If it is an open and public community and is not overtly seeking the development of weapons (just multi-use components), I would say that there is not. At worst, the government should see this as a possibility for intelligence for any real terrorist link.
I suppose that if this was an "open source uranium enrichment centrifuge and bomb design project" there would be a case. But even there, I tend to think that the enemy we do no know is more dangerous than the enemy we do. Such an open source project might indeed be a source of a great amount of information for the CIA.
In the end, I think the question is likely to be about the privacy of participants, not national security. If there are national security concerns, you can expect various governments to send appropriate spy agencies to your project. If this is not desirable, you may wish to reconsider.
All in all, I tend to act as if a lot of this doesn't really matter. I would not close down such a project myself, but I would probably open up a discussion on the issues, explicitly saying that there was no direspect intended for your Iranian friend.
IANAL, but I think the correct answer probably is "it depends."
I personally don't buy the idea that using dynamically linked libraries means derivation. Obviously mixing creative content in screen output/story telling in a game might be. Obviously static linking would. But the dynamic linking argument seems dubius to me.
I would be inclined to allow it provided: Each portion complies with its own license. Identifiable portions of non-GPL code are not derived (meaning creative content beyond a list of facts is included-- most C header files are just a list of function declarations, which really amount to catalogs of facts) For GPL 3, any non-gpl code link *to* GPL code, and the GPL 3 does not link *to* code which cannot be relicensed under the GPL.
But IANAL, just a software developer struggling with similar issues (see my journal for more details).
You use Apache internally. Apache is covered by patents from tech companies X, Y, and Z.
At some point, you discover that Apache arguably violates another of your patents. You don't like this and you ask the Apache Foundation to remove the offending code. Apache Foundation refuses.
You sue the Apache Foundation. This gets publicized, as is the fact that your public web server runs Apache.
Companies X, Y, and Z sue you for *using* Apache in violation of their patents.
IANAL, but I believe that patent rights include the right to regulate *use* of the patent.
As far as I know, pretty much all open source licenses obligate you only to your recipients. Exactly write. Almost every one of them with only a few exceptions. Heck, I am not even going to include the AGPL because this only places restriction on modification, not obligation to users (hence blocking out requests for source, or using a proxy of some sort to send different code seems within the confines of the license).
The only real exception I can think of is Larry Rosen's OSL, which defines distribution to include external deployment (i.e. making available for use by external users).
So this means every license needs to be read, but that one need only look for problems, not track all possible interactions.
WHile what you say is exactly right for most OSI-approved licenses, there is at least one exception that I am aware of.
Larry Rosen's OSL requires distributing the source code of any software which is used by people outside your organization, at least by my lay reading of section 5 (IANAL). So it does seem wise to have lawyers read the licenses for hidden surprises of this sort. Of course, this doesn't add complexity for mere use because this is going to be the same for nearly every license out there (so you are just looking for exceptions).
See the flamewar on the OSI mailing lists; all the above concerns and more have been aired.
No, seriously... large complex component-based software system + GPL = instant holy wars, because the line where one work ends and another begins is no longer clear.
"Dammit Jim, I'm an engineer, not an attorney!", but it seems to me that in practice, the GPL's process-boundary condition becomes little more than a performance issue because you have to use message passing over some kind of communications link instead of loading in-process. For additional flavor, release the "client side" of the message passing bits under the AFL or similar, and the "server side" obligingly under the GPL.
Allow me to summarize the OSI license-discuss flamewars (leaving out the "only my opinion is on topic here" sort of posts).
Some have pointed out that derivative works can't mean what the FSF says they mean because if it didn, every piece of software would be derivative of the OS. THey argue in line with the Eclipse Foundation's FAQ that derivative works as defined in US law require the inclusion of creative (not merely practical) content and therefore merely including a header file is probably not sufficient to argue derivation. They point to legal analysis like http://www.usfca.edu/law/determann/softwarecombina tions060403.pdf for backing.
Others argue that this would render copyleft licenses unenforceable and this would be politically incorrect. They point to legal analysis like the FSF's licensing FAQ for backing.
With Free Software, this is always allowed. No problem.
As long as you remain in good standing with the license and don't sue people under patents, the following seems to be correct.
But under the Apache License 2, you could lose patent rights required to use the software if you initiate such a lawsuit. Under the GPL v3, you could lose such patent rights for any license violation.
IANAL, but this is just my basic reading of the license.
So? Look for opportunities to drive up the asshat's costs. You offer it for free, he charges, so he must be adding value. If he is not, then let him have the suckers......
If he is adding value, then you still have some options. The first is to look for features he includes and reimplement them in your project free. THis drops his value to $0. The second is to get the community development rolling fast enough that he is effectively forced to fork and move on or start contributing back so as not to be buried in trying to merge his changes back into the code.
Most of the large BSDL projects I have been around have a few players who do sell versions with a few new features. Most of the time, the community doesn't *want* those features, such as EnterpriseDB's Oracle compatibility stuff. PostgreSQL, of course, has such a pace of development that none of these companies actually want to maintain any more patches than they have to. Hence they contribute everything possible back.
In short, you contribute to a GPL program becaue you are required to. YOu contribute to a BSD program to drive the competition's prices up and yours down. They both achieve similar ends. Why care?
The benefit from the GNU GPLv2 is that it protects some business interests to a point if the project fails (i.e. if the project fails, your competitors can't proprietize it). This is a business and not a freedom need as BSD-style-license projects offer economic controls to ensure contrbution.
I believe that the GNU GPL v3 and the AGPL (both versions) both violate any basic ethics by placing undue restrictions on developers while failing to guarantee any more Freedom to the downstream user. The GNU GPL v3 forces one to only depend on code one can *relicense* under the *exact* terms of the license (read sections 6 and 7 very carefully and slowly. Pay attention to the required licensing of the Corresponding Source, provisions and definitions for removal of additional permissions, and the provisions for the removal of additional restrictions).
Therefore I cannot support the GPL v3. It is overreaching in a way that the GPL v2 was not.
businesses pay programmers to programme, and the commercial department to read contracts. And in the case of the GPL v3, they have no clue what it means.... Seriously, there are some really nasty easily overlooked clauses in that license. See my latest journal entry for more info.
The problem is that many of the FOSS licenses purport to extend the terms of those licenses to any software that interacts in a close manner (such as linking). IANAL, but this standard seems really suspect to me (it would mean that Microsoft could release a new version of Windows and declare that no open source software could be developed for it).
Again, when you are in business, it doesn't matter whether the FSF is wrong or not. You follow their terms even if you believe that they have no case because it isn't worth going to court over.
Hence we have the GPL v3. The license so complex it will probably take years for your lawyer to understand it in full.
Because everyone draws lines different places and threatens legal action if you cross those lines.
The cardinal rule of *business* relating to intellectual property law is that the licene means what the licensor says it means unless and untill it becomes worth fighting in court. I run a business. IANAL.
I actually see this complexity to be a good thing. It forces licenses to compete. And it raises the likelihood of lawsuits relating to the limits of each open source license. Lawsuits (as long as I am not involved) are a good thing because they provide points of reference as to legal limits of the licenses.
Does anyone here think that merely linking is sufficient to show derivation? WOuldn't this give OS vendors like Microsoft exclusive control over the development of applications for their platform? Why are these different?
I was actually only being half-serious. And it isn't about Gentoo...
The problem isn't with Gentoo. It is the fact that a small subset of users who know very little about what they are doing will always try to toy with the internals of a system.
Before people say "this is why you use Windows," my experience for this comes from providing tech support for Microsoft... Additional choice quotes include:
"I want you to right-click on My Computer and...." "I can't do anyting to your computer. You are on the other side of a phone line."
"I deleted all these files with funny names like.... and now my computer won't boot"
This is not restricted to home users. One gem I got was (when I was providing support for higher-end products):
"I am the senior network admin here. We reformatted the NT4 PDC hard drive and now users can't log in." "Do you have a BDC?" "Yes, but when we try to promote it, it says there is already a PDC on the network. We can't figure out how to get around this problem." (yes, they paid $245 to Microsoft for me to tell them to turn the PDC off. I could have waived the fee but I felt that it was in the best interest of everyone for us not to become their administrative mentors)
Nor is this restricted to Windows users. I have since heard of people deleting libxml from Fedora Linux distros and many other poorly thought out things.
You can make the same joke about every OS out there. Please don't think I am picking on your distro:-)
OK. If I'm a farmer, minding my own business, and I harvest my corn, keeping a few ears for seeds next year, and next year I get sued for stealing genetically engineered corn seeds whose pollen blew in from a neighboring farm the year before, did I do something illegal?
At first, the answer was "yes", but recently some courts have decided to wake up and answer "no". I am not sure how your analogy applies to this specific case. I would personally be ok with this if:
1) He was on his own property, using his neighbors connection (i.e. not actively looking for someone to. At this point, I would still be in favor of it being illegal without permission but would also be againt any crackdown of it (i.e. make it an enforcement issue). 2) Had permission from his neighbor.
Part of the problem with the patent analogy is that your neighbor who grows the GMO-foods would not be able to grant you such permission. Nor in this case would you have gone out actively looking for GM corn to cross polinate yours with. If you had, I would think that maybe there was something to it.
Sounds like he is sticking with the programming model of doing a large number of releases with small changes type model. Glad to see it actually, as this is the approach that I have been using on all of the software I build for work. What this does bring up, though, is the unfilled need currently of having an auto-upgrader software package where new kernel packages can be auto-upgraded and then migrated too on the fly without requiring a reboot. This would be quite complex I would admit, and maybe not possible in all kernel releases, but this is definitely something that needs to be looked at... Just my 2 cents worth..:-) I generally agree. If you can do it, large releases with small changes are the best way to produce solid, stable software.
Unfortunately in LedgerSMB, the code we inherited is rotton so we have to use a slash-and-burn system refactoring system. After that, I expect we will be doing 2.x releases for the foreseable future but will have a strict compatibiity policy (maybe a 2.x.0 every 6-12 months, but revisions being only bugfixes).
I feel Linux can make some serious inroads on the desktop, but it has to be presented as a unified system. When you tell your friends you run Ubuntu (or whatever), then they are like "What's that?" There's no unity... if you run Gentoo, RedHat, Ubuntu... it's not "just" Linux, because even within Linux you have fanboys for different distros. I see your point and unlike others, I am going to tell you what parts of it I agree with before I get to the disagreements.
I think you are right that we would be better off with a unified "Linux for the Desktop" community. This needs not be a single distro, a single vendor, etc. Maybe just an industry organization. Freedesktop.org helps, but only with the technical things. I do agree that we need a central community framework to help avoid user confusion. After all, this is an issue.
However, one of the issues you run into is that no matter what you do, the desktop *experience* will not be unified. Some people like GNOME, some like KDE, and some like Window Maker. And if you start turning these into eachother people are going to be rightly upset. Additionally the desktop-based management tools tend to be different. Part of the reason for this diversity is genuinely different needs, and part is differentiation strategy. SuSE can't be just another Linspire, and Linspire can't be just another SuSE. They have to differentiate themselves.
Again, an industry organization could help get people to cooperate to provide common tools so that certain markets can be more consistantly reached. Distros could continue to experiment with whatever they like in order to differentiate themselves from the pack. Etc.
At the same time, the open source "community" always has one interesting feature-- it iterates over every possible path. Thus such an organization would not preclude others from trying to forge their own way, nor would it prevent a fragmented user experience, but it is also our strength, that people can make the software whatever they want it to be.
The development of something like a kernel NEEDS a dictator, and if Linus walks away, who is going to have the credibility and/or authority to keep a handle on it? I worry that an advisory 'board' or 'panel' would be the death by a thousand cuts that could really mess up kernel development for linux. I disagree. LedgerSMB is not the kernel, nor is PostgreSQL but both seem to work well with committees in charge. There is no reason that Andrew Morton and others couldn't form such a committee.
If you were in your own home, you might have a point. In that case, I don't see a real problem. But going out of your way to find someone's access point, seeking it out, etc. seems to me somewhat different.
> (1) add "CPUTYPE=[whatever-my-cpu-is-here]" to my make.conf file
The problem is that most of the people don't know what their CPUTYPE is. I don't know it either and I have actually build the pc from parts on my own. Is it really impossible to autodetect the CPUTYPE? CPUTYPE="Compaq Presario"
Why doesnt this work? What do you mean look at/proc/cpuinfo?
Gentoo is like going to a restaurant, ordering your dinner, and having the chef take you back into the kitchen and put you to work making your own meal. I like an OS with a little LESS configurability than Gentoo. Some like it though. But think about how much you learn from the chef;-)
I am not a gentoo user either. Why I maintain ebuild packages is beyond me...
Your argument boils down to "I think the rich should pay so others can get something for free. It's only right because the rich stand on the backs of the poor."
Scary Not really. More like:
The rich should pay for others to get something for free because everyone including the rich benefit as a result.
The best way to get this sort of thing passed would be to advocate it to large firms who rely on educated workers.
Of course it screws the worker because the end result is more competition for jobs, so lower wages, etc. But who cares about them? At least this way engineers aren't discriminated against;-)
Given the fact that she got pregnant in the story (and this is not portrayed as a bad thing even despite the fact that they were never married), I doubt it.
These are just metaphores portrayed in the story, translated probably literally from Old Norse. You can't just add English slang interpretations to the metaphores.
"Bunghole" is perfectly good and clean terminology as it relates to kegs of beer.
Slashdot Mirror
My understanding is that you are partly right as is the GP.
The US Military has, according to some articles I have read, been increasingly concerned about being too dependant on Chinese electronics.
At the same time, I believe that most of these concerns were on the chip level, not that of the PCB.
I would make a counterargument here.
If it is an open and public community and is not overtly seeking the development of weapons (just multi-use components), I would say that there is not. At worst, the government should see this as a possibility for intelligence for any real terrorist link.
I suppose that if this was an "open source uranium enrichment centrifuge and bomb design project" there would be a case. But even there, I tend to think that the enemy we do no know is more dangerous than the enemy we do. Such an open source project might indeed be a source of a great amount of information for the CIA.
In the end, I think the question is likely to be about the privacy of participants, not national security. If there are national security concerns, you can expect various governments to send appropriate spy agencies to your project. If this is not desirable, you may wish to reconsider.
All in all, I tend to act as if a lot of this doesn't really matter. I would not close down such a project myself, but I would probably open up a discussion on the issues, explicitly saying that there was no direspect intended for your Iranian friend.
IANAL, but I think the correct answer probably is "it depends."
I personally don't buy the idea that using dynamically linked libraries means derivation. Obviously mixing creative content in screen output/story telling in a game might be. Obviously static linking would. But the dynamic linking argument seems dubius to me.
I would be inclined to allow it provided:
Each portion complies with its own license.
Identifiable portions of non-GPL code are not derived (meaning creative content beyond a list of facts is included-- most C header files are just a list of function declarations, which really amount to catalogs of facts)
For GPL 3, any non-gpl code link *to* GPL code, and the GPL 3 does not link *to* code which cannot be relicensed under the GPL.
But IANAL, just a software developer struggling with similar issues (see my journal for more details).
Not necessarily. Consider:
You use Apache internally. Apache is covered by patents from tech companies X, Y, and Z.
At some point, you discover that Apache arguably violates another of your patents. You don't like this and you ask the Apache Foundation to remove the offending code. Apache Foundation refuses.
You sue the Apache Foundation. This gets publicized, as is the fact that your public web server runs Apache.
Companies X, Y, and Z sue you for *using* Apache in violation of their patents.
IANAL, but I believe that patent rights include the right to regulate *use* of the patent.
Sounds doable. BUt how are you going to get a Lawyer to do something that would jeopardize his/her job security?
The only real exception I can think of is Larry Rosen's OSL, which defines distribution to include external deployment (i.e. making available for use by external users).
So this means every license needs to be read, but that one need only look for problems, not track all possible interactions.
WHile what you say is exactly right for most OSI-approved licenses, there is at least one exception that I am aware of.
Larry Rosen's OSL requires distributing the source code of any software which is used by people outside your organization, at least by my lay reading of section 5 (IANAL). So it does seem wise to have lawyers read the licenses for hidden surprises of this sort. Of course, this doesn't add complexity for mere use because this is going to be the same for nearly every license out there (so you are just looking for exceptions).
In distribution it becomes a pain though....
See the flamewar on the OSI mailing lists; all the above concerns and more have been aired.
No, seriously... large complex component-based software system + GPL = instant holy wars, because the line where one work ends and another begins is no longer clear.
"Dammit Jim, I'm an engineer, not an attorney!", but it seems to me that in practice, the GPL's process-boundary condition becomes little more than a performance issue because you have to use message passing over some kind of communications link instead of loading in-process. For additional flavor, release the "client side" of the message passing bits under the AFL or similar, and the "server side" obligingly under the GPL.
Allow me to summarize the OSI license-discuss flamewars (leaving out the "only my opinion is on topic here" sort of posts).Some have pointed out that derivative works can't mean what the FSF says they mean because if it didn, every piece of software would be derivative of the OS. THey argue in line with the Eclipse Foundation's FAQ that derivative works as defined in US law require the inclusion of creative (not merely practical) content and therefore merely including a header file is probably not sufficient to argue derivation. They point to legal analysis like http://www.usfca.edu/law/determann/softwarecombin
Others argue that this would render copyleft licenses unenforceable and this would be politically incorrect. They point to legal analysis like the FSF's licensing FAQ for backing.
There are two completely separate cases:
Using Software
With Free Software, this is always allowed. No problem.
As long as you remain in good standing with the license and don't sue people under patents, the following seems to be correct.But under the Apache License 2, you could lose patent rights required to use the software if you initiate such a lawsuit. Under the GPL v3, you could lose such patent rights for any license violation.
IANAL, but this is just my basic reading of the license.
Otherwise, I agree with your points.
So? Look for opportunities to drive up the asshat's costs. You offer it for free, he charges, so he must be adding value. If he is not, then let him have the suckers......
If he is adding value, then you still have some options. The first is to look for features he includes and reimplement them in your project free. THis drops his value to $0. The second is to get the community development rolling fast enough that he is effectively forced to fork and move on or start contributing back so as not to be buried in trying to merge his changes back into the code.
Most of the large BSDL projects I have been around have a few players who do sell versions with a few new features. Most of the time, the community doesn't *want* those features, such as EnterpriseDB's Oracle compatibility stuff. PostgreSQL, of course, has such a pace of development that none of these companies actually want to maintain any more patches than they have to. Hence they contribute everything possible back.
In short, you contribute to a GPL program becaue you are required to. YOu contribute to a BSD program to drive the competition's prices up and yours down. They both achieve similar ends. Why care?
The benefit from the GNU GPLv2 is that it protects some business interests to a point if the project fails (i.e. if the project fails, your competitors can't proprietize it). This is a business and not a freedom need as BSD-style-license projects offer economic controls to ensure contrbution.
I believe that the GNU GPL v3 and the AGPL (both versions) both violate any basic ethics by placing undue restrictions on developers while failing to guarantee any more Freedom to the downstream user. The GNU GPL v3 forces one to only depend on code one can *relicense* under the *exact* terms of the license (read sections 6 and 7 very carefully and slowly. Pay attention to the required licensing of the Corresponding Source, provisions and definitions for removal of additional permissions, and the provisions for the removal of additional restrictions).
Therefore I cannot support the GPL v3. It is overreaching in a way that the GPL v2 was not.
The problem is that many of the FOSS licenses purport to extend the terms of those licenses to any software that interacts in a close manner (such as linking). IANAL, but this standard seems really suspect to me (it would mean that Microsoft could release a new version of Windows and declare that no open source software could be developed for it).
Again, when you are in business, it doesn't matter whether the FSF is wrong or not. You follow their terms even if you believe that they have no case because it isn't worth going to court over.
Hence we have the GPL v3. The license so complex it will probably take years for your lawyer to understand it in full.
Because everyone draws lines different places and threatens legal action if you cross those lines.
The cardinal rule of *business* relating to intellectual property law is that the licene means what the licensor says it means unless and untill it becomes worth fighting in court. I run a business. IANAL.
I actually see this complexity to be a good thing. It forces licenses to compete. And it raises the likelihood of lawsuits relating to the limits of each open source license. Lawsuits (as long as I am not involved) are a good thing because they provide points of reference as to legal limits of the licenses.
Does anyone here think that merely linking is sufficient to show derivation? WOuldn't this give OS vendors like Microsoft exclusive control over the development of applications for their platform? Why are these different?
I was actually only being half-serious. And it isn't about Gentoo...
.... and now my computer won't boot"
:-)
The problem isn't with Gentoo. It is the fact that a small subset of users who know very little about what they are doing will always try to toy with the internals of a system.
Before people say "this is why you use Windows," my experience for this comes from providing tech support for Microsoft... Additional choice quotes include:
"I want you to right-click on My Computer and...."
"I can't do anyting to your computer. You are on the other side of a phone line."
"I deleted all these files with funny names like
This is not restricted to home users. One gem I got was (when I was providing support for higher-end products):
"I am the senior network admin here. We reformatted the NT4 PDC hard drive and now users can't log in."
"Do you have a BDC?"
"Yes, but when we try to promote it, it says there is already a PDC on the network. We can't figure out how to get around this problem."
(yes, they paid $245 to Microsoft for me to tell them to turn the PDC off. I could have waived the fee but I felt that it was in the best interest of everyone for us not to become their administrative mentors)
Nor is this restricted to Windows users.
I have since heard of people deleting libxml from Fedora Linux distros and many other poorly thought out things.
You can make the same joke about every OS out there. Please don't think I am picking on your distro
Add Antigua to the State Department list of State Sponsors of Terrorism?
Why?
It seems to be the only option they have left for their idea of pushing US law onto other countries.
At first, the answer was "yes", but recently some courts have decided to wake up and answer "no". I am not sure how your analogy applies to this specific case. I would personally be ok with this if:
1) He was on his own property, using his neighbors connection (i.e. not actively looking for someone to. At this point, I would still be in favor of it being illegal without permission but would also be againt any crackdown of it (i.e. make it an enforcement issue).
2) Had permission from his neighbor.
Part of the problem with the patent analogy is that your neighbor who grows the GMO-foods would not be able to grant you such permission. Nor in this case would you have gone out actively looking for GM corn to cross polinate yours with. If you had, I would think that maybe there was something to it.
Unfortunately in LedgerSMB, the code we inherited is rotton so we have to use a slash-and-burn system refactoring system. After that, I expect we will be doing 2.x releases for the foreseable future but will have a strict compatibiity policy (maybe a 2.x.0 every 6-12 months, but revisions being only bugfixes).
I think you are right that we would be better off with a unified "Linux for the Desktop" community. This needs not be a single distro, a single vendor, etc. Maybe just an industry organization. Freedesktop.org helps, but only with the technical things. I do agree that we need a central community framework to help avoid user confusion. After all, this is an issue.
However, one of the issues you run into is that no matter what you do, the desktop *experience* will not be unified. Some people like GNOME, some like KDE, and some like Window Maker. And if you start turning these into eachother people are going to be rightly upset. Additionally the desktop-based management tools tend to be different. Part of the reason for this diversity is genuinely different needs, and part is differentiation strategy. SuSE can't be just another Linspire, and Linspire can't be just another SuSE. They have to differentiate themselves.
Again, an industry organization could help get people to cooperate to provide common tools so that certain markets can be more consistantly reached. Distros could continue to experiment with whatever they like in order to differentiate themselves from the pack. Etc.
At the same time, the open source "community" always has one interesting feature-- it iterates over every possible path. Thus such an organization would not preclude others from trying to forge their own way, nor would it prevent a fragmented user experience, but it is also our strength, that people can make the software whatever they want it to be.
The guy was (from TFA):
1) Sitting outside the owners house.
2) Admitted to using it without permission.
If you were in your own home, you might have a point. In that case, I don't see a real problem. But going out of your way to find someone's access point, seeking it out, etc. seems to me somewhat different.
The problem is that most of the people don't know what their CPUTYPE is. I don't know it either and I have actually build the pc from parts on my own. Is it really impossible to autodetect the CPUTYPE? CPUTYPE="Compaq Presario"
Why doesnt this work? What do you mean look at
I am not a gentoo user either. Why I maintain ebuild packages is beyond me...
Your argument boils down to "I think the rich should pay so others can get something for free. It's only right because the rich stand on the backs of the poor."
Scary Not really. More like:
The rich should pay for others to get something for free because everyone including the rich benefit as a result.
The best way to get this sort of thing passed would be to advocate it to large firms who rely on educated workers.
Of course it screws the worker because the end result is more competition for jobs, so lower wages, etc. But who cares about them? At least this way engineers aren't discriminated against
Given the fact that she got pregnant in the story (and this is not portrayed as a bad thing even despite the fact that they were never married), I doubt it.
These are just metaphores portrayed in the story, translated probably literally from Old Norse. You can't just add English slang interpretations to the metaphores.
"Bunghole" is perfectly good and clean terminology as it relates to kegs of beer.