Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Forced benevolence is not freedom (Score 1) 551

I have never used the word 'theft', with or without quotation marks. Nor I have said that extending BSD code without giving back is illegal or furtive. It's done with permission.

Albeit with different intent than commercial exploitation, you'll find that some BSD code was imported in key GNU projects, and the FSF even goes as far as to recommend using the 3-clause BSD license when the additional protection of the GPL isn't desired.

And no, BSD developers don't lose their copyright. They lose, freely, an opportunity to endow the community with the best outcome of their work, which is a fact and not a characterization of mine. If you want we can talk about my opinions on the music industry but then I think we'd be derailing the discussion.

Comment Re:Forced benevolence is not freedom (Score 4, Insightful) 551

What rights do BSD contributors lose? All the community code exists, the community can continue without the commercial changes, the community is not required to use some commercial fork. They lose nothing if some contributor chooses not to give back.

They lose the rights to take advantage of the improvements that the commercial contributor has done to their code, while the commercial contributor does not lose the right to take advantage of the improvements that the free contributor has done. You may agree or disagree with this, but it is objectively a loss.

Furthermore, users of GPL'd code decide not to give back at times too. They can use some a commercial fork internally and benefit from community work and not give back.

The point is that with the GPL they cannot commercially fork code written by me. Of course they can do whatever they want with their own code.

Also, various commercial users of BSD code have a pretty good track record of contributing back.

This is irrelevant to the discussion. When people make laws against theft, they don't think about the fact that most people have a pretty good track record of not stealing. Laws (and contracts) must be written with the worst case in mind.

What rights do BSD users lose?

100% pragmatic example: GPLv3 bash has a serious bug (any reference to reality is purely intentional). GPLv3 users patch, recompile and they have lost no right. BSD-licensed phone firmware has a serious bug. Users lose the right to make use of the phone they bought and not be pwned by hackers while doing that.

The GPL does *not* offer greater freedom, it creates restrictions to force behaviors it believes benevolent. Forced benevolence may or may not be a good thing but it is not freedom.

I believe that my rights to own property and to live are freedom. They exists only because other people are "forced to benevolence", in particular not to steal my stuff or harm me. Try to convince me that this is not freedom.

Translated to the software world, can you argue that the ability to fix the code of a program that I use is not a freedom for me? I'm free from bugs. I'm free from hackers. I'm free to add new features. I'm free both in a practical and philosophical sense.

Comment Re: Who cares what RMS wants? (Score 5, Insightful) 551

Later versions of the GPL cannot take away any freedom granted by an earler version, because the choice of the version is done by who redistributes the code.

The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.

If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.

Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.

But serisouly GPLv3 started because of his tantrum with Tivio.

GPLv3 started because RMS saw that companies were using the GPL in a manner that was compliant to the letter but not to the spirit. Back then, the GNU haters laughed at him, as usual, because "who would want to run code on a set-top box". Nowadays, the vast majority of the end-user devices are tivoized (Android, Apple, Microsoft, ...), and users can't do anything with the code that runs on them, including fixing security bugs and auditing it to find out what it does with all their personal data, let alone (God forbid!) run their own programs on it. So the introduction of the GPLv3 wasn't a whim as you are implying, it was actually sensible and farsighted.

Comment Re:Open source code is open for everyone (Score 4, Informative) 211

In fact, the bug had already been audited and fixed, almost two years ago, when the security researchers found a way to exploit it. From TFA:

We identified a number of factors that mitigate the impact of this bug. In particular, we discovered that it was fixed on May 21, 2013 (between the releases of glibc-2.17 and glibc-2.18)

Current glibc release is 2.20. That's three relases without the bug already.

Nothing to see here, move along.

Comment Re:libressl-2.1.3 (Score 5, Interesting) 97

OpenSSL remains the only portable SSL library that can be used by both open source and commercial developers alike. Which is really a shame, because OpenSSL sucks. All the bad things the libressl people have said about OpenSSL are absolutely true.

We have GnuTLS which is only one year younger than OpenSSL, has a nicer API, is portable to Windows, has a better track record with regard to binary compatibility, a better build system, and can be used by commercial software (it’s LGPLv2.1). Comparison of features with other SSL libraries.

Comment Re:lol, Java (Score 1) 79

A large percentage works just fine even with holes, and with greater performance and less overhead.

You need benchmarks to prove such blanket statements. In my experience, Java code usually isn't far from C++ performance and it's actually faster when we're talking about high level "glue" code. It vastly outperforms C in string handling, because C's standard string routines are awful not only to the programmer, but to the processor, too. And then again, for maximum performance there's FORTRAN.

Today, we know it's possible to make a shitpile with any tool, leaving java and other runtimes to sacrifice much of the potential for lean, high performance software for small gains in security (the latter with a growing list of caveats).

Do you know any example of stack smashing, buffer overflows, invalid pointer dereference, malloc failures, code overwriting done by a program written in pure Java? They're the stuff that hackers love. They happen automatically in C: any code you write causes them by default, and you need to be very clever, to have complete information about the machine state after every instruction (which is usually impossible), to have platform-specific tool support (relro, noexecstack, ASLR, ...) in order to avoid or prevent them. In Java, they just don't happen, barring bugs in the JVM, which are akin to bugs in the runtime library of any compiled language of your choice. If this isn't an improvement...

It also doesn't help that java comes with a browser plugin that opens a complete runtime environment to drivebys. Microsoft abandoned activex for this reason.

To be honest, the runtime environment for applets was supposed to be restricted (it's not the same runtime environment that Java applications see). It's the same mechanism that post-HTML5 Javascript has, except that at least we can disable (or better delete) the awful Java plugin, while we can't do the same for the browsers' Javascript support.

Comment Patriots (Score 1) 562

So, who are those "patriots" in Silicon Valley supposedly willing to give him, again, the keys to all the personal information that they collect?

I can make a guess, by looking at the track record and the lobbying spending of the usual suspects, but still it would be more appropriate, in the name of transparency, to state explicitly whether the companies that we are entrusting with our personal information are a neutral third party or, instead, are patriots. So we can choose.

Communications

Feds Operated Yet Another Secret Metadata Database Until 2013 102

A story at Ars Technica describes yet another Federal database of logged call details maintained by the Federal government which has now come to light, this one maintained by the Department of Justice rather than the NSA, and explains how it came to be discovered: [A] three-page partially-redacted affidavit from a top Drug Enforcement Agency (DEA) official, which was filed Thursday, explained that the database was authorized under a particular federal drug trafficking statute. The law allows the government to use "administrative subpoenas" to obtain business records and other "tangible things." The affidavit does not specify which countries records were included, but specifically does mention Iran. ... This database program appears to be wholly separate from the National Security Agency’s metadata program revealed by Edward Snowden, but it targets similar materials and is collected by a different agency. The Wall Street Journal, citing anonymous sources, reported Friday that this newly-revealed program began in the 1990s and was shut down in August 2013. From elsewhere in the article: "It’s now clear that multiple government agencies have tracked the calls that Americans make to their parents and relatives, friends, and business associates overseas, all without any suspicion of wrongdoing," [said ACLU lawyer Patrick Toomey]. "The DEA program shows yet again how strained and untenable legal theories have been used to secretly justify the surveillance of millions of innocent Americans using laws that were never written for that purpose."
Communications

Obama: Gov't Shouldn't Be Hampered By Encrypted Communications 562

According to an article at The Wall Street Journal, President Obama has sided with British Prime Minister David Cameron in saying that police and government agencies should not be blocked by encryption from viewing the content of cellphone or online communications, making the pro-spying arguments everyone has come to expect: “If we find evidence of a terrorist plot and despite having a phone number, despite having a social media address or email address, we can’t penetrate that, that’s a problem,” Obama said. He said he believes Silicon Valley companies also want to solve the problem. “They’re patriots.” ... The president on Friday argued there must be a technical way to keep information private, but ensure that police and spies can listen in when a court approves. The Clinton administration fought and lost a similar battle during the 1990s when it pushed for a “clipper chip” that would allow only the government to decrypt scrambled messages.

Comment Re:unexpected deletion (Score 1) 329

If you were using coreutils in your nightmare, you would actually have no problem:
(guys, don't do this at home, your rm implementation could differ)
# rm -rf /
rm: it is dangerous to operate recursively on '/'
rm: use --no-preserve-root to override this failsafe
# rm --version
rm (GNU coreutils) 8.23
You wouldn't enjoy such protection if you typed rm -rf /*, however.

Comment They took mah job! (Score 4, Insightful) 484

Seeing the slashdot crowd, which is pro-capitalism and laissez faire when it's the other people's source of income which is being put in jeopardy, suddendly start to scream in pain because of the fear of a modest reduction of their earnings, is priceless.

What did you say when shiny gadget manufacturer #1 announced that workers had better learn to "run against the robots"? And when shiny gadget manufacturer #2 exploited underage workers in dangerous sweatshops in China? I haven't read any comments about "unions turning the IT sector into another Detroit" on this page, but instead I now learn that government regulation is in "the true spirit of America, because it's againt slavery". If selling stuff in Spain but paying taxes to the British Virgin Islands is not only moraly acceptable, but even a duty, because it's in the interest of the investors, then why would hiring IT developers from abroad be any different?

Capitalism is about making money, and that's it. It's not a philosophy, it won't make your lives better by itself. And rightly so. It is a government's job to ensure that the interests of those making money proceed in harmony with the interests of a nation as a whole; to which extent is matter of debate. When the government turns out as an expression of those with the most money (bi-partisan agreements...) rather than the choice of informed voters, we'd better learn to love the "invisible hand" and wait for its positive effects on the economy to trickle down on us.

Slashdot Top Deals

A meeting is an event at which the minutes are kept and the hours are lost.

Working...