OpenPGP in Rust: the Sequoia project [LWN.net]

OpenPGP in Rust: the Sequoia project

Posted Sep 14, 2020 21:09 UTC (Mon) by martin.langhoff (subscriber, #61417)
In reply to: OpenPGP in Rust: the Sequoia project by cyphar
Parent article: OpenPGP in Rust: the Sequoia project

> while folks like to wax lyrical about GPLv3's tivoisation clause, many seem to forget
> that GPLv2 actually had a similar (in spirit) requirement

No, that does not hold. You get the tools so can build install the executable... somewhere.

The _gist_ of GPLv2 is share and share-alike. It's about the source code.

GPLv3 improved on v2 on many aspects, but also brought it a new front: control of the hardware. Applied to software not tightly tied to hw -- a web app -- it doesn't matter. Applied to kernels, device drivers, etc it's a massive problem. As a result, folks who work closely to hardware don't want to use it.

To be clear. I don't intend to re-hash the GPLv3 controversies here. Just to point out -- GPLv3 is different, in a meaningful way. Pick GPLv2 or GPLv3, but know they are different beasts.

to post comments

OpenPGP in Rust: the Sequoia project

Posted Sep 15, 2020 5:06 UTC (Tue) by cyphar (subscriber, #110703) [Link] (1 responses)

> No, that does not hold. You get the tools so can build install the executable... somewhere.

Yes, GPLv2 and GPLv3 are obviously legally speaking quite different on this point.

My point is that since the discussion was about "social contracts", it should be noted that the GPLv2 does have a spiritually similar requirement. If you don't see the similarity in spirit between "scripts that control the compilation and installation of the executable" and "any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source", I don't really know what else to say. My point was simply that the new requirements didn't come out of nowhere.

OpenPGP in Rust: the Sequoia project

Posted Sep 15, 2020 14:23 UTC (Tue) by martin.langhoff (subscriber, #61417) [Link]

In GPLv2 the social contract is - share and share _code_ alike. The hardware running software was nowhere in the picture.

Good? Bad? That was the social contract under GPLv2.

GPLv3 introduces rules about the User Product. We're trying to leverage _software_ to put rules on _hardware_. That is a new frontier, and a new social contract.

No significant/popular low-level software projects, where this matters, have adopted GPLv3. So on that front, it did not find traction.

And here's the funny thing -- I personally dislike Tivoization. If the current GPLv3 was called T(ivo)GPL, similar to what happened with AGPL, and we had a GPLv2.1, life would be much better.