Interesting conversation, but I think it will work out OK [LWN.net]

Interesting conversation, but I think it will work out OK

Posted Jan 10, 2005 23:45 UTC (Mon) by kimoto (subscriber, #5244)
In reply to: Interesting conversation, but I think it will work out OK by madscientist
Parent article: Debian and Mozilla - a study in trademarks

Say it is 2+ years after the release of sarge, and its successor (what, "etch"?) is not out. Debian wants to backport some security fix to the trademarked program. The trademark holder says, "No, it is an embarrassment to us for such an ancient version to be released today. You must build a version based on a more modern version of our program. Sometimes it behaves completely differently now, and it may not even build on some of your obscure architectures; however, we don't care about that."

What is Debian to do? Change their security-fix philosophy (i.e., minimal changes) for the sake of the trademark holder? Release a new .deb that deletes the program completely? Release a new .deb with no content except to depend on moz-iceweasel?

(Log in to post comments)

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 0:19 UTC (Tue) by khim (subscriber, #9252) [Link]

Right now Debian released version of Mozilla with known security holes as Debian 3.0r4. If it's Ok to do now - why it's not Ok to do in the future ?

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 11:47 UTC (Tue) by rene (subscriber, #8057) [Link]

That is because it is more or less impossible to backport the fixes to
mozilla 1.0.

When it was possible it probably was done and will be done in the future.

Interesting conversation, but I think it will work out OK

Posted Jan 13, 2005 4:08 UTC (Thu) by khim (subscriber, #9252) [Link]

Have you even read what was written before ?

I asked: what's so problematic about trademark issue.

I've got answer: it can preclude Debian from backporting bugfixes - and what then to do ?

I ask: duh... this already happened - and what Debian did ?

This time it's technical difference, next time it'll be trademark - what's the difference ?

The poimnt is: if you want to always have ability to backport fixes - then this gig is already lost clause. And if you'll think about it then you'll need to piss Mozilla developers quite severely to made them forbit porting bugfixes.

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 18:12 UTC (Tue) by madscientist (subscriber, #16861) [Link]

Is it really necessary to define a generic policy that Debian must follow for every trademark holder who manages their marks the way Mozilla Foundation is doing? Since the legality is not a question, but only the process, there is no reason not to examine each case individually, taking into account the upstream authors. I'm also not interested in arguing about theoretically possible but wildly improbable situations: the idea that MF would make a request like this of Debian, _especially_ when dealing with a security patch, is completely unrealistic. In fact, the threads on debian-legal raised this very point and MF stated that the terminology about patching, etc. is not intended to cover security fixes. Possibly that's something Debian and MF would want to make part of some kind of agreement, if it's a worry for some.

Anyway, in answer to your question, IF something like this happened then obviously Debian would have to create an "iceweasel" release and, as you say, release a new deb that forced the upgrade.

Note, however, that this work will have to be done ANYWAY, right now, if Debian should decide the CE is not acceptable: Debian already provides a firefox package after all. Personally I'm more of a fan of the XP development model; of KISS; of "if it ain't broke, don't fix it"; etc. Don't make work for yourself now just because there's an extremely unlikely possibility you might need it in the future.

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 20:40 UTC (Tue) by kimoto (subscriber, #5244) [Link]

As far as I can tell, it's not clear whether the MF intends to restrict the use of the command name "firefox" (and whether trademark law allows them to). So you could have breakage because the command name stops working.

Also, there is no firefox in a stable Debian release (for the obvious reasons ...), and it is considered no problem for packages to disappear from unstable. This has already happened: the "mozilla-firebird" package has come and gone.

Interesting conversation, but I think it will work out OK

Posted Jan 12, 2005 2:35 UTC (Wed) by madscientist (subscriber, #16861) [Link]

I also don't know if MF intends to/is able to restrict the name of the program on the disk. Seems doubtful to me but you never know. Even if they could restrict the filename, it's hard for me to believe they could restrict Debian from installing a "/usr/bin/firefox" symbolic link to "iceweasel".

Anyway, if the worst came true and the word "firefox" could not appear anywhere on the system, that would of course be annoying. However most applications use (or should use!) Debian's alternatives capability to invoke the browser, which would make any such transition seemless.

symlink is no different

Posted Jan 14, 2005 1:01 UTC (Fri) by giraffedata (subscriber, #1954) [Link]

Even if they could restrict the filename, it's hard for me to believe they could restrict Debian from installing a "/usr/bin/firefox" symbolic link to "iceweasel".

I can't imagine that trademark law or the Mozilla license would restrict the file name but not an alias for that name. It's like saying you can put "Microsoft Office" on your CD package for your Office knockoff as long as you put some other name on the disk inside.