Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

4 points

Posted Oct 5, 2006 15:17 UTC (Thu) by coriordan (guest, #7544)
In reply to: "Ours is Ours, Yours is Yours" is gone from the GPLv3 ... by mingo
Parent article: Similar in spirit?

There is nothing in GPLv3 to "make binaries in ROM's modifiable", I don't know where you're getting that from.
"DRM is not new" - GPLv3 doesn't prohibit DRM, it prohibits tivoisation (one particular use of DRM). If someone else was doing tivoisation before, they mustn't have been successful enough at it. GPLv3 only fixes problems that really exist and are widespread or sustainable, not theoretical or minuscule ones.
Removing "or later versions" would lead to many new free software projects later arriving in the same mess the Linux copyrights are in. If an absurd interpretation of GPLv2 was ruled valid by a court tomorrow, what would Linux do? It would have to relicence and it would be a mess. FSF foresaw this mess decades ago and put two infrastructures in place. One is the "or later versions" language, another is the copyright assignment for GNU projects.
The keys needed to run a piece of software are not a "totally seperate work". If the two were not intertwined, they would not have the relationship of one being necessary for the other to run.

(Log in to post comments)

Tivo and point 4

Posted Oct 5, 2006 22:15 UTC (Thu) by zlynx (subscriber, #2285) [Link]

Quick note on your point 4:
The keys are not required for the work to run. Take Tivo for example: a Tivo binary should execute just fine on some other non-Tivo PowerPC based system.

So what the keys do is prevent executing a binary on a particular piece of hardware, not prevent executing it at all. At least, in the Tivo case. An encrypted binary, rather than a signed one, would be a different situation.

So it seems the key is a part of the hardware, not the software, and thus a separate work.

It's just like having a Linux or HURD (since Linux is staying GPLv2) kernel executing from a virtual machine. If I restrict the execute permissions of the kernel's VM image to a single user, is that user's login password suddenly a "part of the work" required to run the kernel? Ridiculous.

A better example yet, say I build a HURD kernel just the way I like it and take it's SHA1 key. I customize a copy of QEMU to only run if the boot image matches that SHA1 key. Your copy of my image isn't affected. You just can't run a modified version on my QEMU.

Tivo and point 4

Posted Oct 6, 2006 10:57 UTC (Fri) by nim-nim (subscriber, #34454) [Link]

> So what the keys do is prevent executing a binary on a particular piece of
> hardware, not prevent executing it at all.

That's assuming availability of non-DRMed hardware. This is not a safe bet, especially if the existing software pool can be DRMed at will.

Tivo and point 4

Posted Oct 6, 2006 16:10 UTC (Fri) by man_ls (subscriber, #15091) [Link]

Take Tivo for example: a Tivo binary should execute just fine on some other non-Tivo PowerPC based system.

If I had purchased a Tivo and it had some serious flaw which the company did not want to fix, it would not help much to know that I could execute it on some other piece of hardware.

The keys are part of the particular software distribution, which is contained in the Tivo. You could have another type of hardware, another distribution

So it seems the key is a part of the hardware, not the software, and thus a separate work.

Hardly. I could make the same argument about a particular driver: my Linux kernel might run just fine without the driver, on a different hardware configuration. Therefore the driver is part of the hardware.

The key is just a magic number. It is required to install and run the software on a particular piece of hardware. Providing source code but not the magic number is cheating IMHO.

4 points

Posted Oct 6, 2006 9:26 UTC (Fri) by mingo (subscriber, #31122) [Link]

 There is nothing in GPLv3 to "make binaries in ROM's modifiable", I don't
 know where you're getting that from.

You are misrepresenting what i said.

If you read my comment, i was talking about the language in the GPLv2, which language someone else suggested means that "the right to tweak" was somehow embedded in it.

When Linus and i adopted the GPLv2, the GPLv3 draft and the term "right to tweak" did not exist yet, and i resist revisionist interpretation of the GPLv2 license.

Please re-read my ROM point with that in mind, and consider that i'm interpreting the GPLv2 license:

The "receive" stands for distribution, "change the software or use pieces of it in new free programs" means the exclusive right for modification and derivation. No-one in their right mind, neither i nor Linus ever understood that plain langugage to mean: "you have to allow to make binaries in ROM's modifiable". IMO that interpretation is often just wishful, revisionist thinking, possibly created by "oh what should we do about this DRM thing" thoughts.

Thanks.

4 points

Posted Oct 6, 2006 9:51 UTC (Fri) by mingo (subscriber, #31122) [Link]

"DRM is not new" - GPLv3 doesn't prohibit DRM, it prohibits tivoisation (one particular use of DRM).

Firstly, did you read the article you are replying to? In particular the bit where Richard Stallman is quoted as saying:

  I'm less concerned with what happens with embedded systems than I am with
  real computers. The real reason for this is the moral issues about
  software freedom are much more significant for computers that users see
  as a computer. And so I'm not really concerned with what's running
  inside my microwave oven.

The Tivo is not a general purpose computer pretending to be freely modifiable. The Tivo is a PVR (Personal Video Recorder), a special-purpose specialized appliance, not much different from a microwave oven.

Secondly, i never claimed the GPLv3 prohibits "all" forms of DRM - not even the FSF is /that/ out of touch with reality. But if for example Intel based any parts of its microcode on GPL-ed code, and even if they released the source code and met the GPLv2 bargin in every way, the GPLv3 would require them to either stop using the GPL-ed microcode, or to share the DRM key with the public at large (which includes our friendly virus writers).

What you and the FSF is missing is that there are lots of legitimate cases where the "desire to trust a piece of hardware" overrides the "desire to modify hardware". A blanket "freedom must always override physical trust" characterisation can only be true in a society where laws are /always/ fair and are always enforced and acted upon. Such a society does not exist.

4 points

Posted Oct 6, 2006 12:16 UTC (Fri) by alexbk (guest, #37839) [Link]

Much better case than a Tivo would be latest Nokia phones, which *are* general purpose computers that happen to have smaller than normal screens and keyboards. These phones also have a sophisticated mechanism for verification of installed applications called Symbian Signed. That mechanism ensures that only Nokia and vendors approved by them can write software that does interesting things such as getting coordinates from built-in GPS receiver or working with the phone's microphone and speaker. They can legally use GPLv2 software to do that, and keep the keys to themsevles. Saying "don't buy the phones if you don't like that" is not really an option - there are no other devices that offer similar functionality.

Also, when you say "desire to trust a piece of hardware" you should be more specific - who has that desire, and who owns the hardware?

4 points

Posted Oct 6, 2006 14:15 UTC (Fri) by sepreece (subscriber, #19270) [Link]

"Saying "don't buy the phones if you don't like that" is not really an option - there are no other devices that offer similar functionality."

I would argue both with the statement (there are devices with similar functionality from other manufacturers) and the apparent conclusion that the uniqueness of a particular device would somehow create a special obligation to allow you to modify it. If you don't like what the device allows, don't buy it. It's not life-critical that you own one.

Note that there is no real asymmetry here, either. Only you (or someone you have authorized, like your service provider) has access to the device to load software into it. Nokia can't, because it has no access (unless you take the phone in and ask them to). You can choose to load various software into it, but that software comes from a constrained set. That's different from "you can modify the software but I can't".

4 points

Posted Oct 6, 2006 15:30 UTC (Fri) by alexbk (guest, #37839) [Link]

Uhm, you seem to have misunderstood me. My point was that if Ingo thinks Tivo is a bad example because it's only a narrow-purpose appliance, I can give a different and hopefully better example of an increasingly popular (24 million units shipped H1 2006 vs 14 million in H1 2005) general purpose programmable computer running Symbian OS, where access to some (but not all!) important APIs and hardware peripherals is restricted.

The manufacturers don't have an obligation to give me that access of course, but then I don't want them to use and modify my code for their benefit *and* disallow everyone else including me to do the same thing. Once again: they're not producing a Tivoesque appliance but a real computer. Nothing to do with demanding freedom to tinker, everything to do with being fair.

If you know similar devices that are less restricted, please name them, I always want to know about new gadgets :)

Stallman's quote in real context

Posted Oct 6, 2006 14:27 UTC (Fri) by cventers (subscriber, #31465) [Link]

Ingo,

I hesitate to reply to you here because you still haven't addressed any
of my points elsewhere. To the best of my knowledge, I've addressed each
of your points, and I'm hoping you'll do me the same favor.

It's interesting that you quote Stallman here, and so has Jonathan. I
regret that upon reading the interview Jonathan /did/ thankfully link as
the source of the quote, it seems that too much context may have been
removed to discuss Stallman's position with absolute fidelity. I would
thus encourage you to click the Wayback link and read at least the last
question on the page (the one in which the quote you address is
included).

To quote Stallman further:

> But I don't think that's where the social and political issues arise.
> Those arise where the computers are visible to the user as computers.
> We can load software into them. We have thus the possibility of sharing
> and changing software. And then it becomes a significant question
> whether we are allowed to do so or whether we are blocked from doing
> so.

The Tivo is a good deal different from a microwave oven because its
software is not burned into ROM. In fact, in many ways, it is a personal
computer - it has a hard drive, USB port, some models have an ethernet
controller... and so it should be no shock or surprise that the many
hackers who have managed to defeat Tivo's fortunately broken attempt at
violating Freedom #1 have organized into the same hacker communities that
make free software possible:

- http://www.tivotechies.com/

is one of countless sites on the subject that Google presents when
queried.

I don't think a microwave oven would be likely to ever fall into this
category. For one thing, its software will probably be in ROM for a while
further; for another, it doesn't have much need for a computer aside from
presenting a very trivial user interface. Additionally, there isn't much
interesting work you can make a microwave do aside from cooking food, and
there doesn't seem to be much opportunity to improve that behavior
through software anyway.

But it's not just Tivo we should be worried about. Think about another
example where this issue of the difference between embedded systems and
computers is quickly getting blurred:

- http://www.rockbox.org/

This project is a GPL-licensed firmware replacement for MP3 players from
a number of manufacturers. It has substantially more features, and to
some, the more important property of _freedom_ (which includes the
ability to play free codecs) than the manufacturer-provided firmware on
various devices. It even has the amazing property of being portable to a
number of different devices in an area of the market where product
similarity is incidental rather than a system like PCs where
compatibility is essential and thusly documented and practiced.

I hope I'm not the first free software developer to ask this question,
but what of Rockbox? I can't seem to find any substantial references to
GPLv3 in the context of what the Rockbox developers think, but given that
they are deliberately targeted at embedded devices only, I have a
sneaking suspicion that the GPLv3 is about to become absolutely essential
for the continued freedom of their project.

How long before the manufacturers of MP3 players realize they can take
Rockbox, port it, sprinkle on their _music_ DRM layer and then stamp on
their _software_ DRM layer to prevent anyone but them from changing the
license? They can then proceed to stamp out millions of these bastardized
players using the hard work of the Rockbox developers that were fighting
to make _FREEDOM_ and they can stamp that property of the market out
right out in short order.

I know you're not a Rockbox developer. Neither am I. But since you argue
very strongly that the FSF needs to stop what it is doing with the
license that you have a choice of _not using_, I think you ought to tell
us what you think these Rockbox guys should do about their little
problem.

Despite Stallman's great crystal ball, it seems the world still changes
in surprising new ways that are often good for society. Free software is
definitely a driving force in that movement. But given the fidelity of
what Mr. Stallman's crystal ball has shown us in the past, we'd be
complete fools to shatter it while busy arguing about how many bones we
saw through the grim reaper's robe.

And I further hope that you won't drop the other thread of discussion we
have going. I did spend a great deal of time thinking about what you had
to say, and I tried to do my best in fairly addressing your argument.

Stallman's quote in real context

Posted Oct 6, 2006 14:32 UTC (Fri) by cventers (subscriber, #31465) [Link]

Ah, I made a goof. When I said:

> How long before the manufacturers of MP3 players realize they can take
> Rockbox, port it, sprinkle on their _music_ DRM layer and then stamp on
> their _software_ DRM layer to prevent anyone but them from changing the
> license?

I should have said 'changing the software.'

But the goof may raise an interesting counter-argument, 'the GPLv3 cannot
control other (proprietary) software on future MP3 players that might
include a crypto bootloader'. True, but at least in that world the
Rockbox developers still have the option of voting with their code.
Without the provision of "Don't destroy freedom #1 through technological
means" in GPLv3, any greedy manufacturer could freely take Rockbox's code
and use it not only to vote against Rockbox but to incidentally harm the
entire free society in that process.

Stallman's quote in real context

Posted Oct 7, 2006 3:01 UTC (Sat) by sbergman27 (guest, #10767) [Link]

Just to give you some credibility, could you please post a link to some code which you have released under GPLv2 which will be automatically colicensed under GPLv3 when it is released?

Or are you simply in this to push your politics?

Could you pass the red herring please?

Posted Oct 7, 2006 7:10 UTC (Sat) by cventers (subscriber, #31465) [Link]

I will not participate in any attempts to turn what is hopefully an
insightful discussion into a pissing match.

And I almost did. I was in the process of tarballing up some unreleased
(as in prealpha) stuff I've been hacking on for months, but I realized
that it would be a poor waste of my time to divert in order to satisfy
this red herring you are now attempting to serve.

Incidentally it appears that the GPLv3 will be ready by the time I issue
an alpha release of my server software and its supporting 'C' library. And
I fully intend to skip the relicensing step and move straight to version
3, especially because I think the new anti-DRM provisions might be
specifically relevant to some things I'm currently doing. I promise of
course that I would have fully appreciated the opportunity to
automatically relicense had that been a necessity.

I argue now because Ingo proposes to deny me the chance to vote with this
new code of mine at all. He seems to want this license development
stopped. I don't think Ingo would succeed in stopping the process, but I
speak as someone who cares deeply about that process and as someone who
will absolutely engage in code release under GPLv3, and who would rather
do that release under GPLv3 than the less good (but still quite good)
GPLv2. Notice that I'm specifically avoiding telling him what I think he
ought to do with his stuff, or you with yours, because I have no stake in
that.

I have no doubt in my mind that your next reply will criticize me on the
grounds of not having published code about to undergo relicensing. Since
that is surely your intent, fire away and enjoy.

Credibility is a funny thing - it is the first and last thing people like
to attack when they can find absolutely no other argumentative point of
substance. You accuse me of politics when attacks on credibility rather
than reasoned analysis are most often performed by the dirtiest of
politicians. So I'll ask you to pardon me if I roll my eyes while you are
busy adding your two cents to this conversation. But I promise that I
won't do that if you instead decide to say something of substance.

Stallman's quote in real context

Posted Oct 7, 2006 8:23 UTC (Sat) by stijn (subscriber, #570) [Link]

That is a very poor diversion. Ad hominem. Now for your arguments please.

4 points

Posted Oct 6, 2006 10:10 UTC (Fri) by mingo (subscriber, #31122) [Link]

Removing "or later versions" would lead to many new free software projects later arriving in the same mess the Linux copyrights are in. If an absurd interpretation of GPLv2 was ruled valid by a court tomorrow, what would Linux do? It would have to relicence and it would be a mess. FSF foresaw this mess decades ago and put two infrastructures in place. One is the "or later versions" language, another is the copyright assignment for GNU projects.

two quick points.

Firstly, i have heard this "what if the GPLv2 is ruled unenforceable" boogeyman a number of times. It is just not happening. What is happening is that the GPLv2 is alive and kicking and enforced (and even litigated) in lots of important jurisdictions. A healthy number of precedents have built up in Europe for example, and in the US 99%+ of the defendants rushed into settlements without even thinking about a trial. Judges in Germany, the US and elsewhere are showing a clear and deep understanding the GPL and the obligations attached to it.

Please think about it, and dont just accept the FSF's position at face value. Please show some critical thinking.

On one side of the equation are more than 1 billion lines of code, worth tens of billions of US dollars, given away for free, with a few common-sense conditions attached to it, described in very clear words (in the GPLv2) that is easily translated to many languages, and which has been enforced to the true letter and intent of that license in important jurisdictions.

On the other hand we have the theoretical worst-case possibility of some other jurisdiction suddenly growing an "absurd" interpretation of the GPLv2, which, i assume, would mean the forfeiture of the whole codebase and its putting into the public domain. What is better protection against absurdity than the plain and clear language of the GPLv2. Secondly, what kind of judge do you think would do that to a body of work that has such a huge value, which wouldnt immediately be overturned on appeal?

Judges are often amongst the fairest and most objective people in most societies (even in dictatorships), and the law is based on thousands of years of history of fairness. I trust judges a lot more to interpret my license than i trust a mathematician that is currently presiding the FSF ...

Secondly, it is a false dichotomy to suggest that the only option is a total rewrite of the GPLv2. There are lots of options. The FSF could add a limiting language like: "if any portion of the license becomes unenforceable then we reserve the option to correct that language, with the minimal amount of changes needed to make it enforceable again".

Problem solved via GPLv2.01. But i get the feeling that giving up power and letting the community go is quite hard for Richard Stallman to do ...

The crux of the issue

Posted Oct 6, 2006 14:52 UTC (Fri) by cventers (subscriber, #31465) [Link]

Ingo,

(I shall include by reference my request made elsewhere that you return
to my set of points in response to your earlier points further down on
this page.)

> Firstly, i have heard this "what if the GPLv2 is ruled unenforceable"
> boogeyman a number of times. It is just not happening. What is
> happening is that the GPLv2 is alive and kicking and enforced (and even
> litigated) in lots of important jurisdictions. A healthy number of
> precedents have built up in Europe for example, and in the US 99%+ of
> the defendants rushed into settlements without even thinking about a
> trial. Judges in Germany, the US and elsewhere are showing a clear and
> deep understanding the GPL and the obligations attached to it.

You're right. GPLv2 is a strong license. And I think no one does a better
job of explaining why than Eben Moglen, the lawyer standing at the front
lines of the Free Software Foundation. Indeed, no one knows better than
Eben just how well GPL works except maybe your colleague Harald Welte,
netfilter developer and gpl-violations.org project lead, who I gather is
the only kernel developer concerned enough with GPLv3 to participate
beyond mere bickering (pardon the jab, but you still have not answered my
inquiry in this area even after I have asked multiple times).

> Please think about it, and dont just accept the FSF's position at face
> value. Please show some critical thinking.

You know Ingo, it is perfectly valid for you to hold an opinion on this
matter but I don't think you can claim any kind of expert status over the
very man who spends his days as an actual _attorney_ working with
defending the GPL license here and abroad.

Attorneys don't sit around passively and react to situations; part of
their regular job is to actively monitor their own crystal balls for
signs of trouble and develop intelligent responses to questions that have
yet to appear.

No matter how unlikely you think it is that GPLv2 could ever fail to do
precisely what it intends to do, Mr. Moglen (the man whose work you are
now trying to stop) sees a need to internationalize the license.
Internationalizing the license means divorcing the GPL from the very
American concept of 'derivative work', and carefully picking language
that does not imply any particular legal meaning in any particular legal
system in the world.

Once again, it is important to realize that Linux, a largely Western
project, isn't the only GPL-using free software commodity in the world. I
get the distinct sense from monitoring the news and international
conferences on this subject that free software authors are popping up in
any place there are computers, and that there is a particular emphasis
and opportunity for this reality because part of the Freedom is the
freedom to have the knowledge all others have, which can be a great
enabler if you are trying to do better than your third world country
would normally allow.

So I think it's damn essential that the GPL not only defend our software
there, but that it should also defend their software there as well. They
should be comfortable using the GPL license, and frankly, they're going
to be more comfortable using it if it isn't tied entirely to United
States copyright law.

Once again, Ingo, you have the full right of not using GPLv3, and I have
no interest in convincing you that you should. But I find your position
about the so-called moral obligations of the FSF now that its positions
clash with yours an indefensible reason to deny the many users and
developers who want and need GPLv3 the right to have it. And that is why
I strongly object to your strong and repeated assertion of this red
herring.

> On one side of the equation are more than 1 billion lines of code,
> worth tens of billions of US dollars, given away for free, with a few
> common-sense conditions attached to it, described in very clear words
> (in the GPLv2) that is easily translated to many languages, and which
> has been enforced to the true letter and intent of that license in
> important jurisdictions.

I find it interesting that you keep referring to the large body of GPL
code out there. When it's the evil Free Software Foundation going back on
their promises, taking advantage of all the poor free software developers
too stupid, lazy or busy to notice that their inclusion of the words "or
any later version" at the top of every file that comprises their great
work, it is a problem that must be stopped. The FSF wields too much power
over that code!

But when it is the FSF proposing to defend those billions of lines of
code worth billions of US dollars from the whims of, well, every diverse
legal system on the planet, you accuse people of having not used critical
thinking because they worry that the fantastic GPLv2 might not work quite
the same on every place on Earth.

So you don't want the FSF - the drafters of the GPL license, the
philosophers behind the Free Software movement, and the programmers
behind much of the combined GNU/Linux system to do anything but sit
absolutely still and hope disaster never strikes? And you go further and
claim you have been wronged when they try?

Mr. Molnar, I'm beginning to suspect the reason you haven't replied to
any of my other messages is that your whole position is truly
indefensible.

4 points

Posted Oct 7, 2006 4:28 UTC (Sat) by bojan (subscriber, #14302) [Link]

> The keys needed to run a piece of software are not a "totally seperate work". If the two were not intertwined, they would not have the relationship of one being necessary for the other to run.

Actually, the keys are most likely not a "work" in terms of copyright at all. I would say too unoriginal. I doubt one could obtain copyright on any kind of cryptographics keys.