Bruce Perens: State of Open Source [LWN.net]

Bruce Perens: State of Open Source

Posted Apr 7, 2006 16:08 UTC (Fri) by dlang (✭ supporter ✭, #313) [Link]

Bruce,
as I see it there were two issues in Linus' initial post.

1. the GPLv3 can force people to reveal secret keys in situations that violate common sense.

2. disagreeing with the goal of the FSF in trying to ban tivo-like devices.

the huge outcry has been that Linus is an idiot who can't read and the GPLv3 doesn't do anything like #1. having read through it I don't think that Linus is wrong. I think that the wording that the FSF has selected can have exactly that effect.

for the other poster above who said that in my example redhat wouldn't have my box as the 'primary inteneded use' of the software so it wouldn't apply, if that's all it takes it's pretty easy for a company to have an official 'primary intended use' for something that doesn't involve a locked down box, but that also gets used on a locked down box and at least argue plausably that they are not violating things. This is why I say that either the GPLv3 could require the revealing of secret keys in obviously inappropriate conditions or there are loopholes large enough to make it meaningless if a company wants to beat it.

now when you start discussing #2 things get quite a bit trickier. I personally don't have a problem with a company shipping a locked-down box becouse it is just too easy for a determined person to break anything they do (I don't consider having to replace or reprogram a prom unreasonable). witness the x-box mod-chips as an example of the market at work to produce hardware patches that anyone can install.

the problem comes when such hardware modifications are made illegal (which is happening with the xbox mod chips), but I don't think that software copyright law is the appropriate tool to deal with this problem (and I do believe that this is a major problem)

David Lang

loopholes

Posted Apr 7, 2006 17:50 UTC (Fri) by stevenj (guest, #421) [Link]

for the other poster above who said that in my example redhat wouldn't have my box as the 'primary inteneded use' of the software so it wouldn't apply, if that's all it takes it's pretty easy for a company to have an official 'primary intended use' for something that doesn't involve a locked down box, but that also gets used on a locked down box and at least argue plausably that they are not violating things.

I didn't say "primary intended use". I used the words in the (draft) GPLv3: "recommended or principal context of use". And so should you.

Your claim is not very plausible. If you ship a locked-down box bundled with GPL-derived software that has been modified to add DRM, then it seems very hard to argue with a straight face that you are not "recommending" that users employ the software you give them with the hardware you sell them.

Yes, you could try to imagine a hypothetical DRM hardware maker who doesn't include software with their device, but rather requires you to download it from some third party who has nothing to do with DRM, but that is quite a stretch. First, forcing hardware manufacturers to not bundle the software customers need to use the hardware is imposing quite a penalty on them. Second, it seems unlikely that if you want to enforce DRM you're going to rely on the cooperation of a third party who has no financial interest in enforcing DRM on your hardware.

By all means, bring this up with the GPLv3 committees (and for the same reason, it's probably not worth arguing more about it here). However, I'm inclined to give some credence to the ability of a law professor who has spent years enforcing the GPL, and thereby inclined to doubt any random fellow who claims there are "obviously" huge loopholes.

loopholes

Posted Apr 8, 2006 1:33 UTC (Sat) by dlang (✭ supporter ✭, #313) [Link]

you misunderstood what I said

I said that I ship a DRM'd hardware box with NO GPL software. I have the propriatary loader on that box set to go out to a public webserver, download GPL software that's signed and install it only if the signature is valid.

at this point I have not distributed any software so no provisions of the GPl apply to me. but they would apply to the people who ship the software.

and if you depend on the "recommended or principal context of use" phrasing then recognise that it's very possible to use this as a loophole (and how large this loophole can be). trying to define the "recommended or principal context of use" is a process that can very easily be muddied. all it takes is to have one company that distributes a package that can be used for multiple things, some of which are legit by anyone's standards, some of which are of the tivo catagory. at that point it's really hard to argue sucessfully that company B's use of their software is their "recommended or principal context of use".

loopholes

Posted Apr 8, 2006 15:42 UTC (Sat) by stevenj (guest, #421) [Link]

Um, I addressed this very point in my third paragraph. Your hypothetical example is circumventing the GPLv3 for the sake of circumventing it, and doesn't seem practical for DRM or for hardware vendors.

Bruce Perens: State of Open Source

Posted Apr 8, 2006 16:40 UTC (Sat) by BrucePerens (subscriber, #2510) [Link]

David, I think the current GPL text can force people to not use secret keys at all for certain situations, like preventing the kernel from executing. It does not necessarily prevent DRM from being implemented for media, especially in a user-mode program or a piece of hardware accessed by a user-mode program.

Thanks

Bruce