Weekly Edition
Return to the Front page| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
RFCs - insufficiently free?
The issue at hand is how the Internet Society Request For Comments (RFC) documents are licensed. The RFCs are the core of the design of the Internet; they are the standards the describe the protocols, formats, algorithms, and conventions that make the net work. There are RFCs covering everything from the basic network protocols (i.e. for IP and TCP), email headers (RFC 2822) and HTML (RFC 1866) to netiquette (RFC 1855), avian datagram protocols (RFC 1149), and the Y10K problem (RFC 2550). Without the RFC series, the standards-based, interoperable Internet would not exist.
For anybody implementing or otherwise working with a network protocol, the relevant RFCs are required reading. So it is not surprising that a project like Debian would package up the RFC collection and include it with its distribution. The doc-rfc package is useful for Debian developers and its presence would not be questioned, except for a bit of a licensing problem. RFCs, it turns out, are required to carry a specific copyright notice (as specified in RFC 2223) which includes the following text:
This license, of course, does not allow the free creation of derived versions of the RFCs except in certain circumstances. That restriction violates the Debian Free Software Guidelines (DFSG). Most distributors would not be overly concerned about this problem; the license does allow them to distribute the RFC collection, after all. But the Debian Project takes its social contract seriously, and that contract requires that the distribution be "100% free software." Since the RFCs do not meet the DFSG (though there is not a complete consensus on that point), they have been evicted from the Debian distribution. Debian users wanting to install the doc-rfc package will have to look for it in the non-free area.
To many, Debian's uncompromising stance on licensing seems like a pedantic exercise carried out by people with nothing better to do with their time. But Debian is serving an important role in the community by serving as its conscience and early warning system. As recent events have shown, licensing is important. Every set of bits comes with its own copyright and its own restrictions. Failure to pay attention to those restrictions can lead to unwanted contact with lawyers, and is best avoided. Debian's high sensitivity to licensing problems brings those problems out into the open before somebody gets burned, and often leads to licensing changes which make the problems go away. Even when nothing changes, the Debian process points out where the open issues are.
The open issue in this case is that there is still no consensus on what free licensing means when applied to documentation. As a general rule, those who write text tend to want to maintain more control over their works than those to write code. Consider, for example, the Free Software Foundation's Free Documentation License, which includes a vast number of restrictions on modification and redistribution. (Debian, incidentally, is the group that has done the most to point out the non-free aspects of the FDL).
The Internet Society wants to retain enough control so that copies of a particular standard (and that's what the RFCs are) reflect the standard. A modified version of an RFC no longer reflects the standard, so such modifications are not allowed. The motivation is understandable and reasonable, but there is an important question which must be kept in mind. What happens if, sometime in the future, the Internet Society is coopted over to the Dark Side and starts moving the network standards in a proprietary or repressive direction? With the current licensing, there is no right to fork the RFCs and attempt to maintain a free, interoperable net. The RFC collection, thus, is truly not free. This result is almost certainly not what the Internet Society had in mind when it adopted its copyright notice, but that is the way it has turned out.
Five years or so ago, new software releases often were accompanied by new, one-off licenses that, as often as not, turned out to not be free. In more recent times, a relatively small set of well-known licenses has been adopted by most developers. Documentation, however, remains in the "roll your own license" stage. With luck, this area, too, will soon evolve toward a reasonable set of truly free licenses which reflect the needs and interests of writers.
(Log in to post comments)
Coopted Internet Society ?
Posted Jul 17, 2003 1:48 UTC (Thu) by fdesloges (subscriber, #291) [Link]
I may be wrong, (a quick search on ISOC site didn't allowed me to find itschart), but if I remember well, ISOC membership is free, and the IETF is one
of the most open organisation one could dream of.
That makes coopting it very difficult.
RFCs - insufficiently free?
Posted Jul 17, 2003 3:04 UTC (Thu) by wa1hco (subscriber, #3628) [Link]
What's the point of a standard if anyone can change it? That's brain dead.Debian can't possibly want the "freedom" to change standards without notice, can they? I don't want a computer with a "better" Ethernet, which is also untested, unproven, and non-interoperable.
The process of reaching an agreement about a standard has significant value. It't ok to propose a new RFC...but it doesn't become a "standard" until the community reaches consensus.
Maybe the solution is to allow anyone to change the standard but they have to change the revision...or RFC number or something.
RFCs - insufficiently free?
Posted Jul 17, 2003 3:32 UTC (Thu) by Ross (subscriber, #4065) [Link]
First of all Ethernet is an IEEE standard.I think the point is that the evolution of the standards (yes,
standards do change... parts are obsoleted, new sections are
added, requirements are better defined, etc.).
If the ISOC decides to halt development of the Internet
protocols, this license allows them to do so. Everyone
would have to start from scratch with new standards and be
very careful not to infringe any copyrights.
To address your concern it would be enough to require removal
of the RFC number and ISOC references in modified documents.
RFCs - insufficiently free?
Posted Jul 24, 2003 19:40 UTC (Thu) by EricBackus (guest, #2816) [Link]
You wrote:> If the ISOC decides to halt development of the Internet
> protocols, this license allows them to do so. Everyone
> would have to start from scratch with new standards and be
> very careful not to infringe any copyrights.
Remember that copyright protects a particular expression of
an idea, but not the idea itself. While ISOC may own the
particular expression of the ideas in an RFC, there is nothing
stopping you from writing something that you call an RFD, that
explains the same idea as an RFC but in different words.
RFCs - insufficiently free?
Posted Jul 17, 2003 3:46 UTC (Thu) by piman (subscriber, #8957) [Link]
You can't possibly think that changing the text in RFC XYZQ actually changes the standard described in RFC XYZQ. That's absurd. That's like saying I shouldn't be able to use some ls(1) source code (say, the directory traversal code) in a program to delete files, because then ls won't list files anymore.Rather, what Debian wants is the ability to use the text from RFCs elsewhere - free software documentation, for example. Or being able to write a standard based off of RFC 1234, *clearly identified as not being RFC 1234*, but using parts of the standards document.
Don't confuse the text of the standards document with the actual standard.
RFCs - insufficiently free?
Posted Jul 19, 2003 22:35 UTC (Sat) by pascal.martin (subscriber, #2995) [Link]
A standard is defined by its text. There is no other reference that exists, unless one is ready to accept proprietary implementation as a substitute, Microsoft Windows style...Thus it becomes highly critical that when someone makes reference to a given standard, everyone knows what _exact_ text it is.
This is also why standards have revision numbers. A given standard with a given revision number is assumed to represent a given, unaltered, text.
Without this protection, the notion of standard is a joke and Microsoft policy of non-conforming implementation becomes morally right.
Restricting the change of a standard is therefore a _major_ protection of freedom (i.e. freedom of creating conforming implementation), exactly like restricting the changes to a constitution text is a major protection of citizen's freedom.
IMHO, a standard is not a text like others. It is a reference text that is trusted by everyone. Probably standard bodies should start issuing official signature for the text of their standard, including certified translations.
RFCs - insufficiently free?
Posted Jul 24, 2003 9:02 UTC (Thu) by dark (subscriber, #8483) [Link]
Revision numbers are useless if you can't make revisions! Compare RFC 2068 and RFC 2616. One is clearly an updated version of the other, but the release of RFC 2616 changed nothing about what people mean when they refer to RFC 2068. What Debian is saying is that it would be a bad thing if *only* the IETF could ever release an updated version of RFC 2616.
Standards are about trademark, not copyright
Posted Jul 18, 2003 14:24 UTC (Fri) by giraffedata (subscriber, #1954) [Link]
A standard is not a law. It is a definition.So the point of a standard isn't to prevent anyone from changing it, but just to provide a common name people can use to describe something. The SCSI standard doesn't say I'm not allowed to use 0xF2 as the read command on my scanner. It just says I can't call it a SCSI scanner if I do, which tells you not to buy it if you plan to hook it up to a SCSI host.
So using copyright this way for RFCs is wrong. It means the author is using his copy right as a stick to maintain hegemony over the subject. By making it harder for someone to write a competing standard (he'd have to write it from scratch using his own words), he makes it less likely that someone will do so.
Trademark law is the appropriate tool. You aren't allowed to refer to anything but the original RFC 821 as RFC 821.
Standards are about trademark, not copyright
Posted Jul 19, 2003 22:45 UTC (Sat) by pascal.martin (subscriber, #2995) [Link]
Standard are contracts, not trademarks.Similar to a law or a commercial contract, a standard is the result of an agreements between parties. Changing that text nullify the agreement.
BTW, if any text is free, there is no reason why I could not rewrite the Debian constitution myself and release it in the wild as the "latest version"? I am sure that would generate an interesting trail of emails :-)
Compare
Posted Jul 21, 2003 16:59 UTC (Mon) by Ross (subscriber, #4065) [Link]
That argument sounds a bit like SCO's claim that Linux users would be ableto erase "evidence" if they revealed what portions of the kernel they
believe were "stolen".
Being able to make a copy of something and change it does not mean that
the original is changed.
Especially if the copy is required to be called something different :)
RFCs - insufficiently free?
Posted Jul 17, 2003 3:56 UTC (Thu) by jmorris42 (subscriber, #2203) [Link]
Maybe I'm dense, but I fail to see a problem. Worst case scenario, if the Internet Society goes totally over to the enemy (who dwells in Redmond) is that we ignore the new evil RFCs. Nothing in that license says they can revoke the right to redistribute the existing RFCs or that a new entity can't issue new ones. Although to avoid confusion a new entity would probably want to use a different naming scheme.The whole point of the RFCs and their license terms is that an RFC, once issued, is immutable. Nobody, not even the Internet Society changes an RFC. They don't have version numbers. To change one they issue a new RFC with a seperate number. That is the point behind that bit about copying "... except as needed for the purpose of developing Internet standards..." which means you can block quote from an older RFC as needed in the writing of a new RFC.
So you CAN create derivitive works from an RFC, so long as you change the name. And that is totally reasonable because even if the license techically permitted it, to change a work and not rename it is just wrong. You don't see people going to Project Guttenburg, making changes to classic works and redistributing them under the original name.
Just another example of Debian trying to be more Catholic than the Pope. Sometimes when they make a stand on a license (Pine for example) they have a point but sometimes, like this case, the only point is on someone's head. :)
RFCs - insufficiently free?
Posted Jul 17, 2003 5:47 UTC (Thu) by piman (subscriber, #8957) [Link]
> So you CAN create derivitive works from an RFC, so long as you change the name.Except you can't. The license doesn't give you that right. The only way you can develop new "Internet standards" as per their definition is through them.
RFCs - insufficiently free?
Posted Jul 28, 2003 20:03 UTC (Mon) by Baylink (subscriber, #755) [Link]
This is the reply that nails the problem. I knew that if I looked, I'd find one, and thereby be spared the hassle of writing my own. :-)They are *standards documents*. Of course they have to be immutable. But no one says -- so far as *I* can see, that you can't lift parts out for other uses, nor that you couldn't issue some derivative document *with a different name or identifier* that said something slightly different.
"More Catholic than the Pope" says it pretty well, IMPO.
But hell, what do I know.
RFCs - insufficiently free?
Posted Jul 17, 2003 7:20 UTC (Thu) by davidw (subscriber, #947) [Link]
As someone else already said, the answer is to use a free license, except for a statement requiring that if you make any changes, you put a big label at the top stating that it's no longer really the official standard RFC because you've changed it.
RFCs - insufficiently free?
Posted Jul 17, 2003 7:55 UTC (Thu) by cate (subscriber, #1359) [Link]
Standard should be sufficient free, so that in case of inativity or some other problems (legal, patent, close development, ...) groups can always fork standard and continue the development of such standard.A goog license would be a TeX-like license: you can modify the language, but to call TeX you should pass some test. So in case of improvement, you can use the standard implementations, with only the obligation to name your new "standard" with an other (non confusing) name
As you see, the problem is not to modify RFC 822 / 2822, but to allow you to create/develop a OPEN 4822 using existing RFC, to extend mail capabilities, without losing backward compatibility to existing "standard:
RFCs - insufficiently free?
Posted Jul 17, 2003 9:31 UTC (Thu) by ekj (subscriber, #1524) [Link]
What happens if, sometime in the future, the Internet Society is coopted over to the Dark Side and starts moving the network standards in a proprietary or repressive direction? With the current licensing, there is no right to fork the RFCs and attempt to maintain a free, interoperable net.You don't need to. It's perfectly reasonable to use current RFC in the cases where they are still relevant, develop new standard-documents for new cases, and issue new standards that superceed the old ones in cases where the old ones need updating. Such new standards need not be based on the older one, and as such are unaffected by the copyrigth of the old one.
RFCs - insufficiently free?
Posted Jul 17, 2003 16:46 UTC (Thu) by iabervon (subscriber, #722) [Link]
It's somewhat unsurprising that RFCs fail to meet the Debian Free Software Guidelines, since, regardless of their status as "Free", they're clearly not "Software". As such, the rationale of the GPL (that users need the ability to modify software in order to use it effective) fails to apply and the desireable freedoms are different.RFCs are even less logical to modify than documentation. With documentation, you might want to modify it to keep it accurate for software you've changed. But RFCs are obsoleted, not modified, in response to change.
I personally think that, rather than putting RFCs in "non-free", Debian should put them in "non-software", for which there should be a separate set of rules, which permit licenses which restrict the modification of an original document, provided there is a suitable way to create a modified document. In this case, the procedure is to write a new document in the same style which references the original (and ideally submit it as a new RFC, but that's not strictly necessary, depending on your purposes). Nothing prevents Debian from distributing a package of RFCs containing (for example) the original RFC 822, along with a file which suggests that the whitespace and line termination specifications to be used should be the Unicode ones instead of the ones given in the RFC.
In fact, for an RFC, "the preferred form of the work for making modifications to it" is, in fact, the entire series of unmodified RFCs, plus a new draft of an RFC which refers to the prior work (at least, the people who do actually modify RFCs use this procedure). So far as I can tell, the GPL would prohibit the distribution of a changed RFC (were the RFC to be licensed under the GPL) without breaking out the changes into a separate document anyway (at which point the RFC modified in place is not useful).
RFCs - insufficiently free?
Posted Jul 17, 2003 20:01 UTC (Thu) by Peter (guest, #1127) [Link]
RFCs are even less logical to modify than documentation. With documentation, you might want to modify it to keep it accurate for software you've changed. But RFCs are obsoleted, not modified, in response to change.
True ... but in producing a new RFC, it is very helpful to have the right to cut and paste from an old one.
I think that's the real issue. The Internet Society only affords limited rights to cut and paste RFC material, so if they "turned to the dark side" you could no longer do this, and you'd have to write new RFCs (or whatever they would be called) from scratch.
Hence "non-free".
RFCs - insufficiently free?
Posted Jul 17, 2003 21:31 UTC (Thu) by southey (subscriber, #9466) [Link]
Cutting and pasting is just plain plagiarism! A new RFC means that that old one is wrong so you just end up copying rubbish. If you want a variant then just write the variation - far better than reading a new standard to find that it is not new.If any person can change the standard at whim then it is no longer a standard. This is one of places that Debian is screwed up - the second is that they become non-free because they require 'free' software. Really they need to avoid the word 'free' period.
RFCs - insufficiently free?
Posted Jul 17, 2003 22:58 UTC (Thu) by Ross (subscriber, #4065) [Link]
Do I understand correctly that you are saying that all corrections meanthrowing out the original work? I guess you don't believe in software
patches or book editors.
RFCs - insufficiently free?
Posted Jul 17, 2003 23:48 UTC (Thu) by jdthood (guest, #4157) [Link]
> Cutting and pasting is just plain plagiarism!It is not plagiarism if the source is acknowledged.
In any case, _credit_ is not the main issue here.
> A new RFC means that that old one is wrong so you just
> end up copying rubbish.
??
> If any person can change the standard at whim then it
> is no longer a standard.
This is a confusion I have seen again and again. Debian's
concern is not that the standard be changeable. It is that
the document be re-usable for other purposes -- like any
other free software.
RFCs - insufficiently free?
Posted Jul 18, 2003 0:05 UTC (Fri) by jdthood (guest, #4157) [Link]
> It's somewhat unsurprising that RFCs fail to meet the> Debian Free Software Guidelines, since, regardless of
> their status as "Free", they're clearly not "Software".
> As such, the rationale of the GPL (that users need the
> ability to modify software in order to use it effective)
> fails to apply and the desireable freedoms are different.
That is NOT the rationale of the GPL and the FSF. It IS
the rationale of the Open Source Movement; but the FSF,
which wrote the GPL, is more demanding: it wants software
freedom for its own sake. And the FSF believes that free
software requires free documentation.
It turns out, however, that Debian is even more demanding
than the FSF. Debian wants the _documents_ (not just the
_documentation_ that those documents contain) that it
distributes to be free too.
Some people try to support Debian's position by arguing that
there is no sharp distinction between software and documents.
They have some interesting arguments. However, even if there
is an essential difference between them, it does not follow
that "the desirable freedoms are different".
The main difference between software and documentation is that
there is a concern in the latter case about the integrity of
the author's self-expression that there isn't in the former
case. I care a lot less that my program is modified than that
my political manifesto is modified.
Even so, the consensus in Debian is that the concern for
integrity of the author's self-expression is, insofar as it
is Debian's business to protect it, sufficiently protected
by requirements that the source of material and changes be
adequately documented. Debian isn't in the business of
publishing people's opinions, and only needs to go so far as
to make sure that what it does publish is accurately
attributed.
RFCs - insufficiently free?
Posted Jul 18, 2003 21:26 UTC (Fri) by Xman (subscriber, #10620) [Link]
So, I see a fairly simple solution to this problem, one that has been used in various other cases. The Internet Society can release their documents under something resembling the X license, and then trademark their name. Then they set out a policy whereby if you alter an Internet Society document you cannot use the trademark.It then becomes easy to identify unmodified standards documents, as they will still have the trademark. At the same time, there is no restriction preventing you from modifying an RFC and attaching your own seal of approval (or none whatsoever).
RFCs - insufficiently free?
Posted Jul 19, 2003 16:39 UTC (Sat) by jdthood (guest, #4157) [Link]
Yes, Debian would be happy with that. From the Debian Free Software Guidelines (#4):
The license may require derived works to carry a
different name or version number from the original
software.
RFCs - insufficiently free?
Posted Jul 27, 2003 1:40 UTC (Sun) by whig (guest, #8781) [Link]
RFCs may be under an insufficiently free license if, and only if, they disallow modification under the following terms:* Your derived document must include a statement of derivation giving the original authorship and RFC number; and
* It must specifically, clearly, and obviously disclaim to be the RFC, or any sort of RFC, until and unless it is approved as such.
Saying that one cannot change the text of an RFC and yet continue to maintain that it is the RFC would be a potential fraud. And that fraud would seem to appertain to the original author, unless one were sufficiently careful to verify the derivation. And if the copyright were *also* left intact, there would even be no obvious way to know that the derived document was not the actual author's work, and was not the RFC.
So it is possibly necessary for the licensing to be changed to comply with DFSG. And it is possibly necessary for the DFSG to be changed to allow for the restrictions stated here. I believe this would solve the outstanding conflict, and allow for the RFCs to be included in the main Debian distribution.
RFCs - insufficiently free?
Posted Jul 27, 2003 1:53 UTC (Sun) by whig (guest, #8781) [Link]
Reply to myself:By "insufficiently free," I mean that this should be insufficiently free *for Debian.*
Perhaps also I should not say "and only if." There could be *additional* restrictions that would make it not free.
I think that the restrictions I stated before are reasonable ones for Debian to accept, however.
My opinion is subject to revision if I rethink this. But this is my current thinking on it.