Grsecurity stable patches to be limited to sponsors

Posted Aug 28, 2015 12:15 UTC (Fri) by ewan (guest, #5533)
In reply to: Grsecurity stable patches to be limited to sponsors by smckay
Parent article: Grsecurity stable patches to be limited to sponsors

It might be partly a matter of PR - this move has focussed media and community attention on the fact that a major and well funded corporation is using grsecurity and valuing it highly enough to want to shout about it in their advertising, but won't stump up 200USD a month to support its development. For all the amusing weebling on about what the licence and trademark law do or don't strictly allow, there is a layer of what is socially acceptable which is different from what is 'not actually illegal', and on that basis Intel/Windriver aren't looking too good right now.

Grsecurity stable patches to be limited to sponsors

Posted Aug 28, 2015 17:53 UTC (Fri) by dlang (guest, #313) [Link] (6 responses)

since when does using GPL software (or even listing it in your advertising) imply a social obligation to sponsor it's development?

There are a tremendous number of companies using a lot of GPL software and not doing this, so I have a hard time believing that the 'social norms' require it.

Grsecurity stable patches to be limited to sponsors

Posted Aug 30, 2015 1:32 UTC (Sun) by mathstuf (subscriber, #69389) [Link] (5 responses)

> even listing it in your advertising

As I read it, the problem is that if WindRiver gets caught up in some IoT security apocalypse, it having grsecurity on its label can harm grsecurity. Now, if it had been audited and specced by grsecurity itself as up-to-par, this would be valid. But if it is due to poor patching, it is undeserved. Since they will only do such audits and checks with a sponsorship, I think the use of the grsecurity name should be tied to sponsorship. Not unlike Mozilla's trademark allowances on Firefox.

Grsecurity stable patches to be limited to sponsors

Posted Aug 30, 2015 8:03 UTC (Sun) by dlang (guest, #313) [Link] (4 responses)

If the worry is that someone using the patches and listing that they do in their advertising gets hacked it can hurt the reputation of grsecurity, how in the world does limiting it to sponsors who pay $200/month solve the problem?

they seem to be saying, "here are our patches, but you can't use them unless we fully audit the result and approve of it", which is among the most extreme forms of trademark rules you can come up with.

It's bad enough when Mozilla implemented such rules for firefox, but at least Mozilla was providing a complete software package.

grsecurity is only providing patches to the kernel, and to take the attitude that they should have veto power on what other patches can be put in a kernel along with theirs and still use the name is extremely arrogant (at best)

Unfortunately, that sort of "we know everything, everyone else is an idiot" attitude doesn't surprise me from this group.

Grsecurity stable patches to be limited to sponsors

Posted Aug 30, 2015 8:20 UTC (Sun) by mjg59 (subscriber, #23239) [Link] (2 responses)

> grsecurity is only providing patches to the kernel, and to take the attitude that they should have veto power on what other patches can be put in a kernel along with theirs and still use the name is extremely arrogant (at best)

They wrote the code, they're entirely permitted to choose to enforce whatever restrictions the license gives them permission to enforce. The GPL doesn't require that you give blanket permission for trademark use. If permission is only granted to use the trademark for unmodified code, and if a vendor modifies the code and then continues to use the trademark in a way that would be likely to cause confusion between the modified code and the original code, they're within their rights to attempt to enforce their trademark. There's nothing arrogant about that. What's arrogant is the assumption that you can continue using a name even after the original authors indicate that doing so is against their wishes.

Grsecurity stable patches to be limited to sponsors

Posted Aug 30, 2015 9:15 UTC (Sun) by dlang (guest, #313) [Link] (1 responses)

It looks to me like they are not just trying to control modifications to the patches, but also any other matches applied to the same code. That seems to be going a bit far.

Grsecurity stable patches to be limited to sponsors

Posted Sep 11, 2015 11:20 UTC (Fri) by oldtomas (guest, #72579) [Link]

> It looks to me like they are not just trying to control modifications to the patches, but also any other [p]atches applied to the same code [...]

As far as I understand it -- no. They are just trying to control the use of their trademark (which I think is understandable).

Wind River can take the code and patch it all the way to Times Square and back (courtesy of the GPL), but they aren't allowed to say "lookee, grsecurity inside" (strictly speaking it isn't). That sounds pretty sane to me?

Grsecurity stable patches to be limited to sponsors

Posted Aug 30, 2015 14:07 UTC (Sun) by spender (guest, #23067) [Link]

"we know everything, everyone else is an idiot" seems to describe you pretty well. Do you happen to know every detail, published and unpublished, about what drove us to this specific decision? Because you're writing like you do.

-Brad