6 ms·

Some thoughts: Most of the companies ship older pieces of software for one important reason: They need to avoid GPL/LGPL/AGPL version 3. Version 3 of GNU GPL g

by pksadiq 11y ago

Some thoughts: Most of the companies ship older pieces of software for one important reason: They need to avoid GPL/LGPL/AGPL version 3. Version 3 of GNU GPL gives users more freedom which companies hate. For GPLv2 the companies had to just give away the source code. But they need not give away a way to change the software in the hardware. Which was then popularized as Tivoization. Version 3 of GNU GPL family of licenses fixed that. But companies didn't. So you can see a pattern in any hardware (routers, Cars, etc.) and even in OS like Mac, *BSD etc. And the pattern is they always avoid GPL v3. So they always have old gcc, coreutils, bash, and everything else. They say its GPL, but there is a vendor lock-in, as always.

cyphar 11y ago
Which is why I find Linus's childish view of the GPL so frustrating. He claims to have never used it for "user freedom" reasons (even though I'm sure that's how Richard Stallman would've persuaded him). If you frame the question of "is tivoisation bad" as "how could a psychopath use my code to harm users" it becomes clear that tivoisation is something we must reject.
- pksadiq 11y ago
  Its a fact that Linus doesn't even care about open source[0]. Then how will he be caring about software freedom? Hope, someday, we shall have GNU Hurd ready. Anyway, GNU guix is getting better. [0] http://www.techrepublic.com/article/linux-creator-linus-torvalds-doesnt-really-care-about-open-source/ http://www.techrepublic.com/article/linux-creator-linus-torv...
  - lolidaisuki 11y ago
    He used to care, sadly doesn't anymore.
  - tdsamardzhiev 11y ago
    Indeed. He simply uses it because it's the best software development model. I think open source could use more people like him, though. P.S. Man, how I love downvotes without any arguments whatsoever.
    - cyphar 11y ago
      I didn't down-vote you, but I'll explain why I don't like his view on free software. Free software is chiefly concerned with user freedom, to ethically treat users of your software. The GPL is the standard example of a free software license, and its purpose is to in perpetuity make sure that all users of your original code will always be able to use it in freedom. You may notice I didn't reference a "development model". In my opinion, development models are secondary to ethical issues such as user freedom. Yes, it turns out that the "bazaar" model of software development works pretty well, but that doesn't mean that you couldn't have a "cathedral" free software project. The problem with the "open source" movement is that there is no question about morals and ethics. It's just "here are 10 criteria which will give you good code, but if you find a better way to get good code, more power to you". It's plainly obvious when it comes to issues like vendor lock-in why "open source" doesn't have enough of a moral backing to explain why vendor lock-in is unacceptable. If the code is good quality, why are you complaining about vendor lock-in? I wish we had more people like Stallman who will bring attention to the important issue here, the issue of user freedom. Proprietary software hasn't been vanquished yet, and it's not going without a fight.
  - cyphar 11y ago
    I just read that article and it's slightly depressing: > Between the launching of Linux and today, we've waded through decades of free and open source holy wars, but Torvalds' first instinct was right: Software doesn't want to be free, necessarily. It just wants to be open enough that developers can get to work with a minimum of fuss. sigh No, some of us do care about user freedom and are seriously worried about the recent attacks on user freedom done by companies like Amazon.
  - ashitlerferad 11y ago
    At least some of the Linux developers care about software freedom: https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/supporter/ https://sfconservancy.org/supporter/
- cyphar 11y ago
  Yay! Downvotes without any justification!
  - ars 11y ago
    There is plenty of justification. > Which is why I find Linus's childish view This alone is enough. Someone has an opinion different than yours so you call them names? Then you have this: > If you frame the question of "is tivoisation bad" as "how could a psychopath use my code to harm users" it becomes clear that tivoisation is something we must reject. Which barely makes any sense. You could change it to "are oranges bad" as "how could a psychopath use an orange to harm users", for basically equivalent logic. Plus it appears to make the argument the tivoisation is GOOD since it stops the psychopath. It's basically nonsense framed as insight. You deserved your downvotes - and I don't downvote lightly.
    - cyphar 11y ago
      Tivoisation is bad because the corporation that uses it is the psychopath. Wasn't that obvious from context? As for oranges, since we don't create oranges and there's nothing that you can do that's immoral with an orange that isn't also illegal. There are things you can do with software which are legal but are immoral. As for Linus having a childish view: how else do you describe a simplified view like "the GPL is basically where I get people to give their changes back to me -- that's it"? That's emphatically not the only thing that the GPL is for (regardless of whether or not you agree with the ethics).
ersii 11y ago
It's not always about avoiding the GPLv3 - and it's certainly not like that for everyone. I would plead laziness, not evil intentions. Many times, it's just that the product development may have started a long time ago or that they're using some previous product or prototype to build on - which uses even older software versions. Development takes time.. Or they could be using some SDK or vendor supplied base for parts of your products. Then they won't have control over the software versions anyhow, in a way. It's very complex and somewhat annoying to keep up with updating all software and libraries in proprietary products. That in itself should probably say something about the security of a lot of shipped products I guess..
- jeena 11y ago
  The GPLv3 is definatelly the core cause. It is so deep in the minds of those companies, when you talk to them about GPLv3 it is like talking to the devil about holy water. BMW is one of the core members of the GENIVI Aliance (http://www.genivi.org/ http://www.genivi.org/) which tries to bring Open Source (not Free Software) to the industry, to make code reuse easier between the companies. GENIVI has a demo platform (http://wiki.projects.genivi.org/index.php/GENIVI_Demo_Platform#High_Level_Block_Diagram http://wiki.projects.genivi.org/index.php/GENIVI_Demo_Platfo...) which they build with help of Yocto (https://www.yoctoproject.org/ https://www.yoctoproject.org/). Most of the members of GENIVI use Yocto for internal development too. GENIVI provides a layer of recipies for Yocto, which is called meta-ivi. In this layer there is a sample configuration file which many use as a starting point for their development. Most of the other layers which provide this local.conf sample file don't have this special line, but this In-Vehicle-Infotainment layer (you can even think of it like a linux distribution) which is used by the car manufacturers has it: INCOMPATIBLE_LICENSE ?= "GPLv3" http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta-ivi-demo/conf/local.conf.sample#n77 http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta...
  - xyzzy_plugh 11y ago
    Yep, but it's for patent reasons. I used Yocto for $PRODUCT and we had the same variable set. See my reply to the grandparent (does that make it an uncle or aunt of this reply?)
lolidaisuki 11y ago
>But they need not give away a way to change the software in the hardware. This is not true. If you don't have a way to change the software either then your users aren't required to be able to do that either because then the software is considered part of the hardware. So using GPLv3 software embedded into hardware without anyone being able to modify it is ok but implementing cryptographic or ther drm systems, like secureboot, without user being able to get around it isn't.
xyzzy_plugh 11y ago
TL;DR: Companies don't hate "giving users more freedom" Having worked with IP lawyers on multiple consumer electronic products across multiple companies, I believe you are over-simplifying the situation. Every IP lawyer I've talked to didn't care about tivoization -- if you want to go run your own code on our hardware, great, good luck. The main issue with GPLv3 was always the patent clause: http://www.gnu.org/licenses/gpl-3.0.en.html#section11 http://www.gnu.org/licenses/gpl-3.0.en.html#section11 I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. Hardware companies produce a ton of patents. The manufacturers of routers, cars, and even Apple care deeply about their patents. They're not willing to toy with some untested clause in a license of some free software, when there is a perfectly usable version of that software without such a clause. IANAL so I don't know for sure if this is the case, but speaking from experience, this is what lawyers have always told me. Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. It's difficult to have the device already know the checksum, but calculating a signature against a pre-installed signing certificate is easy and works pretty well. You also get the added benefit of decreasing the surface area for remote attackers, since only the trusted company can sign the payloads. Typically, also, physical writing is "disabled" during assembly (e.g. not populating components, sealing off access, etc.) which helps keep costs down and keep the design looking slick. The second reason "signed" payloads are used is for "Tivoization". I've never heard anyone say "we don't want customers putting their own software on a device they purchased." No doubt it happens, but it is rare for sure. Should companies spend more time and resources to make it easy for their customers to modify their devices, in a sane and secure manner? Possibly. But in today's cutthroat consumer-electronics world, you'd be hard pressed to find a company willing to spend that extra engineering effort on something so frivolous.
- pksadiq 11y ago
  > TL;DR: Companies don't hate "giving users more freedom" More freedom doesn't simply means that users can change the code. But, they can also use the code, modify, and redistribute without fear about patents, if they wish. > The manufacturers of routers, cars, and even Apple care deeply about their patents. So why do you think Apple chose Apache license for their new swift language? Apache license explicitly gives patent protection to its users.

by pksadiq 11y ago

cyphar 11y ago

Which is why I find Linus's childish view of the GPL so frustrating. He claims to have never used it for "user freedom" reasons (even though I'm sure that's how Richard Stallman would've persuaded him). If you frame the question of "is tivoisation bad" as "how could a psychopath use my code to harm users" it becomes clear that tivoisation is something we must reject.

pksadiq 11y ago
Its a fact that Linus doesn't even care about open source[0]. Then how will he be caring about software freedom? Hope, someday, we shall have GNU Hurd ready. Anyway, GNU guix is getting better. [0] http://www.techrepublic.com/article/linux-creator-linus-torvalds-doesnt-really-care-about-open-source/ http://www.techrepublic.com/article/linux-creator-linus-torv...
- lolidaisuki 11y ago
  He used to care, sadly doesn't anymore.
- tdsamardzhiev 11y ago
  Indeed. He simply uses it because it's the best software development model. I think open source could use more people like him, though. P.S. Man, how I love downvotes without any arguments whatsoever.
  - cyphar 11y ago
    I didn't down-vote you, but I'll explain why I don't like his view on free software. Free software is chiefly concerned with user freedom, to ethically treat users of your software. The GPL is the standard example of a free software license, and its purpose is to in perpetuity make sure that all users of your original code will always be able to use it in freedom. You may notice I didn't reference a "development model". In my opinion, development models are secondary to ethical issues such as user freedom. Yes, it turns out that the "bazaar" model of software development works pretty well, but that doesn't mean that you couldn't have a "cathedral" free software project. The problem with the "open source" movement is that there is no question about morals and ethics. It's just "here are 10 criteria which will give you good code, but if you find a better way to get good code, more power to you". It's plainly obvious when it comes to issues like vendor lock-in why "open source" doesn't have enough of a moral backing to explain why vendor lock-in is unacceptable. If the code is good quality, why are you complaining about vendor lock-in? I wish we had more people like Stallman who will bring attention to the important issue here, the issue of user freedom. Proprietary software hasn't been vanquished yet, and it's not going without a fight.
- cyphar 11y ago
  I just read that article and it's slightly depressing: > Between the launching of Linux and today, we've waded through decades of free and open source holy wars, but Torvalds' first instinct was right: Software doesn't want to be free, necessarily. It just wants to be open enough that developers can get to work with a minimum of fuss. sigh No, some of us do care about user freedom and are seriously worried about the recent attacks on user freedom done by companies like Amazon.
- ashitlerferad 11y ago
  At least some of the Linux developers care about software freedom: https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/linux-compliance/ https://sfconservancy.org/supporter/ https://sfconservancy.org/supporter/
cyphar 11y ago
Yay! Downvotes without any justification!
- ars 11y ago
  There is plenty of justification. > Which is why I find Linus's childish view This alone is enough. Someone has an opinion different than yours so you call them names? Then you have this: > If you frame the question of "is tivoisation bad" as "how could a psychopath use my code to harm users" it becomes clear that tivoisation is something we must reject. Which barely makes any sense. You could change it to "are oranges bad" as "how could a psychopath use an orange to harm users", for basically equivalent logic. Plus it appears to make the argument the tivoisation is GOOD since it stops the psychopath. It's basically nonsense framed as insight. You deserved your downvotes - and I don't downvote lightly.
  - cyphar 11y ago
    Tivoisation is bad because the corporation that uses it is the psychopath. Wasn't that obvious from context? As for oranges, since we don't create oranges and there's nothing that you can do that's immoral with an orange that isn't also illegal. There are things you can do with software which are legal but are immoral. As for Linus having a childish view: how else do you describe a simplified view like "the GPL is basically where I get people to give their changes back to me -- that's it"? That's emphatically not the only thing that the GPL is for (regardless of whether or not you agree with the ethics).

ersii 11y ago

It's not always about avoiding the GPLv3 - and it's certainly not like that for everyone. I would plead laziness, not evil intentions. Many times, it's just that the product development may have started a long time ago or that they're using some previous product or prototype to build on - which uses even older software versions. Development takes time.. Or they could be using some SDK or vendor supplied base for parts of your products. Then they won't have control over the software versions anyhow, in a way. It's very complex and somewhat annoying to keep up with updating all software and libraries in proprietary products. That in itself should probably say something about the security of a lot of shipped products I guess..

jeena 11y ago
The GPLv3 is definatelly the core cause. It is so deep in the minds of those companies, when you talk to them about GPLv3 it is like talking to the devil about holy water. BMW is one of the core members of the GENIVI Aliance (http://www.genivi.org/ http://www.genivi.org/) which tries to bring Open Source (not Free Software) to the industry, to make code reuse easier between the companies. GENIVI has a demo platform (http://wiki.projects.genivi.org/index.php/GENIVI_Demo_Platform#High_Level_Block_Diagram http://wiki.projects.genivi.org/index.php/GENIVI_Demo_Platfo...) which they build with help of Yocto (https://www.yoctoproject.org/ https://www.yoctoproject.org/). Most of the members of GENIVI use Yocto for internal development too. GENIVI provides a layer of recipies for Yocto, which is called meta-ivi. In this layer there is a sample configuration file which many use as a starting point for their development. Most of the other layers which provide this local.conf sample file don't have this special line, but this In-Vehicle-Infotainment layer (you can even think of it like a linux distribution) which is used by the car manufacturers has it: INCOMPATIBLE_LICENSE ?= "GPLv3" http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta-ivi-demo/conf/local.conf.sample#n77 http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta...
- xyzzy_plugh 11y ago
  Yep, but it's for patent reasons. I used Yocto for $PRODUCT and we had the same variable set. See my reply to the grandparent (does that make it an uncle or aunt of this reply?)

lolidaisuki 11y ago

>But they need not give away a way to change the software in the hardware. This is not true. If you don't have a way to change the software either then your users aren't required to be able to do that either because then the software is considered part of the hardware. So using GPLv3 software embedded into hardware without anyone being able to modify it is ok but implementing cryptographic or ther drm systems, like secureboot, without user being able to get around it isn't.

xyzzy_plugh 11y ago

TL;DR: Companies don't hate "giving users more freedom" Having worked with IP lawyers on multiple consumer electronic products across multiple companies, I believe you are over-simplifying the situation. Every IP lawyer I've talked to didn't care about tivoization -- if you want to go run your own code on our hardware, great, good luck. The main issue with GPLv3 was always the patent clause: http://www.gnu.org/licenses/gpl-3.0.en.html#section11 http://www.gnu.org/licenses/gpl-3.0.en.html#section11 I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. Hardware companies produce a ton of patents. The manufacturers of routers, cars, and even Apple care deeply about their patents. They're not willing to toy with some untested clause in a license of some free software, when there is a perfectly usable version of that software without such a clause. IANAL so I don't know for sure if this is the case, but speaking from experience, this is what lawyers have always told me. Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. It's difficult to have the device already know the checksum, but calculating a signature against a pre-installed signing certificate is easy and works pretty well. You also get the added benefit of decreasing the surface area for remote attackers, since only the trusted company can sign the payloads. Typically, also, physical writing is "disabled" during assembly (e.g. not populating components, sealing off access, etc.) which helps keep costs down and keep the design looking slick. The second reason "signed" payloads are used is for "Tivoization". I've never heard anyone say "we don't want customers putting their own software on a device they purchased." No doubt it happens, but it is rare for sure. Should companies spend more time and resources to make it easy for their customers to modify their devices, in a sane and secure manner? Possibly. But in today's cutthroat consumer-electronics world, you'd be hard pressed to find a company willing to spend that extra engineering effort on something so frivolous.

pksadiq 11y ago
> TL;DR: Companies don't hate "giving users more freedom" More freedom doesn't simply means that users can change the code. But, they can also use the code, modify, and redistribute without fear about patents, if they wish. > The manufacturers of routers, cars, and even Apple care deeply about their patents. So why do you think Apple chose Apache license for their new swift language? Apache license explicitly gives patent protection to its users.