4 ms·

TL;DR: Companies don't hate "giving users more freedom" Having worked with IP lawyers on multiple consumer electronic products across multiple companies, I bel

TL;DR: Companies don't hate "giving users more freedom" Having worked with IP lawyers on multiple consumer electronic products across multiple companies, I believe you are over-simplifying the situation. Every IP lawyer I've talked to didn't care about tivoization -- if you want to go run your own code on our hardware, great, good luck. The main issue with GPLv3 was always the patent clause: http://www.gnu.org/licenses/gpl-3.0.en.html#section11 http://www.gnu.org/licenses/gpl-3.0.en.html#section11 I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. Hardware companies produce a ton of patents. The manufacturers of routers, cars, and even Apple care deeply about their patents. They're not willing to toy with some untested clause in a license of some free software, when there is a perfectly usable version of that software without such a clause. IANAL so I don't know for sure if this is the case, but speaking from experience, this is what lawyers have always told me. Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. It's difficult to have the device already know the checksum, but calculating a signature against a pre-installed signing certificate is easy and works pretty well. You also get the added benefit of decreasing the surface area for remote attackers, since only the trusted company can sign the payloads. Typically, also, physical writing is "disabled" during assembly (e.g. not populating components, sealing off access, etc.) which helps keep costs down and keep the design looking slick. The second reason "signed" payloads are used is for "Tivoization". I've never heard anyone say "we don't want customers putting their own software on a device they purchased." No doubt it happens, but it is rare for sure. Should companies spend more time and resources to make it easy for their customers to modify their devices, in a sane and secure manner? Possibly. But in today's cutthroat consumer-electronics world, you'd be hard pressed to find a company willing to spend that extra engineering effort on something so frivolous.

pksadiq 11y ago
> TL;DR: Companies don't hate "giving users more freedom" More freedom doesn't simply means that users can change the code. But, they can also use the code, modify, and redistribute without fear about patents, if they wish. > The manufacturers of routers, cars, and even Apple care deeply about their patents. So why do you think Apple chose Apache license for their new swift language? Apache license explicitly gives patent protection to its users.
- xyzzy_plugh 11y ago
  A language is pure-software. The language isn't entangled in some proprietary hardware features. The language isn't their kernel drivers. Why would Apple care what you do with their language? You can't bring any harm to their business with it.
  - pksadiq 11y ago
    > Why would Apple care what you do with their language? You can't bring any harm to their business with it. Why do you think Microsoft is giving patent promises for C#, .Net and others[0] (But not licensing their software to Apache/GPL)? Yes. Because they can bring harm to their business. Why Do you think Apple ditched Objective C? For some reason they had to license it under GPL v2. But, as GNU re-licensed everything to GPLv3, they will have to stick with old versions of GCC, binutils, etc. So, they had legal reasons too for yet another language. Hm... Wait. We shall see the struggle of apple someday, because they can't sue Samsung again, just because they are using patents of Apple which are derived from swift. And last, why do you think language is not patented? Even some one-liners are patented in the software world![1] [0] https://msdn.microsoft.com/en-us/openspecifications/dn750984 https://msdn.microsoft.com/en-us/openspecifications/dn750984 [1] https://graphics.stanford.edu/~seander/bithacks.html#IntegerAbs https://graphics.stanford.edu/~seander/bithacks.html#Integer...
    - xyzzy_plugh 11y ago
      > Why do you think Microsoft is giving patent promises for C#, .Net and others[0] (But not licensing their software to Apache/GPL)? Yes. Because they can bring harm to their business. I think you continue to over simplify. This actually looks to me like Microsoft is doing their due-diligence in ensuring that the effects of their licensing are well-bounded with respect to patents. GPLv3 et al tend to hand-wave the actual patents covered, and leave it up to someone else to decide which patents actually apply, and how. Also, it does appear that Microsoft is using the MIT, BSD and Apache licenses[0] > Why Do you think Apple ditched Objective C? They didn't. The way I see it is that Swift is to Objective C as C#/.Net is to COM -- which is to say the underlying tech isn't going away anytime soon. They've just made a nice, shiny high-level abstraction. Unless there is some announcement I've missed where Apple said they are throwing away Obj-C and Obj-C tooling and rewriting everything in Swift. > So, they had legal reasons too for yet another language. This is a stretch. There was and is nothing preventing Apple from continuing to develop and use and sell product made with Objective C. They don't even care about GCC -- they have Clang. Also, there are plenty of suitable alternatives to GNU Coreutils, so please don't think that this means anything to Apple. The GPLv2 versions work well for what Apple needs, so they continue to use them. It is convenient for Apple. They could stop using GNU software entirely if they wanted and nothing would change. > We shall see the struggle of apple someday, because they can't sue Samsung again, just because they are using patents of Apple which are derived from swift. I have no idea what you mean by this. Companies sue other companies that infringe on their patents because NOT doing so is a tacit license. Why even file a patent then? To be fair, I think Apple first sued Samsung because their phones looked like iPhones (or so Apple claimed) and were concerned about how that would impact public perception. I don't think has anything to do with software, which is the topic at hand. > And last, why do you think language is not patented? Because the language itself, at its core, is agnostic of anything patent-worthy. How the compiler works? Platform support? Potentially patentable. A programming language allows a user to textually express what they want a generic computer to do, and at it's core is not patentable (as far as I understand the US patent system). It gets fuzzy around the edges, but you can't patent a language. It is an abstract idea. In any case, I get the impression you think these companies are evil. They're not. They're businesses looking out for the interests of their shareholders and their customers. There is no dark agenda against free software. It is just unfortunately complicated for big businesses. [0] https://en.wikipedia.org/wiki/.NET_Framework#Licensing https://en.wikipedia.org/wiki/.NET_Framework#Licensing
belorn 11y ago
I have heard this theory before but the one fact that speaks against it is the Apache license. GPLv3 did not not invents its own patent clause, but rather copied significant parts of apache as a base (stand on the shoulders of giants, avoid NIH, and so on...). "Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version." "each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work" They did add one major change (beside rewording and reordering), and that was to address the Microsoft-Novell patent agreement. A distributor can not chose to exclusively grant the patent rights to just a selected group, but must do so on a all-or-nothing deal. Once you provide a patent grant and complying with the license, the patent grant is given to everyone who might later receive a copy. So for all those companies that are happy to distribute apache licensed software but not gplv3 software, and is objecting on the subject of patent clause, one must ask why they have a problem that the patent grant is extended to everyone.
- xyzzy_plugh 11y ago
  Well, the Apache license is different from GPL in that you are not required to distribute any source, and your "derivative works" do not fall under the license. I can freely use Apache licensed software and jumble in all my patents and even statically link it all together there is no impact to my patents whatsoever. The point you make covers contributors, which is great! It means if I contribute to an open-source project that uses the Apache license, there are no catches, not even if I contributed something I or my company has patented. So you, as an end user, or consumer of this software, are safe w.r.t. patents. Hurray! (Again, IANAL!)
  - deleted 11y ago
    [deleted]
cyphar 11y ago
> TL;DR: Companies don't hate "giving users more freedom" Software patents are an example of threatening user freedom, since users can be sued for using software that has patented "ideas" in it. > I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. The GPLv3 uses an almost-exact copy of the patent clause in the Apache 2 license (which is used by companies). The only difference is that it requires that the patent rights be transferred in a GPL-like way. > Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. All that is necessary is to provide some advanced option to add your own certificate. That's literally it. Once you have the source, you can figure out how to actually push the bloody thing (it'd be nice if a company provided whatever script they use, but they're probably not required to do it). This isn't a very complicated procedure, UEFI did it and that standard is basically owned by Microsoft.
- xyzzy_plugh 11y ago
  > All that is necessary is to provide some advanced option to add your own certificate. That's literally it. Once you have the source, you can figure out how to actually push the bloody thing (it'd be nice if a company provided whatever script they use, but they're probably not required to do it). This isn't a very complicated procedure Dude. I wish. I have seen things you wouldn't believe. Rube-Goldberg publishing mechanisms that couldn't be provided even if you tried. Not to mention getting QA resources to test it, someone to document it for the public, whatever engineering resources are necessary to allow it to be modified (what if it is in ROM?). You're talking millions of dollars of employee time, easy. And we were supposed to have shipped last month. I want to live in this world of yours too, but it is just not possible today.
stsp 11y ago
Your reasoning doesn't make much sense to me. Companies are temporary entities, even though they don't like to think of themselves as such. Companies get bought or go bankrupt. So when I buy a device which only loads signed code, there is no way to know who is going to be able to sign code for my device in the future. I'm also out of luck if I ever want to run my own or someone else's code on my device. The attack surface is completely dependent on the actual code being signed, so the signature doesn't provide any security benefit to me. And in case there were 3rd party code which is more secure than the vendor code I cannot run it. From the perspective of the company, the signature provides vendor lock-in and planned obsolescence in return for a relatively small effort of maintaining code signing infrastructure. So there's only an advantage but no disadvantage. The only possible disadvantage is that I am less likely to buy the product, but regular consumers won't know the difference so the company can ignore me. Omitting hardware components which would help with repair efforts or debugging problems is just as unfriendly. But I understand there can be a huge cost benefits during mass production.
- xyzzy_plugh 11y ago
  I get where you are coming from, and I'd even say we're on the same page. I love open hardware. I love being able to modify my devices even if I never need to. It brings me comfort. I wish everything was designed like a Chromebook, designed to be hacked on. I applaud those efforts, and vote with my wallet. Most businesses just can't spend time thinking about this kind of problem. Some have tried, but it appeals to such a niche that it is hardly worth it. When you're a business focused on making money, you don't think about what happens when you're gone. You don't care. I wish that vendor lock-in and planned obsolescence were the reasons to explain this behaviour. At least then it makes sense in an obvious way, if it at least a little scummy. But it just isn't that simple, unfortunately.

pksadiq 11y ago

> TL;DR: Companies don't hate "giving users more freedom" More freedom doesn't simply means that users can change the code. But, they can also use the code, modify, and redistribute without fear about patents, if they wish. > The manufacturers of routers, cars, and even Apple care deeply about their patents. So why do you think Apple chose Apache license for their new swift language? Apache license explicitly gives patent protection to its users.

xyzzy_plugh 11y ago
A language is pure-software. The language isn't entangled in some proprietary hardware features. The language isn't their kernel drivers. Why would Apple care what you do with their language? You can't bring any harm to their business with it.
- pksadiq 11y ago
  > Why would Apple care what you do with their language? You can't bring any harm to their business with it. Why do you think Microsoft is giving patent promises for C#, .Net and others[0] (But not licensing their software to Apache/GPL)? Yes. Because they can bring harm to their business. Why Do you think Apple ditched Objective C? For some reason they had to license it under GPL v2. But, as GNU re-licensed everything to GPLv3, they will have to stick with old versions of GCC, binutils, etc. So, they had legal reasons too for yet another language. Hm... Wait. We shall see the struggle of apple someday, because they can't sue Samsung again, just because they are using patents of Apple which are derived from swift. And last, why do you think language is not patented? Even some one-liners are patented in the software world![1] [0] https://msdn.microsoft.com/en-us/openspecifications/dn750984 https://msdn.microsoft.com/en-us/openspecifications/dn750984 [1] https://graphics.stanford.edu/~seander/bithacks.html#IntegerAbs https://graphics.stanford.edu/~seander/bithacks.html#Integer...
  - xyzzy_plugh 11y ago
    > Why do you think Microsoft is giving patent promises for C#, .Net and others[0] (But not licensing their software to Apache/GPL)? Yes. Because they can bring harm to their business. I think you continue to over simplify. This actually looks to me like Microsoft is doing their due-diligence in ensuring that the effects of their licensing are well-bounded with respect to patents. GPLv3 et al tend to hand-wave the actual patents covered, and leave it up to someone else to decide which patents actually apply, and how. Also, it does appear that Microsoft is using the MIT, BSD and Apache licenses[0] > Why Do you think Apple ditched Objective C? They didn't. The way I see it is that Swift is to Objective C as C#/.Net is to COM -- which is to say the underlying tech isn't going away anytime soon. They've just made a nice, shiny high-level abstraction. Unless there is some announcement I've missed where Apple said they are throwing away Obj-C and Obj-C tooling and rewriting everything in Swift. > So, they had legal reasons too for yet another language. This is a stretch. There was and is nothing preventing Apple from continuing to develop and use and sell product made with Objective C. They don't even care about GCC -- they have Clang. Also, there are plenty of suitable alternatives to GNU Coreutils, so please don't think that this means anything to Apple. The GPLv2 versions work well for what Apple needs, so they continue to use them. It is convenient for Apple. They could stop using GNU software entirely if they wanted and nothing would change. > We shall see the struggle of apple someday, because they can't sue Samsung again, just because they are using patents of Apple which are derived from swift. I have no idea what you mean by this. Companies sue other companies that infringe on their patents because NOT doing so is a tacit license. Why even file a patent then? To be fair, I think Apple first sued Samsung because their phones looked like iPhones (or so Apple claimed) and were concerned about how that would impact public perception. I don't think has anything to do with software, which is the topic at hand. > And last, why do you think language is not patented? Because the language itself, at its core, is agnostic of anything patent-worthy. How the compiler works? Platform support? Potentially patentable. A programming language allows a user to textually express what they want a generic computer to do, and at it's core is not patentable (as far as I understand the US patent system). It gets fuzzy around the edges, but you can't patent a language. It is an abstract idea. In any case, I get the impression you think these companies are evil. They're not. They're businesses looking out for the interests of their shareholders and their customers. There is no dark agenda against free software. It is just unfortunately complicated for big businesses. [0] https://en.wikipedia.org/wiki/.NET_Framework#Licensing https://en.wikipedia.org/wiki/.NET_Framework#Licensing

belorn 11y ago

I have heard this theory before but the one fact that speaks against it is the Apache license. GPLv3 did not not invents its own patent clause, but rather copied significant parts of apache as a base (stand on the shoulders of giants, avoid NIH, and so on...). "Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version." "each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work" They did add one major change (beside rewording and reordering), and that was to address the Microsoft-Novell patent agreement. A distributor can not chose to exclusively grant the patent rights to just a selected group, but must do so on a all-or-nothing deal. Once you provide a patent grant and complying with the license, the patent grant is given to everyone who might later receive a copy. So for all those companies that are happy to distribute apache licensed software but not gplv3 software, and is objecting on the subject of patent clause, one must ask why they have a problem that the patent grant is extended to everyone.

xyzzy_plugh 11y ago
Well, the Apache license is different from GPL in that you are not required to distribute any source, and your "derivative works" do not fall under the license. I can freely use Apache licensed software and jumble in all my patents and even statically link it all together there is no impact to my patents whatsoever. The point you make covers contributors, which is great! It means if I contribute to an open-source project that uses the Apache license, there are no catches, not even if I contributed something I or my company has patented. So you, as an end user, or consumer of this software, are safe w.r.t. patents. Hurray! (Again, IANAL!)
- deleted 11y ago
  [deleted]

cyphar 11y ago

> TL;DR: Companies don't hate "giving users more freedom" Software patents are an example of threatening user freedom, since users can be sued for using software that has patented "ideas" in it. > I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. The GPLv3 uses an almost-exact copy of the patent clause in the Apache 2 license (which is used by companies). The only difference is that it requires that the patent rights be transferred in a GPL-like way. > Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. All that is necessary is to provide some advanced option to add your own certificate. That's literally it. Once you have the source, you can figure out how to actually push the bloody thing (it'd be nice if a company provided whatever script they use, but they're probably not required to do it). This isn't a very complicated procedure, UEFI did it and that standard is basically owned by Microsoft.

xyzzy_plugh 11y ago
> All that is necessary is to provide some advanced option to add your own certificate. That's literally it. Once you have the source, you can figure out how to actually push the bloody thing (it'd be nice if a company provided whatever script they use, but they're probably not required to do it). This isn't a very complicated procedure Dude. I wish. I have seen things you wouldn't believe. Rube-Goldberg publishing mechanisms that couldn't be provided even if you tried. Not to mention getting QA resources to test it, someone to document it for the public, whatever engineering resources are necessary to allow it to be modified (what if it is in ROM?). You're talking millions of dollars of employee time, easy. And we were supposed to have shipped last month. I want to live in this world of yours too, but it is just not possible today.

stsp 11y ago

Your reasoning doesn't make much sense to me. Companies are temporary entities, even though they don't like to think of themselves as such. Companies get bought or go bankrupt. So when I buy a device which only loads signed code, there is no way to know who is going to be able to sign code for my device in the future. I'm also out of luck if I ever want to run my own or someone else's code on my device. The attack surface is completely dependent on the actual code being signed, so the signature doesn't provide any security benefit to me. And in case there were 3rd party code which is more secure than the vendor code I cannot run it. From the perspective of the company, the signature provides vendor lock-in and planned obsolescence in return for a relatively small effort of maintaining code signing infrastructure. So there's only an advantage but no disadvantage. The only possible disadvantage is that I am less likely to buy the product, but regular consumers won't know the difference so the company can ignore me. Omitting hardware components which would help with repair efforts or debugging problems is just as unfriendly. But I understand there can be a huge cost benefits during mass production.

xyzzy_plugh 11y ago
I get where you are coming from, and I'd even say we're on the same page. I love open hardware. I love being able to modify my devices even if I never need to. It brings me comfort. I wish everything was designed like a Chromebook, designed to be hacked on. I applaud those efforts, and vote with my wallet. Most businesses just can't spend time thinking about this kind of problem. Some have tried, but it appeals to such a niche that it is hardly worth it. When you're a business focused on making money, you don't think about what happens when you're gone. You don't care. I wish that vendor lock-in and planned obsolescence were the reasons to explain this behaviour. At least then it makes sense in an obvious way, if it at least a little scummy. But it just isn't that simple, unfortunately.