Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Submission + - Conservancy Announces New Strategy for GPL Enforcement (sfconservancy.org)

Jeremy Allison - Sam writes: Software Freedom Conservancy, the only organization actively engaged in General Public License (GPL) enforcement and compliance work for Linux, announces today a new strategy toward improving compliance and the freedom of users of devices that contain Linux-based systems. The new work has received an initial grant from Amateur Radio Digital Communications (ARDC).

Our new initiative features:

1) Litigation to enforce against license violators that do not voluntarily comply in a timely manner.

2) Coordinating the development of alternative firmware for devices where none currently exists.

3) Collaborating with other organizations to promote copyleft compliance as a feature for consumers to protect their privacy and get more out of their devices.

We take this holistic approach because compliance is not an end in itself, but rather a lever to help people advance technology for themselves and the world. Bradley Kuhn, Conservancy’s Policy Fellow and Hacker-in-Residence remarked: “GPL enforcement began as merely an education process more than twenty years ago. We all had hoped that industry-wide awareness of copyleft’s essential role in spreading software freedom would yield widespread, spontaneous compliance. We were simply wrong about that. Today, we observe almost universal failure in compliance throughout the (so-called) Internet of Things (IoT) market. Only unrelenting enforcement that holds companies accountable can change this abysmal reality. ARDC, a visionary grant-maker, recognizes the value of systemic enforcement that utilizes the legal system to regain software freedom. That process also catalyzes community-led projects to build liberated firmware for many devices.”

ARDC has long served the amateur radio community who were early adopters of Internet communication. These roots have grown from the deeper soils of wireless and digital communication and open access to technical information. Amateur radio operators have long practiced the tradition of individual technical experimentation that benefited the general public. These traditions also form the basis of software freedom. Hobbyists and volunteers built, modified and improved Free and Open Source Software (FOSS) first. Conservancy defends the rights of software developers to examine the code in their devices and assists their work to improve the platforms they rely on and to understand our communication technologies. Copyleft compliance enables this work to continue and expand to new kinds of devices.

Rosy Wolfe, ARDC’s Executive Director commented: “GPL enforcement is notoriously difficult, and yet it is necessary to deter self-serving actors who want the benefits of community software but won’t follow the rules. Thus Conservancy’s efforts in this arena are critical, and we are honored to support them in this work.”

When companies prevent us from actually modifying the software on our devices, software freedom remains only theoretical. In this new chapter of compliance work, Conservancy will leverage its technical and legal resources to help the public take control of the software on which they rely. This generous grant from ARDC is a first step. Please help in the next step through support of Conservancy’s work with a donation. You can also email compliance@sfconservancy.org to let us know about GPL violations or to discuss volunteering on these projects.

Comment Re: GPLv3 adoption/rejection and begged questions (Score 1) 40

Dual licensing isn't the same as adding the GPLv3 termination conditions to GPLv2.

If you dual license, then if it's accepted under GPLv3 terms that means you have the replacability and anti-DRM provisions along with the termination grant.

If you accept under GPLv2 then you don't get the termination grant from GPLv3 but don't have to obey the replability or anti-DRM provisions.

Dual licensing isn't an 'AND' of licensing terms, it's an 'OR'.

Comment Re:GPLv3 adoption/rejection and begged questions (Score 1) 40

A fellow Samba Team member and Red Hat engineer has just pointed out to me that it's unfair to call out Red Hat specifically for this, and in retrospect I agree with him and would like to apologize to Red Hat.

Many others including my own employer Google also signed on to this statement as well.

Sorry Red Hat. Hats off to you for all your sterling Open Source work :-).

Comment Re:GPLv3 adoption/rejection and begged questions (Score 2) 40

Here is a great retrospective on GPLv3 from a good friend of mine, Richard Fontana at Red Hat:

https://opensource.com/article...

One of the things he notes (that to be honest I'd forgotten about for my talk) is that Red Hat and others have lead the charge to adopt the "forgiveness" provisions of GPLv3 (which as I recall was one of the primary concerns of corporate lawyers taking part in the GPLv3 drafting process) into GPLv2.

To quote from the linked article:

> "This in turn was followed by a Red Hat-led series of corporate commitments to extend the GPLv3 cure provisions to GPLv2 and LGPLv2.x noncompliance, a
> campaign to get individual open source developers to extend the same commitment, and an announcement by Red Hat that henceforth GPLv2 and LGPLv2.x
> projects it leads will use the commitment language directly in project repositories."

From Richard's blog post:

https://www.redhat.com/en/blog...

> "As of today, all new Red Hat-initiated open source projects that opt to use GPLv2 or LGPLv2.1 will be expected to supplement the license with the cure
> commitment language of GPLv3."

A cynic would read that as an attempt by Red Hat to neuter possible adoption of GPLv3 with it's "problematic" (for corporations) anti-DRM provisions. In the words of one of my favorite fictional characters - "You might think that, I couldn't possibly comment" :-).

Comment Re: GPLv3 adoption/rejection and begged questions (Score 2) 40

I have experience with license enforcement. I have done quite a bit of it behind the scenes (think about my own project to understand where this experience may have come from). It isn't working. There is a great asymmetry between individual developers and corporate legal departments that makes it virtually impossible for developers to successfully enforce their rights.

Look at the VMware case for the latest sorry example.

Comment Re:FTFY (Score 3, Informative) 40

Maybe. But not all software is written by large corps.

But this isn't the point of the talk, and I don't want people to get hung up on that one idea.

The main point of the talk is that the asymmetry in power between individual developers and corporate law departments means that even if you pick copyleft licenses, it's almost impossible to get them enforced. Most developers have given up - full disclosure, I'm on the Board of Directors of the Software Freedom Conservancy who is (I'm going to make another claim here) the *only* organization that still tries to enforce the GPL. The FSF have long since given up on enforcement.

So let's concentrate on things that have a better chance of working - concentrate on opening up the protocols between software components and not getting bogged down in the licensing.

Comment Re:For a long time the GPLv2 was rejected. (Score 2) 40

I have been around since "the early phase" of GPLv2. The adoption curve for GPLv3 and AGPL is different. It's unclear as to exactly why, although the co-opting of the most important FLOSS project (the Linux kernel) by corporations may be a big factor.

Remember, back when GPLv2 was created, gcc was one of the most important FLOSS (not that we called it that back then) projects and it was an early adopter of GPLv2. These days there is llvm as competitor. No compelling, category-defining GPLv3/AGPL programs exist to my knowledge.

Comment Re:GPLv3 adoption/rejection and begged questions (Score 4, Interesting) 40

I don't have *any* problem with the GPL. I was one of the people who helped author the GPLv3. I think it's a great license.

"rejected soundly" to me means the fact that the creators and curators of the license, the FSF, refuse to license some of their most important code under it (glibc for example).

If you think I have a "religious/political problem with the GPL" you don't know me very well :-).

Submission + - Copyleft and the Cloud - a talk on the nature of FLOSS licensing in the Cloud. (archive.org)

Jeremy Allison - Sam writes: The Samba project has traditionally been one of the strongest proponents of Copyleft licensing and Free Software. However, in the Corporate Cloud-first world we find ourselves, traditional enforcement mechanisms have not been effective. How do we achieve the goals of the Free Software movement in this new world and how do we need to change what we're doing to be successful ?

Traditional license enforcement doesn't seem to work well in the Cloud and for the modern software environment we find ourselves. In order to achieve the world of Free Software available for all I think we need to change our approach. Both GPLv3 and the AGPL have been rejected soundly by most developers. I would argue that we need a new way to inspire developers to adopt Free Software goals and principles, as depending on licensing has failed as licensing itself has fractured.

Communication and collaboration are key to this. Stand-alone software is essentially useless. Software interoperability and published protocol and communication definitions are essential to build a freedom valuing software industry for the future.

https://archive.org/details/co...

Comment Re:Key term (Score 1) 68

> How many Linux SMB installations are vulnerable to this?

None.

>Microsoft is probably not alone in this.

Nope. In this case they are, actually. The added an SMB3 transform compression header which Samba doesn't implement (yet). There was a bug in their compression libraries. Hence the bug. Even if we did implement SMB3 transform compression we'd be using different compression libraries (which may have their own bugs of course - compression/decompression code is notoriously hard to get right).

Comment Re:The problem runs deeper (Score 1) 68

> All these samba exploits have been a big *yawn*. Wormable it may be in theory, but a threat it won't be in practice.

Just a correction. This is not a Samba exploit. It's an exploit in Microsoft's implementation of the SMB3 protocol (which is native on Windows). Samba is *not* the same as the protocol - it's actually a separate open source project that implements SMB1/2/3 - https://samba.org./

Yeah I know it's easy to get the two mixed up. Even Microsoft marketing have done so on occasion :-).

Slashdot Top Deals

To restore a sense of reality, I think Walt Disney should have a Hardluckland. -- Jack Paar

Working...