and you cannot license it or drive it on the road. You own the hardeware and have the right to do anything you want with it, but the manufactuer has no obligation to support your changing it or make it easy for you to do so. They have no obligation other then ensuring that it performs as they exected it and warrented the sale for. If this means they make it dificult for you to change then so be it.

You can still change things, use it differently then it was intended for and a host of other things but GPLed code or not, Nothing in the Current GPL forces them to help you, make it easy for you or even allow you to operate it in any way other then they intended it to be sold as.

What manufacturer, specifically? Nvidia claims that writing drivers is just too complex for anyone outside their team. Utter absurd BS, but nowhere near the level of what you are implying.

It has been said if they released the entire driver, Details of the hardware interfaces for graphics chips are the "family jewels...and expose how the chip itself works," he said. "Nvidia doesn't want ATI to know that, and vice versa." as quoted from John Peddie in an interview. Or more percisley, nvidia made the claim too much licensed ip is in thier products to opensource them entirley. Numerous other venders have made simular claims too.

Bottom line, usage of GPL software to cut business cost is intended, and has always been intended, to be conditional on those business respecting their customers basic liberty. If they aren't willing to do that, they should be writing their own software, or licensing proprietary offerings. No one can take those options away from them, nor is anyone trying to. But they shouldn't be able to have their cake and eat it too.

No, no, no, that isn't the bottom line. Hardware manufactuers aren't using opensource code to cut business costs. They are doing it so the drivers and devices can be included into different operating systems, or to let people play around with the hardware or experience the full capabilities of it. Nvidia's driver model will be pretty mutch kissed goodbuy on any preinstalled computers/distros. It is as if we are saying to all the newbies and people trying to make linux competitive and user friendly, "you cannot have your cake and eat it too, You should be using your own software".

This is a big ball of confusions, let me try to unravel it a little for you.

You can do what you want if you write your own code. It won't be illegal to do what you're describing, it might be problematic to do what you're describing and also use GPL v3 code.

It will also be problematic if i write my own code, and

Re:The problem with signing

[LuYu]

Isint this a form of DRM through license?

This concept is ludicrous. DRM is specifically technology based. DRM is hardware or software enforcing legal or illegal restrictions against the user. By this statement, all copyright licensing would be "DRM through license". The entire purpose of licenses is to define a user's (or consumer's, if you will) "rights" with respect to someone else's copyrights.

The concept that this puts any restrictions on the hardware manufacturer is also absurd. The hardware does not have to change. All that is required, if and only if the hardware restricts the running of unsigned binaries, is a single key, that does not limit any functionality that any of the distributed software has, be distributed with the source code. Is that so hard? One little key for the owner of the hardware to use?

Re:The problem with signing

[LuYu]

And the GPL can easily be extended to hardware- thats what the GPLv3 does. It ensures that if you use GPLed code in your hardware product, that the user must maintain the right to modify the code. It protects the principles of Free Software that the GPL was created for. If the hardware maker wants to take away my rights as a user, they can write their own damn software to do it with.

No, the GPLv3 does not extend to hardware. This incorrect way of stating your perceived rights is what is harming the GPLv3 in the minds of hardware manufacturers. If you value the new clarifications in the GPLv3, you should realize that the clarification still applies to software (or a piece of data, in this case) rather than hardware and frame your rights arguments in that context. Otherwise, the hardware manufacturers are going to get the wrong idea, pack up their kit, and leave the playroom.

I quote an earlier post of mine: All that is required, if and only if the hardware restricts the running of unsigned binaries, is a single key, that does not limit any functionality that any of the distributed software has, be distributed with the source code.

Further, by denying that GPLed software can constitute an "effective technological protection measure" in Title 17, the GPLv3 protects anyone modifying the code from the now infamous DMCA criminal prosecution for circumvention of technological protection measures and protecting the user's freedom to tinker.

These things are all about software and law. Hardware is not an issue. Try not to freak the hardware manufacturers out too much.

Re:The problem with signing

[LuYu]

Now, some retailer offers a 'special discount' if you buy Company A's hardware and Company B's software together. When you get home, all you need to do is stick a CD into the hardware device, and everything installs and is ready to run. But - you cannot modify the software and run it on the hardware.

Either Company B or the retailer are responsible. One of those two must possess some method (signing key, hidden script, information on the CD, etc.) of telling that hardware to run when other software cannot, and that method must be distributed by the company that possesses it. Someone has a method to run software -- otherwise it would not run -- on that computer, and that person or company has to distribute that method if they distribute GPLed software.

Re:The problem with signing

[kripkenstein]

In the example, (1) the software company isn't to blame - they just put out a software product (in theory, anyone could make hardware to run it). (2) The hardware company isn't to blame - sure, they only run software by a specific company, but they do NOT sell software - and therefore cannot be held to a software license (which the GPL is). (3) A retailer that sells the two products together at a discount also isn't to blame - they just give a discount for a certain type of purchase. They would also sell the two products separately.

To be specific, the method by which the hardware manufacturer makes sure only certain software runs on his hardware can be done WITHOUT help from the software company. For example, the hardware manufacturer could buy the software product, create a signature from the binary, and then create hardware that only runs with that binary.

Tell me where you disagree.

Re:The problem with signing

[sumdumass]

the odd thing is that the right to modify your code has nothing to do with what machine it runs on. Thats my point. Nothing in the GPL says that any GPLed code should run on and specific hardware. Nor should it.

I should be able to create a device, lock it into only using my version of software while it does what it was intended to do (for whatever reasons) and then give that software to the comunity under the GPL without losing control over how my device operates. I also should be able to do the same while the device uses license material from other content providers with having to give a license from those other content providers to every one downstream outside what the original license was ment to cover(my code running as my company developed the device for).

GPLv3 draft2 wants to take that away and it is wrong.

Re:The problem with signing

[nlago]

This is where we disagree - the ability to install is different from the ability to run a specific piece of code. It installs, but the hardware will not allow it to execute because it does not match the originally installed piece of code; and the GPL does not require execution only installation, so they are in compliance with the license.

How about this, then: you ask a guy (me!) if it would be possible to install windows XP on your pentium 233MHz with 32MB of ram for a fee. The guy (me!) says, "sure, no problem", plugs an extra 128MB of ram on the machine, installs windows (after a long time ;) and removes the 128MB of ram. Now, windows will not run on that computer, because the minimum ram required for windows is 64MB. Would you pay the guy (me!)? You asked for the software to be installed and, by your definition, it is. I could even go as far as saying I "installed" windows on a powerPC-based macintosh by your logic, by just perfoming an installation on a PC and copying the files over to the mac.

Now, where I (and hopefully others) come from, it would be obvious to anyone that the guy screwed you up, because it is only obvious that if you asked for a windows installation it's because you intend to run said copy of windows. But maybe this is just me...

Also, let's not forget that the GPL includes a preamble explaining the spirit of the license, which is "to guarantee your freedom to share and change free software--to make sure the software is free for all its users"; it also mentions that "To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights."

So, even if this specific portion of the GPL is not written in legalese, it is part of the license and is open to interpretation in order to clarify dubious issues (such as this one we are discussing). And do you really believe that actively preventing the user from running a modified version of the software on the hardware in which the distributor installed it does not qualify as breaching the "restrictions that forbid anyone to deny you these rights"? There would be a lot of talk on a court, sure, but in the end, if the lawyers are competent, I could bet what the outcome would be. The new GPL is supposed to simplify the talking, it does not add anything really new in this regard.

Re:The problem with signing

[Registered Coward v2]

How about this, then: you ask a guy (me!) if it would be possible to install windows XP on your pentium 233MHz with 32MB of ram for a fee. The guy (me!) says, "sure, no problem", plugs an extra 128MB of ram on the machine, installs windows (after a long time ;) and removes the 128MB of ram. Now, windows will not run on that computer, because the minimum ram required for windows is 64MB. Would you pay the guy (me!)? You asked for the software to be installed and, by your definition, it is. I could even go as far as saying I "installed" windows on a powerPC-based macintosh by your logic, by just perfoming an installation on a PC and copying the files over to the mac.

Now, where I (and hopefully others) come from, it would be obvious to anyone that the guy screwed you up, because it is only obvious that if you asked for a windows installation it's because you intend to run said copy of windows. But maybe this is just me...

Your example has no relevance to whether or not the GPL requires modified code to be capable of running on the original hardware. You performed tasks to do an install then undid modifications required to install, which is different from modifying code and then expecting it to work.

Also, let's not forget that the GPL includes a preamble explaining the spirit of the license, which is "to guarantee your freedom to share and change free software--to make sure the software is free for all its users"; it also mentions that "To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights."

So, even if this specific portion of the GPL is not written in legalese, it is part of the license and is open to interpretation in order to clarify dubious issues (such as this one we are discussing). And do you really believe that actively preventing the user from running a modified version of the software on the hardware in which the distributor installed it does not qualify as breaching the "restrictions that forbid anyone to deny you these rights"? There would be a lot of talk on a court, sure, but in the end, if the lawyers are competent, I could bet what the outcome would be. The new GPL is supposed to simplify the talking, it does not add anything really new in this regard.

Well, IANAL, but as I recall specific generally trumps vague in a contract. Even so, TIVO has not impacted your "...your freedom to share and change free software--to make sure the software is free for all its users" since you can still do that - even the preamble doesn't say squat about the ability to run modified software on the hardware it shipped with. It's about your ability to get the source and change it anyway you want and then it's up to you to get it to run; you could build non-keyed hardware and run your modified software. As a side note, once it's modified TIVO should no longer be obligated to allow access to their network with the moded software.

So yes, I do think that not ensuing modified code runs does not breach your rights under the GPL - you can get the source, change it, build hardware that runs it, redistribute your modified code; even create a TIVO competitor - so I'd say you enjoyed the same rights as TIVO did when the decided to use GPL code.

Interestingly enough, the GPL does address this type of issue:

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works.

So as long as the key checking is done separate from the GPL's code then they are on full compliance with the GPL, IMHO.

If you really believe what you wrote, any GPL V2 code can never be released under V3 since that would limit rights by adding new restrictions that did not exist under v2.

Re:The problem with signing

[LuYu]

(2) The hardware company isn't to blame - sure, they only run software by a specific company, but they do NOT sell software - and therefore cannot be held to a software license (which the GPL is).

So, in this example, is there any software that runs on the computer? If the hardware does not run software, how would be sold or even classified as a computer? Devices that do not do anything are useless. If it is designed and manufactured to run Linux, for instance, then the manufacturer would have to provide the keys or have no software for the hardware.

(3) A retailer that sells the two products together at a discount also isn't to blame - they just give a discount for a certain type of purchase. They would also sell the two products separately.

This person is the most to blame. If the hardware and the software are separate, and the software does not run unless signed, the software will not run on the hardware, and the hardware will be useless. If the hardware manufacturer signs this distributor's software, the manufacturer must give the key to the distributor in order for the distributor to legally sell the bundle. No one would buy the hardware if software to run on it could not be purchased. Software that cannot be modified after it is sold cannot be legally sold with the hardware.

The bundler has two options: (a) He can obtain a valid key from the hardware manufacturer, (b) or he can not sell the hardware. Since no one would buy hardware with no possibility of putting software on it, the hardware manufacturer would have to give up his key or file for bankruptcy.

As it appears to me, the GPL makes even the situation you are talking about far fetched, if not impossible. It seems that there would be no way to sell the hardware without giving at least one key away to the public, and that key has to enable all the functionality that the distributed software does.

Maybe I am wrong, but I just cannot see that end run working without somebody getting burned.

The FSF, GPLv3 and DRM

[Yvan256]

FSF has a thing against DRM. This article tries to explain why RMS isn't a DRM (Note that NewsForge is also owned by OSTG) fan and how GPLv3 is gearing up to protect against it.

I'm already busy gearing up to protect myself against acronyms overload, thank you.

Re:The FSF, GPLv3 and DRM

[91degrees]

Don't you mean "IAB, GUT, PMA, AO, TY"?

Unfortunately, slashdot insists that I add some lower case letters, kinda ruining the joke.

Lay off the acronyms?

[megaditto]

The FSF, GPLv3 and DRM, WTF, STFU, and RTFM

There, fixed it for you

Re:Lay off the acronyms?

[roman_mir]

TFIFY

I think...

[badasscat]

FSF has a thing against DRM. This article tries to explain why RMS isn't a DRM (Note that NewsForge is also owned by OSTG)

We'd better get the CIA and FBI involved, along with the RIAA, NTSB, MPAA, ABC, CBS, CNN, AOL, MSN, and NBC. Oh, and be sure to alert the EFF and NRA while you're at it. Note that I am not affiliated with the RNC or DNC, although I am a FOB.

Re:I think...

[Lars83]

You'd understand what's going on if you just RTFA.

Re:I think...

[Anonymous Coward]

They need to join the AAAAA....

The American Association Against the Abuse of Acronyms.

Re:I think...

[Anonymous Coward]

What about GNAA?

Re:I think...

[Anonymous Coward]

I thought the AAAAA provided automotive support to drunks...

(Alcoholics Anonoymous Automobile Association of America, to spoil the joke...)

Re:I think...

[Anonymous Coward]

TMI!

Re:I think...

[Anonymous Coward]

http://en.wikipedia.org/wiki/Fecal_occult_blood

?

Re:I think...

[nuremon]

What about Septuple-A?

Re:I think...

[fbjon]

Good lord, seeing the link I first thought it was about some occult practice that only wikipedia could have the stomach to write about.

Re:I think...

[shadowbearer]

  Great post... yup, you are definitely a Fucking Obvious Badass (tm) :-)

SB

Re:I think...

[bersl2]

ZOMGWTFBBQ!!! Quit it with the TLAs and FLAs!

Re:I think...

[roman_mir]

what is this thing, FOB? Fat Old Bastard? I am confused.

Of course RMS is not DRM!

[Anonymous Coward]

One of them tries to control what you can do by enforcing a system of burdensome legal restrictions, and the other is a system for managing digital rights.

Re:Of course RMS is not DRM!

[MustardMan]

oooooooo, sick burn

Eek!

[Anonymous Coward]

TMA, too many acronyms.

Summus interruptus

[PavementPizza]

why RMS isn't a DRM (Note that NewsForge is also owned by OSTG) fan Could you POSSIBLY have picked a worse place to insert that annoying conflict-of-interest disclaimer? Secondly, do you really think anyone cares if you guys happen to link to NewsForge?

Re:Summus interruptus

[linuxbert]

yes, i think its important that media (any media - print, blogs, tv, radio) disclose clearly any self-referential material. i hate watching the news and seeing stories about some event, and then jump to coverage of that media outlet participating in the event. If slashdot refers to an article that is produced by another site that is run by OSTG- it is the same media outlet and should be announced.

i agree though that in this case the disclaimer was ackwardly placed.

Re:Summus interruptus

[bradkittenbrink]

I don't think the disclaimer is awkwardly placed, I think the link text was chosen poorly. I think the slashdot editor was right in placing the disclaimer directly following the link (I'm assuming the editor had to do that). Whoever thought it was a good idea to say

<a href="http://trends.newsforge.com/trends/06/08/02/ 2210213.shtml?tid=147">why RMS isn't a DRM</a> fan

instead of

<a href="http://trends.newsforge.com/trends/06/08/02/ 2210213.shtml?tid=147">why RMS isn't a DRM fan</a>

is the one at fault here.

Could we use a few more acronyms?

[eck011219]

FYI, that article really ID's the SNAFUs with DRM and OSS as pertaining to the GPL. I was KO'd when I read it - IANAL, but I wonder if it's BS or OK. Maybe I'll keep it on the QT until I know. Gotta run - I need to have a BM so I can leave for my AA meeting ASAP.

Re:Could we use a few more acronyms?

[andphi]

I need to have a BM so I can leave for my AA meeting ASAP....
TMI?

Preaching to the choir?

[Anonymous Coward]

Hardly. Slashdot features some of the most anti-GPL trolls around =- they can put the Microsoft Marketing department to shame on occasion.

*waves to the trolls* Hi! This is for you!

1) The GPL is only ever a problem for you if you want to distribute someone else's work that they already let you use for free.

2) See point 1.

Gift horse, mouth, examination via the anus... all those are things that spring to mind when I hear complaints about how restrictive the GPL is.

Re:Preaching to the choir?

[Anonymous Coward]

Well #1 is a pretty big goddamn problem and is the sole reason the GPL is seen as restrictive! It places a huge restriction on the use of code that more sensical licenses like BSD dont have. If you pro-GPL zealots can't understand that, then we give up.

Re:Preaching to the choir?

[Hope Thelps]

It places a huge restriction on the use of code that more sensical licenses like BSD dont have.

Huge restrictions on use of code? It guarantees the right of recipients to reuse code.

Re:Preaching to the choir?

[AuMatar]

THe only restriction is to make sure that the code stays free and ensure the rights of the truely important person- the user- for eternity. If you pro-BSD zealots can't understand that, we give up.

Re:Preaching to the choir?

[chromatic]

I think you mean the redistribution of the code or any derivative works. If so, your problem is with copyright, not the GPL.

Re:Preaching to the choir?

[brainnolo]

Are you serious? I not a pro-GPL zealots, because being zealot about a license is really absurd. I write both open source and commercial software and i think very well what license to use when do open source. I usually (but not always) go for BSD for things like libraries, MIT for snippets of code and GPL for projects i would like to see develop as open source so i can back each and every fix/improvment done to the code (its my right). I guess we just have to use the right tool for problem every time.

Re:Preaching to the choir?

[Anonymous Coward]

Please do give up. If I release my code under the BSD license that code IS ALWAYS AND FOREVER OPEN. If I release my code under the GPL license that code IS ALWAYS AND FOREVER OPEN. There is zero difference in that regard.

If you want to change the BSD code or add it to your code or redistribute it to make the software world better, that is fine with me. I have no need to require that you give me all your code in return, I have not placed that restriction on you. After all, the mantra of OSS zealots is that open code ALWAYS produces better software. If that is the case, you will naturally open your codebase anyway - right, right?

What a joke.

Re:Preaching to the choir?

[kcbrown]

It places a huge restriction on the use of code that more sensical licenses like BSD dont have.

It places a huge restriction on the use of code the same way that a law forbidding you to hold another cognizant adult on your property against their will "restricts" your actions.

If you can't tell the difference between a restriction designed to maximize the freedom of all (which is the entire purpose of the GPL) from a restriction designed to reduce the freedom of all then you're beyond help or hope.

Re:Preaching to the choir?

[AuMatar]

I'm not an OSS zealot. I believe in the Free Software principles. If I use a BSD license my code is not forever free- it can be turned proprietary at any time. Any code that can be turned into a proprietary product at any time is definitely not free.

Re:Preaching to the choir?

[wild_berry]

I read the GPL to say that the software is free to have a life independent of my use, modification and redistribution; the BSD-style licenses say that the effort put into making the software is the free part of the job: anyone can take it and use it for themselves however they want. Depending on what you want to give away with your software, each has its appeal.

I applaud the altruism of releasing your work under a BSD-style license.

Re:Preaching to the choir?

[Millenniumman]

No it can't. It will always be free. The difference is that it can be used in proprietary software, and there is nothing wrong with allowing people that freedom.

OSS is properly a development model, not a philosophy.

Re:Preaching to the choir?

[Goaway]

The GPL is only ever a problem for you if you want to distribute someone else's work that they already let you use for free.

It is also a problem if I want to use their code in a project that is distributed under a license that is more free than the GPL. And I do.

Re:Preaching to the choir?

[AJWM]

then we give up.

Surrender accepted. Now go away and stop bothering us.

Oh, and GPL all your base on your way out.

Re:Preaching to the choir?

[AuMatar]

There's everything wrong with allowing that freedom- it detracts from the users freedom. This is why OSS fails- its only a development model, and not a particularly good one. Free Software is a philosophy, and its the philosophy that gave you pretty much every program running on your Linux box now.

Re:Preaching to the choir?

[WilliamSChips]

If you want to keep your libs open while allowing proprietary libs to link to them use the LGPL. If you want people to adopt your standard as fast as possible use BSD.

Re:Preaching to the choir?

[AJWM]

Slashdot features some of the most anti-GPL trolls around =- they can put the Microsoft Marketing department to shame on occasion.

No, no, you misunderstand. Most of those trolls are the Microsoft Marketing department.

Re:Preaching to the choir?

[Millenniumman]

It doesn't detract from user's freedom. Just because some FreeBSD code is in proprietary software doesn't make FreeBSD any less free for users.

Re:Preaching to the choir?

[Anonymous Coward]

The difference is that it can be used in proprietary software, and there is nothing wrong with allowing people that freedom.

There is nothing wrong with that in the same sense that there is nothing wrong with worshipping [insert God of choice]. When you start saying right and wrong here, you're back in philosophy, whether it's yours or the FSF's.

In the FSF's philosophy, the "wrong" in using your code in proprietary software is that the public loses the modifications they made to your code. Plus, since they believe that all code should be free, the fact that the code in question is proprietary in the first place is "wrong".

Really, it's down to "if I create something, and someone else figures out how to use it to do something I didn't, should I still get some credit?" The answers to this tend to vary based on the situation. If X invents foo, and Y patents "using foo to do bar", a lot of people get up in arms about Y patenting it when they didn't invent foo. Especially when someone else invented bar as well. (What's YOUR position on "... on the internet" patents?) Yet, if someone takes something someone else invented, polishes it up, and sells it as their own... why, that's the vast majority of modern commerce right there. Then theres also the issue of realizing that someone could be selling your own code back to you. I wonder what the programmers who developed the BSD code that got into Windows think when they buy Windows?

Re:Preaching to the choir?

[ClosedSource]

"It guarantees the right of It guarantees the right of recipients to reuse code."

Which is exactly what the BSD license does without the restriction.

Oh, I see. You were talking about the right of recipients to reuse code that the original GPL'd code writer didn't write and has no claim to. Yes, the GPL restricts the licensing rights of an author who extends GPL'd code. That's OK, because he agreed to the GPL license, but its absurd to claim that the restriction doesn't exist, it's right there in the GPL text.

Other people don't want to control the destiny of code they didn't write even if it's an extension of their own code. Those people choose the less restrictive BSD license.

Re:Preaching to the choir?

[Anonymous Coward]

"It places a huge restriction on the use of code the same way that a law forbidding you to hold another cognizant adult on your property against their will "restricts" your actions."

Please explain how this analogy has anything whatsoever to do with GPL vs. BSD.

Re:Preaching to the choir?

[ross.w]

So go to Microsoft or Borland and see if they'll let you use theirs instead. Good luck!

Re:Preaching to the choir?

[Goaway]

Borland? What the hell are you talking about?

Re:Preaching to the choir?

[Anonymous Coward]

Huh? If you release the source code for Widget 1.0.3 under a BSD license the source code for Widget 1.0.3 will ALWAYS be available and free. If someone takes Widget 1.0.3 and incorporates that into a closed source program called Foo 9.0 the source code for Widget 1.0.3 (YOUR core) will still be free. YOUR code is not affected at all.

What makes you zealots think you have any rights to the source for Foo 9.0? Its totally illogical.

Re:Preaching to the choir?

[kcbrown]

Please explain how this analogy has anything whatsoever to do with GPL vs. BSD.

Versus BSD, the analogy would be between having the law in question and not having it. In other words, would you prefer to live in a society where it was legal to hold a cognizant adult on one's property against that person's will, or where it was illegal to do so?

That's the difference between GPL and BSD. BSD allows you to do anything you want, including restrict the rights of others. GPL does not allow you to restrict the rights of others (it allows you to restrict the actions of others that would, in turn, restrict the rights of others, but that is the limit of the restrictions it allows).

Re:Preaching to the choir?

[WilliamSChips]

Until the proprietary modification becomes popular. Like it did with the original UNIX(although technically not BSD-licensed it ended up forking into 20 000 proprietary commercial Unices because its licence was close to BSD's) and to a lesser degree with XFree86(a lot of hardware makers made special versions of such for their hardware).

Re:Preaching to the choir?

[AuMatar]

Foo used my code, which I donated with the intention of keeping it free. WHat gives them the right to take it without also making it free? The BSD license does allow this- thats why the BSD license is a mistake which should never be used, and why I refuse to contribute to BSD projects.

Re:Preaching to the choir?

[Chops]

OSS is properly a development model, not a philosophy.

See, I can do that too:

OSS is properly a philosophy, not a development model.

Really, the point is for everyone to use the license that works for them :-).

Re:Preaching to the choir?

[Zerathdune]

I seriously doubt that the parent thinks proprietary liscenses are better than than the GPL.

Mussolini was definately much worse than nixon, but to imply that that makes nixon acceptable is a logical fallacy.

(Disclaimer: I personally have no problem with the GPLv2. Still haven't decided about 3.)

Re:Preaching to the choir?

[Brandybuck]

Free Software is a philosophy, and its the philosophy that gave you pretty much every program running on your Linux box now.

Except for X.org. And Apache. And Perl. And Python. Etc. Etc.

Re:Preaching to the choir?

[Brandybuck]

it can be turned proprietary at any time.

How? How can it possibly be made proprietary? Under what possible mechanism can this be done? Is Bill Gates going to come send some thugs over to my colo and physically steal the server hosting my software? Is he going to send thugs over to each of my users to physically rip the harddrives out of their systems?

Digital nformation (including software), can be infinitely and accurately copied without cost. This makes it impossible to unfree free software. Regardless of license. No one can take away my software or my users' software without their permission. The most they can do is to make a fork. But only the fork will be unfree. The original is still as free as the day it was released.

Re:Preaching to the choir?

[dvNull]

Uhmm if I get a copy of the now defunct BSD/OS, I dont have the right to reuse code. I don't have the right to make a derivative product based on it and redistribute it.

The issue is that with the BSD license, people who receive your code, can now restrict others from using it in any way they please including yourself if they so wish. While this may not be a problem for many people, it is for others. The GPL was written to make sure that everyone who gets the code has an _EQUAL_ right to it.

Re:Preaching to the choir?

[Brandybuck]

That's the difference between GPL and BSD. BSD allows you to do anything you want, including restrict the rights of others. GPL does not allow you to restrict the rights of others (it allows you to restrict the actions of others that would, in turn, restrict the rights of others, but that is the limit of the restrictions it allows).

While on the surface this sounds pleasingly libertarian, it has a grave flaw, and that flaw is a fundamental misunderstanding of rights. A right is a property. All natural rights can be be traced back to the ownership of property, including the ownership of the self. Likewise, all good law can be traced back to a prohibition against trespass or violation of property. The reason why your right to swing your fist ends at my nose is because my nose is my property.

But what of the "right" to modify someone else's software? It depends on your view of copyright. If copyright is a "right", then you do not have the right to distribute someone else's software without their permission, as it is not your property. The FSF supports copyright and views copyright favorably, as evidenced by their rigorous arguments in favor of a copyright-based license.

But let's suppose that the FSF was tremendously confused, and really did favor the complete abolition of copyright, despite their actions to the contrary. In that case, formerly GPLd software would now be in the public domain. Ownerless. Software would no longer be property, but as free and malleable as the water we drink. But wait! If you put water in a container it becomes property, as evidenced by your getting arrested by stealing bottled water out of a store. Software can similary be put into containers of sorts. Encryption is one example. Or you can place it under a EULA (contract law still exists). You may have the right to distribute software that isn't owned, but you don't have the right to distribute software you legally agreed not to distribute.

But because we do have copyright in the real world, you don't have the right to distribute software other people have written. You can argue that you should have that right, that software should not be property. But if you do, you need to also argue AGAINST the GPL and other copyright-based licenses.

Re:Preaching to the choir?

[Millenniumman]

No one is entitled to software. If I choose to share my code for free, that is my choice. If I choose to keep it, that is also my choice.

If someone GPLs their application, then those rules should be followed, and the same is true of proprietary code.

I think the GPL/LGPL is great in some situations. The QT licensing scheme is great, but it is limited in the situations that it works. LGPL would be near perfect, if not for the limitations of libraries.

What I dislike about the FSFs philosophy is it's opposition to proprietary software. If people make their program and want to keep it, that is their choice. No one has an inherent right to it.

Patents and copyrights are totally different. I think that patents should only be given for real, original inventions. As far as I'm concerned, anyone can copyright their art, writing, or code however they like.

If I was one of those programmers, I would be proud to have my code on nearly every computer in the world (Mac OS X uses it too, and Linux might). If I had expected compensation, I wouldn't have released my code as open source.

Re:Preaching to the choir?

[Arker]

Because we do have copyright laws, we work within them to maximise liberty regardless.

Copyleft is a hack of copyright law towards that purpose. It's very valuable and useful inside that context.

But anyone that things copyright is property needs to go back to square one and figure out what property is again. I highly recommend Ludwig von Mises' Liberty and Property as a good starting point.

Copyright is not property, 'intellectual property' in general is not property. It's privilege, and the antithesis of property. I'll happily give up the GPL the day that 'intellectual property' privilege is gone across the board. Until then, it's a wonderful tool to preserve some sanity inside an insane system.

Re:Preaching to the choir?

[kcbrown]

While on the surface this sounds pleasingly libertarian, it has a grave flaw, and that flaw is a fundamental misunderstanding of rights. A right is a property. All natural rights can be be traced back to the ownership of property, including the ownership of the self. Likewise, all good law can be traced back to a prohibition against trespass or violation of property. The reason why your right to swing your fist ends at my nose is because my nose is my property.

Then by your own argument (that all natural rights can be traced back to the ownership of property), copyright isn't a natural right. Copyright is a restriction on the freedom to copy a work that, if it were treated the same way as all other property is treated, belongs to the possessor. The work is theirs because they either paid for it, which literally means they exchanged their labor for it, or it was freely given to them. That it happens to be a clone and thus identical to another work is irrelevant -- the concept of property does not distinguish between a copy and an original. Copying is merely another action that one can take involving said property that happens to produce an identical object. If it were as easy to copy material objects as it is to copy information, I rather doubt that you would have any issues with it. In short, I rather doubt you'd insist on artificially restricting someone's ability to do so, because you'd treat the physical object in their possession as their property.

So copyright is an artificial restriction imposed by society for a purpose. It happens that the purpose is spelled out in the Constitution: to promote progress in the sciences and useful arts.

But what of the "right" to modify someone else's software? It depends on your view of copyright. If copyright is a "right", then you do not have the right to distribute someone else's software without their permission, as it is not your property. The FSF supports copyright and views copyright favorably, as evidenced by their rigorous arguments in favor of a copyright-based license.

I think you're somewhat confused (but of course, there is always the possibility that it I who is confused). The FSF's support of the GPL (or, more precisely, the principles it embodies) is independent of the existence of copyright. They would support its stipulations whether or not copyright existed, because as you point out yourself, even if copyright didn't exist, restrictions could be enacted via contract. So the GPL would, in such an environment, likely be a contract rather than a license -- a contract whose purpose is to ensure that all parties are able to do examine, modify, and distribute the software in question.

But because we do have copyright in the real world, you don't have the right to distribute software other people have written. You can argue that you should have that right, that software should not be property. But if you do, you need to also argue AGAINST the GPL and other copyright-based licenses.

Here you are most definitely confused. Argument against copyright is not argument against the GPL as such, because the GPL is the embodiment of a set of principles which are valid regardless of the existence of copyright. That set of principles is, in every way that matters, the same as the set of principles which were used to draw up the Constitution. The primary principle is dirt simple: you have the right to do anything you want, so long as in doing so you don't infringe on someone else's right to do anything they want.

Those who argue in favor of copyright and "intellectual property" are really arguing against that principle. They want to give "intellectual property owners" the ability to limit and control what others do. That is the very antithesis of liberty. I certainly understand why copyrights and patents exist (to promote progress in the sciences and the useful arts), but most

Re:Preaching to the choir?

[Anonymous Coward]

I couldn't care less of Python, Perl and Apache : 99% of the software i run in my computer, from midi music editing to my photography hobbies are GPL'd or LGPL. The one percent left for the stupid xorg.

Re:Preaching to the choir?

[anandsr]

And who decides what is more free.
Yes you make it more free and then go and use it in your own product after closing it down.
If the license does not protect the software from becoming unfree then it is not a good license.
Unless we are talking about protocols, there is no way that I will want to use BSD license.

Re:Preaching to the choir?

[anandsr]

Yes you wouldn't even want anybody to know that your code is running on every computer in the world. Just like the BSD TCP/IP stack writers. But it is only good for this particular case, writing interoperable interfaces.

Re:Preaching to the choir?

[anandsr]

Copywrite is not bad per-se. But currently it is insane. Look at the time limit. Look at the lack of fair use. Look at the automatic copywriting.

Repeat after me. Works are not created in a void. They are created after assimilating thoughts occuring in the public domain.

If you create a chair, you have paid for the wood, the tools and everything else except the design. So I agree that you have property rights to it.
But when you create mickey mouse then I don't agree that you have property rights to it unless you have paid for the steam boat willy's ancestor or any and all public domain ideas that you used for creating that movie. I could recognise that you have some privilege for having created something, and can allow you a limited time monopoly over its distribution. But that is the extent of it. Nothing more nothing less. And in case of patents, independent discoveries should be allowed. If somebody recreated something without the original creators help why should original creator given any benefit at all.

The whole point of the copywrite and patents is to enrich the public domain, to provide an incentive to the authors to generate works and to the inventors to open up their invention so that others can view. They are not because anybody can keep then hostage forever and disallow others from coming up with the same ideas. They are not their to impoverish the public domain and to allow everybody to create new fiefdoms.

Unless the public domain is rich, thoughts will not have a rich source. The fact of life is that you need the public domain to thrive. The current IPR regime is stiffling the public domain. That is why we need copyleft, creative commons, etc licenses to bring some sanity back to this insane IPR world.

Repeat after me. IPR is evil.

Re:Preaching to the choir?

[Anonymous Coward]

Please learn your Unix history. Unix(TM) started life as a the proprietary "intellectual property" of Bell Labs. Since Richie and Thompson where concerned with doing research, they let the sources escape into the wild without much concern for copyright or licenses - which later resulted in a large legal mess that took some years to sort out (see AT&T vs. Berkley).

Re:Preaching to the choir?

[ClosedSource]

"The issue is that with the BSD license, people who receive your code, can now restrict others from using it in any way they please including yourself if they so wish."

No, you're absolutely wrong. If I write BSD'd code nobody can restrict it in any way shape or form. Yes, if they incorporate my code in their own application they could restrict that code, but my code reamains unrestricted.

Re:Preaching to the choir?

[Goaway]

And who decides what is more free.

How about assuming that "more free" means "contains less restrictions". Sounds free to me.

PS: The GPL doesn't prevent me from changing my mind and closing the source of future versions. Releasing under a more free license doesn't allow me to suddenly make previously released version non-free. The only thing the GPL prevents is somebody else using the program in a closed product. And you know what? I don't care if they do. If they want to, they're free to. It doesn't hurt me or any other users one bit.

Re:Preaching to the choir?

[tinkerghost]

The only thing the GPL prevents is somebody else using the program in a closed product. And you know what? I don't care if they do. If they want to, they're free to. It doesn't hurt me or any other users one bit.

It does however hurt the other developers. By not returning their improvements to the code to the community, they are stealing from all of the developers who contributed to the initial code. If you don't care if people/companies contribute their improvements back to you/the community, use the BSD liscense. The essense of GPL is, "We made this with our time & effort, if you use it as the basis for your product, you have to share your time & effort by giving the changes back so we can learn from it." That's true for both v2 and v3. The difference is that v3 includes a prohibition against Trusted Computing.

Re:Preaching to the choir?

[Goaway]

How, exactly, does not returning improvements hurt others? Obviously, you benefit if people do return their improvements, but you really can't argue it actively hurts anyone. You have exactly the same resources at hand before and after.

I release stuff more freely than the GPL because, first, I trust people to be decent enough to return their improvements, and second, because I know it's in people's best interests to do so because if they fork the source to keep their improvements to themselves, they'll have a hell of a time porting over all the changes from the public source, and thirdly, because even if they don't, it does not hurt me.

There is also a fourth reason, which is that if I do not tie people down with the GPL, more people can use my code, and that makes me happier. I am not offended if my source ends up in a closed project. I feel honoured. Code like zlib, libpng, the IJG's libjpeg, and SQLite are all free to use, and used in massive numbers of both closed and open projects. I do not think their developers are kept up at night because closed projects use their source. They want people to use their code, no matter what.

Re:Preaching to the choir?

[sveinungkv]

Can I ask you what makes you belive that you are entitled to take other peoples work and not give what they ask for in return? To me it sounds like many people that argue against the GPL apply doubble standards: they should get to use everything they want to use unrestricted, but other people should obey the restriction they add to their software.

Re:Preaching to the choir?

[Brandybuck]

Since you're recommending von Mises, I'm assuming you're a libertarian. Most libertarians support contract law. EULAs are contracts. A copyright free world does not imply a EULA free world. How does this fit into a libertarian's Free Software philosophy? Why is proprietarizing software via copyrights immoral, but proprietarizing it via contracts and agreements not?

Re:Preaching to the choir?

[Brandybuck]

Repeat after me. IPR is evil.

IPR is evil
GPL is IPR
GPL is evil

Re:Preaching to the choir?

[Brandybuck]

Then by your own argument (that all natural rights can be traced back to the ownership of property), copyright isn't a natural right. Copyright is a restriction on the freedom to copy a work that, if it were treated the same way as all other property is treated, belongs to the possessor.

Possession does not define property. I can lend you my property, so that you possess it, but it is still my property. I can let people swim in my pool, but it is still my pool. Even if I put a sign up saying "free to use", it is still my pool.

I do agree with you however that copyright is an artificial property. I would shed no tears if copyright were abolished.

I think you're somewhat confused (but of course, there is always the possibility that it I who is confused). The FSF's support of the GPL (or, more precisely, the principles it embodies) is independent of the existence of copyright. They would support its stipulations whether or not copyright existed, because as you point out yourself, even if copyright didn't exist, restrictions could be enacted via contract. So the GPL would, in such an environment, likely be a contract rather than a license -- a contract whose purpose is to ensure that all parties are able to do examine, modify, and distribute the software in question.

The FSF takes great pains to emphasis that the GPL is NOT a contract. If they truly do not believe in copyright, then they can change their license to be a EULA.

But beyond that, the principals the GPL espouses are not natural rights. Reciprocity does not exist in nature. If software is not a property, then why must I pay for it via the payment of reciprocity? Why must I make modifications available. Another principle of the GPL is the availability of source. But what natural right does the user have to demand my source code? If in a world free of copyright, what prevents me from releasing binary-only software?

The "rights" of the GPL are not natural rights, and require the coercive power of the state to enforce. Even if the GPL were a EULA, the FSF still argues that these "rights" should exist for ALL software.

In short, the FSF is arguing against one legal system of intellectual property, in favor of their own legal system of intellectual property. They want to replace coercive copyright with coercive copyleft.

If they truly believed that software should not be owned, then they would not be actively arguing AGAINST the public domain.

Re:Preaching to the choir?

[kcbrown]

Possession does not define property. I can lend you my property, so that you possess it, but it is still my property. I can let people swim in my pool, but it is still my pool. Even if I put a sign up saying "free to use", it is still my pool.

But I'm not talking about lending or renting an existing object that you own, I'm talking about possessing a copy of an object you own. A copy that you either gave to me or sold to me. You still have the original. In that case, I, and not you, own the copy by any reasonable definition. Copyright adds restrictions on what I can do with a copy that I own that would not exist under any other rules governing property. Hence, copyright is very definitely not a natural right by your own definition of natural rights.

The FSF takes great pains to emphasis that the GPL is NOT a contract.

I think you misinterpreted what I was saying. The GPL is not a contract right now because it currently exists in an evironment of copyright. What I was saying is that the GPL would probably be a contract in an environment where copyright didn't exist.

If in a world free of copyright, what prevents me from releasing binary-only software?

Nothing at all. That is why I stated that in a world free of copyright, the GPL would probably be a contract. The FSF's goal isn't a world free of copyright, it's a world in which everyone has the same rights to use, modify, and distribute software (and, likely, other forms of information). A world in which everyone is equal in that regard.

The "rights" of the GPL are not natural rights, and require the coercive power of the state to enforce.

The "rights" of the GPL are the right to use, modify, and redistribute code. Those rights are natural rights just as surely as is your right to use, modify, and distribute anything else you own. The GPL adds only one basic restriction: you may not prevent the recipient of your distribution from using, modifying, and distributing what you gave them (that, and you have to give it to them in the same form you received it).

Those rights listed above do not require the coercive power of the state to enforce. The restriction is the only thing that does.

That restriction is the same as the restriction on you that says that you may not hold another cognizant adult on your property against their will. Your argument about self-ownership doesn't fly in that case, because you don't have to violate someone's person in order to hold them against their will. You merely need to make it physically impossible for them to leave. And since they'd have to traverse your property in order to leave, one can easily argue that your property rights trump their right to travel, since that very same argument is used to define tresspass to begin with.

The bottom line is this: as much as you might like to think otherwise, liberty and property are not at all the same thing. The FSF is interested in liberty. And so are you, when you really think about it. Property is about stability and control, but liberty is about freedom of action. In the end, it is freedom of action that we as human beings are ultimately interested in: we want to be able to do what we will. We have property in order to allow us to take certain actions that without said property we would not be able to, or at least not always be able to. But it is freedom of action that we truly crave.

Re:Preaching to the choir?

[Arker]

First off EULAs are not contracts. Lack of consideration alone voids them as contracts, and they have other defects as well.

Proprietizing it through valid contracts, negotiated and signed prior to purchase, might be something that should be legal. That doesn't mean that it would be practical, nor does it mean it would be good. Not everything immoral or stupid is illegal - nor should it be. If you'll think about it for a moment, any legal system so far reaching it could prevent anyone from doing anything immoral, or stupid, would be an oppressive system evil in itself beyond all measure.

DRM isn't the problem

[gr8_phk]

Suppose MS wanted to run Free Software on the next XBOX and didn't want people to mess around with it. They could have Intel modify a processor any number of ways (change the opcodes for a SIMPLE example) and provide a proprietary tool chain to compile the code. No DRM, yet the users have no way to modify and run the code on that hardware. Does GPL need to require a complete tool chain be provided when binaries are provided? It seems overkill, but custom (closed) hardware running free software defeats the GPL in the same way as DRM. I need to read the new draft, but I think it suggests the broader concept of denying freedom more than DRM in particular. Thoughts?

Re:DRM isn't the problem

[vertinox]

Suppose MS wanted to run Free Software on the next XBOX and didn't want people to mess around with it.

For starters, I don't think MS would ever do that and if they did they wouldn't use GPL but some other kind of license they came up with.

Re:DRM isn't the problem

[Reverend528]

Well, in that example, there would be nothing stopping the end users from reverse-engineering the hardware and duplicating the proprietary tool chain.

Re:DRM isn't the problem

[SanityInAnarchy]

So what's to stop us from reverse-engineering the hardware and disabling signature checks, or simply stealing the keys?

Personally, I have no problem with requiring an open tool chain. Really, why are compilers still being sold? Make your money with tools like Photoshop, or Lightwave, or whatever other tools are required to make the content. Or use LGPL'd stuff and sell a proprietary library. Or...

People who call the GPL "viral" and such really need a little imagination.

Re:DRM isn't the problem

[emurphy42]

if they did they wouldn't use GPL but some other kind of license they came up with.

If they did, then they might well want to run some existing piece of free software that was only released under the GPL.

Re:DRM isn't the problem

[Anonymous Coward]

The DMCA prevents that if the device is capable of playing any protected media file.

Re:DRM isn't the problem

[Jerome H]

And then they will put in the EULA : "You aren't allowed to reverse-enginer this hardware."

Linus needs to join the party

[Bryansix]

But Linus Torvalds, the creator of Linux, has a problem with this. He says that he himself signs the Linux kernel, and that that's his way of telling everyone, "You can trust this, it's from me." In an email message to the Linux Kernel Mailing List (LKML) on 23 April, he says that there are two types of keys: "One is an external key that is applied _to_ the kernel (OK, and outside the license), and the other one is embedding a key _into_ the kernel."

GPLv3 says that if any GPLed software carries an embedded key, this key should me made available to the users, but it makes no demands on the first kind of key. Linus has said that he would never distribute his signing keys, but the GPLv3 does not require him to release them. The key he talks about only describe the trustworthiness of the kernel. It in no way affects the freedoms of copyleft. It's only the embedded keys, which can be used to nullify the freedoms offered by copyleft, that need to be released.

Linus has repeatedly claimed that it is not for a license to decide how a manufacturer uses digital keys. He says the key are firmware, and therefore a software license has no scope or reason for controlling this.

Linus, the license has all kinds of business specifically prohibiting DRM on hardware that runs GPL licensed software and requiring internal keys. The reason they have to do this is because people like to ignore the GPL while using GPL software. These people should be sued. Changing the license to specifically prohibit certain illegal actions will make it easier to sue these violators later.

I hope that Tivo get's taken to court. It would be a triumph for open source efforts.

Re:Linus needs to join the party

[Decameron81]

The reason they have to do this is because people like to ignore the GPL while using GPL software.

Technically speaking they are not ignoring the GPL.

The purpose of the GPLv2 was never to force all hardware to run your custom software, it was to force other developers to publish their own changes to your code (please note that I am talking about the intents of the GPLv2, not the intents of the FSF). In other words: feel free to modify the software... just don't expect it to run in my hardware. And Linus simply chose the GPLv2 to distribute the kernel based on its intents, and not on the FSF's agenda (ie: the "quid pro quo" argument made by Linus demonstrates this point).

I realize that there's a lot of people here that think this is wrong, and I respect that choice. But why can't Linus make his own choice? Isn't him in his full right to do so?

Re:Linus needs to join the party

[DaveAtFraud]

I hope that Tivo get's taken to court. It would be a triumph for open source efforts.

Er, no it wouldn't. Here's why...

The TiVo license applies to what can be run on the TiVo hardware device. You are free to download the TiVo source, modify it as you see fit and run it on any compatible device; the TiVo device itself just isn't one of these. You are also free to attempt to hack the TiVo hardware to allow non-signed software to run but this is a different problem (and probably voids the warranty).

Tivo meets all of the requirements of GPL v2 and, chances are, it will meet the letter of GPL v3. It would be very difficult for a software license to restrict what a hardware vendor does.

Cheers,
Dave

Re:Linus needs to join the party

[mrchaotica]

please note that I am talking about the intents of the GPLv2, not the intents of the FSF

The intents of the GPL v.2 and the intents of the FSF are exactly the same. The trouble is that the letter of the GPL v.2 fails to reflect that, which is why the FSF is coming out with the GPL v.3. It doesn't change the intent; it just fixes some bugs.

Re:Linus needs to join the party

[pinky0x51]

>The purpose of the GPLv2 was never to force all hardware to run your custom software,...

it isn't the purpose of GPLv3 either.

>it was to force other developers to publish their own changes to your code (please note that I am talking about the intents of the GPLv2, not the intents of the FSF). In other words: feel free to modify the software... just don't expect it to run in my hardware. And Linus simply chose the GPLv2 to distribute the kernel based on its intents, and not on the FSF's agenda

That's the "mistake", Linus doesn't choose the license based on its intents he choosed the license based on his intents. Linus hat looked at the license interpreted it and decided that it "technically" fits his needs. But it seems that he has never understand the intent of the license.
The intent of the license is the intent of it's creator and that's the FSF. And the intent of the FSF is pretty clear and was always the same. It's not about publishing source code or writing better software. The intent is that every user should have the 4 freedoms defined as Free Software. If you now start do design your hardware+software distribution in a way that removes some of the 4 freedoms you do something which was not the intent of the license and the logical step is to close this hole by releasing a update of the license.

Re:Linus needs to join the party

[pinky0x51]

i completely agree with you.
I just wan't to make this sentence a little bit clearer:

>The trouble is that the letter of the GPL v.2 fails to reflect that, which is why the FSF is coming out with the GPL v.3.

The letter of the GPLv2 doesn't really fails to reflect the intent of the GPL and the FSF. But it refects it in the world we had 1991. Since 1991 law and technology has changed which created some holes in GPLv2. GPLv3 will close this holes and will refelct the same intent GPLv2 did but orientated on the world of today (2006).

Re:Linus needs to join the party

[Anonymous Coward]

The intent is that every user should have the 4 freedoms defined as Free Software. If you now start do design your hardware+software distribution in a way that removes some of the 4 freedoms you do something which was not the intent of the license and the logical step is to close this hole by releasing a update of the license.
 
Then they should have worded it that way.

Re:Linus needs to join the party

[Alsee]

The purpose of the GPLv2 was never to force all hardware to run your custom software

Well duh, of course not. Cray software is not intended to be run on an Atari 2600, and the GPL does not expect or require it to run on an Atari 2600.

The purpose of the GPL is and was that you had to supply the complete source code required to modify and compile working software on the intended system.

Well, Tivo is indisputably violating the spirit of the original GPL, and Tivo is arguably violating the current text of the GPL. Tivo is supplying DELIBERATELY INCOMPLETE source code. They are deliberately leaving out a critical component of the source code they need and use to compile a working executable. They use a crypto key during the compilation process of making a working executable. If they did not utilize this key during compilation, even they themselves would be incapable of creating a working executable for the intended use on the intended system.

Software for a Tivo, the key is a functional component of the executable.

The GPLv3 simply clarifies that complete source code really does mean complete source, and that it specifically does include any keys they themselves needed in order to compile a functioning executable. This point is at best an "ambiguity" in the original GPL that needs to be clarified by the GPLv3, and it is at worst an actual loophole in the original GPL that needs to be closed by the GPLv3.

---

There is also a second "DRM-related" issue in the GPLv3. The original intent and operation of the GPL was that you were required to pass on the full legal rights to modify, use, and redistribute that derivative of *my own code*. When the GPL was originally written, this meant you had to pass along any needed copyright permissions and any needed patent permissions. However THE LAW HAS CHANGED, and the GPLv3 needs to be updated to preserve the original function of the GPL under the new law. In particular the GPLv3 simply clarifies that you cannot take my GPL code, modify it to a derivative work, and then turn around and sue ME under copyright, patent, or *DMCA/EUCD* law for using and modifing and redistributing that derivative of my own work.

The GPLv3 does not prohibit anyone from doing any and all the DRM they like in GPL code. However you cannot deny me the legal right to modify that code under the DMCA/EUCD in an attempt to deny me the legal ability to circuvent or remove that DRM scheme, and that you cannot supply deliberately incomplete source code in an attempt to deny me the practical ability to circumvent or remove that DRM scheme. You can do all they DRM you like, you just can't expect it to actually deny anyone any right or ability to do anything.

Trying to do DRM in connection to the GPL has always been nonsensical, when the GPL means that you have to pass on the legal right and practical ability to make any and all modifications. And now bizarrely we have people getting all up-in-arms that the GPLv3 makes that more explicit.

-

Re:Linus needs to join the party

[Brandybuck]

These people should be sued.

Yup, that's what freedom is all about. Suing people! Thanks to the hard work of RMS and Ebon Moglen, we now have an legal instrument to sue the shit out of people!

GPL: License to sue

Re:Linus needs to join the party

[Decameron81]

The intents of the GPL v.2 and the intents of the FSF are exactly the same. The trouble is that the letter of the GPL v.2 fails to reflect that, which is why the FSF is coming out with the GPL v.3. It doesn't change the intent; it just fixes some bugs.

The intents of the GPLv2 are only those stated by the license. I am not saying that they go against the interests of the FSF, just that they slightly differ from what the FSF would want to promote today (which is the GPLv3).

For this simple reason you can see that there's people out there who might have opted for the GPLv2 once upon a time (eg: Linus), but that did so for different reasons than those of the FSF. It's not surprising to see some of them not agree with the GPLv3.

WSE

[szembek]

Worst Summary Ever

Re:WSE

[Anonymous Coward]

Understandable: worst subject for an article ever.

Why does RMS hate DRM?

1. RMS is a person
2. everybody hates DRM
3. therefore, RMS hates DRM

Wasn't that simple?

He is against DRM, but that's not the point

[Ed Avis]

TFA gets it wrong. Richard Stallman is opposed to DRM; look at the 'Defective By Design' real-world protests of earlier this year. But that's not the point here.

Since the beginning the idea of free software (as rms sees it) is that if you use a program, you should have the freedom to modify it, among other freedoms. So if you have a Tivo, you should have the freedom to modify the software that runs on your Tivo. If Linux is GPLed, then it's clearly not allowed for the Tivo manufacturers to ship it with a label saying 'we forbid modifying the software'. It's also not allowed under the GPL for them to try blocking your freedom another way by withholding the source code. But under GPLv2 your freedom to change the program can still be taken away, by the manufacturer making the device only execute signed binaries (for which nobody but the manufacturer has the signing key). GPLv3 as proposed is about making sure your freedom to change the software running on your computer (or Tivo) isn't taken away like this.

Of course anyone can write GPLed software that has DRM restrictions. But if you use it, you should have the right to modify it, and remove the DRM if you don't want DRM on your computer. That is the important point.

Analogously: there is nothing in the GPL against charging a sum of money for the software. You can sell it for as much as you like. But if you do, the person who receives it still gets all the freedoms to use, share and change the program.

Re:He is against DRM, but that's not the point

[tchuladdiass]

Um, nothing that Tivo does prevents you from modifying the source for the GPL'd software they ship. You just can't run the modified version on the hardware they sold you. This is no different then if they put the binary on a non-flash chip, or some other read-only media.

So fundimentally, what's the difference between hardware only running signed code, and having the code on a PROM chip? Is the GPL V4 going to end up banning the use of read-only memory?

Re:He is against DRM, but that's not the point

[Anonymous Coward]

Yes, ANYONE can write free/open source software. You are also right that they can make it into DRMed hardware also, BUT with the GPL3 they won't be able to license it under the GPL3. They will just have to use their own license. ANYONE can just take the GPL3, cut out all the parts involving DRM and then use that as their own license 'MY-GPL' or some such.

Though, if they do this they will NOT be able to use any previously GPL3ed software (read: starting from scratch) or they may be able to find some of the increasing amounts of software opensourced but not under the GPL. There were a couple Slashdot articles about this several months ago

Re:He is against DRM, but that's not the point

[DrJimbo]

tchuladdiass said:

Um, nothing that Tivo does prevents you from modifying the source for the GPL'd software they ship. You just can't run the modified version on the hardware they sold you. This is no different then if they put the binary on a non-flash chip, or some other read-only media.

Since you have obviously not read either the pertinent sections of the GPLv3 or any of the explanations offered by its proponents, I will try to explain this to you again.

There is a huge difference between the DRM scenario and the non-flash ROM scenario and the GPLv3 is particularly clear about the difference. In a nutshell, the GPLv3 says that if one person can modify and run the code then everyone needs to be able to modify and run the code. So non-flash ROM is fine but DRM controlled computers are not.

I realize that it is a long standing tradition here at Slashdot for posters to state their opinions without RTFA. But I don't understand why there are so many anti-GPLv3 trolls. How can you be against the GPLv3 if you haven't read it and don't have a clue about what it says?

Re:He is against DRM, but that's not the point

[cortana]

I realize that it is a long standing tradition here at Slashdot for posters to state their opinions without RTFA. But I don't understand why there are so many anti-GPLv3 trolls. How can you be against the GPLv3 if you haven't read it and don't have a clue about what it says?

Astroturfers, or bitter pro-BSD partisans. Or maybe they are the same thing? ;)

Re:He is against DRM, but that's not the point

[Brandybuck]

Since you have obviously not read either the pertinent sections of the GPLv3 or any of the explanations offered by its proponents, I will try to explain this to you again
This isn't about the text of the GPLv3. This is about the moral difference between protecting code from modification by signing it versus protecting code from modification by burning it into a PROM.

And please don't quote the GPLv3 in your arguments regarding morality. Software licenses are NOT the basis of morality.

Re:He is against DRM, but that's not the point

[tchuladdiass]

I'm not trying to be an anti GPL3 troll, just pointing out a weakness in it. Basically, it is saying that if you pre-load gpl3 code onto hardware that is cripled in a certain way (i.e., hardware that will only run signed code), you must provide the ability for the end user to sign and run their own code. This is to prevent manufactures from making an end-run around the GPL by using code signing & locked-down hardware. However, this particualar clause in GPL3 does not address other ways of shipping cripled hardware that won't run your modified binaries. The example I gave was shipping the code on PROM's, that can't be updated, but manufactures may invent other ways of accomplishing the same goal (none of which would be prevented by the GPLv3). The most straight forward method I can think of is to impliment a hypervisor to run the OS, where the hypervisor has it's own enforcement rules that the OS won't be able to get around (since it isn't talking directly to the hardware). I think this is the method that Sony used to ship their Linux kit for Playstation (the Linux kernel didn't have direct access to all the fancy hardware).

Re:He is against DRM, but that's not the point

[DrJimbo]

Two issues.

1) Treacherous Computing vs. ROM
You seem to think it is a bug in the GPLv3 that allows code to be used on ROM'ed machines but not treacherous computers. I see this as a feature not a bug. You might want to look at Stallman's description of the problem with treacherous computing so we at least have a common reference point even if you don't agree with everything he says. Personally, I've got no problem with people using my GPL'ed code on ROM'ed devices, but I am very concerned about using my GPL'ed code on treacherous computers. This is why I see the distinction made between the two by the GPLv3 as a feature not a bug.

2)Treacherous Computing via Virtualization
If I understand your second point correctly, you're suggesting that a virtualization layer (like Xen or VMware) could impose DRM restrictions on GPLv3 code. IANAL, so you might want to run this past the good folks at the FSF and see if they thought of it already, but it seems to me that holding DRM keys in a virtualization layer would be no different from holding keys in hardware so I don't see how it could make an end run around the GPLv3.

As I told you before, the GPLv3 says that if one person can modify and run the code then everyone needs to be able to modify and run the code. It doesn't matter what type of thing holds the keys, hardware or software, the GPLv3 is all about who controls the keys. If the manufacturer controls the keys and not the computer owner, then it's not legal to use GPLv3 code.

If these GPLv3 issues are of any interest to you at all, you will save both of us a lot of trouble if you just read it for yourself at the GPLv3 web site and also read their opinion pieces, particular the one about DRM. If you still think they've missed something, you should contact them and let them know. There is a link to their comments page from both the FSF links I gave you above.

Re:He is against DRM, but that's not the point

[Ed Avis]

This is about the moral difference between protecting code from modification by signing it versus protecting code from modification by burning it into a PROM.

Perhaps 'moral difference' isn't the best way to judge this. The intent of the GPL is to get more freedom for computer users in practice. Practically speaking, the GPLv2 has been fairly successful here (at least in FSF's view), but as demonstrated by Tivo there are some cases where it's not guaranteeing the freedom of users to change the software running on their computers. If in practice a change to the licence can increase freedom in some cases, it would seem worthwhile.

It wouldn't make much sense to argue that because you can't block all possible ways for unscrupulous manufacturers to work around the GPL, you shouldn't try to block any of them. The existence of one theoretically possible but hardly seen method (burning GPLed code onto a ROM) isn't an argument for not doing something about a more common case (crippling the hardware so that Tivo, Inc. can change what runs on your machine, but you the owner cannot).

And then GPLv4 will come out

[everphilski]

... you hit the nail on the head. The problem here is that RMS and the FSF are trying to protect freedoms by placing restrictions on them. Kind of funny, if you think about it...

Re:And then GPLv4 will come out

[0racle]

It's called Free as in Richard Stallman. As long as he has no problem with what you're doing, you're free to do it, If he doesn't like it, he'll demonize it and try to 'protect' the world from it.

Re:And then GPLv4 will come out

[vertinox]

The problem here is that RMS and the FSF are trying to protect freedoms by placing restrictions on them.

Its kind of like a law that punishes people that kidknap you off the street and lock you in their basement.

Sure that restricts the kidnapper's freedom from doing what they want, but the hostages in the basement would beg to differ.

The point of these DRM restrictions allow the original author of the code to prevent people down the line from going against the spirit of the GPL by adding DRM to the code they so graciously received for free.

If these people want to use DRM they are free to do so but they can't use code of author's who disagree with DRM. Hence, if you want DRM use someone else's BSD or GPLv2 licensed code or write your own.

GPLv3 is for original author's who want their works not to be used in ways that violate free access to the code and what you can do with it.

Re:And then GPLv4 will come out

[IAmTheDave]

It's called Free as in Richard Stallman.

And he'll be the only one releasing software under GPLv3.

Re:And then GPLv4 will come out

[gr8_phk]

The problem here is that RMS and the FSF are trying to protect freedoms by placing restrictions on them.

Yeah, F*** those guys. It's like trying to make laws to protect people from other people. They must be clueless...

Re:And then GPLv4 will come out

[nsillik]

That reminds me of something that happened to me a few years ago.

I was kidnapped by this guy, and locked in his basement. I was reminded of this time that I was writing commercial software and couldn't link against a GPL'd library. If only there were some LGPL interface to kidnapping. ?

Re:And then GPLv4 will come out

[Anonymous Coward]

It's the old question about freedom being "do anything" or freedom as in "do almost anything but don't steal/murder because that hurts others".

I think the later gives me more freedom, so then the question is about which particular rules over others protect your freedoms.

If your goal is to keep source code open then BSD doesn't give you that.

Re:And then GPLv4 will come out

[Clod9]

It's not a problem, it's an elegant and necessary feature of their work.
The FSF cannot protect peoples' freedoms by mere talk...they have to use tools that are effective in an arena that is defined by vested interests who do not play according to individual notions of fairness.
The tools are laws, licenses, contracts, courts, and lawyers, and the GPL is a fine example of a sharp use of these tools.
Again, it isn't a problem, it's what levels the playing field in an arena that would otherwise be strongly tilted against individual freedom.

What's wrong with TiVo?

[Chris Pimlott]

I hope that Tivo get's taken to court. It would be a triumph for open source efforts.

Er, TiVo's one of the good guys, they release their source in compliance with the GPL.

Re:What's wrong with TiVo?

[stratjakt]

You can't do anything with it. I can't modify or use it. I can't get video off my series 2 tivo any way other than the god-awful tivotogo pita encryption scheme. I can't slam in a 500gb hdd and tweak it into a networked storage device, etc.

They comply with the letter of the "law", but not it's spirit. There's nothing open or free about tivo.

Re:What's wrong with TiVo?

[Bryansix]

Because if you RTFA you will see that TiVo makes it impossible to run modified code on it's hardware which effectively makes the source code useless to anybody.

Re:What's wrong with TiVo?

[SpaceLifeForm]

Yeah, but.

They don't make it easy to hack the box and put fixes or
enhancements of GPLed software on the box.

Tivo went overboard, and locked down the entire box when
they could have done the following alternative:

Provide the source (as they do).
Provide a build environment so you can make enhancements
or install bug fixes to the GPLed software (they don't).
Provide a method to update the box (reflash if needed) (they don't).
Make sure the box will boot any kernel with GPLed userland (they don't).

Tivo could do the above, and provide their signed proprietary
binaries, and everyone would be happy.

Because of Tivo, RMS has been gamed, and he and Eben have
come up with a more complicated 'solution' to the problem.

All the GPLv3 has to do (with regard to DRM), is to require
that distributors provide the source, provide the build environment,
provide their proprietary binaries, provide a method to update
the box, and make sure the box will boot even if you change the GPLed software.

Everyone will be happy, and the spirit of GPL will be preserved.

Re:What's wrong with TiVo?

[MojoRilla]

The irony here is that by requiring signed binaries, TiVO is both restricting and protecting users.

Sure, by requiring signed binaries, you are restricted to run code only from TiVO. This restricts what users can do with their own hardware.

At the same time, since these devices are now on networks, there is a real possibility of them getting hacked. If TiVO ran untrusted binaries, this probably would have already happened. Of course, this happens now with Series 1 TiVO's, but you can't put them on the net without hacking, and if you are smart enough to do that, you probably have a firewall. So in some ways TiVO is doing a good thing by only running trusted code.

It is an interesting tradeoff.

Re:What's wrong with TiVo?

[cgranade]

Really, what you need is to be able to allow any arbitrary key to be the key. With my FC5 system, I have to add the Livna key to my list in order to use RPM's key verification functionality. Of course, this does weaken security in some ways, but it enables it in others. What if TiVo bit the big one? Then any holes in the signed binaries could never be fixed, as the hardware enforces a set trusted list of -- you guessed it -- one key. Code trust should be based on user decisions, not the decisions of hardware manufacturers.

Re:What's wrong with TiVo?

[metamatic]

At the same time, since these devices are now on networks, there is a real possibility of them getting hacked.

Well, first off my DirecTiVo has no network option, and it's still crippled.

Secondly, there's a simple solution which would enable them to comply with the letter and spirit of the GPL: Put a DIP switch inside the unit that turned off the signature verification.

And thirdly, yesterday I had a successful Denial of Service attack perpetrated against my TiVo by TiVo/DirecTV themselves, who somehow screwed up a bunch of people's boxes by sending an erroneous "You are no longer authorized" message.

Re:What's wrong with TiVo?

[91degrees]

No you can't. And this is where the fundamental disagreement is. It all depends on what you think the spirit of the GPL is. The FSF want to expand the scope of the GPL to hardware. Linus feels that he has no right to demand what others do with their hardware, and believes that the GPL offers the appropriate protections.

Tivo took a free kernel, modified it, and released their modified version. If their modifications are useful, then they go to the community. That was all that was asked of them. Nobody even suggested that they must allow other software to run on their machine. And why should they have to?

And is it really breaking the spirit? I use gcc to write proprietry applications. They even have restrictive copy protection (blame the publishers). Am I breaking the spirit of the GPL by using gcc in that way?

Re:What's wrong with TiVo?

[AVee]

...which effectively makes the source code useless to anybody.

Why, why, why?
I mean, the whole point of the GPL(v2) is this, you can take my code and do with it whatever you want. And than I can take your modifications/additions and do with it whatever I want. And look, you can take the code used in the Tivo and you can do with it whatever you want. Nothing wrong there...

And then there's the fact that some hardware will only run manufacturer approved software. If you don't like that, don't buy the hardware. End of story, you don't need a software license for that.

Think about this one for a while: An open-source e-voting system so everyone can verify there is nothing messing with the election, released under GPLv3 to make sure everyone and his dog can update the code on the voting hardware. Thats one example, but you could add lots of others, e.g. drive/fly by wire sytems etc.

Re:What's wrong with TiVo?

[Hatta]

All the GPLv3 has to do (with regard to DRM), is to require
that distributors provide the source, provide the build environment,
provide their proprietary binaries, provide a method to update
the box, and make sure the box will boot even if you change the GPLed software.

What could be easier?!

Re:What's wrong with TiVo?

[AJWM]

RMS has been gamed, and he and Eben have come up with a more complicated 'solution' to the problem.

Which turns out to be even worse than the original problem. To satisfy GPLv3, all Tivo (or any other manufacturer of a device with embedded software) has to do is to stop distributing source.

Yes, really. Now, that interpretation depends on the definitions of "propagate" vs "convey", by an unintended consequence of the definitions and the rest of the license language (by at least one interpretation, and the law tends to interpret ambiguous wording in contracts (or licenses) in the way most advantageous to the party that did not write the contract language). Specifically, GPLv3 (latest draft) gives an "unlimited" license to "propagate", where "propagate" means "conveying ... without making source available". (Or words to that effect, I don't have the GPLv3 in front of me.

The verbage had to do with making applications available over a network without providing source -- but a box with binary-only code is black-box equivalent to a box with a wireless network connection. (And before you beat on RF detection, I'll say the black box contains a proprietary networking method not based on otherwise available technologies. Sub-aetheric waves, for example.)

Everyone will be happy, and the spirit of GPL will be preserved.

I don't think so. The new GPL is too clever for its own good, it needs to go back to the simple and direct language of v2. Doing that may fix the above problem -- although there may be other loopholes lurking.

Re:What's wrong with TiVo?

[cortana]

I think it's pretty clear that the spirit of the GPL is to defend the Four Freedoms; and that what Tivo does makes a mockery of Freedom One.

Re:What's wrong with TiVo?

[capologist]

They could easily thwart black-hat hackers while protecting users' rights by implementing a system that would require physical access to the box to install software signed by someone else (such as the user).

Re:What's wrong with TiVo?

[mrbobjoe]

Er, TiVo's one of the good guys, they release their source in compliance with the GPL.

It takes more than bare minimum compliance with one's obligations to be considered "one of the good guys" in my book.

Re:What's wrong with TiVo?

[newhoggy]

But bearing in mind that TiVo could have use other equally effective measures to protect users without compromising their freedoms.

Re:What's wrong with TiVo?

[RoadWarriorX]

Yeah, but. They don't make it easy to hack the box and put fixes or enhancements of GPLed software on the box. Tivo went overboard, and locked down the entire box when they could have done the following alternative...

I think that they must do this considering an FCC ruling made in 2004 that allows TiVo to share their recording to up to 10 other units. Well, how exactly would TiVo be able to comply with that ruling and satisfy the requirements of the GPL? Locking down the box was the obvious choice.

Re:What's wrong with TiVo?

[Mr2001]

Think about this one for a while: An open-source e-voting system so everyone can verify there is nothing messing with the election, released under GPLv3 to make sure everyone and his dog can update the code on the voting hardware. Thats one example, but you could add lots of others, e.g. drive/fly by wire sytems etc.

Yup, so for cases like that, they shouldn't use GPL'd software. Run the voting machines on BSD, and save the GPL for cases where people with access to the hardware really should be able to modify the software, like TiVo.

Re:What's wrong with TiVo?

[91degrees]

And I don't. Unless I misunderstand, you can recompile Tivo's Linux kernel and run it on different hardware, can't you? However you see it, you have to realise that a lot of can interpret things differently.

Re:What's wrong with TiVo?

[mad4ngel]

The irony here is that by requiring signed binaries, TiVO is both restricting and protecting users. Sure, by requiring signed binaries, you are restricted to run code only from TiVO. This restricts what users can do with their own hardware. At the same time, since these devices are now on networks, there is a real possibility of them getting hacked. If TiVO ran untrusted binaries, this probably would have already happened. Of course, this happens now with Series 1 TiVO's, but you can't put them on the net without hacking, and if you are smart enough to do that, you probably have a firewall. So in some ways TiVO is doing a good thing by only running trusted code. It is an interesting tradeoff.

Wow - i wonder if apache.org should follow that pearl of wisdom ans start releasing binary-only versions of it's webserver, because as you know the servers are on networks, and they could be hacked *gasp*. Protecting the users? I don't think so.

Re:What's wrong with TiVo?

[Chris Pimlott]

Oh really? I assume that's for Series 2 TiVos. That's disappointing, the Series 1 is wonderful for hacking.

Re:What's wrong with TiVo?

[AVee]

When GPLv3 gets up and running you might just see that happening. BSD licenced voting software that is. Tivo and the likes will simply revert to closed source software or stick with GPLv2. Make no mistake, no serious hardware vendor is going to use the GPLv3 in it's current form. It simply places to much limits on what they can do with it...

Re:What's wrong with TiVo?

[Mr2001]

Tivo and the likes will simply revert to closed source software or stick with GPLv2.

If they want to develop their own proprietary software, more power to them. The point of making these changes to the GPL is to prevent them from making a profit out of pissing on the very freedoms the GPL stands for. Let them do their own damn development work if they aren't going to let us hack the hardware we bought.

Make no mistake, no serious hardware vendor is going to use the GPLv3 in it's current form. It simply places to much limits on what they can do with it...

Hardware vendors don't choose the license, open source developers do. The vendors can either loosen the restrictions on running modified software, stick with software that's distributed under a license that allows them to restrict mods, or develop their own, and any of those are fine with me.

The NASA got no problem with DRM...

[Anonymous Coward]

..they can lose their precious movies even without DRM-crippling them useless

Yes, that's right, I'm from europe and I'd crap myself when I saw that article... :-)

I fear a repeat of the Bison fiasco...

[nweaver]

Bison (GNU's version of YACC) used to have the restriction that the output of Bison, since it was a large amount of code, was GPL. As a result, nobody used Bison except for GCC, because the liscence was untenible.

I fear that GPLv3, by trying to force RMS's notion of "Liberty" more strongly (anti-DRM provisions, anti-closed-hardware provisions) will be a repeat: GPLv3 based software will only be used by the real FSF zealots. Everyone else will avoid it.

Let us be thankful that Linus Torvald has more of a "tit for tat" notion rather than a liberty notion, and thus selected GPLv2 only.

Re:I fear a repeat of the Bison fiasco...

[noidentity]

I haven't heard the Bison story before, so I'll go by what you wrote. The difference is that the proposed GPL v3 restrictions will only affect those wanting to make closed hardware that runs a particular binary built from GPL software, while the Bison example affects anyone not wanting to use the GPL on the output. Unless I'm missing something, these differences are vast.

How would the proposed GPL v3 affect average programmers in a negative way, other than denying us pieces of hardware that come with GPL binaries and source code but which we can't use with modified versions of the source?

Re:I fear a repeat of the Bison fiasco...

[mpcooke3]

DRM will be used to attempt to restrict users rights to read documents, share documents, listen to music, watch films and possibly connect to other systems.

Microsoft, the RIAA and the MPAA have wanted to be able to do this for a long time.

We will then need a blessed versions of Linux that has been signed by a major financial backer like IBM who could give kickbacks to the right cartels just to be able to access the content we can currenly use and to read files sent to us from Microsoft machines.

I don't know if Richard Stallman stands much chance against the tide of monopolies and cartels that want to use DRM to restrict our rights(RIAA/MPAA) and kill competition (Microsoft).

But I'm glad someones trying.

Re:I fear a repeat of the Bison fiasco...

[Chops]

Bison (GNU's version of YACC) used to have the restriction that the output of Bison, since it was a large amount of code, was GPL. As a result, nobody used Bison except for GCC, because the liscence was untenible.

Correction: Bison used to have the restriction that the output of Bison was GPL, because nobody (including the FSF) had noticed that that was true. As soon as somebody did (in 1996 or so), the FSF put in a special exception and life went on pretty much as normal.

I fear that GPLv3, by trying to force RMS's notion of "Liberty" more strongly (anti-DRM provisions, anti-closed-hardware provisions) will be a repeat: GPLv3 based software will only be used by the real FSF zealots. Everyone else will avoid it.

Yes, the popularity of Bison has certainly suffered a staggering defeat; the Debian popularity contest, to pick a random example, shows it slightly less popular than X Windows, but slightly more popular than the ftp client. Doubtless we should heed your example and run screaming from the GPLv3 lest we, like it, and like Bison, become...

(shudder)

unpopular.

Nice use of the word "zealot" to describe harmless nerds who like to share their software, also.

Re:I fear a repeat of the Bison fiasco...

[noidentity]

Well, I've come up with one argument in favor of allowing GPL software on closed hardware: it means that the hardware maker won't be paying a closed-source vendor for the software, which might be some small benefit to the free software movement, though perhaps outweighed by the user's loss of freedom when using that hardware.

tough one...

[blindd0t]

If the GPL alone made it so that software no could no longer fit in with a business model, the business has only two options: 1. change the business model, 2. find something that fits the business model. My guess is that the latter is most common. Let's take tivo for example. If the GPL3 condems their practices, and we assume it is not an option for them to simply use source that falls under the previous GPL, then what would they do? I agree with provisions to protect against DRM in many if not most cases, but how do such provisions safely provide a means to protect against this while still offering enough flexibility to fit business needs similar to Tivo? It's not easy to fit niche needs of business and government - especially when niche seems to be the norm.

Help a clueless newbie out?

[megaditto]

Say, if I compiled my C++ program on linux using the GPL-ed includes and libs, does my program automatically become GPL?

Thanks

Re:Help a clueless newbie out?

[Anonymous Coward]

Yes. Even if the linked in GPL code comprises .0005% of the total codebase the ENTIRE codebase becomes GPL. Crazy isn't it?

Re:Help a clueless newbie out?

[brainnolo]

Don't know if you are just kidding (because this question has been answered many times). Basically, the output of GCC (the compiler) is not automatically GPL'ed and linking to glibc (the GNU C Library) and STL does not make your program GPL. If you use other GPL (not LGPL) libraries then you can't release your program under licenses other than the GPL. So, basically, linking to "system stuff" is ok, but if you have any doubt over a library you are using just check its license.

Re:Help a clueless newbie out?

[AuMatar]

Yes, if the libraries are GPLed. If you mean glibc, that library is released under the LGPL, so no your program would not.

Re:Help a clueless newbie out?

[Hope Thelps]

Even if the linked in GPL code comprises .0005% of the total codebase the ENTIRE codebase becomes GPL. Crazy isn't it?

That's not really accurate, but if the courts afford copyright protection to that .0005% of the code, and if they hold that your product is a derived work, then you will be liable for infringing copyright. If you think that's a bad bargain then don't use the GPL code. It's as simple as that.

Re:Help a clueless newbie out?

[mrchaotica]

Yes. If you don't want your code to be GPL, link to LGPL libraries instead. (Note, by the way, that GLIBC is LGPL, so system calls and standard library functions shouldn't cause a problem for you.)

Re:Help a clueless newbie out?

[megaditto]

Thanks

Re:Help a clueless newbie out?

[fregaham]

Nothing can automatically become GPL covered program. You just can't distribute that program unless you do GPL it. You can just use this program of yours (which is now a derived work of said libraries) and excercise all your fair use rights.

Re:Help a clueless newbie out?

[Anonymous Coward]

Yes. Even if the linked in GPL code comprises .0005% of the total codebase the ENTIRE codebase becomes GPL. Crazy isn't it?

Nonsense, the entire codebase *doesn't* become GPL - the license doesn't magically spread to any other code that uses it. But if the other code isn't under a GPL-compatible license, you simply don't have the right to use the GPL'd code, and cannot therefore distribute the product that breaches that license.

One possible fix is that the entire codebase be made GPL, but that's neither required nor automatic. The GPL is simply a set of conditions under which the copyright holder allows you to use their code - nothing stops you fromn negotiation a different set of conditions.

Oh, if Linux's key is ok, GPLv3 doesn't stop Tivo.

[nweaver]

Verifying the code (the TiVo portion that RMS hates) is equivelent to verifying Linus's key: Is this code released by the entity you trust. The only major difference is TiVo is more concerned, so it only RUNS code that has been signed by the trusted entity.

Tivoization

[jythie]

Something I never understood about this argument and how 'horrible' this is. If you have the hardware and it matters that much to you that you need to run software with a differnt signature, then change the key in the hardware. Requiring that you distribute the hardware keys seems like the wrong solution.

Re:Tivoization

[pinky0x51]

>If you have the hardware and it matters that much to you that you need to run software with a differnt signature, then change the key in the hardware. Requiring that you distribute the hardware keys seems like the wrong solution.

If you can change the key than you don't have to distribute the hardware keys because than people can exercise all 4 freedoms. But if you embed they keys in a way into the hardware so that i can't change them and the hardware will run only software signed by this keys than you remove some of my freedom granted by the GPL and than the GPL will fight back.

GPL 2 vs. GPL 3

[toriver]

"You may not impose any further restrictions on the recipients' exercise of the rights granted herein."

Doesn't this mean that - since GPL 3 is more restrictive - that already GPL'ed software cannot be distributed under GPL 3?

Re:GPL 2 vs. GPL 3

[Todd Knarr]

If it was released with the "or any future version" language in the GPL it used, there's no problem.

Re:GPL 2 vs. GPL 3

[codehead78]

Right. It says "You may not..." not "We may not..." so unless you strike the "or later versions" clause, you don't really control how others use your code, the author of the GPL does.

Re:GPL 2 vs. GPL 3

[mrchaotica]

It would, except that the default boilerplate is that you license it under the GPL v.2 "or any later version." Because of that clause, the code is effectively dual-licensed.

Aside from that, however, no, they're not compatible. This is why Linux kernel code (licensed without that clause) can't become GPL v.3 without the consent of every copyright holder.

Re:GPL 2 vs. GPL 3

[MooUK]

And so, REGARDLESS of what Linus wants or does not want, he doesn't have any control over it.

Re:GPL 2 vs. GPL 3

[truedfx]

More accurately, he can't relicense the kernel under the GPLv3. He can prevent relicensing the kernel under the GPLv3 even if every single contributor other than himself wishes to change the license.

Re:GPL 2 vs. GPL 3

[Anonymous Coward]

If you said "version 2 or any later version", then somebody can choose to use either license. It doesn't matter what GPL2 says because you allowed them to use GPL3 if they want.

If you didn't, it's a moot point, because nobody can just change the license, either from GPL2 to GPL3 or to BSD or anything else.

This isn't rocket science, folks.

Re:GPL 2 vs. GPL 3

[Anonymous Coward]

However, if everyone else licenses their code under GPL3 and Linus says "no" to the bits he owns, then they'll get re-written and Linus will be left with the GPL2 code and nobody to help.

If enough people want the GPL2 to be kept up to date, then it will survive. If not, then either Linus moves to GPL3 or he falls out of the picture.

YAT

[adavies42]

Yet another TLA....

Talking to the atheists.

[Anonymous Coward]

"*waves to the trolls* Hi! This is for you!"

Hi Mr AC! Did you bake me a cake?

"Gift horse, mouth, examination via the anus... all those are things that spring to mind when I hear complaints about how restrictive the GPL is."

Let me put it to you as plainly as possible. The GPL needs the world, more than the world needs the GPL. Got it? Good.*

*Now if you had said open standards (but you didn't), it would be an entirely different matter.

Why does everyone keep quoting Linus?

[sigzero]

He doesn't have to make the kernel GPL3. He can stay at GPL2.

Re:Why does everyone keep quoting Linus?

[stratjakt]

More correctly, he can't make it GPL3. It's already been released, and he can't add restrictions to it after the fact, I don't see how he could make it GPL3 any more than he could decide to close the source and charge 699 bucks per CPU to use it.

Unless he wanted to write a brand new kernel from scratch, which would be a kick-ass idea. I wouldn't miss linux' monolithic dinkerishisness.

Re:Why does everyone keep quoting Linus?

[mikeal]

That's not true.

There is a provision in the GPL allowing the user to do a few things related to altering or changing the license.

One is to automatically increase the current license to a future version, which linux obviously has never opted for.

Another and more common practice is to allow the license for a work to increase to a later version of that license at the owners discresion. That means that if linus did decide to increase the license that it would make all previous version of the code GPLv3.

This is in contrast with changing the license completely, like if they were to say move the license to an Apache or Python license. That would make future versions bare the new license while older versions remained bound to the previous license.

The reason for these distinctions is to allow the GPL license to change over time and accomodate changes in the computing world and still protect works that were licensed under previous versions without inhibiting the right of the owner to maintain the copyright of their choice.

Re:Why does everyone keep quoting Linus?

[Talchas]

Yes, but (as many have said) others have contributed to the kernel, and they didn't give their copyrights to Linus. Since all of this was licenced under the GPLv2 without the "or any later version" clause, it cannot be updated to v3

Re:Why does everyone keep quoting Linus?

[mikeal]

ince all of this was licenced under the GPLv2 without the "or any later version" clause, it cannot be updated to v3

... unless the authors choose to move their license to v3 which would extend to previous versions :)
Most successful open source projects have a mix of code under different licenses and authors for this reason. My point is just that if transfered by the authors the extention would extend back over previous releases.

Re:Why does everyone keep quoting Linus?

[AJWM]

unless the authors choose to move their license to v3 which would extend to previous versions

I'm not sure what you mean by that, but you can't mix GPLv3 code with any GPLv2-only code. GPLv3 contains "extra restrictions" that GPLv2 doesn't allow.

Or did you mean the authors relicense previous versions of their software under v3? That would have to be explicit. Just because I release version 27.42 of my software under GPLv3, that doesn't automatically relicense versions 0.01 thru 27.41. (And yes, it might make a difference if I dropped a major subsystem at version 23.2, and completely rewrote another one at 26.1 say.) I'd also have to make sure that I didn't use anybody else's GPLv2-only code or libraries in any of those versions.

In the case of the Linux kernel, some authors (or their heirs and assigns, for those that have died) probably can't be tracked down to be asked to change the license.

Re:Why does everyone keep quoting Linus?

[Anonymous Coward]

GPLv3 is not retroactive unless the developer(s) of GPLv2 code say so. In other words, you can't take GPLv2 code and rerelease it under GPLv3 unless the license explicitly has that little "or any later version" clause.

Of course, this is assuming that the copyright owner(s) don't want the code to be GPLv3.

Re:Why does everyone keep quoting Linus?

[MooUK]

Exactly.

He chose, and convinced many (not all) other contributors to choose, to not use the common "GPLv2 or any later version" clause in the boilerplate text. Even if he wanted to, there's nothing he can do without getting the permission of all those contributors.

The FSF are out to lunch on this.

[Anonymous Coward]

DRM has nothing to do with the software, and nothing to do with its license. This is like including provisions in the license that say you cannot eat bananas. Its irrelivant, makes the license less likely to stand up legally (a license is not a contract), and isn't about freedom at all. DRM does not prevent you from having the freedom on the software that the FSF loves so much. It prevents you from having the freedom on the hardware. You can still modify the software, distribute it, etc. You just can't run it on that particular hardware, because the hardware has no freedom. So run the software on some other hardware. The hardware is not covered by software licenses.

Re:The FSF are out to lunch on this.

[DrJimbo]

ac said:

[DRM] prevents you from having the freedom on the hardware. You can still modify the software, distribute it, etc. You just can't run it on that particular hardware, because the hardware has no freedom.

And the GPLv3 simply says that if I can't run modified GPLv3 software on that machine then no one can use my GPLv3 software on that machine.

ac said:

So run the software on some other hardware. The hardware is not covered by software licenses.

Exactly! And if there is a large enough GPLv3 code base then there may be a market for machines that are not controlled by DRM.

I can't imagine a circumstance where I would want my GPLv3'ed software to be used on DRM controlled hardware. There are plenty of licenses that already exist that allow manufacturers to lock down otherwise free code with DRM. What's wrong with having a license that preserves the freedom to modify and run code? No one is forcing you to use it.

Re:The FSF are out to lunch on this.

[Anonymous Coward]

"What's wrong with having a license that preserves the freedom to modify and run code?"

We'll skip why I dislike that because its irrelivant. The GPL v2 already preserves this freedom. And this will not help create demand for non-DRM hardware, that demand will be created by DRM hardware itself. Not being able to run some GPLv3 code isn't going to change anything, they will use other code on their DRM machines like tivos, or simply run the GPLv3 code anyways and let the copyright holder try to stop them. Good luck getting that shit hole of a license to hold up in any court besides the US.

ObGoodMorningVietnam

[Amazing Quantum Man]

Excuse me, sir. Seeing as how the VP is such a VIP, shouldn't we keep the PC on the QT? 'Cause if it leaks to the VC he could end up MIA, and then we'd all be put out in KP.

Can I buy a vowel?

[Anonymous Coward]

So the FSF is GPLv3 and DRM with the RMS and what now? I'm in the military and therefore quite good at decoding stupid acronyms, but this is pushing it. . .

Re:Can I buy a vowel?

[WilliamSChips]

Were you ever in the SGC?

What if Linksys had TiVo'd the WRT54G?

[twmcneil]

It may off-topic but it seems to me that allowing people to mod a Tivo would be a good thing for everyone. I don't understand why they locked the code down in the first place.

Re:What if Linksys had TiVo'd the WRT54G?

[OldeTimeGeek]

My guess would be the fine line that Tivo walks between giving the users the flexibility that Tivo would like to and getting sued into extinction by the content providers. Programatically it would be a whole bunch easier for Tivo to drop the DRM stuff and just add functionality, but if they allowed or even partially supported free distibution of copyrighted material the vultures would be circling in an instant.

I'd like to ask the amatuer lawers here a question: Does the GPL (pick your version) have any standing in law? Lets say that Tivo decides to fully open the code and allow people to write any extensions they like. Someone writes some code that allows file copying beween the Tivo and any other device. Because its far easier to go after Tivo than the person who wrote the code, Tivo gets sued. Can they use adherence to the GPL in their defense?

Re:What if Linksys had TiVo'd the WRT54G?

[mikeal]

If someone wrote additional code for the Tivo platform that users could install but was not distributed by Tivo then Tivo has absolutely no legal responsibility for possible violations of copyright law the application may commit.

This goes beyond even the sony betamax case. It would be like the RIAA sueing Microsoft or Apple because someone wrote a bittorrent client on for their operating system.

Re:What if Linksys had TiVo'd the WRT54G?

[Anonymous Coward]

If someone wrote additional code for the Tivo platform that users could install but was not distributed by Tivo then Tivo has absolutely no legal responsibility for possible violations of copyright law the application may commit.

This goes beyond even the sony betamax case. It would be like the RIAA sueing Microsoft or Apple because someone wrote a bittorrent client on for their operating system.

Dilbert: I've invented a system to send millions of data bytes without using wires. What do you think the phone company would give me for this?
Dogbert: A horse's head in your bed.

Seriously, when has the RIAA been anything but a bunch of mobsters? If they didn't own congress and half the judicial branch they'd have been prosecuted under RICO decades ago.

Re:What if Linksys had TiVo'd the WRT54G?

[Jaime2]

Tivo can walk that fine line all they want, no one is arguing their right to do so here. However, RMS is objecting to TiVo releasing a product that contains a large amount of community contributed code, in a manner not consistent with the wishes of that community. See, TiVo saved a ton of cash by basing the product on Linux. The payback is supposed to be that we get to play with the product. By including the signature verifying component in the hardware, they are making it a one sided tradeoff -- otherwise know as "a bad deal". Why should we give an operating system to TiVo free of charge and free of any other benefit? GPLv3 has provisions to help assure that we won't get burned again.

In direct response to your first comment, of course TiVo wouldn't succeed if they had opened up the TiVo. But they really should have picked a different platform instead of hiding behind a technicality in the GPLv2. There are pleny of for-profit companies that would have sold them an OS.

Re:What if Linksys had TiVo'd the WRT54G?

[dvNull]

But they really should have picked a different platform instead of hiding behind a technicality in the GPLv2. There are pleny of for-profit companies that would have sold them an OS

Amen

Re:What if Linksys had TiVo'd the WRT54G?

[tinkerghost]

The payback is supposed to be that we get to play with the product. By including the signature verifying component in the hardware, they are making it a one sided tradeoff -- otherwise know as "a bad deal"

No it's not one sided. They made modifications to the various pieces of code and returned those pieces to the community. You can download their code, examine it, change it, and run it on another system. Hell you can download the code, tweak it, and use it without buying a TIVO. How exactly is that 1 way? The only thing you are not getting is open access to the hardware, which the GPLv2 never requested.
I have to agree with Linus, this is a software liscense, creating hardware dependencies in it is outside it's scope. The other thing you have to look at is what people value more - the code or the end use. For Linus and others, the code is the important thing, since TIVO provided the code they use to restrict sharing, and the format shows are saved in (those should be in the GPL code they returned), I can rip open a TIVO, pull the HD & retrieve the shows to use how I want on my PC. For others, the end use experiance of being able to run their tweaks on the same hardware is more important.
Linus, as the head of the Kernel dev team, is concerned with seeing the Linux Kernel continuing to develop and grow. GPLv3 trims an entire branch from the possible growth tree. Face it, DRM & Trusted Computing are not evil in and of themselves*, they are tools, and GPLv3 prohibits them from being used in any meaningful way.

*

• DRM can simplify corporate/govt/military/medical document security by ensuring that only those persons with the apropriate clearance can view/copy the documents, reguardless of who has physical access to them. Sorry, the 'no information should be secured' crowd can sod off, I don't think you have any right to view my medical history.
• Trusted computing goes along with DRM in this instance - only by verifying that the OS & the viewer are running secured versions can the DRM of the document be trusted.
• Until a DRM format is created that automatically expires with the copyright, and allows for the defined rules of 'fair use', DRM is not suitable for use with copyright protected media.

Violates SPIRIT of GPL.

[mrchaotica]

Complying with the letter of the license is not the same thing as complying with the spirit and intent of it. The GPL is designed to ensure that the user always has control over his hardware; since the TiVo won't run modified code, the user does not have this control. QED.

Missed the point

[gr8_phk]

For starters, I don't think MS would ever do that and if they did they wouldn't use GPL but some other kind of license they came up with.

I switched to the XBOX instead of keeping with TiVo so people wouldn't chime in with "but TiVo doesn't have the volume to get a custom chip from Intel". Suppose Sony wanted to use a variant of VLC for a media player in the PS3 rather than write their own. The point was that you can TiVoize the software by running on custom hardware where the user can't recompile for that hardware - regardless of the specific thing we call DRM.

Two problems with this

[DrJimbo]

jythie said:

If you have the hardware and it matters that much to you that you need to run software with a differnt signature, then change the key in the hardware.

The first problem is that this ranges from being technically very difficult to technically impossible. For example, if the key is built into the CPU chip you can't just pry it open and flip bits. Early versions might be breakable but later versions will be extremely difficult if not impossible to break.

The second problem is that this is illegal in the US under the DMCA.

If I license my software under a license like the GPLv3, I don't want to have to take my damned computer apart in order to modify and run software I wrote. Nor should other people need to tear apart their computers to modify and run my software.

Re:Two problems with this

[Sloppy]

If you have the hardware and it matters that much to you that you need to run software with a differnt signature, then change the key in the hardware.

...The second problem is that this is illegal in the US under the DMCA.

How so? What content's protection is being bypassed?

Re:Two problems with this

[DrJimbo]

DrJimbo:

...The second problem is that this is illegal in the US under the DMCA.

Sloppy:

How so? What content's protection is being bypassed?

The DMCA is not about "content" it is about copyright. Here is the lead paragraph from the Wikipedia:

The Digital Millennium Copyright Act (DMCA) is a United States copyright law which criminalizes production and dissemination of technology that can circumvent measures taken to protect copyright, not merely infringement of copyright itself, and heightens the penalties for copyright infringement on the Internet.

The copyrighted material being protected (in the Tivo for example) is the code itself.

If you don't believe me, take a look at the Trusted Computer FAQ. Section 15 says:

15. Can't TC be broken?

The early versions will be vulnerable to anyone with the tools and patience to crack the hardware (e.g., get clear data on the bus between the CPU and the Fritz chip). However, in a few years, the Fritz chip may disappear inside the main processor - let's call it the `Hexium' - and things will get a lot harder. Really serious, well funded opponents will still be able to crack it. But it's likely to go on getting more difficult and expensive.

Also, in many countries, cracking Fritz will be illegal. In the USA the Digital Millennium Copyright Act already does this, ...

Also, in many products, compatibility control is already being mixed quite deliberately with copyright control. The Sony Playstation's authentication chips also contain the encryption algorithm for DVD, so that reverse engineers can be accused of circumventing a copyright protection mechanism and hounded under the Digital Millennium Copyright Act. The situation is likely to be messy - and that will favour large firms with big legal budgets.

RMS?

[slapout]

Now they're even using Root-Mean-Square against us? Is nothing sacred? Next they'll be taking away our sine waves!

Acronyms

[ericlondaits]

FSF: Free Software Foundation
DRM: Digital Rights Management
RMS: Richard M. Stallman (founder of the free software movement, the GNU Project, the Free Software Foundation, and the League for Programming Freedom).
OSTG: The Open Source Technology Group.
GPLv3: GNU Public License version 3.

Re:Acronyms

[Whatsisname]

What about TFA? I keep saying that without enough context to figure it out.

Re:Acronyms

[TeknoHog]

Acronym: the kind of abbreviation that you can pronounce as a single word. For example NATO and laser.

Boooring

[orzetto]

This argument keeps surfacing even though it has been debunked time and again. The GPL v3 only requires you to provide the embedded key if it is necessary to run the software. That's the letter and the spirit of the GPL v3. The second discussion draft clearly words out:

The Corresponding Source also includes any encryption or authorization keys necessary to install and/or execute modified versions from source code in the recommended or principal context of use, such that they can implement all the same functionality in the same range of circumstances.

Re:Boooring

[jez9999]

I'm afraid I missed the GPLv3 discussion that happened some time ago on Slashdot, so I'm sorry if this question is obvious but... why can't you just compile and run Tivo's code on a general purpose PC? Or hack Tivo's hardware? It looks like the only problem is that Tivo's hardware stops modified code from running on it, why is that a major problem?

Re:Boooring

[orzetto]

I'm afraid I missed the GPLv3 discussion that happened some time ago on Slashdot, so I'm sorry if this question is obvious but... why can't you just compile and run Tivo's code on a general purpose PC? Or hack Tivo's hardware? It looks like the only problem is that Tivo's hardware stops modified code from running on it, why is that a major problem?

The major problem is a future with hardware that stops you from doing what you want with your software. The GPL's spirit is to guard the user's rights, but these can effectively be taken away (not breaching GPLv2) by hardware means. Of course you can compile TiVo's code on a PC, but hacking the machine it may be more complicated than just some soldering. With a decent encryption/signature scheme, it's pretty safe to say it is practically impossible. Now, the problem comes when all PC's will be (say in ten years?) able to run this "trusted computing" thing: you will not be able to compile and use TiVo's code on any machine, because all the machines you can get your hands on will require signatures. I think the FSF is doing well being a bit paranoid about this development before it gets dangerous in any way.

Preaching to the choir?-Let my code go.

[Anonymous Coward]

The GPL is about freedom of code. The BSD is about freedom of ideas.

Calling a spade a spade.

[mikeal]

Let's just site down and admit it. Linus does not now, and probably never has, believed completely in the mission of the FSF or the freedoms given by the GPL.

He is a very smart guy, and knows that his argument doesn't hold water which is why he is declining to speak about it further. The truth is that Linus is buddying up with lots of companies, he's part of the corporate side of open source now not the community side. The relationship between money and open source has been great until now, when the needs of freedom are now coming in opposition to some of the buisness needs of open source money.

Linus didn't build the entire Linux kernel, a community did. If he is unwilling, or the companies supporting him are unwilling, to move the license forward in the interest and popular support of the linux community then we can branch the code now and start extending and reworking the linux kernel under the GPLv3. They know that, and they don't want to loose the communities support so they are trying to make it sound like the FSF is imposing their will on the community, rather than Linus and a hand full of companies imposing their will on the community that builds their product.

The provision in GPLv3 that Linus opposes refernces "Tivoization" in it's text, and if you look back Linus and others he's worked for and with have never viewed Tivo's products as a negative imposition on the rights of software and software developers.

Re:Calling a spade a spade.

[MooUK]

"If he is unwilling, or the companies supporting him are unwilling, to move the license forward in the interest and popular support of the linux community then we can branch the code now and start extending and reworking the linux kernel under the GPLv3."

No, you can't.

Many of the contributions to the kernel, including Linus' own, are licensed under GPL v2 ONLY. They do not have the common "or any later version" clause in the boilerplate text.

So, if you wanted to convert to GPLv3, or to anything else, you would have to get the permission of every single contributor who said "GPLv2 only" beforehand, or you would yourself be breaking the license and have no right to distribute it.

DRM isn't necessarily evil.

[Anonymous Coward]

I don't understand. One side says "DRM is EVIL! We hate the RIAA!" and "If you don't support GPLv3, MS will lock your machine out of Linux!" (which they could do anyone regardless of what the GPL says) This is absurd.

DRM can be used for good. Let's say you want to build an electronic voting machine properly. You use entirely GPL source code. All parts are off-the-shelf and well known. Everything is open to public review. However, when you actually go to send the machines out, you want to be damn sure those machines are running the same code you put on them at the factory. That means locked and tagged boxes, and that also means DRM. Under the GPLv3 draft, you'd have to publish the secret key to the world, making that security worthless.

Another case: Let's say I make a system that monitors building security. I want to be open about how it all works, so I use GPL'd hardware. However, even my customers want to make sure that the software isn't tampered with. That means DRM. Again, if I have to publish the secret key, someone could write a modified version, sign it with my key, and get it on the machine.

The GPLv3 draft makes it impossible to create tamper-resistant software. (Note, I didn't say tamper-proof, there would still be ways around it, but as part of a layered security, it is necessary.)

Re:DRM isn't necessarily evil.

[TeknoHog]

DRM can be used for good. Let's say you want to build an electronic voting machine properly. You use entirely GPL source code. All parts are off-the-shelf and well known. Everything is open to public review. However, when you actually go to send the machines out, you want to be damn sure those machines are running the same code you put on them at the factory. That means locked and tagged boxes, and that also means DRM. Under the GPLv3 draft, you'd have to publish the secret key to the world, making that security worthless.

How is this better than completely closed-source software?

Re:DRM isn't necessarily evil.

[Anonymous Coward]

You can see the source code yourself and be certain it doesn't contain any underhanded vote tampering. You could even use the GPL'd software to make your own voting machines, that could even be signed by you. You just couldn't sell voting machines that appeared to be signed by me, which is what the draft gplv3 would require I let you do.

The only time the DRM comes into effect is in those individual machines that are sent out to vote with. They'll contain a signed version of the software that will refuse to run if it is tampered with. The source code would be fully available and the machines themselves are standard hardware with just an extra drm chip in them. If you wanted, you could just run an unsigned version of the voting software on a normal PC.

The point of the DRM is to help make sure the devices are safe from tampering. This is not just for voting machines, but anywhere you need a device to be tamper-resistant. From voting machines to security servers to ATMs to who knows what. There are plenty of appliace-style devices that are running computer code that could benefit from being tamper-resistant. Currently, most of them are pretty basic and use more of what we'd call electronics, rather than computers, but that's changing. How about a computer that controls a building's elevators? Air traffic control, heck, in the future we might have ground traffic controls. The GPLv3 draft completely cuts off this entire line of legitimate use out of ideological hatred of one possible use of this tool.

If they put something like "If you sell drm'd hardware, then you also have to sell a version of the hardware, at no extra cost, that does not contain the drm restriction", this entire problem would go away. People could have their secure machines, Linus could sign his kernel without having to give up his key, and everyone comes out happy.

Re:DRM isn't necessarily evil.

[MrMickS]

How is this better than completely closed-source software?

If you don't know the answer to this then you aren't thinking about it. Instead you are going along with the prevalent Slashdot herd mentality 'DRM is bad'. DRM is a tool. As a tool it is neither good nor bad but can be used to do either.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

One could let the user change the key and seal the key change mechanism when the machine is actually used in elections. This way the hardware could still be used when a private key has been leaked.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

The GPLv3 draft makes it impossible to create tamper-resistant software.

You can, just burn the software into ROM. Those who want to tamper it can still do so, but they will have to replace the ROM itself.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

If the user can change the key, that what the hell good is it? Anything the user can do, an attacker can do, too. That's the whole point of tamper-resistant software. You WANT the system to not let people tinker with it.

Moreover then, who is the user? Do you want the election officials themselves compiling the system and signing each machine? Do you think the people at each individual polling station is savvy enough to know how to do that properly and securely? If it's at a higher level, say the state level, then, by the definition of the GPL, is the state distributing the systems to the polling places, and thus, would have to release their key?

DRM is a tool. It can be used for good or ill. Don't get me wrong, the RIAA/MPAA/etc want to use it for evil. But having the GPL ban it is wrong, since it can also be used for good.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

I suggested sealing the key change mechanism so changes could be detected (while the software could still be updated - if updating is not deemed necessary, simply seal the software). Instead of physically sealing it, one could build in a hardware counter showing how many changes have been made. This makes things more complicated, but it eliminates the dependency on the manufacturer in case of changing the key.

Re:DRM isn't necessarily evil.

[Todd Knarr]

Because it puts the DRM keys in the hands of the user, not the vendor. The vendor (the one who makes the hardware and software) doesn't need to insure that there's no tampering. The user generates their own signing key, loads it into the hardware (or possibly has the vendor do it, if the chip with the verification key's tamperproof and can't be changed or written to after installation), certifies the software and signs the binaries so only the binary they certified can run. Nobody else can run binaries on that hardware, not even the vendor, but that's OK since the user isn't going to distribute the firmware in that state to anyone else, they'll only use it themselves. They can similarly sign the data file containing the ballots for each election, letting them create and use their own ballots without being dependent on the vendor. Any further distribution of the firmware would of course be without a burned-in key, so again the end user can supply their own key for their own hardware and binaries.

This means, of course, that the vendor can't install software updates without going through the end user (election commission) to get the new binaries signed (and presumably certified first), but that's OK since that's what we want. And of course the election commission itself could tamper with the software, but we already have methods from physical ballots to prevent that (think multiple independent observers who can supply and verify additional signatures, if the election officials modified the binaries they'd invalidate those additional signatures).

Re:DRM isn't necessarily evil.

[DrJimbo]

Either you do not understand what you are talking about or you are intentionally propagating anti-GPLv3 lies.

In the voting machine scenario, it turns out that the anti-DRM provisions of the GPLv3 actually do the right thing. The GPLv3 takes the DRM control away from the computer manufacturers and gives it back to the computer owners.

If we had an election system where every voter owned their own voting machine then your argument above might deserve some consideration. But I don't know of any place on earth that does this, nor to I see this happening in the foreseeable future. What happens in the actual world is that we have three different groups involved with voting machines:

1. Manufacturers, such as Diebold.
2. Owners, such as boards of election.
3. Users who are the voters.

Without the DRM provisions voting machine manufacturers could use our GPL'ed software in their voting machines and the local boards of election would have no control over which software was being run. The DRM provisions of the GPLv3 insist that the control be transferred from the manufacturer to the owner, the board of elections.

IMO, this is the way things ought to work. The board of elections buys the voting machines so they have control over what software runs on them. If you would rather have us put our trust in companies like Diebold instead of the boards of election, then there is no hope for you.

This crazy idea of yours that every person who uses a computer that runs GPLv3'ed software must be given all of the keys that control and protect that software is totally absurd. According to your logic, if I let you use my computer to check your Yahoo account does this mean I have to give you all my keys?

The DRM provisions in the GPLv3 are about giving computer owners control over their own machines. I'm sure that if you dig deep enough it is possible you might find some benevolent applications that are not a good fit with the GPLv3. Then for those apps, a different license should be used.

Think of the DRM provisions of the GPLv3 like the guard that covers the blade of a table saw or a portable circular saw. For 95% of applications those guards keep us safe and keep us from losing fingers. There are a few applications where those guards get in the way and prevent us from doing what we want. For those rare few applications we simply take the guard off. In the software world, we would simply either use non-GPLv3 software or use GPLv3 software embedded in a ROM.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

You don't seem to understand how this whole process works. For smaller markets, the vendor is the manufacturer, and they have a very close relationship with the customer. How many boards of election have the technical expertise to manage the internal software? Moreover, the keys are HARDWARE BASED. Are you saying that every single instance of hardware based tamper-protection, every customer must be sent a chip burner?

"This crazy idea of yours that every person who uses a computer that runs GPLv3'ed software must be given all of the keys that control and protect that software is totally absurd."

That's what the GPLv3 says. And I agree, it's absurd. That voting machine that is distributed above, it's source code must be available on request. Right along with that source code MUST BE THE KEYS. Thus, it's not just the customer who buys the hardware getting the keys, it's ANYONE. From the GPLv3 draft: "The Corresponding Source also includes any encryption or authorization keys"

The GPLv3 currently makes it impossible for a vendor to build tamper-resistant software. You keep thinking about evil manufacturers. I agree, DRM can be horribly abused. But tamper-resistant software can be a very GOOD thing.

Here's another thing to think about: Let's say I run a consulting company. I'm hired by firms to install a fancy building security systems. They want the systems to be the most secure, so I use off-the-shelf components, and make certain they will only run signed software. The customer wants this to help prevent people from bypassing security, but doesn't have a load of computer savvy people, that's why they hire me. However, according to the GPLv3, I would have to give my secret key to anyone that asked.

The problem with the GPLv3 is that it is expected to be widely used, and many people who wouldn't have a problem with the above uses of DRM would release their code under the latest GPL without really thinking about it.

However, as I've posted, the solution is simple. Change the language so that it requires hardware manufacturers to sell both DRM'd and un-DRM'd (or release the key for those versions) at the same cost or less. For instance, if evil-Tivo releases Tivo v3-a that includes DRM so that people can't tinker it, they would also have to offer Tivo v3-b that doesn't include the DRM chip.

Or, to take my example of security equipment, I would have to sell "Securomatic" and "Securomatic TamperResistant". The latter would have a secret key only I had and, the former would have a published key.

Or with voting machines, you'd have a "Vote-o-matic Evaluation" and "Vote-o-matic Election", the first for Election Officials to evaluate with a published key, and the latter with a secret key. The Election Officials would have complete control over the Evaluation version, they could run find the version they liked and order the Election version and run md5sums or whatever on it to make sure the software is identical.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

That's absurd. ROM is slow and expensive. A fully capable Linux system can be hundreds of megabytes or more.

Re:DRM isn't necessarily evil.

[dch24]

The problem with the GPLv3 is that it is expected to be widely used, and many people who wouldn't have a problem with the above uses of DRM would release their code under the latest GPL without really thinking about it.

Here's the way to release GPLv3 (current draft) hardware that is tamper-resistant. I'm ignoring the obvious attacks, like physically pulling the ROM chip out and sticking in another one. Sticking just to software attacks, and how the GPLv3 doesn't stop a hypothetical election official from protecting his voting machine.

You build the system with DRM to verify that all the software is signed properly. You distribute the key with the source code. So, anyone who wants to tamper with your machine can put in another ROM that is signed.

*BUT* The election official probes the ROM with a ROM reader, with the machine off. He gets the contents of the ROM before any election, and reads them into a different computer. This means the ROM must be properly isolated electrically when the power is off. Design that into the board.

Now, he computes the MD5 sum of the ROM on his other computer, and checks that by hand with the MD5 sum printed on the contract he signed with the manufacturer.

The manufacturer's contract with the election official includes the MD5 sum of the software they both have agreed to use.

So why bother signing it at all in the first place? To prevent "accidental" inclusions of unsigned software by the manufacturer. The election official has studied and accepted *ONE* form of the software on the machine. He only has to find that one MD5 sum, and he's satisfied.

Note how it is the final owner (often, that's me, like when it's my computer, and not a voting machine) that must be responsible for making the "trustworthy" call, to trust or not to trust. I won't let some chip or some chip manufacturer make that decision for me.

Just my 2 cents.

Re:DRM isn't necessarily evil.

[Anonymous Coward]

I don't quite understand what you're saying. Reading the DRM chip doesn't do you any good. Public key cryptography. All it needs is the public key.

Now, if, in the case of the election machine, the attacker took out the DRM chip, replaced it with his own and completely replaced the software, that would defeat it. (But that's why you'd use a locked and tagged chassis)

If the attacker has the secret key, he can sign his own version, find some flaw or other in the machine, perhaps a previously undetected buffer over flow, and get root on the box. From there, he just copies in his version of the software. As long as he does this after the initial verification sweep, it won't be detected. The key that signs the software much remain secret, or it doesn't really help security all that much.

I'm surprised no one has responded to my suggestion that the requirement be "You must also sell a non-drm version of the hardware or a version with a published secret." As far as I can tell, it solves the problems of both sides. Security people can sell secure boxes to clients that require the security. Tinkerers can get the non-drm version.

Re:DRM isn't necessarily evil.

[dch24]

He just copies in his version of the software. As long as he does this after the initial verification sweep, it won't be detected. The key that signs the software much remain secret, or it doesn't really help security all that much.

I realize ROM chips are slower than RAM, but since we're talking about hardware where security matters so much, they should execute directly from the ROM.

You are right about exploits though. For instance, if the USB driver has an exploit, he sticks in a special USB key, takes over the system, and executes new code from RAM. No amount of DRM will ever protect against a completely new exploit.

But the GPLv3 is not the problem. Whether the binary is signed or not doesn't matter if the hypervisor, kernel, and/or TPM chip can be bypassed. That's actually a great argument for releasing the keys and the source. Release the keys and the source so that I can compile the entire ROM image using a toolchain of my choice and I can verify it comes out bit-for-bit just like the one you gave me. Otherwise, how can I, the customer, trust that you haven't put in a back door.

You must also sell a non-drm version of the hardware or a version with a published secret

It sounds like a good idea. However, they are not the same thing to begin with, right? I guess I wouldn't trust the company not to use separate source trees to build the secure and open versions. If a company can make it happen as a viable business model, then that means it's a good idea, my reservations notwithstanding.

Bison fiasco? Numerous GPLv2 forks are unlikely.

[jetxee]

Most of GPL software will easily become GPLv3, thanks to this clause:

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

So if developers support it (I expect they will do), a lot of software will turn to explicit GPLv3.

Of course, one could always make a fork of some particular project and allow GPLv2 only. Yet starting from this point it is impossible to reuse any GPLv3 code in it. Whole libraries might become not suitable for this GPLv2 fork, at least the new versions of these libraries. Maintaining such GPLv2 forks may become really difficult. Linux kernel is probably one of few projects which may stay with GPLv2 for a long time. Most small projects are likely to make a transition to GPLv3, either willingly or by using some GPLv3 code.

What's wrong with that?

[Dr_Marvin_Monroe]

As long as they provide the source that they used before they signed, I think that's fair enough.

I'm with Linus, I don't think the license should be used as a "crowbar" into the hardware too. The GPL3 sounds like it places even MORE restrictions on what the user and/or developer and/or companies may do, not less... I'm against how they went about it too... it doesn't sound like the FSF even took anyone's opinions into account, RS and the rest just created an even more onerous license than the original. I don't see too many companies adopting it....

Take for instance, the following possible situation.... As a developer and small business man, this type of situation entirely possible, I've run up against this using GPL code. Company X developes a brand new, extra-cool heart monitor and defibulator widget based upon embedded linux. The product has been carefully tested at the factory, with good records kept, etc. The product uses a signed image to verify that it's the same image that went through tests and hasn't been modified. Product is FDA accepted and on the market, the company that developed the product feels fine taking the responsibility for the code. I know the license doesn't confer responsibility to the other developers, but the company has tested this particular image and they assume liability.

Now, some fool at the calibration outlet decides he's going to load some updated packages into the image, without telling anyone and without proper testing. He's creating a dangerous situation by running software that wasn't tested for it's particular use. According to the GPL3, he can resign the binaries and create a potentially injurious product, exposing company X to VERY SERIOUS liability that they had no part in.... Remember that company X did NOT want to release the signing keys, did NOT load the untested software on, but they will be held liable for any injury that results from it's being ABLE to be loaded. Company X here also may become the "deep pockets" defendant in this case, with the repair guy skating away....

No, this is totally wrong.... GPL3 should NOT be able to force this situation.

I don't like what TIVO is doing, and I sure don't like DRM, but I like what the FSF is doing even less. How about an open comment period. How about querying the free software developer as to what they want. I didn't receive any survey, I didn't find any place where I could provide feedback or vote either. They propose to speak for me, but I have not found any way to tell them what I want. People using stuff that I write will find the "either version 2, or (at your option)any later version" missing from any of my new works.

@*&% the GPL3!

Re:What's wrong with that?

[numatrix]

The license isn't a crowbar, it's a shield. It's a shield for YOUR code you're writing, a shield for the ideal that you don't want your code used unless others can modify it and use it. If someone's use of your code is limited by hardware restrictions and you want to further strengthen that shield by V3, then go for it. If you as an author don't like carrying the ideal that far and you think access to the source is enough, don't use V3 (as you seem to suggest you won't be). There's room for more than one OSS license.

The example you site has nothing to do with the GPLV3. The fault is either with:

1) The company who released hardware built on code that allowed others to change the code in an environment where that's a bad idea. (ie, build your own fricking code, don't rely on others who want their code to be modifiable, not just easy to print out and stare at)

or

2) The moron who loaded code onto a machine that could cause problems, probably violating federal law in using a non-FDA approved device (since I imagine the FDA approval only covers the device with specific code).

The GPLV3 is not evil and didn't cause anyone's heart monitor problems, the above did.

As for a comment period, check out:

http://www.fsf.org/news/gpl3.html

Scroll to the bottom, specifically the section near: "The Foundation will, before it emits a first discussion draft, publicize the process by which it intends to gather opinion and suggestions. The Free Software Foundation recognizes that the reversioning of the GPL is a crucial moment in the evolution of the free software community, and the Foundation intends to meet its responsibilities to the makers, distributors and users of free software. In doing so, we hope to hear all relevant points of view, and to make decisions that reflect the many disparate purposes that the license must serve."

Re:What's wrong with that?

[Arker]

Your example is clearly misinformed.

The only reason they would have to provide that signing key would be if they rig the hardware so that it is NOT possible to run modified binaries in any other way. This would be silly.

Instead, what they should do, is include a documented, warranty-voiding method to turn off the circuit that refuses to load unsigned binaries. As an example - you have a locked, tamper proof box (like all medical equipment) and the purchaser receives a key. They may, at their discrection, use that key, unlock the box, and change a jumper on the main board. Then replace and relock the case, reboot, and answer 'yes' to a confirmation dialogue with GIANT WARNING TEXT all over it. At this point, they can load whatever kernel they want. They've also voided the warranty and any and all FDA certifications of the box, so it's now illegal to use it for its original purpose. There could also be a permanently visible tamper indicator, I would suggest a red and green light placed prominently for all to see, clearly labeled, that would switch from green to red if the box was even opened.

There's no need to distribute any signing keys here, as the ability to run modified binaries is preserved without doing that. And legal liabilities are clearly shifted from the manufacturer in the event that a customer chooses to do that.

Re:What's wrong with that?

[5937]

"No, this is totally wrong.... GPL3 should NOT be able to force this situation."

Sure it should. If i gpl code, i want my users to play with the code (and fix my bugs :) . If they don't do that, sad. If they can't do that, use someone elses code.

Thats what GPL2 wants, lost by DRM, and GLP3 re-enfoces.

Re:What's wrong with that?

[5937]

Did read wrong. Sure the company should not be responsible for other peoples changes.

But that is taken care of: The key needs only be released to the owner to the device, not to everyone. So give each device a unique key, sign the software specifically for it, and this random guy cant change it.

Re:What's wrong with that?

[Znork]

"Remember that company X did NOT want to release the signing keys"

What company X wants is irrelevant. If they use GPL code, they should expect to afford everyone else the same freedoms they were afforded. If they do not want to forward those freedoms, then they can damn well write their own code.

"exposing company X to VERY SERIOUS liability"

Oh, please. And if the fool opens up the machine and solders a few neat improvements, you think the company is liable?

A more likely situation is Company X goes out of business and the signing keys are lost, and the machine turns out to contain potentially dangerous, but trivially fixable bugs. Without the signing keys you've lost the freedom to fix those bugs.

Re:What's wrong with that?

[jonbryce]

In this case, surely the person who fraudulently signed the code as being suitable for use in the heart machine would be liable, and nobody else.

Re:What's wrong with that?

[tinkerghost]

Actually, you will see 3 people/companies named:

1. The calibration technician - because he did it.
2. The calibration company - because they employed him.
3. Company X - because they manufactured a system that allowed him to do it, and they probably have the deepest pockets.

Now is that right? Not really, but it's reality.
I also have a problem with the GPLv3 requiring hardware to run all software. As I understood the purpose of GPL, it's to enhance and ensure the freedom of the authors to have their code - which they are generously and freely giving - remain open and available, to ensure that any enhancements to the core code are returned to the GPL community and the whole continues to grow and improve.
In most cases, there is no economic bennifit to anyone to create hardware/firmware which locks out alternate versions of the OS/Software. In Tivo's case, it does have a bennifit, by requiring a signed OS, it is capable of imposing restrictions on the devices use - IE block unrestricted copying of recorded programming - which allow them to operate without the constant threat of legal action by copyright holders. In the heart monitor/defibulator case, it would again provide proof against liability for unauthorized changes.
In both of those cases, there is a compelling legal reason to use the 'Trusted Computing' mode. Remember, locking out software via signing is part of trusted computing not DRM. DRM is about Digital Rights Management - controlling access to digital data, Trusted Coputing is about being able to verify the authenticity of software. While I do not agree with the 'need' for a hardware mfg to provide a locked environment to protect someone else's IP, it's the way our legal system currently operates. In other cases where high security, and zero fault tolerance are required, the Trusted Computing model is not only viable, it's desireable.
The problem with GPLv3 is that, the requirement that keys be provided to resign modified code negates the entire concept of Trusted Computing. This means that some of the largest industries will have no incentive to provide support for FOSS. The medical hardware industry is as fanatical about zero defect as the guys at SecureBSD are about security. If their efforts twords zero defect can be negated by any hack with a serial cable, they won't help. The same with the financial industry, if they are prohibited from blocking modified code, they have no incentive to help make the core code better.
So it comes to a choice of what's more important:

1. The continued contributions to, and improvement of, the FOSS community and its body of knowledge by corporate sponsor donations of code and patent liscensing.
2. The ability to run modified code on every embeded device

Of the 2, I find the contributions to be more rewarding, and more in the open spirit of the FOSS movement. I want my medical records to be stored in a system that requires validated software, that way I have 1 less worry that my data is going to be compromised by some asshat waving his cyberdick around. I also want that system to be running FOSS, both because I want bragging rights for having contributed, and because I feel that more coders looking at the software does make it more secure.

Re:What's wrong with that?

[jonbryce]

There are cases where it is a good idea to control what software runs on your hardware. Your heart machine is one good example.

However, that doesn't mean that control should be exercised by the manufacturer. In this case, I think the keys should be controlled either by a suitably senior official at the hospital or the local health regulator.

What happens if the manufacturer goes out of business. Your expensive heart machine is now a paper weight.

What happens if the manufacturer decides to drastically increase support fees. You don't have the choice of getting support for the machine from other approved suppliers.

I think the new provisions get the balance just right.

The heart machine presumably is password controlled so that the hospital can ensure that only suitably qualified doctors can operate it. Likewise, it can be controlled so that the hospital can ensure that only suitably tested code can run on it.

you misunderstand the point of the GPL

[Anonymous Coward]

The GPL is, and always has been, about using your code to further RMS's political views not about keeping open source open... v3 makes this more obvious but it has always been true.

I don't use it for precisely this reason, instead I have always used MPL or BSD style licensing for the open source stuff that I author.

Get a grip.

[Corngood]

They can't stop you legally from doing anything you want with the device (or let's assume that for now), but there's no reason for you to expect that it is capable of anything other than what the manufacturer intended. They are perfectly free to cripple their product for whatever reason they like, so long as it is sold as such.

Mod parent up.

[Corngood]

You did a good job of making the point I was trying to make in my last post.

Running is not enough for GPLv3 - rootkit clause

[Shirotae]

The problem with GPLv3 is that it goes beyond requiring that you be able to run modified software. It requires that if a signed binary could access content that belongs to someone else, you must be given the keys to let a modified version access that content.

This is the essence of being anti-DRM - it demands the right to ignore other people's rights.

If you read GPLv3 and think outside the "it's all about DRM" box you find that GPLv3 requires that you give away everything it takes to create perfect rootkits. The "cannot distinguish" words mean that it must be impossible to perform any kind of post-installation integrity test of the system. If you always boot from verified read-only media, you may be able to protect your own system but a GPLv3 OS would otherwise guarantee that your system can be controlled by anyone who has managed to acquire your rights for a moment.

What about ROM?

[Corngood]

I haven't really looked into it, but what if instead of checking a key, they just put the software on a ROM? They could even put a GPL OS on a ROM and then have a signed non-GPL userland image on flash. Sure it's probably not practical, but would it work? It would take a hardware mod to bypass, but that's all most DRM systems would take anyway. Does that fail the GPL3 test, and if so, does that mean all devices using GPL have to be field updatable?

Re:What about ROM?

[5937]

Removing the DRM could be illegal, exchanging a ROM not.

Re:What about ROM?

[Corngood]

Oh right, I forgot about that insane law. I wonder if just using a ROM could be considered DRM. It's just another way of locking down the system.

Re:What about ROM?

[5937]

I guess not, a ROM is a technical solution. By default it does not imply that you want to protect the code from modification, only that you want to protect it from vapourisation on powerout. And since the code is GPL, that would imply you are ok with changes. IANAL of course.

But now i am curious, if tivo uses GPL-code, they are technically ok to modifications. So if i remove the DRM, i am not removing a protection, because there is nothing to protect? Just thinking loud.. :)

Burned by DRM

[zcat_NZ]

I friend of mine dropped by yesterday with an interesting story. He had a pile of CD's which he wanted 'ripped' to try out on his recently purchased mp3/wma player. He doesn't have an internet connection at home, so to save himself the effort of typing in all the track listings by hand he took his CD's to another friend's place, ripped them in Windows Media Player, made sure they all played properly, and burned them to a CDR to take home.

Surprise, surprise, he can't play them at home. Not on his computer, and not on his new media player. Still at least it was only an afternoon wasted, he could have bought a few tracks online at his friend's house and ended up with 1-dollar-a-track unplayable music instead.

Re:Burned by DRM

[sumdumass]

You friend needs ot backup the WMP media license and restore it onto his computer. That or remove the checkmark by the protect my media box in media player options and then re-ip it.

WMP by default, has the "protect content" enabled to make you think you cannot share your media files. This mistake is more commen then ever.

Re:Burned by DRM

[zcat_NZ]

Nope. My friend has learned not to trust Microsoft and in future he'll rip his music to mp3 using CDex. He's also seriously interested in switching to Ubuntu, I just have to find some free time to install it and set it up nicely for him.

Re:Burned by DRM

[sumdumass]

That could be another way of doing it. but there is nothing stoping him from doing it the way described if the protect content is turned off.

Linux heading towards BSD License?

[xoundmind]

From a freedom standpoint, I'd say RMS is dead on correct. Torvalds' is effectively rejecting our contemporary nation of free software. (And the GPL - like the US Constitution is and should be a living dcoument that adjusts over time.) The upshot is that - from my reading - Linus is embracing what is far closer to a BSD license.

But here is here it gets really odd: What about Debian and the rest of the wonderful purists? If the kernel lags behind in a (relatively) antiquated GPL 2 status, why should free software embrace it at all? Would that mean the sudden surge of the Hurd?

Lots to think about here...

Personally, if the kernel stays at GPL 2, I'm finally ditching linux for good in favor of FreeBSD. At least their licensing viewpoint is not hypocritcal.

Have you stopped beating your code?

[Anonymous Coward]

I think he's trying to say choose proprietary* and leave the GPL alone. I'd recommend doing so, and leave the consequences to the team of RMS and FSF.

*Actually you don't have to go that far(1). There's plenty of non-GPL (but F/OSS) software out there, with some of the same (dis)advantages as the GPL.

(1) A side note. Most people with a pro-GPL stance have the presumption that all software relationships are abusive. Microsofts may be. SCO's may be. However that doesn't mean everyone's are (in fact some contracts give the purchaser the source code. They just can't distribute it to others).

Re:Have you stopped beating your code?

[Goaway]

I think he's trying to say choose proprietary* and leave the GPL alone. I'd recommend doing so, and leave the consequences to the team of RMS and FSF.

Did you even read what I said?

Re:Oh, if Linux's key is ok, GPLv3 doesn't stop Ti

[MooUK]

No, that's where you're wrong. That major difference is the ENTIRE point.

You can choose to ignore whether it is signed by Linus or not. You CANNOT choose to use unsigned software on the TiVo device, and therefore you are prevented from making changes and running your own modified code.

And that is the entire core of the GPL.

This really doesn't matter

[Arker]

It's an interesting thought experiment, to be sure, but it's really of no consequence in the real world. Linus' kernel doesn't have spyware. And we may place a fairly high probability on the prediction that it never will contain spyware. That being the case, this is a purely hypothetical issue.

Re:Running is not enough for GPLv3 - rootkit claus

[stony3k]

Let me get this straight - you're talking about DRM software which itself is GPL, so the GPLv3 would force the author to release the key to decrypt the DRM (and access the DRMed content) along with the source code. That's the only case where the GPLv3 would ignore the rights of others - and it's not the GPL's fault but the author's.

See, the GPLv3 is a very open public licence - it's not like someone is forcing any author to release their software under this licence. If they don't like the terms, or if the terms defeat the purpose of their software, they can very well choose another licence.

Derived work?

[5937]

If the hardware works *only* with that gpl-code, its derived work in a way? Basically "linked" to it.

Re:Derived work?

[kripkenstein]

There is no linking here. Company A sells hardware, Company B sells software. Separately.

To reiterate, the software works on the hardware only if signed with a key, known only to Company A, the hardware manufacturer. Anyone is free to reach an arrangement with Company A in order to get their code signed by them. As it happens - by 'chance' - the only one that actually does so is the software manufacturer 'Company B'. This could be because Company A charges a ridiculous sum of money from everyone but Company B, for example.

The end result is that there is NO freedom to modify and run Company B's code on Company A's hardware. But there is no violation of the GPL3. The hardware and software are two 'separate' products, by two different manufacturers.

The argument is that since it is impossible to prevent this from happening, there is no reason to even try. As I said in the previous post, I hope I am wrong here, please correct me.

Re:Derived work?

[5937]

"There is no linking here. Company A sells hardware, Company B sells software. Separately."

Same for dlls. If required, derived. In your example the software is required, the hardware broken without it. So derived.

Re:Derived work?

[kripkenstein]

But hardware isn't the same as software in this area, I don't think. Perhaps I'm wrong, but here is how I see the problem:

Say there are two people making hardware that can run my software. One of them runs only digitally signed software, and I have my code signed by them. The other hardware vendor will run any code.

I, the software vendor, am complying with the GPL3. Correct me if you disagree at this point. But as I see it, I give out my product with accompanying source code, and people can run it on hardware from either hardware vendor. If they want to modify it, they can use hardware by the second vendor. You can't blame me for paying a modest fee to the first hardware vendor to get my code digitally signed, can you? (I might get more sales that way)

Now, what happens if the second hardware vendor goes out of business? Am I all of a sudden in violation of the GPL3, because now there is no hardware to run modified versions of my code?

If you say yes to this, but thought I was complying before, then the GPL violation can be circumvented by having a THIRD party, which makes hardware that can run modified versions of my software - but that hardware is very expensive/poorly made/produced in small numbers, so in practice no-one buys it.

Re:Derived work?

[doc modulo]

What if the GPLv3 said that it's not allowed for ANYONE to install or run GPLv3 code on hardware that is crippled/put together in a certain way (DRM). That way the company that tells people to install their software on the crippled hardware is breaking the law by advocating license infringement.

It's impossible to enforce this "don't install/run on crippled hardware" for every private user but you don't HAVE to enforce it. You just enforce the GPLv3 if a hardware manufacturer or a "hardware software combination seller" breaks the license.

Re:Derived work?

[5937]

"I, the software vendor, am complying with the GPL3. Correct me if you disagree at this point."

I disagree ;)
You stop users from changing the code, which is the whole purpose of the GPL.
You do that intentionally, not out of technical need.
So you remove the freedom to run any code.
So you have no license to run GPL-code.
IMHO, IANAL etc.

Re:Derived work?

[kripkenstein]

You stop users from changing the code, which is the whole purpose of the GPL.
You do that intentionally, not out of technical need.
So you remove the freedom to run any code.
So you have no license to run GPL-code.

But the point of my example was that it is NOT me that does the removal of freedom. I put out software. Some (not even all) of the hardware manufacturers prevent unsigned code from running. How am I to blame for that?

IANAL also, of course :). But something seems wrong to me here. Maybe I'm not putting my finger on it yet, though, or not being clear enough in my arguments (apologies if so).

Re:Derived work?

[5937]

Got it. IMHO not the software-developer, but the hardware-seller is at fault. The hardware is hardwired to your software. So in a way its "linked". Running this software is not only possible, but is enforced. So it must provide a way to run modified software, or has no license.

(IANAL)

Re:Derived work?

[kripkenstein]

I agree that, morally, the hardware-seller is the one at fault. However, I don't see how to make them legally at fault. They sell a hardware product, containing no software (they just check a key when you do try to install software on it), so they aren't bound by a software license like the GPL. The GPL is based on copyright law for its power, but here they aren't copying software, so they can't be in violation.

The end-user who installs the software IS copying it. However, there is no redistribution, so no problem there (this is the same as making a personal backup copy, i.e. fair use, I would assume).

Re:Derived work?

[5937]

AFAIK there is such a thing as derivation. If i write a story and you write a continuation, its still an infringement because your story would not work without mine.
In case of this hardware the hardware would not work without this software, so IMO its a derived work.
(IANAL)

Re:Derived work?

[LuYu]

Company B is under a legal obligation to release the key with their software. In other words, if Company B cannot distribute Company A's key with Company B's software, but they do distribute a Company A signed version of Company B's software to anyone, Company B is in violation of the GPL. If Company B does not possess the key, Company B cannot legally distribute binaries signed with it.

freeloaders

[Anonymous Coward]

to use the over-emotive rhetoric of the RIAA/BSA, if Tivo want to steal code from others then they should be jailed.

Freeloders could *buy* GPL code and have it relicensed. They could make their own. They could buy off someone else.

They cannot steal the code of others.

If buying code is too expensive, then Tivo either give up entirely or allow non-signed or self-signed code on the machine.

Or should businesses be allowed to use unlicensed MS software because their profit margins are too small to pay for licenses?

DRM is not the only use for strong integrity

[Shirotae]

My main concern here is that the proposed GPLv3 is hostile to strong integrity. The motivation is hatred of DRM, but the narrow focus on DRM seems to have blinded people to what else will be affected.

Fortunately Linus Torvalds seems to one of those who can see beyond the narrow DRM focus and he has apparently come to the conclusion that GPLv3 will be inappropriate for Linux. I agree with him in that - GPLv3 will be a very bad license for infrastructure software such as an OS where GPLv2 has been a good license.

Yes, people have a choice about which license to use. Linus seems to have looked clearly, thought carefully, and made a choice. Some people are now besmirching his good name by asserting that he has "misunderstood" GPLv3 and ought to be persuaded to adopt it.

Perhaps the strong GPLv3 advocates should put some effort into getting Hurd up to scratch - I assume it will be GPLv3 licensed given its provenance. If you really think Linus is wrong, get on with making something that will displace Linux by sheer force of merit, and its vastly superior license.

The real problem with trusted computing

[graf0z]

is not keeping secret keys secret. It's the missing possibility to edit the list of pubkeys which the trusted computing (TC) mechanism acccepts!

1. bad thing:
   1. Tivo sign their kernels using their secret key.
   2. Tivo's bootloader refuses to boot any kernel not signed by tivo
2. good thing (prevents trojan LKMs):
   1. RH sign their LKMs using their secret key.
   2. A RH kernel binary refuses to load any LKM not signed by RH.

As far as i understood the discussion, GPLv3 thinks that (1.1) is the problem, so it demands publishing the secret key. But that's wrong and renders (2) useless.

Instead, the problem is (1.2): i cannot append my own pubkey to the bootloaders list of approved binary signing keys, although i "own" that bootloader. Instead with (2.2), i can build and run my own kernel image embedding a different list of acceptable LKM signing keys.

So if one wants to prevent such a mess like tivo, (s)he should use a licence that demands that the software is not run on devices with a write protected TC pubkey list. I'd perfectly happy with TC if i could enter the fingerprints of valid TC-pubkeys into the BIOS.

Just my 2ct, m.

NOOOOOOOOO.....

[hummassa]

The GPLv3 says that:
IF:
1. you are going to use GPLv3'd software,
2. to distribute it with some hardware,
3. and said hardware demands the software to be signed,
THEN:
you must release some way/key to sign other (potentially modified) versions of the same software to run in the same hardware.

HTH

bison vs. byacc

[Per Abrahamsen]

Actually, the GPL'ed output of bison it was considered a feature for some time. Enough time for byacc to gain ground. The exception was inserted because of the existence of byacc ment that the ability to use bison was no longer a incentive to release code as GPL.

The appropriate popularity comparison would be between byacc and bison.

Re:bison vs. byacc

[Chops]

Actually, the GPL'ed output of bison it was considered a feature for some time. Enough time for byacc to gain ground. The exception was inserted because of the existence of byacc ment that the ability to use bison was no longer a incentive to release code as GPL.

Do you have a link to back this up? My understanding is that bison was never intended to GPL the code that it output; that was an accidental feature. For example, the bison docs say, "[B]efore Bison version 1.24, Bison-generated parsers could be used only in programs that were free software. ... The other GNU programming tools, such as the GNU C compiler, ... could always be used for nonfree software. The reason Bison was different was not due to a special policy decision; it resulted from applying the usual General Public License to all of the Bison source code."

The appropriate popularity comparison would be between byacc and bison.

I'm not sure how that matters (I only mentioned popularity to counter a rather silly argument by the original poster), but bison is much more popular than byacc in Debian (11000 installs to 500). BTW, the same person wrote both bison and byacc.

Re:bison vs. byacc

[Per Abrahamsen]

It is from memory, presumably discussions at gnu.misc.discuss at the time.

How are they hurt?

[Anonymous Coward]

Because they did work and got no compensation for that work from you.

Or would you go "hey, I wasn't actually *hurt*" if your boss says "sorry, won't pay you this month"?

And, for your fouth reason, that is fine with code you wrote, but why are you deciding that for other coders? Release your code GPL and BSD (MIT, SharedSouce, ...). Don't release someone else's code BSD.

Unless it's MS's code, of course. It will be amusing to see you squirm explaining this to the judge and solicitors...

Re:How are they hurt?

[Goaway]

Because they did work and got no compensation for that work from you.

Or would you go "hey, I wasn't actually *hurt*" if your boss says "sorry, won't pay you this month"?

I never expected any compensation. That's why I released the source for free, as opposed to charging money for it. Your work analogy is just incredibly silly.

And, for your fouth reason, that is fine with code you wrote, but why are you deciding that for other coders? Release your code GPL and BSD (MIT, SharedSouce, ...). Don't release someone else's code BSD.

Why are you accusing me of breaking the law?

Your problem here

[Anonymous Coward]

is that you have to say that the code they have given you is not suitable for running on that hardware. Which is rediculous because they are running that software on the hardware. Since this is inherently incomptible, they must either

a) Allow you to sign binaries for the hardware
b) Allow you to run unsigned binaries on the hardware

If Tivo really want to keep it locked down, stop "stealing" the code off others and make their own. Or they can go out of business, source software elsewhere or even obey the spirit of the GPL. But I don't see why Tivo should be saving money by leeching off the hard work of others without playing ball.

Read again please

[5937]

"And they have - you can modify it and redistribute as you see fit"

i don't think so.

"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means ..."

What do you think "an executable work" means?

BTW legends says RMS wanted to fix a printer and was not able to do it, because not able to reprogram that thing. Which is one reason for the GPL. I doubt he would put out a license which would say "have fun typing a bit in the source" when his original reason was to fix *that* printer. (Sure lawyers may have messed it up, don't know, IANAL)

Re:Read again please

[Registered Coward v2]

"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means ..."

What do you think "an executable work" means?

Just what it says - it does not say that you must provide the necessary information to execute, install, or compile a modified work. You want to extend the GPL to hardware which the current license does not require.

An executable work, BTW, runs on its own, unmodified and is supplied by the distributer; it specifically is not the ability to execute any derived work from the original.

You clearly don't like that but that doesn't change the terms of the license.

An interesting side question is if you release a GPL 3 version of previous GPL v2 code are you restricting the rights of subsequent users since it now includes more restrictive DRM requirements; thus it would violate the GPL to release code under the GPL.

Re:Read again please

[5937]

You: "Just what it says - it does not say that you must provide the necessary information to execute, install, or compile a modified work"

GPL: "plus the scripts used to control compilation and installation of the executable"
Me: Question is does a key count as part of those scripts. I think so. But IANAL.

You: "An interesting side question is if you release a GPL 3 version of previous GPL v2 code are you restricting the rights of subsequent users since it now includes more restrictive DRM requirements" /.: Not a question, of course you can't. Thats why some use "GPL2 or any later", then you can use whatever FSF calls GPL. If that is missing, only GPL2 is valid, or agreement of all the authors. (Learned on /. , again IANAL).

Re:Read again please

[Registered Coward v2]

You: "Just what it says - it does not say that you must provide the necessary information to execute, install, or compile a modified work"

GPL: "plus the scripts used to control compilation and installation of the executable"
Me: Question is does a key count as part of those scripts. I think so. But IANAL.

And I don't because it excludes "and execution" as a condition of license - which to me is significant because programs are compiled; installed, and executed; you could argue that the original license writers should understand that distinction and therefore did not include it - as further evidenced by later changing the terms to include it. But, then again, IANAL either.

You: "An interesting side question is if you release a GPL 3 version of previous GPL v2 code are you restricting the rights of subsequent users since it now includes more restrictive DRM requirements" /.: Not a question, of course you can't. Thats why some use "GPL2 or any later", then you can use whatever FSF calls GPL. If that is missing, only GPL2 is valid, or agreement of all the authors. (Learned on /. , again IANAL).

But even then someone might argue that you can't exclusively GPL3 it because the original allowed for 2 or later; so to avoid restricting the rights further you must also allow redistribution of the code under 2 regardless of whether you also release it under 3; i.e does the "no more restrictive" clause trump "2 or later?" IANAL as previously stated.