5 ms·

There was a cultural change when Bell was broken up and UNIX became less laissez-faire, a paradigm shift. Software became valuable and not just bundled with ha

by deepnet 10y ago

There was a cultural change when Bell was broken up and UNIX became less laissez-faire, a paradigm shift. Software became valuable and not just bundled with hardware. Stallman saw it coming early enough that he had completed his GNU Free toolchain in time for Torvalds to use it. A developer community is less likely to arise when your modifications can be closed and you cannot fork. If your business runs in someone elses walled garden it can be taken away. Without the GPL's four freedoms we would not have the rich public domain of code we have today - a legally protected commons. Before the GPL the public domain suffered from the tradgedy of the commons, a fantastic legal hack.

nickpsecurity 10y ago
I mostly agree with that. It's not what you said, though, which went further and is what I responded to. Stallman and FOSS fans like to go from those contributions to unsopported claims where no proprietary can have a single property of OSS. Yours implied only FOSS could've resisted a secret, US directive which was 100% untrue given existence of closed, non-US products. I preempted your likely counter by pointing out proprietary can come with source too for anti-subversion and actually reached highest form of security possible. We're still waiting on FOSS model to do that. Nobody has. Fortunately, the cathedral builders in industry and good CompSci are sometimes open-sourcing stuff after the fact. RISC-V, GenodeOS, seL4, NaCl, etc.
- deepnet 10y ago
  Fair point and well preempted. Proprietary software can offer some freedom but it does not ensure it will remain, nor does it offer the full 4 freedoms required. What you say is not technically incorrect, but practically Google, Apple & Microsoft were all secretly in NSA's PRISM. A large corporate entity is subject to state pressure in a different way than a public good. A corporation must profit, new markets must be entered, their regimes placated at the expense of users. Ownership is a single point of failure. A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source. So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden). PGP and SSH are both provably secure. Security is dynamic, FOSS is faster at releasing patches and not removing features while updating security. If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck. Companies change hands, policies change, you may be secure today but they sell your data tomorrow. Free software forks at disagreements so everyone is happy. Free software cannot be taken from you by law - it is public domain.
  - nickpsecurity 10y ago
    "Ownership is a single point of failure." Ownership can be a single point of failure but someone owns copyright to GPL code, too. Trick is protections in licensing. A recent conversation found that the real issue, if you get down to it, is in distribution: free distribution and network effects is strongest benefit of FOSS over proprietary, shared-source model which may have every other benefit. "A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source." Realize that I said proprietary, shared source. You have the source of whatever you need. One can also do something like Wirth's Pascal/P where runtime is P-code and some I/O shims. Everything else in toolchain was compiled to it. Result was amateurs ported whole thing to 70+ architectures while having to reimplement just one, tiny part. Interesting enough, System/38 design did same thing at microcode or asm level with successful port to POWER with many apps needing no source recompile. "So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden)." This problem exists for FOSS, too, so don't kid yourself. The vast majority of FOSS isn't Linux: it's barely maintained and many ignore bug reports for long periods. The average is in favor of FOSS if it's major projects vs proprietary software but individually it ranges from total shit to excellence. Totally dependent on contributors or maintainers. "PGP and SSH are both provably secure. " They're not due to their CVE history. They just got really good with GPG foiling NSA after years of improvements with a narrow focus for GPG. GEMSOS, PSOS, and seL4 are provably secure. World of difference in how they're built. None were created with a FOSS model. "If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck." " Free software forks at disagreements so everyone is happy. " It's a risk but can be countered. The counter I did in another discussion was a shared-source license that allowed fixes, modifications, and even distribution to other customers. You perpetually keep what you licensed if you keep paying optionally with a limit on per organization charges. You and a group can do anything you want with that commercial code if you're paying. Btw, the real hacker OS was provided with some (but not enough) of those attributes with features UNIX still can't fully match: http://www.symbolics-dks.com/Genera-why-1.htm http://www.symbolics-dks.com/Genera-why-1.htm "cannot be taken from you by law - it is public domain." It's actually not: it's copywritten software licensed with specific terms that enforce things on you. Public domain has no copyrights or restrictions. This is a problem or a feature of GPL vs public domain depending on who you ask. Only thing both protect almost 100% is widespread distribution which any paid model might... might... always reduce.
ashitlerferad 10y ago
The GPL is not magic pixie dust: http://bonedaddy.net/pabs3/log/2015/11/27/sfc-supporter/ http://bonedaddy.net/pabs3/log/2015/11/27/sfc-supporter/

by deepnet 10y ago

nickpsecurity 10y ago

I mostly agree with that. It's not what you said, though, which went further and is what I responded to. Stallman and FOSS fans like to go from those contributions to unsopported claims where no proprietary can have a single property of OSS. Yours implied only FOSS could've resisted a secret, US directive which was 100% untrue given existence of closed, non-US products. I preempted your likely counter by pointing out proprietary can come with source too for anti-subversion and actually reached highest form of security possible. We're still waiting on FOSS model to do that. Nobody has. Fortunately, the cathedral builders in industry and good CompSci are sometimes open-sourcing stuff after the fact. RISC-V, GenodeOS, seL4, NaCl, etc.

deepnet 10y ago
Fair point and well preempted. Proprietary software can offer some freedom but it does not ensure it will remain, nor does it offer the full 4 freedoms required. What you say is not technically incorrect, but practically Google, Apple & Microsoft were all secretly in NSA's PRISM. A large corporate entity is subject to state pressure in a different way than a public good. A corporation must profit, new markets must be entered, their regimes placated at the expense of users. Ownership is a single point of failure. A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source. So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden). PGP and SSH are both provably secure. Security is dynamic, FOSS is faster at releasing patches and not removing features while updating security. If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck. Companies change hands, policies change, you may be secure today but they sell your data tomorrow. Free software forks at disagreements so everyone is happy. Free software cannot be taken from you by law - it is public domain.
- nickpsecurity 10y ago
  "Ownership is a single point of failure." Ownership can be a single point of failure but someone owns copyright to GPL code, too. Trick is protections in licensing. A recent conversation found that the real issue, if you get down to it, is in distribution: free distribution and network effects is strongest benefit of FOSS over proprietary, shared-source model which may have every other benefit. "A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source." Realize that I said proprietary, shared source. You have the source of whatever you need. One can also do something like Wirth's Pascal/P where runtime is P-code and some I/O shims. Everything else in toolchain was compiled to it. Result was amateurs ported whole thing to 70+ architectures while having to reimplement just one, tiny part. Interesting enough, System/38 design did same thing at microcode or asm level with successful port to POWER with many apps needing no source recompile. "So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden)." This problem exists for FOSS, too, so don't kid yourself. The vast majority of FOSS isn't Linux: it's barely maintained and many ignore bug reports for long periods. The average is in favor of FOSS if it's major projects vs proprietary software but individually it ranges from total shit to excellence. Totally dependent on contributors or maintainers. "PGP and SSH are both provably secure. " They're not due to their CVE history. They just got really good with GPG foiling NSA after years of improvements with a narrow focus for GPG. GEMSOS, PSOS, and seL4 are provably secure. World of difference in how they're built. None were created with a FOSS model. "If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck." " Free software forks at disagreements so everyone is happy. " It's a risk but can be countered. The counter I did in another discussion was a shared-source license that allowed fixes, modifications, and even distribution to other customers. You perpetually keep what you licensed if you keep paying optionally with a limit on per organization charges. You and a group can do anything you want with that commercial code if you're paying. Btw, the real hacker OS was provided with some (but not enough) of those attributes with features UNIX still can't fully match: http://www.symbolics-dks.com/Genera-why-1.htm http://www.symbolics-dks.com/Genera-why-1.htm "cannot be taken from you by law - it is public domain." It's actually not: it's copywritten software licensed with specific terms that enforce things on you. Public domain has no copyrights or restrictions. This is a problem or a feature of GPL vs public domain depending on who you ask. Only thing both protect almost 100% is widespread distribution which any paid model might... might... always reduce.

ashitlerferad 10y ago

The GPL is not magic pixie dust: http://bonedaddy.net/pabs3/log/2015/11/27/sfc-supporter/ http://bonedaddy.net/pabs3/log/2015/11/27/sfc-supporter/