Weekly Edition
Return to the Press page
| |||||||||||||
|
| |||||||||||||
Interview: Theo de Raadt of OpenBSD (NewsForge)
NewsForge interviews
Theo de Raadt of OpenBSD. " NF: You regularly organize events
called hackathons. What exactly is a hackathon? TdR: This is
something we started many years ago. A bunch of us would fly to one
location (typically before or after a conference) and we would sit down and
code. These events really are about getting tasks done; there is very
little chatter, as we already know basically what needs to be done. They
are not meetings, no one presents talks, nor are they so-called
summits. They are for taking action in the source tree, knowing that the
guy you need to ask a question of really quickly is sitting at a table a
meter away."
(Log in to post comments)
OpenSSH donations Posted Mar 29, 2006 4:30 UTC (Wed) by cventers (subscriber, #31465) [Link] In light of a discussion about OpenSSH and OpenBSD on Slashdot a littleearlier, I'd like to point out to the LWN readers that it is possible to donate to OpenSSH. Send your donation to OpenBSD through normal channels, and specify in the comments that you would like to contribute the funds to OpenSSH. I'm not an OpenBSD user, but I donated to OpenSSH.
In fairness, they should explore options Posted Mar 29, 2006 6:15 UTC (Wed) by b7j0c (subscriber, #27559) [Link] i do intend to donate some amount for openssh development, but i would also suggest that the team consider options for keeping these projects going. for example, get a day job with a company that understands the value of openssh, even better if they depend on it. get them to fund half-time development. i am sure google, yahoo, ibm, redhat, etc etc would be willing to work out some arrangement. i know at yahoo, for example, some people spend time contributing back to freebsd. i can't imagine that openssh requires full-time 9-5 development every day.
Theo de Raadt on OpenSSH security flaws Posted Mar 29, 2006 13:09 UTC (Wed) by jmtapio (guest, #23124) [Link] If you want to judge any entity particularly harshly, judge Sun. Yearly they hold interoperability events, for NFS and other protocols, and they include SSH implementation tests as well. Twice we asked them to cover the travel and accommodation costs for a developer to come to their event, and they refused. Considering that their SunSSH is directly based on our code, that is just flat out insulting. Shame on you Sun, shame, shame, shame. I will say it here -- if an OpenSSH hole is found that applies to SunSSH, Sun will not be informed. Or maybe that has happened already. Emphasis mine. I must say I find this comment disturbing even from Theo de Raadt. The idea of trying withhold information about security problems does not belong to free software, especially to such critical free software. I thought the point with the BSD license was supposed to be that it does not require corporations to give back to the community.
Theo de Raadt on OpenSSH security flaws Posted Mar 29, 2006 15:09 UTC (Wed) by ibukanov (subscriber, #3942) [Link] > I thought the point with the BSD license was supposed to be that it does not require corporations to give back to the community.
But then the license does not promise that the company would be notified about the securyty updates either.
My interpretation of Theo's quote is that Sun would not be informed about bugs in advance via some established procedure. Which is fair as I do not receive any advance warnings as well and rely on FedoraCore/Ubutnu to patch OpenSSH installations instead. Why any other entity that use OpenSSH should be any different?
Theo de Raadt on OpenSSH security flaws Posted Mar 29, 2006 15:25 UTC (Wed) by man_ls (subscriber, #15091) [Link] In the interest of responsible disclosure, developers (open or closed) should be notified as soon as you learn about a vulnerability, and the general public some time later. This is what de Raadt does not promise to do.And it is really a disturbing attitude, given that OpenBSD people are always advocating complete freedom for their source code, even if it means that competitors may take it and release a closed version. Or I should say especially when competitors take it and release a closed version, since these people claim the superiority of their license for this same reason. We must conclude that they do not think closed versions are a bad thing.
Theo de Raadt on OpenSSH security flaws Posted Mar 29, 2006 16:18 UTC (Wed) by vmole (guest, #111) [Link] Closed or not, Sun is taking other people's work and selling it, and then failing to provide any support for those people. Legal? Yes. Ethical? No. Wise? Definitely not. Of course, expecting corporations to behave either ethically or wisely is naive.
Ethical behaviour Posted Mar 29, 2006 17:06 UTC (Wed) by man_ls (subscriber, #15091) [Link] Yeah, sure. The GPL helps with keeping companies ethical, but not much.However, unethical behavior on the part of those companies does not justify unethical behavior on the part of individual developers, as seems to be the case here. Failing to do responsible disclosure (as somehow threatening not to) is not a sensible position. And this comes from a crucial security provider for almost all of us! Gives me the creeps.
Ethical behaviour Posted Apr 1, 2006 2:55 UTC (Sat) by Shanep (guest, #36879) [Link] However, unethical behavior on the part of those companies does not justify unethical behavior on the part of individual developers, as seems to be the case here. Failing to do responsible disclosure (as somehow threatening not to) is not a sensible position. And this comes from a crucial security provider for almost all of us! Gives me the creeps.Theo is NOT failing to do responsible disclosure. He is talking about Suns OWN SunSSH. NOT OpenSSH. OpenSSH will continue to provide full disclosure and Sun, just like the rest of the World, is free to view that disclosure and scrutinize their OWN SunSSH code. Theo should not have to audit Sun's own code when Sun gives him NOTHING.
Disclosure of vulnerabilities Posted Apr 1, 2006 8:54 UTC (Sat) by man_ls (subscriber, #15091) [Link] Responsible disclosure does not work that way. Suppose that A knows that B's software has a vulnerability. A notifies B in advance and, some time later, A goes public. The amount of advance time is under discussion; two weeks to a month seems reasonable. For example: you find a vulnerability in Mac OS X, you notify Microsoft and wait for a month. Apple has time to patch the system and to distribute the patch; then you can go public.Now let us suppose you find a vulnerability in OpenSSH. You notify the OpenSSH team at security@openssh.org (or whatever) and give them a month. But you know nothing of Sun's own SunSSH; however de Raadt does, and he knows that the vulnerable code is in Sun's version too. So de Raadt knows that some software (SunSSH) has a vulnerability, and should in the interest of responsible disclosure warn them in advance. However he is mad at them for not inviting him to their sleep-overs and he does not warn Sun; when the bug goes public, Sun's software is exposed with no advance warning. So you see that responsible disclosure is orthogonal from full disclosure. Both are not a matter of law, but of ethics; the latter says "let users know what is wrong with their software", the former says "let developers patch their software before the black hats get the information". A crucial security provider should know the difference.
Disclosure of vulnerabilities Posted Apr 1, 2006 12:30 UTC (Sat) by Shanep (guest, #36879) [Link] Sorry, but if want to talk about ethics, then where are Sun and IBM's ethics? Theo refusing to give them a heads up on security issues, is hardly worse than Sun and IBM, with all their money, refusing to give a cent but expecting support for free. If you get any at all, it is a damn temporary privilege.Sun and the rest need to look at the part of the BSD licence which disclaims all warranties. Sure the code is as free as it gets. But don't expect support at all, much less for free. I would love to see Theo charge a premium for responsible disclosure.
Disclosure of vulnerabilities Posted Apr 1, 2006 13:40 UTC (Sat) by man_ls (subscriber, #15091) [Link] That is precisely the point. Of course Sun is not behaving ethically. But seeing the other party is not behaving ethically is no excuse for behaving unethically yourself.
Theo de Raadt on OpenSSH security flaws Posted Apr 1, 2006 2:49 UTC (Sat) by Shanep (guest, #36879) [Link] In the interest of responsible disclosure, developers (open or closed) should be notified as soon as you learn about a vulnerability, and the general public some time later. This is what de Raadt does not promise to do.How much money does Sun have and how many staff members do they have? They give NOTHING back, yet expect something in return for NOTHING? They have the staff and resources to monitor the advisories themselves. They should not need and do not deserve a personal touch. And it is really a disturbing attitude, given that OpenBSD people are always advocating complete freedom for their source code, even if it means that competitors may take it and release a closed version. Or I should say especially when competitors take it and release a closed version, since these people claim the superiority of their license for this same reason. We must conclude that they do not think closed versions are a bad thing. It is about freedom of OpenBSD's OWN source code. That freedom is absolute when you allow people to take it for themselves and close their own copy and development off to the rest of the World. OpenBSD's version remains as free as possible.
Theo de Raadt on OpenSSH security flaws Posted Apr 1, 2006 9:51 UTC (Sat) by man_ls (subscriber, #15091) [Link] They have the staff and resources to monitor the advisories themselves. They should not need and do not deserve a personal touch.As I tried to explain above, it has nothing to do with staff and resources, but with knowing that somebody's code out there has a flaw. Even worse, the flaw comes from a reputed source (the OpenSSH project). Monitoring advisories after the vulnerability has gone public still puts your customers at risk for a period of time. That freedom is absolute when you allow people to take it for themselves and close their own copy and development off to the rest of the World.If you give the possibility to take your code and make it proprietary then you should be ready to have it happen. If you insist that this possibility is an essential freedom, not an undesirable artifact, then it must be that you think that such closed versions are not a bad thing. Other people (notably Stallman) think that closed versions are a disgrace, and so license their code (notably under the GPL) to avoid such things. De Raadt and others go out of their way to let companies make closed versions. So when it happens they should not go mad; they should instead understand that SunSSH users are also their users and not put them at risk. It is not ethical (and it looks unprofessional too).
Theo de Raadt on OpenSSH security flaws Posted Apr 1, 2006 12:11 UTC (Sat) by Shanep (guest, #36879) [Link] De Raadt and others go out of their way to let companies make closed versions. So when it happens they should not go mad;Theo is mad that an expectation from Sun and IBM that the OpenSSH project is responsible for fixing software which Sun and IBM are providing their paying customers. IBM has refused to fix problems for their customers because they say it is the responsibility of the OpenSSH project. Well it is NOT OpenSSH's responsibility. IBM wants the benefits of the BSD licence without the responsibilities that go with it. I would be mad too. they should instead understand that SunSSH users are also their users and not put them at risk. It is not ethical (and it looks unprofessional too). The stance of the OpenBSD project is that they write code for themselves and allow other people to use that code. I agree that ethically they should provide fixes for users of their own code. However I don't agree that they should have a responsibility to Sun as Sun being OpenBSD's user. Because Sun was a user of OpenSSH for the instant that they took it, but then gave that up at the point where they started making their own changes. Just like people who compile custom OpenBSD kernels, putting things in, taking stuff out and making mods and then expecting the OpenBSD project to be able to help them. Sun has chosen to branch OpenSSH into their own codebase. Now they, Sun, are responsible from not only an ethical standpoint to their (Sun's) customers, but possibly also from a legal standpoint. Theo should not have to watch SunSSH development to see what is vulnerable and what is not, as time goes on and the codebases continue to make distance from each other. Sun is a big company and like any big company releasing software, they need to deal with the security too. They take the benefit from the BSD licence, they need to deal with it.
Responsibility? Posted Apr 1, 2006 15:34 UTC (Sat) by man_ls (subscriber, #15091) [Link] IBM wants the benefits of the BSD licence without the responsibilities that go with it.What responsibilities are you talking about? The BSD license says that you can do whatever you want with the code, no strings attached. It does not say you have to invite developers to your events. However I don't agree that they should have a responsibility to Sun as Sun being OpenBSD's user.You should really pay more attention to what is being said. In the phrase you quoted I didn't speak about Sun; I said that SunSSH users are OpenSSH users too. If SunSSH has a vulnerability, users will think it is not very secure. When they learn that it is a fork of OpenSSH, then they are likely to figure out that OpenSSH is not as secure as they thought. You know, all this talk makes me want to use an OpenSSH fork under the GPL. This is all too childish.
Responsibility? Posted Apr 1, 2006 23:03 UTC (Sat) by Shanep (guest, #36879) [Link] What responsibilities are you talking about? The BSD license says that you can do whatever you want with the code, no strings attached. It does not say you have to invite developers to your events.I'm talking about IBM's responsibilities to their own customers. IBM want to take the full benefit from the BSD licence, but when it comes time to assist their own customers with problems, they tell those customers that it is the OpenSSH projects responsibility. This is clearly NOT the case, given the BSD licence disclaims warranties. You should really pay more attention to what is being said. No, I wrote OpenBSD when I should have written OpenSSH. In the phrase you quoted I didn't speak about Sun; I said that SunSSH users are OpenSSH users too. If SunSSH has a vulnerability, users will think it is not very secure. When they learn that it is a fork of OpenSSH, then they are likely to figure out that OpenSSH is not as secure as they thought. I don't agree that SunSSH users are OpenSSH users. Sun have taken the code and changed it into their own. The fact remains, that SunSSH users are Sun users. You know, all this talk makes me want to use an OpenSSH fork under the GPL. This is all too childish. Yes, I'd like to see you do that. And yes, there have been lots of childish comments here under this story.
Mixing responsibilities Posted Apr 2, 2006 11:06 UTC (Sun) by man_ls (subscriber, #15091) [Link] I'm talking about IBM's responsibilities to their own customers.You are not. You were talking specifically about the responsibilities that go with the BSD license. In fact, you said: "IBM wants the benefits of the BSD licence without the responsibilities that go with it." And now you say it is IBM's responsibilities to their own customers. If you keep changing the subjet it is difficult to have a meaningful conversation. This is clearly NOT the case, given the BSD licence disclaims warranties.The BSD license talks about warranties, not about whining in public. IBM can say whatever they want to their customers and still comply with the license, in letter if not in spirit. I don't know the specifics so it's hard to tell about the spirit; but the BSD license clearly says nothing about contributing with upstream or inviting developers to your gigs. I don't agree that SunSSH users are OpenSSH users.Well, we disagree. But following this line of reasoning, we should have to say that OpenBSD users are not Apache users (since the httpd version they run is effectively forked), are not FreeBSD users (they forked long ago), are not BSD users and not Unix users in the end. It is misleading to say the least.
But that is not the main point. SunSSH comes from OpenSSH, and is supposed to draw from its strengths. If de Raadt leaves those users vulnerable by releasing an update before Sun has been warned, Sun will have the perfect excuse for blaming the OpenSSH team.
Mixing responsibilities Posted Apr 2, 2006 15:17 UTC (Sun) by Shanep (guest, #36879) [Link] I'm talking about IBM's responsibilities to their own customers.You are not. Yes I AM and WAS. You were talking specifically about the responsibilities that go with the BSD license. No, to be exact, I was being specific about IBM adhering to the licence terms, where they have been said to be failing to do so in regards to their customers. IBM has a responsibility to pass the CORRECT terms of the licence on with the software, in this case to their own customers. Even when there may be times when IBM speak verbally to their customers, this does not mean that they can ADD responsibilities to the OpenSSH project, in this case they are covering something which the OpenSSH project have specifically disclaimed in their official licence. IBM takes software which they can use mostly how they see fit, but which is clearly stated in the licence that NO WARRANTY is given by the authors of the code which makes up OpenSSH. When there are terms stipulated in the licence like this, "ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED" and this, "SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION" and this, "IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES", IBM cannot then state to their customers that the OpenSSH project are RESPONSIBLE for providing fixes to OpenSSH and it actually be a true statement. In fact, you said: "IBM wants the benefits of the BSD licence without the responsibilities that go with it." And now you say it is IBM's responsibilities to their own customers. If you keep changing the subjet it is difficult to have a meaningful conversation. Yes that's right, why do you not understand what they means? I am not changing the subject, I am merely pointing out intimately related specifics. To glue this together for you, the responsibility IBM has, is to pass on the truth as to the licence terms, to their customers, that the OpenSSH project are NOT responsible, as clearly stipulated in the licence of the OpenSSH code which IBM has chosen to pass on to their customers. Out of that truth, customers would then no doubt want to know what IBM's responsibility is for providing that software. If IBM are not willing to accept responsibility for the code they pass on or derivative code, then they need to inform their customers of that also and point their customers to any licence or further terms which they may have applied to the code they ship. Obviously IBM cannot add terms which add responsibilities to the OpenSSH project, without the OpenSSH project agreeing to that. Yet IBM tells their customers that the OpenSSH project is responsible for providing fixes. That is not true and IBM cannot speak on the behalf of the OpenSSH project beyond simply informing users of the ACTUAL licence terms which OpenSSH has laid down themselves. The BSD license talks about warranties, not about whining in public. IBM can say whatever they want to their customers and still comply with the license, in letter if not in spirit. No, legally IBM can NOT speak on behalf of the OpenSSH project to the extent that IBM says that the OpenSSH project have ADDITIONAL responsibilities on top of the official written OpenSSH licence which disclaims exactly what IBM claims the project are responsible for. I don't know the specifics so it's hard to tell about the spirit; but the BSD license clearly says nothing about contributing with upstream or inviting developers to your gigs. Yeah, so what? In that respect Theo is just venting about something which I think the World ought to know. He and I never claimed otherwise about that and the BSD licence. Well, we disagree. But following this line of reasoning, we should have to say that OpenBSD users are not Apache users (since the httpd version they run is effectively forked), Yes, that makes perfect sense to me. I would not hope for the Apache project to fix OpenBSD's version of Apache, since OpenBSD have changed a fair deal. Last count I heard it was 40,000 lines difference. But even if it were ONE line, if those changes are not accepted into the official tree and is maintained by a 3rd party, then it is a derivative work. are not FreeBSD users (they forked long ago), No they didn't, you don't know what you are talking about. OpenBSD forked from NetBSD 1.0 and later took parts from 4.4BSD Lite 2. NetBSD 1.0 came from 4.3BSD Lite. FreeBSD came from 386BSD 0.1 and of course has taken parts from other BSD versions. Practically speaking, the "FreeBSD in OpenBSD" comes from minor discrete incidences of shared or ported code. Then there is the fact that they share from portions of various versions of old heritage BSD code (converging on 4.3BSD Lite). Are OpenBSD users FreeBSD users? No. Are OpenBSD, NetBSD and FreeBSD users BSD users? Yes, if you are talking about their heritage. OpenBSD most certainly did NOT fork from FreeBSD. are not BSD users Hey careful now, don't mix heritage up with responsibilities (convey licence terms) clearly detailed in licences. "BSD" is not specific enough to mean anything other than something very general. Saying "BSD" and leaving it at that, is largely meaningless if you are talking about licences. I would expect you to a LEAST provide details as to who provides that software DERIVED from "BSD" and possibly a version name and/or number. Are OpenBSD users "BSD" users? Yes, if you are talking about code heritage or loosely about system style if comparing to SysV for example. and not Unix users in the end. Well this depends on what the relevance of "UNIX" is to the person asking or stating it. Are they taking it as its literal current day meaning? Or once again, are they using it in a loose heritage form? Are OpenBSD users, users of UNIX? Well, that depends on the user, but if the only UNIX- like system they use is OpenBSD, then NO, I beleive they are not a UNIX user in the official meaning. UNIX is a definition and trademark for which I beleive both do not officially apply to OpenBSD. It is misleading to say the least. What is misleading, is ignoring licence terms and selectively choosing the relevance of various terms or names, ranging from loose meanings evolved by public IT culture, to absolute literal meanings. IBM goes beyond being misleading, right into out and out lie. But that is not the main point. SunSSH comes from OpenSSH, and is supposed to draw from its strengths. If de Raadt leaves those users vulnerable by releasing an update before Sun has been warned, Sun will have the perfect excuse for blaming the OpenSSH team. SunSSH is a derived work, built from a BSD licence code-base which has disclaimed warranties, such that I have shown above. Plenty of other companies provide their own software, just like Sun are providing their own SunSSH, while dealing with the security issues themselves because the buck stops with them. IF Sun does not receive responsible disclosure from Theo or the OpenSSH project, it will be because time and time again, Sun have been a bunch of arse-holes. Sun customers suffer under similar circumstances because of Sun.
Mixing responsibilities Posted Apr 3, 2006 0:42 UTC (Mon) by man_ls (subscriber, #15091) [Link] Dude, relax. Your gripe with IBM has cannibalized this thread which dealt with Sun and responsible disclosure. I don't know what IBM said or how or when, without which information this discussion is turning into a one-sided flamefest. They obviously did something very wrong in your eyes, and I'm ready to accept it; but it is not easy to see the relationship with the topic under discussion. De Raadt only mentions them in passing. Finally, mixing IBM's responsibilities to their users with IBM's responsibilities under the OpenSSH license is not helping.I'm sorry I mistook NetBSD for FreeBSD; in my defense there are a lot of branches and from the outside it is not so easy to tell them apart. Finally, even if IBM and Sun are the devil incarnate, this does not justify leaving a lot of users in the cold.
Mixing responsibilities Posted Apr 3, 2006 9:08 UTC (Mon) by Shanep (guest, #36879) [Link] Dude, relax.I am not trying to direct anger towards you, by the way. You could be my best friend, playing devils advocate or not and I'd still be putting my position forward in the same manner. Conversations escalate as they go back and forth, which brings new content into potential conflict on both sides. Your gripe with IBM has cannibalized this thread which dealt with Sun and responsible disclosure. I don't know what IBM said or how or when, without which information this discussion is turning into a one-sided flamefest. I have tried to remain civil and I think I mostly have. Don't confuse content with flaming. I assume when you say one sided flamefest, you are refering to flames coming from me? I have merely tried to put forward reason and evidence. You have tried to shoot it down, even with a few snide remarks. I felt flames but tried not to give them back. They obviously did something very wrong in your eyes, and I'm ready to accept it; but it is not easy to see the relationship with the topic under discussion. De Raadt only mentions them in passing. Finally, mixing IBM's responsibilities to their users with IBM's responsibilities under the OpenSSH license is not helping. IBM claims OpenSSH is responsible for something OpenSSH clearly disclaims in a legal licence. IBM, in some cases like Sun, want their cake and to eat it too. IBM are in the wrong. Sun are not legally in the wrong, but they have not played nicely, so I hardly see why Theo should play nicely "for the sake of Sun's customers" when were talking about a derived work for which Sun does NOT want to assist the OpenSSH team into helping Sun and their customers. A work which Sun passes off as their own. If Sun want to exploit the licence to it's fullest potential and ignore good-will, then more power to Theo for doing the same. Finally, even if IBM and Sun are the devil incarnate, this does not justify leaving a lot of users in the cold. Theo and the OpenSSH project have not left a lot of users in the cold. Sun users are free to replace SunSSH with OpenSSH. The users of IBM and Sun should look at the completely disgraceful slap in the face and lack of good will which their vendor has shown to a software team which has been selflessly providing some important software under some very free terms. Sun inviting and paying for an OpenSSH developer to attend interoperability events, is in the best interests Sun's customers also. I don't feel bad if Theo acts "unethically" towards Sun, because Sun's users choose to be customers of an unethical company. The politics which go back and forth as a result of Sun being unethical or choosing to not uphold good-will, results in an impact on Sun's users (they live with SunSSH without the benfit of responsible disclosure, or they have to replace it with OpenSSH). Sun and IBM give OpenBSD an uphill battle, needlessly. A company acts unethically and their users suffer as a result. If I was treated like crap over and over again, all because I was trying to uphold the greater good, I'd come to a breaking point to.
Sun and IBM Posted Apr 3, 2006 9:52 UTC (Mon) by man_ls (subscriber, #15091) [Link] I am not trying to direct anger towards you, by the way.Same here. Cold expression of facts can easily be regarded as aggressivity on the net. That's why smileys were invented :) I assume when you say one sided flamefest, you are refering to flames coming from me?Actually, I meant from you to IBM. I have merely tried to put forward reason and evidence.I have seen no evidence actually, just your subjective impressions. A link or two would be nice. I don't feel bad if Theo acts "unethically" towards Sun, because Sun's users choose to be customers of an unethical company.Back to square one. See, this is not a very professional attitude. (And yeah, Sun may not have been professional in this instance, but this is where one's professionality should show.) Sorry if I have misunderstood the situation, but from the outside it looks like that.
Sun and IBM Posted Apr 3, 2006 12:41 UTC (Mon) by Shanep (guest, #36879) [Link] I have seen no evidence actually, just your subjective impressions.The evidence I'm refering to are the parts of the OpenSSH licence which disclaim warranties. I don't feel the terms of the licence leave much room for subjectivity. A link or two would be nice. The details of the OpenSSH licence.
Non-copyleft license and reciprocality Posted Mar 30, 2006 22:30 UTC (Thu) by bignose (subscriber, #40) [Link] > I thought the point with the BSD license was supposed to be that it does> not require corporations to give back to the community.
Yes. The licensor decides not to use copyright to enforce "share and share alike". This doesn't mean the licensor does not desire that behaviour, only that they choose not to use copyright law as a tool to enforce it.
Many people feel much better about social obligation if it isn't strong-armed by legal obligation. It also allows those who choose to behave well in the absence of legal obligation to be demonstrably better citizens by comparison with those who choose not to.
Theo de Raadt on OpenSSH security flaws Posted Apr 1, 2006 2:31 UTC (Sat) by Shanep (guest, #36879) [Link] I must say I find this comment disturbing even from Theo de Raadt. The idea of trying withhold information about security problems does not belong to free software, especially to such critical free software.Now hang on just a second. Theo is refering to SunSSH here, a seperate branch which Sun have chosen to fork and develop for themselves and yet don't even donate a cent to him. Theo should not be expected to audit Sun's source for bugs, when they have incredible amounts of money and resources to do it themselves. Sun can watch the OpenSSH advisories and audit their own SunSSH. There is no lack of full disclosure here. Theo discloses information about OpenSSH and Sun is free to listen to that, ignore it and continue to make a complete mess of SunSSH. Why should Theo and the OpenSSH project hold Sun's hand on SUNS OWN SOFTWARE when Sun gives NOTHING back? I thought the point with the BSD license was supposed to be that it does not require corporations to give back to the community. That's right. The software is given away for free and corporations do not have to give back code changes or money. However, OpenSSH is important and costs money to develop. With the savings the corporations have made by using OpenSSH and with the future of OpenSSH being in everyones best interests, including that of the corporations, donations from those who can most afford it would help retain the bright future of OpenSSH. Theo is just as free to request donations, as the users are free to deny him that. But if people hold any value in OpenSSH and its future, they'll donate. It's the least people can do when you consider all the time and effort people have put into OpenSSH for free.
Time for Theo to grow up Posted Mar 29, 2006 17:45 UTC (Wed) by Junior_Samples (guest, #26737) [Link] Theo's outbursts over the years have raised many an eyebrow. I suppose we all expected that he'd eventually mature and outgrow his tantrums. Evidently not.Theo should realize that most people are not so fortunate as to have others pay for their hobby. It's great that Theo likes playing in his sandbox. But most other Free Software authors have to hold down a day job. Maybe it's time for Theo to bite the bullet and join society. If Theo's skills really are any good, there should be plenty of employers willing to pay him what he's worth. If he saves his money, and spends wisely, then he can pay for his trips and vacations out of his own pocket. He can even plan his vacation schedule so that he can attended a "hackathon", or maybe the Sci-Fi convention. Welcome to real world, Theo.
Time for Theo to grow up Posted Mar 29, 2006 20:31 UTC (Wed) by sbergman27 (guest, #10767) [Link] You know, I think you might be on to something there.
Imagine Theo starring in his own sit-com about Theo deRaat getting a real job and working for a major corporation. Say, 'JCN'. They could call it rot('IBM', +1)
It wouldn't be much different from his work with OpenBSD and OpenSSH. He could just be himself and give us all a laugh. Kinda like he does now. ;-)
Time for Theo to grow up Posted Apr 1, 2006 3:21 UTC (Sat) by Shanep (guest, #36879) [Link] Theo should realize that most people are not so fortunate as to have others pay for their hobby. It's great that Theo likes playing in his sandbox. But most other Free Software authors have to hold down a day job.Most other Free Software authors do not LEAD a project which is the size of OpenBSD and OpenSSH. Projects which provide high quality software which Apple, Sun, Cisco, Novell, IBM, RedHat, Microsoft, etc etc etc continue to use. It's not much to ask for donations for software you have written and projects you have managed, when they are so large and important and have been so successful as to be used by some of the industries biggest names. If Theo's skills really are any good, there should be plenty of employers willing to pay him what he's worth. He has. I seem to remember that Theo has written satellite control software amongst other things. Now his position is obviously much more needed heading OpenBSD and OpenSSH. There he has acheived a great deal. Over Christmas, I sent an email to the OpenBSD sparc64 mailing list. I got some auto-replies because obviously at that time of the year, some people are on holidays and being away from work, they set those auto-replies. One of the auto-replies I got, was from someone at the Pentagon Computer Incident Response Team. So, the US DoD donates $2M US to OpenBSD and the Pentagon are watching OpenBSD development, but you don't think what Theo does is important? So, tell us about your acheivements. And please grow up.
Please... Posted Mar 29, 2006 21:28 UTC (Wed) by dweller (guest, #36831) [Link] I just registered to LWN because I couldn't resist.To everyone: you know, it would be really cool if you just cut all that crap you are now saying. Theo De Raadt took huge risks, invested a lot of money merely to give birth to this project, while you whiners just reap the benefits of it (ie secure your computers) and give nothing back. Just whine,whine,whine. I wish a *lot* more people had *worse* attitude than Theo but gave to the community *half* of what he had offered so far. Things would be much better right now.
Please... Posted Mar 29, 2006 23:50 UTC (Wed) by sbergman27 (guest, #10767) [Link] Dweller,
Theo goes out of his way to bring this "crap" upon himself.
I personally think that he probably enjoys it. Theo's a big boy.
Let him be that. Don't try to be his protector.
Just my personal opinion... nothing else.
Please... Posted Apr 1, 2006 2:41 UTC (Sat) by Shanep (guest, #36879) [Link] Theo goes out of his way to bring this "crap" upon himself.Ok, so let's see... in this instance, the "crap" Theo has brought upon himself, is to say that he won't audit Suns own seperate SunSSH source tree for them. When Sun gives him NO money to do that or for the privilege of starting from OpenSSH. Sun are free to listen to the full disclosure of OpenSSH advisories and then audit their own damn tree themselves. That comment of Theo's hardly brings "crap" upon himself if you actually put a bit of thought into it.
Please... Posted Mar 31, 2006 4:37 UTC (Fri) by hppnq (subscriber, #14462) [Link] Oh please, there are many other forums that welcome users who register so they can complain about whining. Next time do try to resist.
|
|
||||||||||||