RMS on Proposed GPLv3 changes

H4x0r Jim Duggan writes "Last Saturday - the first day of FOSDEM, Richard Stallman gave what seems to have been his first public talk about the draft GPLv3. Ciaran O'Riordan of Free Software Foundation Europe was there and, after recording with his digital camera, has published a transcript of RMS's GPLv3 talk. O'Riordan previously made a transcript of the January 16th first presentation on the GPLv3 which consists of 70 minutes of Eben Moglen, with 20 minutes worth of interruptions from Stallman."

Man-in-the-Middle Signature Attacks against GPL v3

[morgan_greywolf]

What about Man-in-the-Middle attacks? That is, MonopolySoft builds a machine that will only run binaries signed by Red Hat. Red Hat is not required under GPLv3 to give its signature key, but the machine maker is, except, he's decided to verify only against Red Hat's key and he doesn't have Red Hat's private key (just the public key, which is used to validate that the binary came from Red Hat, which is all he needs). So I can still be prevented from modifying my GPL software and running it on my box, right? And no one's violated GPLv3, right? GPLv3 doesn't cover this type of attack at all.

Re:This is a good question: he's thinking about it

[0xABADC0DA]

Summary:

1) Red Hat creates a binary linux distro based on GPLv3.
2) Dell makes hardware that only runs *specific, known binaries*.
3) You buy machine and compile linux from source, but it won't run.

How does GPL v3 help?

Dell can't distribute RH linux without making it possible for you to run your compiled version (whether the actual hardware that only loads the signed binaries is theirs or not), since they also have to accept GPLv3 in order to distribute software that is licensed with GPLv3.

What's the loophole?

Dell could just ship blank machines that you have to load yourself, that only run Red Hat. Dell may not even have agreed to GPLv3 for anything (by running completely commercial , bsd-like, or GPL-2 software).

What's the solution?

The GPLv3 can include a clause that if you accept the license you cannot distribute *any* product that prevents a user from using any of their own modified GPL-covered software. This means for Dell to ship a computer that only runs Red Hat Linux, they have to use *no* GPL3 software of any kind in their entire company. That's about the best you could do, legally, and even still it may not be enforceable.

Personally I don't care how far-reaching the GPLv3 is. The idea that Dell could take my work and actively use it to take away people's rights is so wrong that there's pretty much nothing the license could do that would be worse. I'll be releasing my code as GPLv3 as soon as it comes out.

Re:RMS likes to talk doesn't he.

[codehead78]

No, RMS does not force anyone to use GPL. But he has tried to leverage someone else's more successful project to give the GPL3 more steam. Linus didn't like it, so RMS tried to subvert his control by saying Linus can't make other Linux developers not use the GPL3.

But no, he doesn't force anyone.

Re:A request

[AeroIllini]

To make it more compatable with similar licenses, there's a whole bunch of optional terms and conditions that can be added. For example, you can say "If you sue us for patent infringement, you can't use any patents our code relies upon that we own, effectively ending your ability to use our software." The notable feature is that this is an optional condition.

Wait, what?

Didn't RMS blow a gasket a few weeks ago, talking about how Creative Commons sucks eggs because it includes optional clauses [slashdot.org]?

How is this different? Now, instead of GPLv3, we have GPLv3-with-patent-restrictions, and GPLv3-with-attribution, and GPLv3-with-different-disclaimer-of-liability, and...

Either RMS likes customizing licensing, or he doesn't. He's being a hypocritical here.