LWN: Comments on "How Sun's Java got into Debian"

How Sun's Java got into Debian

wookey — Mon, 05 Jun 2006 21:38:16 +0000

Debian is not a legal entity. It has representative legal entities in various juristictions to look after (parts of) its money (SPI in the US, FFII in Europe, The Debian-UK Society in the UK), but Debian itself doesn't really have a legal existence you could sue.

Come on...

wolfrider — Thu, 01 Jun 2006 23:39:46 +0000

--My take on it is this:

o Debian "traditionally" debates things endlessly, and Things Don't Get Done in a Timely Manner as a result.

o The Duly Elected Head Honchos were approached by Sun, short-circuited the debate after examining the circumstances, and now Debian has the right to distribute Java from Sun.

--I'm not seeing a Downside here... ;-)

How Sun's Java got into Debian

ballombe — Tue, 30 May 2006 10:09:14 +0000

> For example, when I uploaded the uqm-content package to non-free, I don't recall asking debian-legal for their opinion of its clearly non-free license.

You do not recall, but you actually did the right thing: you properly RTP/ITPed it mentionning the license issue, see the RFP #171314 <http://bugs.debian.org/171314>.

If no one decided to discuss the license on debian-legal, it was
certainly not due to your failure of advertising the license.

Improving the free stack

slef — Mon, 29 May 2006 16:57:02 +0000

Unsurprisingly, buggy proprietary code may not work on some implementations or platforms.

It seems that free software Java is an effective replacement on a free software operating system, which makes that statement by the *Debian* project leader somewhat disappointing.

How Sun's Java got into Debian

pimlott — Sun, 28 May 2006 22:32:47 +0000

What does Debian gain from being in Sun's proprietary software PR?

I see that I read this too quickly the first time around. I thought you were asking how Debian benefits from Sun's proprietary software being in non-free, not how Debian benefits from being included in the publicity for their proprietary software. I agree that if Debian developers, including the project leader, avoided public discussion just to appear in print next to Sun, that would be rather unseemly. But the PR may have been just a side effect of the license negotiation: Sun didn't want to go public without a license, but Sun and Debian both had an interest in the license being acceptible for non-free, so they agreed to hammer it out in closed discussions. After that, the coordinated launch and joint press release come for free.

You might still object that publicity over proprietary software is not in line with Debian's principles. I think this is a deep and difficult question. One way to look at this is as a public affirmation that Debian indeed supports users who "require the use of works that do not conform to the Debian Free Software Guidelines". On the other hand, you could argue that supporting is one thing, hyping is another.

Improving the free stack

pimlott — Sun, 28 May 2006 15:22:06 +0000

Awesome, it gets better all the time! I would still tend to back up aj's statement, because I have almost always had to do some fiddling to get my development infrastructure working with gcj, especially when it involves proprietary code. I'm willing to do that, but I could understand that for some people, it might not be worth it. This is not a judgement on the merit of gcj or classpath (or anything else) per se (I much prefer them to the proprietary alternatives!), just why they may not be "effective replacements" for everyone.

Improving the free stack

mjw — Sun, 28 May 2006 12:15:29 +0000

In general, only Java software that has been "ported" to GCJ or whatever runs. Since much software (especially non-free) hasn't been ported, it usually doesn't run without hacking.

At least for free software this is mostly untrue now, no "porting" should be needed, if there is, that is just a bug. Just see http://wiki.debian.org/Java/AlreadyMovedToMain

It is probably fair to say that Sun wanted their non-free packages included now because so many packages can these days be build and used on a completely free stack without any need for Sun proprietary code anymore.

As a more concrete test, try viewing a random web page with an embedded applet using a free appletviewer.

If you find such any applet that doesn't yet work please do add it to the GNU Classpath applets page http://developer.classpath.org/mediation/Applets and if it really doesn't work at the moment we will make sure it works soon.

How Sun's Java got into Debian

davidw — Sat, 27 May 2006 22:28:50 +0000

You may have a point, but unless the system changes, involving legal professionals in the legal review of licenses is a sensible thing to do.

You would hire a professional programmer to work with your source code, wouldn't you?

How non-free software is not in Debian

ajk — Sat, 27 May 2006 09:09:49 +0000

That non-free is done by Debian developers and hosted on Debian servers but still "is not part of Debian" is nothing new. It is decade-old diplomatic fiction, a compromise between the faction that wanted Debian to be all free, and the faction that wanted Debian to ship useful software even if it was non-free. This compromise allowed both parties to save face. Nowadays it is an inseparable part of the Debian ethos, a fact of life.

Back then it was mostly about Netscape Navigator, as far as I know. Now it is about Java.

As long as it's ... in, I'm [un]happy

ajk — Sat, 27 May 2006 08:58:57 +0000

What you are thinking about is "contrib". Non-free is ... non-free.

As long as it's ... in, I'm [un]happy

giraffedata — Sat, 27 May 2006 00:40:25 +0000

The description of non-free on Debian's web site, in its entirety, is:

Packages in this area have some onerous license condition restricting use or redistribution of the software.

How Sun's Java got into Debian

giraffedata — Sat, 27 May 2006 00:33:53 +0000

A legal technical correction: indemnity doesn't work that way. Company X still sues Sun; Sun then sues Debian (assuming Debian is a suable legal entity such as a corporation) for whatever Company X wins from Sun.

How Sun's Java got into Debian

kleptog — Fri, 26 May 2006 21:08:04 +0000

Yeah, but you're assuming that clause is enforcable too, which is debatable.

The more interesting clause, which wasn't meantioned at all in the article) is the one where Debian indemnifies Sun from any claim arising out of the Debian distributed version. So I imagine something like:

Company X: Oops, the JVM died on us, causing us millions in losses, lets sue Sun, see if we can get anything back.
Sun Lawyer: Interesting idea, what OS are you using?
Company X: Err, Debian?
Sun Lawyer: Cool, they idemnified us, you'll have to sue them.
Debian: ????

Arguing the PR department will prevent this seems silly to me. It's the lawyers job to minimise risk and they'd be stupid not to use the above tactic to make a lawsuit go away...

As long as it's ... in, I'm [un]happy

Max.Hyre — Fri, 26 May 2006 21:02:17 +0000

I'd always understood that non-free comprised Free Software which depended on something non-free to operate.

Sun's Java is outrageously not Free, and has no business in either the Debian distribution, or in mirrors hosted by Debian, ``in the distribution'' or not.

How Sun's Java got into Debian

pimlott — Fri, 26 May 2006 19:53:10 +0000

If you didn't mean to imply that aj is not a "free software supporter", then I retract that, though that is how I read it. However, I can't find anything objectionable in what he wrote. You made some pretty strong changes for which I don't see evidence. (If you had just said aj can be a jerk, I would have let it go.)

If the free Java implementations aren't effective replacements, why does so much Java software seem to run on them now?

In general, only Java software that has been "ported" to GCJ or whatever runs. Since much software (especially non-free) hasn't been ported, it usually doesn't run without hacking. This makes GCJ not an effective replacement. As a more concrete test, try viewing a random web page with an embedded applet using a free appletviewer.

PR secrecy helps Sun and it seems this time it screws our users by giving a false impression of safety of the DLJ.

The standard disclaimer for software in non-free is that the only thing you should conclude is that Debian can get away with distributing it. No implied freedom to use it in a jurisdiction or for a purpose, to redistribute verbatim, etc. Presence in non-free is not much of an endorsement.

How Sun's Java got into Debian

slef — Fri, 26 May 2006 18:28:40 +0000

I really think it's unfair to suggest that I implied stuff about Anthony Towns. Read his article. His "bad" scare quotes and comments about other Java implementations are there. Decide for yourself. Maybe I'm overreacting given other stuff he's done, as DPL and before, but that should be understandable.

If the free Java implementations aren't effective replacements, why does so much Java software seem to run on them now? It seems quite easy to dispute it, but I'm no Java fan.

I can't see how PR is an acceptable reason for secrecy. Security secrecy helps our users. PR secrecy helps Sun and it seems this time it screws our users by giving a false impression of safety of the DLJ. Not the same thing at all.

How Sun's Java got into Debian

pimlott — Fri, 26 May 2006 18:06:52 +0000

What does Debian gain from being in Sun's proprietary software PR?

While non-free has indeed long been a source of confusion, Debian made a decision in the beginning that user convenience trumps the confusion and moral taint. Sun's Java is nothing new in this sense--except that its convenience value is particularly high. (Yes, I say this as someone who, reluctantly, has this program on some of my computers.)

reputation for accepting NDAs

NDA's are not uniformly evil. Temporary secrecy, even for PR purposes, may sometimes be acceptible. As Michael Banck pointed out, the security team does something similar all the time.

RMS criticising us deservedly

RMS has always criticised non-free, citing it as the reason he doesn't endorse Debian. Sun's Java in non-free doesn't give him any new arguments.

Meanwhile, DPL Anthony Towns reacts by trying to cut down discussion (again), criticising free software supporters and writing that Java is important but free software Java implementations aren't effective...

I think you're overreacting. Anthony Towns is encouraging people (from Debian and Sun) to discuss this on -legal, and I can't find him criticizing anyone (quite unusual for a Debian discussion!). And I really think it's unfair to imply that Anthony Towns is not a true "free software supporter". To your last point, he said that free implementations aren't effective as a replacement for Sun's Java, not that they aren't effective in general. It's hard to dispute this.

if the proprietary vendors start flexing their legal idiots

kenyee — Fri, 26 May 2006 14:29:14 +0000

just take the package out :-)

What "freedoms" could go away? I still don't get what the big deal is...the important thing for the next step in Linux evolution is to make it easier for users (which is probably why Ubuntu has been so successful, even though I disagree w/ forking the Debien code so I've installed Kanotix instead)...

As long as it's finally in, I'm happy (for how long?)

jstAusr — Fri, 26 May 2006 03:55:26 +0000

And that will work just fine until the freedom goes away because no one cared. Then, the system will only work the way the proprietary vendors want it to. At that point you won't be able to do a damn thing about it.

As long as it's finally in, I'm happy

kenyee — Fri, 26 May 2006 00:44:35 +0000

As a user, I'm just happy I'm going to be able to do "apt-get install java" and have it get updated on dist-upgrades and it doesn't bother me one bit that it was added under cover of night to be part of a Sun PR event :-)

Up to now, people have had to try and figure out which version to download and install (made more complicated on the 64-bit Linux I'm running on because you have to decide whether to install Blackdown java, or Sun's 32-bit or 64-bit versions) and then it's their problem dealing for deciding on when to upgrade, etc. Anything to make this process less painful for Debian users is a plus in my book (and yeah, I use the Marillat archives for installing Myth, mplayer, and all the weird codecs that aren't part of the official Debian repos too...I just want the system to do what I want ;-)

Now, if Sun would just open source their Plugin so people can figure out how to get the 64-bit version of Java to run as a plugin in the 64-bit version of Mozilla so we don't have to run the 32-bit version of browsers in chroots....

How non-free software is not in Debian

paulmfoster — Thu, 25 May 2006 22:47:54 +0000

Okay, let me get this straight. Debian engineers work on packaging these packages. They're hosted on the same servers as Debian, under the Debian hierarchy. They show up in aptitude. But they're not part of Debian. I dunno. It sure *sounds* like semantics to me.

How Sun's Java got into Debian

smitty_one_each — Thu, 25 May 2006 21:29:56 +0000

Not sure why the legal system has to be so obscure that it requires "legal professionals" to understand it. Does the legal system serve us, or we it?

How Sun's Java got into Debian

zooko — Thu, 25 May 2006 19:44:58 +0000

"They could be loosely paraphrased as "it looks like we can get away with it, and, if that turns out not to be true, we'll just stop.""

Maybe Debian should apply this principle to all of the distribution and not just to special deals from certain corporations. There is probably quite a lot of software and other content which could find its way into the next Debian release which has heretofore been excluded by excessive concern about legal what-ifs!

Regards,

Zooko

P.S. I'm halfway serious. Unless you're a pessimist in which case I'm halfway sarcastic.

How Sun's Java got into Debian

mbanck — Thu, 25 May 2006 17:31:16 +0000

True. However, -legal is a LOT better than the non-process that rammed Java into Debian without any meaningful license analysis at all.

The license was reviewed by the person who usually reviews licenses for non-free - James Troup. Argueably, more review might not been a bad idea, but to say there was a non-process is totally false; in fact, I believe the correct process has been used.

Michael

How Sun's Java got into Debian

slef — Thu, 25 May 2006 17:30:44 +0000

Most licences are obvious enough not to refer to debian-legal, even non-free ones like uqm-content, but the DLJ one is clearly not obvious. You can tell just by looking at the size of the non-binding FAQ. It's a confusion of lawyerbombs and indemnifications, in my opinion.

I think this short-cutting of debian's usual good practices is a fair topic for an LWN article. Good, even. The more pressure on debian to sort this out, the better.

What does Debian gain from being in Sun's proprietary software PR? A bad name in free software circles, confusion among wider IT circles ("does this mean debian includes proprietary software, or that debian considers Java free software?"), a reputation for accepting NDAs and RMS criticising us deservedly. Deep joy.

Meanwhile, DPL Anthony Towns reacts by trying to cut down discussion (again), criticising free software supporters and writing that Java is important but free software Java implementations aren't effective...
http://lists.debian.org/debian-legal/2006/05/msg00278.html

How Sun's Java got into Debian

bronson — Thu, 25 May 2006 15:51:30 +0000

True. However, -legal is a LOT better than the non-process that rammed Java into Debian without any meaningful license analysis at all.

"in conjunction"

mattdm — Thu, 25 May 2006 14:35:19 +0000

[I posted something similar to this on the Fedora list...]

I think people concerned about the "in conjunction" phrase are misinterpretting. Remember, licenses are written in legalese, which is formed from English words but where the meaning of certain terms is determined by heaps of case law and precedent, not necessarily by the dictionary.

My assumption, given that Sun people say that this clause does not prevent distribution of the JDK _alongside_ GCJ etc., is that people are reading the phrase "in conjunction with" more strongly than it should be. A more narrow reading indicates that you can't use the Sun JVM with GNU Classpath, but you can use and distribute them both _not_ in conjunction.

But really, a lawyer needs to answer this question.

(The new license, by the way, is not helpful for Fedora, which is a pure Free Software distribution. Nor, of course, is it helpful for inclusion in actual Debian.)

How Sun's Java got into Debian

mjg59 — Thu, 25 May 2006 13:04:32 +0000

> even then, the answer only applies to one jurisdiction.

Really? The license explicitly states that any action concerning the license will be covered by Californian or US federal law.

How Sun's Java got into Debian

davidw — Thu, 25 May 2006 07:06:34 +0000

-legal is sort of a dubious resource in any case, as, last I checked, it was mostly amateurs - not legal professionals. While they may have the best of intentions and be smart people, not having a legal background is a big impediment to some legal discussions.

How non-free software is not in Debian

bignose — Thu, 25 May 2006 05:37:25 +0000

> But if non-free is not part of Debian, then non-free cannot ship Sun's
> Java. The license clearly states that it is permission to ship Java as part
> of an operating system.

Indeed, this issue was raised on the Debian discussion lists very soon after the announcement was made -- along with many other issues revealed by a less-hasty investigation of the license terms.

> The Debian project cannot have it both ways.

Yes. I don't think Debian can legally distribute the software (from anywhere) under the current license terms.

I sincerely hope *all* free software projects will learn from this. Rushing the process of investigating license terms, to meet some externally-imposed deadline, conflicts with the trust placed in the project by its users. It's not worth risking copyright infringement just to get some shiny bauble.

How ignorance is truth

bignose — Thu, 25 May 2006 05:29:11 +0000

Thanks. The article's phrasing can easily lead a reader to believe that Sun's secret process is somehow necessary to getting the package into Debian *at all*, which is not the case.

How Sun's Java got into Debian

mgb — Thu, 25 May 2006 04:57:27 +0000

> Sure we could just have disclosed the license to -legal beforehand,
> but then Sun probably would never talk to us about doing things
> like this one again

S: Wanna buy a bridge? I can get you a great deal. Only it's gotta
be our secret see?

D: Can't I check with my attorney?

S: Sure. You can check with your attorney after you sign.

D: OK!

How ignorance is truth

thedevil — Thu, 25 May 2006 03:46:33 +0000

Presumably because that was Sun's precondition for the whole thing to happen.

How ignorance is truth

corbet — Thu, 25 May 2006 03:44:35 +0000

It was the only way to have a package when the announcement was made. Certainly they could have made one after the fact, but then they would not have been part of the spectacle.

Sun, in turn, could have done things differently if it had wanted to, but I wasn't talking about Sun. They were just doing the usual corporate PR thing.

How non-free software is not in Debian

JoeBuck — Thu, 25 May 2006 03:40:38 +0000

But if non-free is not part of Debian, then non-free cannot ship Sun's Java. The license clearly states that it is permission to ship Java as part of an operating system. The Debian project cannot have it both ways.

How non-free software is not in Debian

bignose — Thu, 25 May 2006 03:28:37 +0000

While it makes for a catchy headline, it's simply not true to say that the Sun Java software is or was ever "in Debian".

The 'non-free' repository is *not* part of Debian; it's distributed from the same servers, as a service to users, but it's not "in Debian" since it's not part of the thing called Debian. Only the 'main' repository is "in Debian".

This is more than semantics: it's the leading point of the social contract that is the basis of the Debian project's work.

How ignorance is truth

bignose — Thu, 25 May 2006 03:23:48 +0000

> all of the relevant information was under embargo until Sun made its
> announcement at JavaOne. The only way for Debian to have a Java package
> when Sun announced - and for Sun to announce that said package existed -
> was for the process to happen in secret.

What a complete non-sequitur. Why is process secrecy "the only way" for Debian to distribute a Java package? Why is process secrecy "the only way" for Sun to announce the existence of a package?

It's a totally disingenuous claim. Can we please see this explained and hopefully corrected in the article?

Come on...

error27 — Thu, 25 May 2006 03:09:49 +0000

Comparing uqm-content with java is pretty bogus. You know Corbet is right that Debian traditionally would debate the java license endlessly.

They still are going to in fact. See if I'm wrong.

How Sun's Java got into Debian

joey — Thu, 25 May 2006 02:01:08 +0000

> Sun's Java was fast-tracked into non-free, with the traditional
> extended debate on debian-legal having been shorted out entirely.

That's a mighty thin wire to hang an article on. It's traditional for new licences for potentially DFSG-free software targeted at Debian main to be hammered on in debian-legal first, but the process is much less stringent for packages going into non-free, and -legal is generally bypassed altogether in these cases unless there's some question about the redistributability of the software.

For example, when I uploaded the uqm-content package to non-free, I don't recall asking debian-legal for their opinion of its clearly non-free license. I did rely on the ftp-masters (James Troup, et al) to review the license and make sure they were ok with it being distributed by Debian mirrors in non-free. This seems much the same as how the java thing was handled, minus the publicity that surrounds java as a proprietary product backed by PR.