I didn't say a license is a contract. A license is part of a contract
It might be, it might not. There may be a contract in addition to the licence, there may not. Most proprietary EULAs are structured as contracts so they can try to restrict activities not restricted by copyright, eg. publishing benchmarks.
For most FOSS licences, however, there is no consideration, no requirement to agree to terms (eg. as required by UCITA), and hence no contract.
Copyright law does not outlaw adding terms when redistributing copies, providing the redistribution is permitted by the copyright holder.
I agree with this - but the conclusion that it is ok then follows from copyright law not prohibiting it, not from the licence actually being a contract.
In general, acts that are not specified as prohibited in a contract [...] are permitted
A licence is not a contract.
A licence (in copyright) is a permit to do things otherwise prohibited by law.
So, if a licence doesn't give you permission to do something (that would be prohibited by copyright law), then you can't do it. Period. See the explanation in the GPL ("you are not required to accept...").
Yes, this may be opposite to the case with contracts - that is because (repeat...): A licence is not a contract.
When was the last time you saw a 1K executable on Windows?
About a minute after running a search for one on a windows box [maybe you should have checked first]
Looks like there are three or four in system32 (I only looked in windows system folders) on a standard XP install.
About 15 are less than 4k (one disk block on a default setup), and over a hundred are under 16k.
That is just *.exe - there are a few small.com files too, and hundreds of.sys and.dll (driver/library files - not directly executable but are compiled code in PE format).
Well I, for one, can remember seeing porn passed round in school (paper-based, in the days before the internet). Plenty of interest in actual sex as well, and clearly some people were succeeding looking at the number of pregnancies...
Looking at current statistics and surveys I see no reason to believe it is any different now. I think the figures are around 1% of UK 13-15yr old girls are acutally getting pregnant, so the % of that age group having sex must be much higher, and the % looking at porn is most likely higher still.
I see no reason why the OLPC users should be any different from other schoolchildren - so, if they can use it to find porn, they almost certainly will.
It's insane to sell software as a product (rather than labor) anyway. You can reproduce it for negligible cost, and it's the developers' time that needs to be paid for. Why not just pay for the developers' time in the first place?
Sometimes this happens. It's called T&M (time & materials).
Every single software company I've worked for would _love_ it if all contracts were T&M. I would. Makes life _so_ much easier.
Guess what ? Customers don't want to pay T&M - they want fixed-price development or product (licence), every damn time.
Why ? Because they don't want to buy software development, they want to buy a solution or a product and they want to know how much it's going to cost - up front. T&M puts the risk on the customer, product puts the risk on the software developer. Guess where the customer wants the risk ?
Also, reproduction for negligible cost is not really relevant. In software and many hardware industries, high upfront development costs need to be recovered from a large number of customers - whether the unit production costs are negligible or not. When Ford introduce a new car model, if the first customer paid a few hundred million then everyone else would be able to get there cars for about half the current price. Brilliant - all you have to do is find that first customer... (call me if you do, I have some software development ideas he might beinterested in...).
Uh, couldn't somebody else just register a new type of aircraft - a Boeing 737 with 3rd party bolts? And then apply for airworthiness?
Yes, given enough money to burn, this might be possible, however I doubt it could ever be economic given the massive costs of certification.
I'm all for a requirement of validation of parts in safety-sensitive arenas. However, there are ways of accomplishing this without giving vendors monopoly powers over their parts.
I'm sure the airlines would love to know your ideas - because the aircraft industry doesn't seem to know how to do it (IMO).
If the plane manufacturer doesn't like it they can just avoid using GPL v3 code.
And if the FAA constrains the mfr. to lock down to get certification, then the mfr. is prevented from using GPLv3 code - although they may use, and contribute to, GPLv2 code currently.
Thus GPLv3 could bar use in a legitimate field of endeavour (because of the regulatory rules in that field) that was not barred under GPLv2.
Simple - you provide the owner of the system both keys.
Precisely. That is now no longer dual-key (the whole point is that no one ever has both keys) - you just restated my point that GPLv3 prohibits dual-key.
In any case, what security does the dual-key concept provide in any of these situations? You don't need both keys to rig the machine - it just makes it a lot easier.
Again, you just restated my point - if (as you say) having both keys makes it a lot easier to rig the machine, then dual key (ie. no one person/entity ever has both keys) makes it a lot less easy to rig the machine. That is the point.
A typical safety deposit box is dual key (one for you, one for the bank). I can't see how the fact that you don't _need_ both keys to open the box, (eg. a burning bar will probably do it) negates all the reasons why people designed these things to be dual-key.
And what happens if the user wants to use the aircraft in Africa?
Most likely they'll mess around with it in unapproved ways until it falls out of the sky. I'm not sure if I was a mfr. that I'd want to make it easier for them to do so, particularly if that meant removing an FAA mandated safety feature.
They should not require vendors to lock down their systems so that the whole world is subject to the cost of FAA regulations.
I don't disagree with that. Raises an interesting question though - suppose an FAA-certified aircraft is locked down, but the non-US version isn't, could GPLv3 software then be used ? Which version of the hardware is the "recommended or principal context of use" ?
Can the aircraft mfr. say that the "recommended or principal context of use" is the international version, which you can modify the software on, but if you want to fly in the US obviously you have to buy the locked down version.
Is that ok with GPLv3 ?
If it's not, then the mfr. is still effectively barred from using gplv3 because of the US regs (unless they build solely for non-US market).
Now suppose **AA makes TIVO lock the hardware down in the US, but they do a Russian "all-of-mp4" model which is unlocked.
If the kernel connected to a network service for support purposes, it could not identify itself as changed / tainted / whatever.
The GPL (v3 draft - v2 has no problem with this) says quite clearly:
"it must be possible for modified versions to communicate with the same online service in the same way such that the service cannot distinguish"
Clearly if an untainted kernel was shipped originally, the support comms protocol could not include tainting info as the service at the other end could then distinguish a tainted kernel as modified.
I can say with certainty that it predates their statement. Therefore they cannot have been the stated intent of the current GPL.
They may have been the actual intent (ie. I do not claim that RMS has necessarily changed his views) but they could not have been the _stated_ intent.
Those (other than RMS), such as Linus, who adopted GPLv2 when it was new could only go on the then stated intent - which was not "four freedoms". Logically (because people are different) some of those people are going to disagree with the new statement of intent.
No. You may NOT link GPLv2 code with any code under a licence which imposes further restrictions (over and above GPLv2).
What part of (to quote the GPL):
"You may not impose any further restrictions"
do you not understand ?
Whether the GPLv3 contains anything which prohibits linking GPLv2 code is completely irrelevant - the code is under GPLv2 and it is what GPLv2 says that matters.
GPLv3 clearly does contain restrictions over and above v2, therefore it would appear to be fundamentally incompatible.
Why would an airline allow anyone to install arbitrary, uncertified software on mission-critical hardware?
They wouldn't. The FAA / EASA / whoever would ground them for it.
And why would the vendor of that hardware have any interest in preventing the airline from installing whatever software they want?
Because if they allowed it the FAA / EASA / whoever could ground all aircraft of that model.
Airlines are _not_ allowed to mess around with their aircraft hardware/software as they wish. For good reason.
Not only may the FAA etc. mandate that only Boeing parts be used on Boeings, but they may (and I believe do) mandate that the Boeing be deliberately designed to make it more difficult (ideally impossible) to use an Airbus part instead.
The FAA might require the aircraft to only accept FAA-signed (possibly in addition to other keys) flight software, with the argument that the FAA could then ensure the software was that which had gone through flight certification, then I would think that was reasonable and within their remit.
The aircraft mfr. then would be unable to use GPLv3 for that software - because they obviously cannot give out the FAA key, which their hardware is required to require.
Do you think any airline in their right mind would buy an airplane that they were told they couldn't take apart or fix the software of?
Yes. Because that is how I understand the industry works (or at least did work when I was last in it, which is a fair few years ago).
Airlines have to do exactly what the aircraft mfr. says in terms of maintenance. Or they don't fly - legally (at least in the first world).
They have to use approved parts and procedures, and carry out checks / changes / repairs as the manufacturer specifies. Sometimes the notices come from mfr., sometimes from FAA / CAA etc., but I think they usually just require conformance with the notice from the manufacturer.
Either way, I am absolutely sure that airlines don't modify flight control software. I'm nervous enough about fly-by-wire on civilian aircraft as it is, but if I thought the airlines were able to modify the software I actually would not fly on that aircraft.
What happens when the airplane manufacturer goes out of business?
My understanding is that either:
a) someone buys the business and continues supporting the aircraft (possibly requiring additional / new FAA/CAA approvals for new business?) or: b) nobody does
In case (b), once you run out of mfr. supplied / approved parts etc., your aircraft is grounded. If it happens to be fast, pointy and in fact rather beautiful, then you can probably find it a new home in a museum, but don't expect to get paid much for it.
That is what happens. That is how the aviation industry works, and that is how it gets to be as safe as it is.
If the unit throws up some kind of prominent notice upon modified software being installed
Not clear that this is allowed, since it arguably changes the functionality in the same circumstances (same hardware) - which is prohibited.
Further, if the support/warranty was done via network connection, then such notice of modification is explicitly prohibited - the network support service must not be able to distinguish a modified version.
And for those of you who haven't figured it out yet, the reason for providing this option is to allow old, abandoned code to be reused along with newer code.
All that would be required for that would be for the newer licence to be GPLv2 compatible. So, if GPLv3 is compatible with GPLv2, then there is no problem using old code.
If it is (or will be) not compatible (as you seem to be implying) then you should be asking why.
The typical cause of GPL incompatiblity is the addition of restrictions, and the intent of the GPL is that you may not add further restrictions (and it looks to me, although IANAL, like v3 does do that). If code (old or otherwise) cannot be combined with code under another licence because of such restrictions, then that is a feature of the GPL, not a bug. That applies whether the other licence is a new version of the GPL or not.
Or, to put it another way, if I licence code under GPLv2 I mean this bit to apply:
You may not impose any further restrictions on the recipients' exercise of the rights granted herein.
and you don't get to end-run around that by putting those restrictions in via the GPLv3.
Right before that clause there is a note saying that future licences will have the same spirit (read intention) than the curent one. That means, the licence protect the 4 freedoms
Neat trick - can I borrow your tardis ?
Clue: The four freedoms as currently stated date from around '96 or '97. The current GPL is much older than that. Therefore if the four freedoms are the stated intention of the future (GPLv3) licence, then the stated intention is clearly not the same as the previous version.
The differences in intention from v2 to v3 may be subtle and may be unimportant, or even unnoticed, for you, but that does not mean they are not there. For some people in the GPL community those differences will (inevitably - since there are many many different people in that community) be significant.
Slashdot Mirror
oddly, I thought it was mainly Republicans who considered Faith more important than reality...
"lybbying" - isn't that spelled "libbying", as in scooter ?
I didn't say a license is a contract. A license is part of a contract
It might be, it might not. There may be a contract in addition to the licence, there may not. Most proprietary EULAs are structured as contracts so they can try to restrict activities not restricted by copyright, eg. publishing benchmarks.
For most FOSS licences, however, there is no consideration, no requirement to agree to terms (eg. as required by UCITA), and hence no contract.
The GPL is specifically structured to _not_ be a contract - see eg. http://lwn.net/articles/61292.
Copyright law does not outlaw adding terms when redistributing copies, providing the redistribution is permitted by the copyright holder.
I agree with this - but the conclusion that it is ok then follows from copyright law not prohibiting it, not from the licence actually being a contract.
Also available in other timezones...
In general, acts that are not specified as prohibited in a contract [...] are permitted
A licence is not a contract.
A licence (in copyright) is a permit to do things otherwise prohibited by law.
So, if a licence doesn't give you permission to do something (that would be prohibited by copyright law), then you can't do it. Period. See the explanation in the GPL ("you are not required to accept...").
Yes, this may be opposite to the case with contracts - that is because (repeat...): A licence is not a contract.
What's the security risk of opening a PDF?
Complex file format, typical reader software closed source, could have any number of eploitable security holes...
Oh, and in case you've been on a different planet recently: http://secunia.com/advisories/23666/
And that's just one of the ones we know about...
I guess it's this one: http://www.youtube.com/watch?v=yjiGH9QNiU0
Definitely worth finding.
When was the last time you saw a 1K executable on Windows?
.com files too, and hundreds of .sys and .dll (driver/library files - not directly executable but are compiled code in PE format).
About a minute after running a search for one on a windows box [maybe you should have checked first]
Looks like there are three or four in system32 (I only looked in windows system folders) on a standard XP install.
About 15 are less than 4k (one disk block on a default setup), and over a hundred are under 16k.
That is just *.exe - there are a few small
well, NASA just has at least... http://www.space.com/news/070108_moon_metric.html
Well I, for one, can remember seeing porn passed round in school (paper-based, in the days before the internet). Plenty of interest in actual sex as well, and clearly some people were succeeding looking at the number of pregnancies...
Looking at current statistics and surveys I see no reason to believe it is any different now. I think the figures are around 1% of UK 13-15yr old girls are acutally getting pregnant, so the % of that age group having sex must be much higher, and the % looking at porn is most likely higher still.
I see no reason why the OLPC users should be any different from other schoolchildren - so, if they can use it to find porn, they almost certainly will.
It's insane to sell software as a product (rather than labor) anyway. You can reproduce it for negligible cost, and it's the developers' time that needs to be paid for. Why not just pay for the developers' time in the first place?
Sometimes this happens. It's called T&M (time & materials).
Every single software company I've worked for would _love_ it if all contracts were T&M. I would. Makes life _so_ much easier.
Guess what ? Customers don't want to pay T&M - they want fixed-price development or product (licence), every damn time.
Why ? Because they don't want to buy software development, they want to buy a solution or a product and they want to know how much it's going to cost - up front. T&M puts the risk on the customer, product puts the risk on the software developer. Guess where the customer wants the risk ?
Also, reproduction for negligible cost is not really relevant. In software and many hardware industries, high upfront development costs need to be recovered from a large number of customers - whether the unit production costs are negligible or not. When Ford introduce a new car model, if the first customer paid a few hundred million then everyone else would be able to get there cars for about half the current price. Brilliant - all you have to do is find that first customer... (call me if you do, I have some software development ideas he might beinterested in...).
As I understand it, He rests on the seventh day
I think you'll find that was his dad.
That probably means that on the seventh day Jesus actually ends up with all the chores.
Uh, couldn't somebody else just register a new type of aircraft - a Boeing 737 with 3rd party bolts? And then apply for airworthiness?
Yes, given enough money to burn, this might be possible, however I doubt it could ever be economic given the massive costs of certification.
I'm all for a requirement of validation of parts in safety-sensitive arenas. However, there are ways of accomplishing this without giving vendors monopoly powers over their parts.
I'm sure the airlines would love to know your ideas - because the aircraft industry doesn't seem to know how to do it (IMO).
If the plane manufacturer doesn't like it they can just avoid using GPL v3 code.
And if the FAA constrains the mfr. to lock down to get certification, then the mfr. is prevented from using GPLv3 code - although they may use, and contribute to, GPLv2 code currently.
Thus GPLv3 could bar use in a legitimate field of endeavour (because of the regulatory rules in that field) that was not barred under GPLv2.
Simple - you provide the owner of the system both keys.
Precisely. That is now no longer dual-key (the whole point is that no one ever has both keys) - you just restated my point that GPLv3 prohibits dual-key.
In any case, what security does the dual-key concept provide in any of these situations? You don't need both keys to rig the machine - it just makes it a lot easier.
Again, you just restated my point - if (as you say) having both keys makes it a lot easier to rig the machine, then dual key (ie. no one person/entity ever has both keys) makes it a lot less easy to rig the machine. That is the point.
A typical safety deposit box is dual key (one for you, one for the bank). I can't see how the fact that you don't _need_ both keys to open the box, (eg. a burning bar will probably do it) negates all the reasons why people designed these things to be dual-key.
And what happens if the user wants to use the aircraft in Africa?
Most likely they'll mess around with it in unapproved ways until it falls out of the sky. I'm not sure if I was a mfr. that I'd want to make it easier for them to do so, particularly if that meant removing an FAA mandated safety feature.
They should not require vendors to lock down their systems so that the whole world is subject to the cost of FAA regulations.
I don't disagree with that. Raises an interesting question though - suppose an FAA-certified aircraft is locked down, but the non-US version isn't, could GPLv3 software then be used ? Which version of the hardware is the "recommended or principal context of use" ?
Can the aircraft mfr. say that the "recommended or principal context of use" is the international version, which you can modify the software on, but if you want to fly in the US obviously you have to buy the locked down version.
Is that ok with GPLv3 ?
If it's not, then the mfr. is still effectively barred from using gplv3 because of the US regs (unless they build solely for non-US market).
Now suppose **AA makes TIVO lock the hardware down in the US, but they do a Russian "all-of-mp4" model which is unlocked.
Is that ok with GPLv3 ?
If the kernel connected to a network service for support purposes, it could not identify itself as changed / tainted / whatever.
The GPL (v3 draft - v2 has no problem with this) says quite clearly:
"it must be possible for modified versions to communicate with the same online service in the same way such that the service cannot distinguish"
Clearly if an untainted kernel was shipped originally, the support comms protocol could not include tainting info as the service at the other end could then distinguish a tainted kernel as modified.
I can say with certainty that it predates their statement. Therefore they cannot have been the stated intent of the current GPL.
They may have been the actual intent (ie. I do not claim that RMS has necessarily changed his views) but they could not have been the _stated_ intent.
Those (other than RMS), such as Linus, who adopted GPLv2 when it was new could only go on the then stated intent - which was not "four freedoms". Logically (because people are different) some of those people are going to disagree with the new statement of intent.
No. You may NOT link GPLv2 code with any code under a licence which imposes further restrictions (over and above GPLv2).
What part of (to quote the GPL):
"You may not impose any further restrictions"
do you not understand ?
Whether the GPLv3 contains anything which prohibits linking GPLv2 code is completely irrelevant - the code is under GPLv2 and it is what GPLv2 says that matters.
GPLv3 clearly does contain restrictions over and above v2, therefore it would appear to be fundamentally incompatible.
Why would an airline allow anyone to install arbitrary, uncertified software on
mission-critical hardware?
They wouldn't. The FAA / EASA / whoever would ground them for it.
And why would the vendor of that hardware have any interest in preventing the airline from installing whatever software they want?
Because if they allowed it the FAA / EASA / whoever could ground all aircraft of that model.
Airlines are _not_ allowed to mess around with their aircraft hardware/software as they wish. For good reason.
Not only may the FAA etc. mandate that only Boeing parts be used on Boeings, but they may (and I believe do) mandate that the Boeing be deliberately designed to make it more difficult (ideally impossible) to use an Airbus part instead.
The FAA might require the aircraft to only accept FAA-signed (possibly in addition to other keys) flight software, with the argument that the FAA could then ensure the software was that which had gone through flight certification, then I would think that was reasonable and within their remit.
The aircraft mfr. then would be unable to use GPLv3 for that software - because they obviously cannot give out the FAA key, which their hardware is required to require.
Ok, forget which application (voting. medical, whatever), please just explain how you do dual-key (SOP for many things) under GPLv3.
ie. to install the software it has to be signed (showing audit/authorization) by at least two independent key holders.
AFAICS under GPLv3 the "user" (a single entity) _has_ to be provided with _all_ keys necessary.
I don't see how you can reconcile this with the dual-key concept.
If you think I am wrong, please explain exactly how it would work under gplv3.
Do you think any airline in their right mind would buy an airplane that they were told they couldn't take apart or fix the software of?
Yes. Because that is how I understand the industry works (or at least did work when I was last in it, which is a fair few years ago).
Airlines have to do exactly what the aircraft mfr. says in terms of maintenance. Or they don't fly - legally (at least in the first world).
They have to use approved parts and procedures, and carry out checks / changes / repairs as the manufacturer specifies. Sometimes the notices come from mfr., sometimes from FAA / CAA etc., but I think they usually just require conformance with the notice from the manufacturer.
Either way, I am absolutely sure that airlines don't modify flight control software. I'm nervous enough about fly-by-wire on civilian aircraft as it is, but if I thought the airlines were able to modify the software I actually would not fly on that aircraft.
What happens when the airplane manufacturer goes out of business?
My understanding is that either:
a) someone buys the business and continues supporting the aircraft (possibly requiring additional / new FAA/CAA approvals for new business?)
or:
b) nobody does
In case (b), once you run out of mfr. supplied / approved parts etc., your aircraft is grounded. If it happens to be fast, pointy and in fact rather beautiful, then you can probably find it a new home in a museum, but don't expect to get paid much for it.
That is what happens. That is how the aviation industry works, and that is how it gets to be as safe as it is.
If the unit throws up some kind of prominent notice upon modified software being installed
Not clear that this is allowed, since it arguably changes the functionality in the same circumstances (same hardware) - which is prohibited.
Further, if the support/warranty was done via network connection, then such notice of modification is explicitly prohibited - the network support service must not be able to distinguish a modified version.
All that would be required for that would be for the newer licence to be GPLv2 compatible. So, if GPLv3 is compatible with GPLv2, then there is no problem using old code.
If it is (or will be) not compatible (as you seem to be implying) then you should be asking why.
The typical cause of GPL incompatiblity is the addition of restrictions, and the intent of the GPL is that you may not add further restrictions (and it looks to me, although IANAL, like v3 does do that). If code (old or otherwise) cannot be combined with code under another licence because of such restrictions, then that is a feature of the GPL, not a bug. That applies whether the other licence is a new version of the GPL or not.
Or, to put it another way, if I licence code under GPLv2 I mean this bit to apply:
and you don't get to end-run around that by putting those restrictions in via the GPLv3.
pretty clear that the FSF has led everyone to expect that future versions of the GPL will have the same intent, to protect the same four freedoms.
If true that is in itself a deception - since the current GPL predates (by several years) the statement of the "four freedoms".
Right before that clause there is a note saying that future licences will have the same spirit (read intention) than the curent one. That means, the licence protect the 4 freedoms
Neat trick - can I borrow your tardis ?
Clue: The four freedoms as currently stated date from around '96 or '97. The current GPL is much older than that. Therefore if the four freedoms are the stated intention of the future (GPLv3) licence, then the stated intention is clearly not the same as the previous version.
The differences in intention from v2 to v3 may be subtle and may be unimportant, or even unnoticed, for you, but that does not mean they are not there. For some people in the GPL community those differences will (inevitably - since there are many many different people in that community) be significant.