4 ms·

Can we as a society stop ripping off open source developers? Companies that do are essentially stealing from artisans to build infrastructure to defraud the po

Can we as a society stop ripping off open source developers? Companies that do are essentially stealing from artisans to build infrastructure to defraud the poor so they can horde wealth.

stephengillie 11y ago
Yeah, we just have to find their project page, hope they have a PayPal or Stripe or other donation link (that accepts a currency we already have, sorry I own no Bitcoin)... And then donate. For every developer or project. I don't know about most of the engineers whose work powers my internet use. How do I donate to people I don't know about?
- strcat 11y ago
  The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you want to use anything but the latest official/test kernels, then you need to make it clear that it's not grsecurity (but rather your port) or pay official support with all of the backporting, auditing and testing that entails. I'm working on a product using my own port of PaX/grsecurity and I had no problem understanding and complying with spender's wishes about this.
  - sarciszewski 11y ago
    I think this was a dupe.
cwyers 11y ago
Actual GPL violations are bad. If actual trademark infringement happened (the blog post presents the company's counterarguement as to whether or not that happened, and I neither know enough about the law to assess the competing claims or know enough about the situation to know whether or not the blogpost fairly represented the counterarguement), that's bad. But "[not] bother[ing] to hire us to perform the port properly for them or to actively maintain the security of the kernel they're providing to their paid customers" isn't ripping off the developers or stealing from artisans. Nor is "not contribut[ing] a single dime toward our continued development and maintenance." None of those things are required by the GPL. If you want to sell software, and if you want to get pissed when people use your software without paying you for it, choose a license that requires people to pay you for your software. (And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? The unmitigated gall factor here is stronger than most of these kinds of rants that I've seen, because they're not even the upstream.)
- strcat 11y ago
  The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you want to use anything but the latest official/test kernels, then you need to make it clear that it's not grsecurity (but rather your port) or pay official support with all of the backporting, auditing and testing that entails. I'm working on an open-source product using my own port of PaX/grsecurity (as it needs to target an unsupported kernel) and I had no problem understanding and complying with spender's wishes about this. These companies have to respect the GPL license, so they need to provide the users with the source code for their kernels. > And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? The unmitigated gall factor here is stronger than most of these kinds of rants that I've seen, because they're not even the upstream. The grsecurity project respects the upstream trademark and licensing. In this case, they are one of the upstreams... they're not complaining about kernels not using their substantial amount of code.
- rodgerd 11y ago
  > And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? They've donated a lot more mockery than money, I would think. It's a good point.
  - strcat 11y ago
    The Linux kernel wouldn't have features like ASLR, protected_{hardlinks,symlinks}, dmesg_restrict, kptr_restrict, ptrace_scope and lots more if not for PaX/grsecurity. The fact that pipacs and spender no longer spend their time pushing stuff upstream doesn't mean that upstream doesn't benefit in a huge way from grsecurity via others like Kees Cook who are willing to deal with the politics. grsecurity doesn't violate the Linux trademark or licensing. It's not a good point at all. You wonder why they don't contribute upstream directly? It has a lot to do with this entitled attitude.

Can we as a society stop ripping off open source developers? Companies that do are essentially stealing from artisans to build infrastructure to defraud the poor so they can horde wealth.

stephengillie 11y ago

Yeah, we just have to find their project page, hope they have a PayPal or Stripe or other donation link (that accepts a currency we already have, sorry I own no Bitcoin)... And then donate. For every developer or project. I don't know about most of the engineers whose work powers my internet use. How do I donate to people I don't know about?

strcat 11y ago
The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you want to use anything but the latest official/test kernels, then you need to make it clear that it's not grsecurity (but rather your port) or pay official support with all of the backporting, auditing and testing that entails. I'm working on a product using my own port of PaX/grsecurity and I had no problem understanding and complying with spender's wishes about this.
- sarciszewski 11y ago
  I think this was a dupe.

cwyers 11y ago

Actual GPL violations are bad. If actual trademark infringement happened (the blog post presents the company's counterarguement as to whether or not that happened, and I neither know enough about the law to assess the competing claims or know enough about the situation to know whether or not the blogpost fairly represented the counterarguement), that's bad. But "[not] bother[ing] to hire us to perform the port properly for them or to actively maintain the security of the kernel they're providing to their paid customers" isn't ripping off the developers or stealing from artisans. Nor is "not contribut[ing] a single dime toward our continued development and maintenance." None of those things are required by the GPL. If you want to sell software, and if you want to get pissed when people use your software without paying you for it, choose a license that requires people to pay you for your software. (And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? The unmitigated gall factor here is stronger than most of these kinds of rants that I've seen, because they're not even the upstream.)

strcat 11y ago
The grsecurity brand is a registered trademark and spender has the right to control how it's used. If you ship a product with the official grsecurity patch applied, you get to say it uses a grsecurity kernel in your marketing. If you want to use anything but the latest official/test kernels, then you need to make it clear that it's not grsecurity (but rather your port) or pay official support with all of the backporting, auditing and testing that entails. I'm working on an open-source product using my own port of PaX/grsecurity (as it needs to target an unsupported kernel) and I had no problem understanding and complying with spender's wishes about this. These companies have to respect the GPL license, so they need to provide the users with the source code for their kernels. > And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? The unmitigated gall factor here is stronger than most of these kinds of rants that I've seen, because they're not even the upstream. The grsecurity project respects the upstream trademark and licensing. In this case, they are one of the upstreams... they're not complaining about kernels not using their substantial amount of code.
rodgerd 11y ago
> And exactly how much money has GRsecurity paid to the developers of the kernel they're patching? They've donated a lot more mockery than money, I would think. It's a good point.
- strcat 11y ago
  The Linux kernel wouldn't have features like ASLR, protected_{hardlinks,symlinks}, dmesg_restrict, kptr_restrict, ptrace_scope and lots more if not for PaX/grsecurity. The fact that pipacs and spender no longer spend their time pushing stuff upstream doesn't mean that upstream doesn't benefit in a huge way from grsecurity via others like Kees Cook who are willing to deal with the politics. grsecurity doesn't violate the Linux trademark or licensing. It's not a good point at all. You wonder why they don't contribute upstream directly? It has a lot to do with this entitled attitude.