"why shouldn't they be allowed to say what machines can and can't run it?"
For the same reason that the people who write chemistry textbooks cannot say how the knowledge in those books can or cannot be used. For the same reason the people who write mathematics textbook cannot dictate how those mathematical results can or cannot be used. For the same reason I cannot tell you how my opinion can or cannot be used.
Seriously, just because Apple spent a lot of money making a BSD look prettier does not mean that they can dictate how you use that software. It would be terrible if the courts ruled that they could; terrible to live in a society where Apple is legally allowed to declare that you are a criminal if you build your own computer that runs Mac OS X.
Yeah, I know there are plenty of Apple fanbois here who will see nothing wrong with this whole situation. Really though, this is exactly why proprietary licensing is bad for society -- Apple is basically declaring that you are not allowed to build a computer than runs Mac OS X, you must BUY one from them, at a price that THEY determine. If Psystar loses, every hobbyist in the USA should take note to avoid Apple computers like a plague, because of the legal risk they impose on hobbyist groups. Anyone who was planning to buy a computer from Apple should take a moment to rethink that decision, and consider a more freedom respecting company.
Just my opinion. I will probably be flamed off the edge of the Earth by Apple fanbois though.
Which is fine if all nobody else is logged in. As I noted in my post, I care about remote access where I do not have to worry about interfering with someone else who is using the machine, which is not something *VNC can give you in Windows XP. I cannot attest to the situation with Vista or Windows 7, but I would be willing to bet that, given the more restrictive licensing in those systems, this functionality is even more restricted.
Hate to break it to you, but organizing thousands of developers is nothing new in open source. Look at the big Linux distros, and how their leaders keep everyone in line and organized. You think GSoC is difficult to organize? Try managing Debian or Fedora, where you have to deal not only with your own people and finances, but also with upstream maintainers and the weird decisions they make. GSoC involves keeping all the different, largely unrelated projects in line; a Linux distro supervisor needs to make sure that all the packages in the distro will play nicely with each other. Distro maintainers also have to deal with users, who sometimes make absurd demands and are insulted when they do not get what they want (e.g. the people who demand that Fedora ship with SELinux disabled by default).
Not to make Leslie Hawthorn's task seem easy, but I would hardly call her the most influential open source leader out there.
"They only way you're going to get someone who is happy with Windows or OSX to go Linux is to get apps that are Linux only that they just can't live without. That isn't happening today. These apps don't exist."
In my opinion, the reason those apps do not exist is that consumers really only care about 4 apps at most, and that number is really reduced to one app in this day and age. There are plenty of things I am doing with free/open source software that are could not be done without spending a fortune on proprietary licensing, but they are things that consumers do not care about. As a simple example, I frequently access systems remotely, sometimes while other people are using them; with Windows XP, this was not possible without purchasing an expensive, "enterprise edition" license, or using some kind of crack. Most people hear this and shrug -- they really do not see this as a particularly important feature or activity, more of a novelty than anything else, and it is certainly not convincing enough to get them to take the terrifying step of switching. It is the same with just about everything; even security is a tough sell, with most people having been conditioned that worms and viruses are just an unavoidable fact of life, certainly not worth the effort of using some software that they have never heard of.
It really boils down to whether or not proprietary licensing is causing a problem for them. For someone who is just browsing the web and using no-cost plugins like Flash, they will never encounter licensing restrictions in any meaningful way. The only desktop users who really feel the pain of proprietary licensing are "power users," and they usually have some Linux distro installed already. With them, though, there is a substantial fear of ditching proprietary software entirely, but that is the same story we have dealt with for years.
So they designed a system that accumulated rounding errors over time, and their solution was to ask the system's users to reboot the system every so often? Somehow, that does not add to my sympathy for these programmers...
I want to know who programmed a system that allowed floating point errors to accumulate over time in a critical calculation. I hope they did not receive a degree in computer science, or that if they did, it was not from my alma mater.
Seriously, what programmer has not heard of floating point errors? That has to be one of the most common phrases I have ever heard in relation to programming; even the EEs and MEs I have met are familiar with the concept.
Except that people tend to rely on computers, and take risks they would not have otherwise taken. I am not saying that the number of deaths resulting from computer errors is going to be higher than other deaths, but that it is not as simple as "every death caused by a computer error is a death that would have happened before computers." If you knew your enemy was launching missiles at you, and you had no missile defense, what would you do to protect yourself? What would you do if you did have missile defense?
Read about identity based encryption; a trusted third party has to generate your private keys for you. The compromise here is that the scheme allows your identity -- name, email address, etc. -- to serve as the public key, thus eliminating a lot of the complication of key management.
Yes, I know that if the third party is compromised, the system breaks down. That is why it must be a third party you can trust, and that was my point about the "techies" being that third party for their friends, assuming that you can trust your friends.
People are only so willing to not have webmail, and they are not always available in person. Forget trying to explain to people how to carry crypto keys around on a thumb drive; that is about as useful as explaining why only encrypting emails that they think are sensitive enough to require encryption is not a good strategy. Basically, the FBI won the battle -- we were so bogged down with fighting their efforts to thwart email encryption that we missed the mark and the masses never adopted it.
Postal mail privacy is a tradition that predates the current era of American politics. In the new, digital age, you do not have the expectation of privacy, unless you are one of those crazy paranoid hacker types who uses encryption.
You are thinking of identity based encryption -- the "public key" is your email address (which can be anything you want, in fact). Unfortunately, the current schemes (those that I know of, anyway) involve a trusted third party generating your private key and assigning it to you, which will run into the same problems Hushmail ran into. What would be nice is a hybrid model -- where the trusted third party could be chosen by the user, and then those trusted parties would authenticate each other. Thus, the people who currently serve "techie" roles in their social circle would generate the private keys for their friends, and then use something like PGP to authenticate each other.
More work needs to be done; in particular, the government should simply mandate that no proprietary software may be used in any voting machine that is actually used in an election. Hoping for these companies to volunteer their source code is just not enough, although I do applaud Sequoia for taking this step.
Uhm...farmers slaughter their animals all the time. What is the difference between what was proposed and growing your own vegetables? Oh, right, a rabbit is cuter than a tomato.
"For everyone else this is a solution looking for a problem as package management and repositories don't really have a problem with different arches and versions."
Actually, having to maintain packages across several architectures can be tricky at times. Some packages need to be patched to run correctly on different architectures, and the upstream maintainers can accidentally break those patches (e.g. if they are not personally testing on a given architecture). It could even be the case that different architectures have different versions of the same packages, because the distro maintainers are busy trying to get everything to work.
I am not saying that this "universal binary" solution is the answer, but it might help streamline the build process at the distro level. It might help.
Not everyone is skilled enough to compile the source on their own, especially for packages that must be patched to run on certain architectures. Personally, I would think this might be useful for distro maintainers who do not want to maintain separate packages across multiple architectures, although the benefits may not outweigh the costs.
A new model for deriving income from creative works is needed. Maybe it is time to start looking toward online multiplayer accounts as a source of revenue for games, or concerts as a source of revenue for music. Just because you cannot figure out a revenue model other than restricting copying and slowing the progress of technology and society does not mean that no such model exists.
"Besides, why do you think you should be allowed to use the software or game if you haven't paid the author what he is asking for it?"
Why should you be allowed to read a book without the author's permission? Why should you be allowed to use the techniques described in a math textbook without the author's permission?
When copyrights were first envisioned, nobody was thinking, "Well, the general public should have to get the author's permission to read books." It was an issue of who was allowed to publish the book, not who was allowed to read it. Now we include software in copyright law, but the law should remain the same: an issue of who may publish, not who may use. Unfortunately, we have not updated copyright law to fit the times that we live in, and the line between "publishing" and "using" software has become blurred; instead of rethinking copyrights to compensate for this new age, we just pretend that everything is the same and pass laws like the DMCA to help prop up that fantasy.
So why should you be allowed to use the software without the author's permission? Because we live in a new age, and it is time for publishers of all sorts to adapt to that new age instead of clinging to the realities of a previous era.
Irrelevant. In a truly free market -- one that is free of regulation -- there will eventually a single winner for every segment of the market, and that winner will follow its best interests and prevent anyone from ever becoming a serious competitor. That is why the government must occasionally break up monopolies -- effectively resetting the market so that competition can continue.
Well, there is always the issue of business secrets -- it would be pretty easy for a rival company to pay off a maid to follow a few simple steps to install a bootloader on your laptop, without the maid even knowing exactly what she is doing. It would also be pretty basic for that company to arrange for your laptop to be stolen once you leave the hotel -- and presumably, you would have had to enter your passphrase during that period of time.
The point is that whole disk encryption is not sufficient to protect machines against a concerted attack -- but we knew that anyway. Your attackers could also have placed a microphone in the room to listen to your keystrokes as you enter the passphrase, or a video camera to watch your keystrokes, or any number of other vectors. If your data is important enough for someone to put in the effort needed to execute one of these attacks, you should not be accessing it in an environment you cannot control.
Ask yourself this: how many people (or criminal organizations) out there would benefit from having complete access to the Windows source code? Or even "just enough" access to disable all of the copy restrictions? Now, if you were a Microsoft employee, would you carry that source code around on your laptop? Would you even log in remotely to work on it?
It gives you a measure of protection if your device is stolen. It does nothing for you if you are worried about an attacker who has access to the system without having to steal it.
Except that physical access always trumps encryption. You need to go beyond simple encryption when your attacker might be a coworker (or a maid or janitor) -- you need a security policy that mitigates the attacks.
As an example, instead of whole disk encryption, suppose you just want to read some PGP encrypted emails on your coworker's computer, which you are allowed to SSH into (as is the case where I am now). One strategy you might try is to SSH in and use the microphone to listen to your coworker's keystrokes while he is reading his email (perhaps you can predict when he will be doing this -- e.g. if you send him a message marked "URGENT" and you spy on his network connection, so you know roughly when he received it). The time between keystrokes is related to which keys are being typed in -- not an exact measure, but enough to reduce the search space if you are trying to guess a passphrase. Thus, policies must be in place -- perhaps that no microphones may be installed on systems dealing with high security information.
Encryption is great if your attacker cannot get physical access to your machine (or something equivalent like logging in remotely), which is a common scenario. However, if you are dealing with uncommon data and your attackers are determined to see it, relying on encryption alone is simply not sufficient -- even if the keys are stored on a smartcard (you could be mugged) or if the keys are based on biometrics (your corpse is still sufficient).
Slashdot Mirror
"why shouldn't they be allowed to say what machines can and can't run it?"
For the same reason that the people who write chemistry textbooks cannot say how the knowledge in those books can or cannot be used. For the same reason the people who write mathematics textbook cannot dictate how those mathematical results can or cannot be used. For the same reason I cannot tell you how my opinion can or cannot be used.
Seriously, just because Apple spent a lot of money making a BSD look prettier does not mean that they can dictate how you use that software. It would be terrible if the courts ruled that they could; terrible to live in a society where Apple is legally allowed to declare that you are a criminal if you build your own computer that runs Mac OS X.
Yeah, I know there are plenty of Apple fanbois here who will see nothing wrong with this whole situation. Really though, this is exactly why proprietary licensing is bad for society -- Apple is basically declaring that you are not allowed to build a computer than runs Mac OS X, you must BUY one from them, at a price that THEY determine. If Psystar loses, every hobbyist in the USA should take note to avoid Apple computers like a plague, because of the legal risk they impose on hobbyist groups. Anyone who was planning to buy a computer from Apple should take a moment to rethink that decision, and consider a more freedom respecting company.
Just my opinion. I will probably be flamed off the edge of the Earth by Apple fanbois though.
Which is fine if all nobody else is logged in. As I noted in my post, I care about remote access where I do not have to worry about interfering with someone else who is using the machine, which is not something *VNC can give you in Windows XP. I cannot attest to the situation with Vista or Windows 7, but I would be willing to bet that, given the more restrictive licensing in those systems, this functionality is even more restricted.
Or has the situation changed?
Hate to break it to you, but organizing thousands of developers is nothing new in open source. Look at the big Linux distros, and how their leaders keep everyone in line and organized. You think GSoC is difficult to organize? Try managing Debian or Fedora, where you have to deal not only with your own people and finances, but also with upstream maintainers and the weird decisions they make. GSoC involves keeping all the different, largely unrelated projects in line; a Linux distro supervisor needs to make sure that all the packages in the distro will play nicely with each other. Distro maintainers also have to deal with users, who sometimes make absurd demands and are insulted when they do not get what they want (e.g. the people who demand that Fedora ship with SELinux disabled by default).
Not to make Leslie Hawthorn's task seem easy, but I would hardly call her the most influential open source leader out there.
Most end users do not even bother filing bug reports or feature requests, let alone writing any code or discussing issues on mailing lists.
"They only way you're going to get someone who is happy with Windows or OSX to go Linux is to get apps that are Linux only that they just can't live without. That isn't happening today. These apps don't exist."
In my opinion, the reason those apps do not exist is that consumers really only care about 4 apps at most, and that number is really reduced to one app in this day and age. There are plenty of things I am doing with free/open source software that are could not be done without spending a fortune on proprietary licensing, but they are things that consumers do not care about. As a simple example, I frequently access systems remotely, sometimes while other people are using them; with Windows XP, this was not possible without purchasing an expensive, "enterprise edition" license, or using some kind of crack. Most people hear this and shrug -- they really do not see this as a particularly important feature or activity, more of a novelty than anything else, and it is certainly not convincing enough to get them to take the terrifying step of switching. It is the same with just about everything; even security is a tough sell, with most people having been conditioned that worms and viruses are just an unavoidable fact of life, certainly not worth the effort of using some software that they have never heard of.
It really boils down to whether or not proprietary licensing is causing a problem for them. For someone who is just browsing the web and using no-cost plugins like Flash, they will never encounter licensing restrictions in any meaningful way. The only desktop users who really feel the pain of proprietary licensing are "power users," and they usually have some Linux distro installed already. With them, though, there is a substantial fear of ditching proprietary software entirely, but that is the same story we have dealt with for years.
So they designed a system that accumulated rounding errors over time, and their solution was to ask the system's users to reboot the system every so often? Somehow, that does not add to my sympathy for these programmers...
I want to know who programmed a system that allowed floating point errors to accumulate over time in a critical calculation. I hope they did not receive a degree in computer science, or that if they did, it was not from my alma mater.
Seriously, what programmer has not heard of floating point errors? That has to be one of the most common phrases I have ever heard in relation to programming; even the EEs and MEs I have met are familiar with the concept.
Except that people tend to rely on computers, and take risks they would not have otherwise taken. I am not saying that the number of deaths resulting from computer errors is going to be higher than other deaths, but that it is not as simple as "every death caused by a computer error is a death that would have happened before computers." If you knew your enemy was launching missiles at you, and you had no missile defense, what would you do to protect yourself? What would you do if you did have missile defense?
Read about identity based encryption; a trusted third party has to generate your private keys for you. The compromise here is that the scheme allows your identity -- name, email address, etc. -- to serve as the public key, thus eliminating a lot of the complication of key management.
Yes, I know that if the third party is compromised, the system breaks down. That is why it must be a third party you can trust, and that was my point about the "techies" being that third party for their friends, assuming that you can trust your friends.
People are only so willing to not have webmail, and they are not always available in person. Forget trying to explain to people how to carry crypto keys around on a thumb drive; that is about as useful as explaining why only encrypting emails that they think are sensitive enough to require encryption is not a good strategy. Basically, the FBI won the battle -- we were so bogged down with fighting their efforts to thwart email encryption that we missed the mark and the masses never adopted it.
Postal mail privacy is a tradition that predates the current era of American politics. In the new, digital age, you do not have the expectation of privacy, unless you are one of those crazy paranoid hacker types who uses encryption.
You are thinking of identity based encryption -- the "public key" is your email address (which can be anything you want, in fact). Unfortunately, the current schemes (those that I know of, anyway) involve a trusted third party generating your private key and assigning it to you, which will run into the same problems Hushmail ran into. What would be nice is a hybrid model -- where the trusted third party could be chosen by the user, and then those trusted parties would authenticate each other. Thus, the people who currently serve "techie" roles in their social circle would generate the private keys for their friends, and then use something like PGP to authenticate each other.
More work needs to be done; in particular, the government should simply mandate that no proprietary software may be used in any voting machine that is actually used in an election. Hoping for these companies to volunteer their source code is just not enough, although I do applaud Sequoia for taking this step.
Uhm...farmers slaughter their animals all the time. What is the difference between what was proposed and growing your own vegetables? Oh, right, a rabbit is cuter than a tomato.
The new guy does not get to just through any random software into a government system with no oversight...
This is /., if it is not as pretty as Aqua, it does not count.
"For everyone else this is a solution looking for a problem as package management and repositories don't really have a problem with different arches and versions."
Actually, having to maintain packages across several architectures can be tricky at times. Some packages need to be patched to run correctly on different architectures, and the upstream maintainers can accidentally break those patches (e.g. if they are not personally testing on a given architecture). It could even be the case that different architectures have different versions of the same packages, because the distro maintainers are busy trying to get everything to work.
I am not saying that this "universal binary" solution is the answer, but it might help streamline the build process at the distro level. It might help.
Not everyone is skilled enough to compile the source on their own, especially for packages that must be patched to run on certain architectures. Personally, I would think this might be useful for distro maintainers who do not want to maintain separate packages across multiple architectures, although the benefits may not outweigh the costs.
A new model for deriving income from creative works is needed. Maybe it is time to start looking toward online multiplayer accounts as a source of revenue for games, or concerts as a source of revenue for music. Just because you cannot figure out a revenue model other than restricting copying and slowing the progress of technology and society does not mean that no such model exists.
"Besides, why do you think you should be allowed to use the software or game if you haven't paid the author what he is asking for it?"
Why should you be allowed to read a book without the author's permission? Why should you be allowed to use the techniques described in a math textbook without the author's permission?
When copyrights were first envisioned, nobody was thinking, "Well, the general public should have to get the author's permission to read books." It was an issue of who was allowed to publish the book, not who was allowed to read it. Now we include software in copyright law, but the law should remain the same: an issue of who may publish, not who may use. Unfortunately, we have not updated copyright law to fit the times that we live in, and the line between "publishing" and "using" software has become blurred; instead of rethinking copyrights to compensate for this new age, we just pretend that everything is the same and pass laws like the DMCA to help prop up that fantasy.
So why should you be allowed to use the software without the author's permission? Because we live in a new age, and it is time for publishers of all sorts to adapt to that new age instead of clinging to the realities of a previous era.
Irrelevant. In a truly free market -- one that is free of regulation -- there will eventually a single winner for every segment of the market, and that winner will follow its best interests and prevent anyone from ever becoming a serious competitor. That is why the government must occasionally break up monopolies -- effectively resetting the market so that competition can continue.
Well, there is always the issue of business secrets -- it would be pretty easy for a rival company to pay off a maid to follow a few simple steps to install a bootloader on your laptop, without the maid even knowing exactly what she is doing. It would also be pretty basic for that company to arrange for your laptop to be stolen once you leave the hotel -- and presumably, you would have had to enter your passphrase during that period of time.
The point is that whole disk encryption is not sufficient to protect machines against a concerted attack -- but we knew that anyway. Your attackers could also have placed a microphone in the room to listen to your keystrokes as you enter the passphrase, or a video camera to watch your keystrokes, or any number of other vectors. If your data is important enough for someone to put in the effort needed to execute one of these attacks, you should not be accessing it in an environment you cannot control.
Ask yourself this: how many people (or criminal organizations) out there would benefit from having complete access to the Windows source code? Or even "just enough" access to disable all of the copy restrictions? Now, if you were a Microsoft employee, would you carry that source code around on your laptop? Would you even log in remotely to work on it?
It gives you a measure of protection if your device is stolen. It does nothing for you if you are worried about an attacker who has access to the system without having to steal it.
Except that physical access always trumps encryption. You need to go beyond simple encryption when your attacker might be a coworker (or a maid or janitor) -- you need a security policy that mitigates the attacks.
As an example, instead of whole disk encryption, suppose you just want to read some PGP encrypted emails on your coworker's computer, which you are allowed to SSH into (as is the case where I am now). One strategy you might try is to SSH in and use the microphone to listen to your coworker's keystrokes while he is reading his email (perhaps you can predict when he will be doing this -- e.g. if you send him a message marked "URGENT" and you spy on his network connection, so you know roughly when he received it). The time between keystrokes is related to which keys are being typed in -- not an exact measure, but enough to reduce the search space if you are trying to guess a passphrase. Thus, policies must be in place -- perhaps that no microphones may be installed on systems dealing with high security information.
Encryption is great if your attacker cannot get physical access to your machine (or something equivalent like logging in remotely), which is a common scenario. However, if you are dealing with uncommon data and your attackers are determined to see it, relying on encryption alone is simply not sufficient -- even if the keys are stored on a smartcard (you could be mugged) or if the keys are based on biometrics (your corpse is still sufficient).