That's true only if you distribute the source alongside the binaries. If you distribute the binaries with an offer to provide the source, then you are, infact, required to provide the source to anybody (regardless of if you distributed the binaries to them) who requests it for a minimum of three years.

That's how I read it at first, but I think the point is that new iPhones that come with new firmware preinstalled won't be able to take advantage...

This is exactly what I did when I resigned from my sys/net-admin job - insist that all admin level passwords are immediately changed and any elevated privileges assigned to any of my accounts be revoked, and refusing to go near a keyboard until it is done.

It's the only sensible, ethical thing to do - it protects you, and you employer.

Of course, it helped that there was an intense blame culture, everybody's focus was on CYA, at least 3 non admin "trusted" employees had knowledge of the admin passwords (I was the sole admin in the company of 20 employees), and all of my security policies were ignored - not the environment where you want to make yourself a convenient scapegoat while working out your notice period.

Actually, I'm not 100% correct on that point either - so long as the source is distributed at the same time as the binaries, then they've discharged their obligations under the GPL so we were actually both right.

Yes, Oracle can limit who they provide the source to, but only if they supply the source at the same time they provide the binaries (I don't personally know if they do this), otherwise the GPL requires them to make the source available to anyone who has a copy of the binary. Yes, Oracle can charge for supplying the binaries as a commercial transaction, but the sources need to be supplied at a reasonable cost for shipping. Yes, Oracle can choose who to do business with and so have the right to not sell the binaries or distribute the source to anyone other than existing customers.

So, to answer the question in your subject line - *this* is exactly why people misunderstand the GPL. Of course, it serves it's purpose, and if the world hadn't been taken over by lawyers it would probably be a lot simpler, but surely there's a better way?

Basically, the GPL does give Oracle the right to do exactly what you say. You were right, I was right, but the Devil is in the details and apparently even the combined nerd-quotient of Slashdot doesn't get it right first time.

On the plus side - I've got a slightly better understanding of the GPL now.

Touché, that'll teach me to read a bit more thoroughly instead of only searching for "third party".

Unless they've been stung by a Scorpion, in which case the venom will kill or paralyse them, thus preventing them from breathing.

Actually, not quite. In GPLv2 section 3, which you're referring to here,

They *DO* have to provide source code to any third party who has a copy of the binary

No, you are not allowed to charge an arbitrary sum for providing the source. You can charge an arbitrary sum for the binaries, since that is covered in the commercial distribution clause but the source must be provided at cost, and it must be in a machine readable form. So, the comment to code ratio will be OK, the 6pt Dingbats font is debatable, but the leather bound hard copy, while nice to keep on a shelf is expressly forbidden by the machine readable provision of the GPL.

No, and no.

The source must be made available to anyone with the binary, regardless of where it came from since the GPL is transferred along with the binary. For the same reason, you cannot place additional restrictions on the use of the binary or source code.

Yes, if the updated binary was originally distributed from them since the GPL is implicitly transferred along with the binaries. If you got the binaries from somebody who got them from Sun, Sun still have to provide to you upon request a copy of the source code the binary was built from. They are permitted to charge reasonable costs for distributing the source, however.

No, only for a minimum of three years, and the GPL says nothing about support - only that the source be available upon request.

Except the motor industry (probably more specifically *safety* in the motor industry) is regulated, the software industry is not. So Toyota are legally required to ensure their car designs/manufacturing processes result in their cars meeting certain minimum safety standards, Oracle/Sun is not legally required to ensure their software does anything.

Only problem with that is Sun/Oracle aren't selling to consumers.