4 ms·

Do you check your private GitHub keys into VCS? Your wide definition of "scripts used to control compliation" would seem to include them! My preferred form of

Do you check your private GitHub keys into VCS? Your wide definition of "scripts used to control compliation" would seem to include them! My preferred form of making modifications to my software includes uploading them to my GitHub account for code reviews among other things. I use my GitHub private keys way more often than final code signing keys - be those keys used for as "nefarious" a use as tivoization lock-in, or as benign a use as proving authorship so Windows can tell my executables apart from some asshole's malware better. During standard development I'm either using temporary, machine-local certificates, or using unsigned code. If that means I need a devkit, or an emulator, or a dongle, or whatever else might be required to iterate that doesn't require the final "publishing" steps, in a well designed system it shouldn't require final publishing certs. Because for security's sake, you'd consider going to such lengths as keeping those code signing certs on a tightly controlled, air gapped machine, to reduce the chance of getting pwned and dealing with cert invalidation. Or worse. Which makes it a very far cry from being part of your compilation phase in any capacity, nevermind a script used to control it.

AnthonyMouse 11y ago
You haven't read what I wrote. But the "preferred form of the work for making modifications" presumably involves each person using their own github keys (and/or repositories) etc. Anybody can create an account and use github. That is not true in the tivoization case because in that case the only keys that can be used are the original ones.
- MaulingMonkey 11y ago
  > You haven't read what I wrote. Are you sure? Based on what? I've managed to quote you without the use of copy and paste in that previous post - I'm not sure how I accomplished that if I didn't read what you wrote - so please be more specific. This also begs the question: Did you read what I wrote? > But the "preferred form of the work for making modifications" presumably involves each person using their own github keys (and/or repositories) etc. And the "preferred form of the work for making modifications" also presumably involves each person using their own signing keys (and/or hardware that may not require them) etc. > Anybody can create an account and use github. Anyone can buy their own hardware, and compile for it, and install on it. Just don't pick tivoized hardware. > That is not true in the tivoization case because in that case the only keys that can be used are the original ones. The source code is not tivoized - hardware is. So don't pick tivoized hardware.
  - AnthonyMouse 11y ago
    > Are you sure? Based on what? I've managed to quote you without the use of copy and paste in that previous post - I'm not sure how I accomplished that if I didn't read what you wrote - so please be more specific. You're still talking about "scripts used to control compliation" when my point was that it doesn't need to be that if it falls under the definition of source code proper. > And the "preferred form of the work for making modifications" also presumably involves each person using their own signing keys (and/or hardware that may not require them) etc. Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware that does require signing keys and doesn't allow the user/owner to use their own keys. Then they need yours because you prevented them from using their own. > The source code is not tivoized - hardware is. So don't pick tivoized hardware. The hardware is being chosen by the person distributing it with GPL software.
    - MaulingMonkey 11y ago
      > You're still talking about "scripts used to control compliation" when my point was that it doesn't need to be that if it falls under the definition of source code proper. Ahh. Expanding the definition of source code enough to include code signing keys would have also put them into the (sub)category of "scripts used to control compilation and installation" in my mind, making the distinction moot. It's not moot in the context of the specific point you intended, of course, and which you've now provided, which I thank you for. > Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware that does require signing keys and doesn't allow the user/owner to use their own keys. Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware (my VCS server) that does require VCS keys and doesn't allow the user/owner to use their own keys. > The hardware is being chosen by the person distributing it with GPL software. ...and by the person purchasing the product that has the GPL software in it, by choosing to buy that product.
      - AnthonyMouse 11y ago
        > Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware (my VCS server) that does require VCS keys and doesn't allow the user/owner to use their own keys. You distribute your software by conveying the VCS server hardware to the customer? > ...and by the person purchasing the product that has the GPL software in it, by choosing to buy that product. All GPL licensees have the rights the license grants them, not just the ones who buy or don't buy specific hardware. What good is the license at all if distributors can just say "I'm not doing that part, if you don't like it buy from somebody else"? And what if they all do that, or nobody else makes equivalent hardware?

AnthonyMouse 11y ago

You haven't read what I wrote. But the "preferred form of the work for making modifications" presumably involves each person using their own github keys (and/or repositories) etc. Anybody can create an account and use github. That is not true in the tivoization case because in that case the only keys that can be used are the original ones.

MaulingMonkey 11y ago
> You haven't read what I wrote. Are you sure? Based on what? I've managed to quote you without the use of copy and paste in that previous post - I'm not sure how I accomplished that if I didn't read what you wrote - so please be more specific. This also begs the question: Did you read what I wrote? > But the "preferred form of the work for making modifications" presumably involves each person using their own github keys (and/or repositories) etc. And the "preferred form of the work for making modifications" also presumably involves each person using their own signing keys (and/or hardware that may not require them) etc. > Anybody can create an account and use github. Anyone can buy their own hardware, and compile for it, and install on it. Just don't pick tivoized hardware. > That is not true in the tivoization case because in that case the only keys that can be used are the original ones. The source code is not tivoized - hardware is. So don't pick tivoized hardware.
- AnthonyMouse 11y ago
  > Are you sure? Based on what? I've managed to quote you without the use of copy and paste in that previous post - I'm not sure how I accomplished that if I didn't read what you wrote - so please be more specific. You're still talking about "scripts used to control compliation" when my point was that it doesn't need to be that if it falls under the definition of source code proper. > And the "preferred form of the work for making modifications" also presumably involves each person using their own signing keys (and/or hardware that may not require them) etc. Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware that does require signing keys and doesn't allow the user/owner to use their own keys. Then they need yours because you prevented them from using their own. > The source code is not tivoized - hardware is. So don't pick tivoized hardware. The hardware is being chosen by the person distributing it with GPL software.
  - MaulingMonkey 11y ago
    > You're still talking about "scripts used to control compliation" when my point was that it doesn't need to be that if it falls under the definition of source code proper. Ahh. Expanding the definition of source code enough to include code signing keys would have also put them into the (sub)category of "scripts used to control compilation and installation" in my mind, making the distinction moot. It's not moot in the context of the specific point you intended, of course, and which you've now provided, which I thank you for. > Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware that does require signing keys and doesn't allow the user/owner to use their own keys. Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware (my VCS server) that does require VCS keys and doesn't allow the user/owner to use their own keys. > The hardware is being chosen by the person distributing it with GPL software. ...and by the person purchasing the product that has the GPL software in it, by choosing to buy that product.
    - AnthonyMouse 11y ago
      > Which works perfectly well up to exactly the point where the person distributing the software delivers it on hardware (my VCS server) that does require VCS keys and doesn't allow the user/owner to use their own keys. You distribute your software by conveying the VCS server hardware to the customer? > ...and by the person purchasing the product that has the GPL software in it, by choosing to buy that product. All GPL licensees have the rights the license grants them, not just the ones who buy or don't buy specific hardware. What good is the license at all if distributors can just say "I'm not doing that part, if you don't like it buy from somebody else"? And what if they all do that, or nobody else makes equivalent hardware?