Mixing responsibilities

Posted Apr 2, 2006 15:17 UTC (Sun) by Shanep (guest, #36879) [Link]

You are not.

Yes I AM and WAS.

You were talking specifically about the responsibilities that go with the BSD license.

No, to be exact, I was being specific about IBM adhering to the licence terms, where they have been said to be failing to do so in regards to their customers. IBM has a responsibility to pass the CORRECT terms of the licence on with the software, in this case to their own customers. Even when there may be times when IBM speak verbally to their customers, this does not mean that they can ADD responsibilities to the OpenSSH project, in this case they are covering something which the OpenSSH project have specifically disclaimed in their official licence. IBM takes software which they can use mostly how they see fit, but which is clearly stated in the licence that NO WARRANTY is given by the authors of the code which makes up OpenSSH. When there are terms stipulated in the licence like this,

"ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED"

and this,

"SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION"

and this,

"IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES",

IBM cannot then state to their customers that the OpenSSH project are RESPONSIBLE for providing fixes to OpenSSH and it actually be a true statement.

In fact, you said: "IBM wants the benefits of the BSD licence without the responsibilities that go with it." And now you say it is IBM's responsibilities to their own customers. If you keep changing the subjet it is difficult to have a meaningful conversation.

Yes that's right, why do you not understand what they means? I am not changing the subject, I am merely pointing out intimately related specifics.

To glue this together for you, the responsibility IBM has, is to pass on the truth as to the licence terms, to their customers, that the OpenSSH project are NOT responsible, as clearly stipulated in the licence of the OpenSSH code which IBM has chosen to pass on to their customers. Out of that truth, customers would then no doubt want to know what IBM's responsibility is for providing that software. If IBM are not willing to accept responsibility for the code they pass on or derivative code, then they need to inform their customers of that also and point their customers to any licence or further terms which they may have applied to the code they ship. Obviously IBM cannot add terms which add responsibilities to the OpenSSH project, without the OpenSSH project agreeing to that. Yet IBM tells their customers that the OpenSSH project is responsible for providing fixes. That is not true and IBM cannot speak on the behalf of the OpenSSH project beyond simply informing users of the ACTUAL licence terms which OpenSSH has laid down themselves.

The BSD license talks about warranties, not about whining in public. IBM can say whatever they want to their customers and still comply with the license, in letter if not in spirit.

No, legally IBM can NOT speak on behalf of the OpenSSH project to the extent that IBM says that the OpenSSH project have ADDITIONAL responsibilities on top of the official written OpenSSH licence which disclaims exactly what IBM claims the project are responsible for.

I don't know the specifics so it's hard to tell about the spirit; but the BSD license clearly says nothing about contributing with upstream or inviting developers to your gigs.

Yeah, so what? In that respect Theo is just venting about something which I think the World ought to know. He and I never claimed otherwise about that and the BSD licence.

Well, we disagree. But following this line of reasoning, we should have to say that OpenBSD users are not Apache users (since the httpd version they run is effectively forked),

Yes, that makes perfect sense to me. I would not hope for the Apache project to fix OpenBSD's version of Apache, since OpenBSD have changed a fair deal. Last count I heard it was 40,000 lines difference. But even if it were ONE line, if those changes are not accepted into the official tree and is maintained by a 3rd party, then it is a derivative work.

are not FreeBSD users (they forked long ago),

No they didn't, you don't know what you are talking about. OpenBSD forked from NetBSD 1.0 and later took parts from 4.4BSD Lite 2. NetBSD 1.0 came from 4.3BSD Lite. FreeBSD came from 386BSD 0.1 and of course has taken parts from other BSD versions. Practically speaking, the "FreeBSD in OpenBSD" comes from minor discrete incidences of shared or ported code. Then there is the fact that they share from portions of various versions of old heritage BSD code (converging on 4.3BSD Lite). Are OpenBSD users FreeBSD users? No. Are OpenBSD, NetBSD and FreeBSD users BSD users? Yes, if you are talking about their heritage.

OpenBSD most certainly did NOT fork from FreeBSD.

are not BSD users

Hey careful now, don't mix heritage up with responsibilities (convey licence terms) clearly detailed in licences. "BSD" is not specific enough to mean anything other than something very general. Saying "BSD" and leaving it at that, is largely meaningless if you are talking about licences. I would expect you to a LEAST provide details as to who provides that software DERIVED from "BSD" and possibly a version name and/or number.

Are OpenBSD users "BSD" users? Yes, if you are talking about code heritage or loosely about system style if comparing to SysV for example.

and not Unix users in the end.

Well this depends on what the relevance of "UNIX" is to the person asking or stating it. Are they taking it as its literal current day meaning? Or once again, are they using it in a loose heritage form? Are OpenBSD users, users of UNIX? Well, that depends on the user, but if the only UNIX- like system they use is OpenBSD, then NO, I beleive they are not a UNIX user in the official meaning. UNIX is a definition and trademark for which I beleive both do not officially apply to OpenBSD.

It is misleading to say the least.

What is misleading, is ignoring licence terms and selectively choosing the relevance of various terms or names, ranging from loose meanings evolved by public IT culture, to absolute literal meanings. IBM goes beyond being misleading, right into out and out lie.

But that is not the main point. SunSSH comes from OpenSSH, and is supposed to draw from its strengths. If de Raadt leaves those users vulnerable by releasing an update before Sun has been warned, Sun will have the perfect excuse for blaming the OpenSSH team.

SunSSH is a derived work, built from a BSD licence code-base which has disclaimed warranties, such that I have shown above. Plenty of other companies provide their own software, just like Sun are providing their own SunSSH, while dealing with the security issues themselves because the buck stops with them. IF Sun does not receive responsible disclosure from Theo or the OpenSSH project, it will be because time and time again, Sun have been a bunch of arse-holes. Sun customers suffer under similar circumstances because of Sun.