6 ms·

Anyone know how things are panning out after the grsecurity stopped making their stable patch series freely available? There was a fourm post and message on the

by gbrown_ 10y ago

Anyone know how things are panning out after the grsecurity stopped making their stable patch series freely available? There was a fourm post and message on the mailing list a while but I've not been able to find anything more recent.

neoCrimeLabs 10y ago
IIRC, established linux distributions that were using the stable patch set before could still have access to the stable patch after it closed. Did that change?
- lolidaisuki 10y ago
  At least Alpine and Arch use the demo (testing) version. IIRC their initial announcement said that the distros can continue using the demo version and not the stable version unless they pay. And no distro can get the stable version even by paying because Brad knows that the distro would have to redistribute the sources as per GPLv2 and thus he will only make ridiculously high offers. There is no distro or any other consumer product that does or ever will have the stable patches. Brad is a greedy asshole and all around a bad person.
geofft 10y ago
How exactly are they doing this without either violating the GPL or failing to keep their patches secret?
- striking 10y ago
  If you release the content to people who shouldn't have it, the next set will not be distributed to you. Your contract will not be renewed. https://archive.is/qt0n2 https://archive.is/qt0n2
  - techdragon 10y ago
    Wait ... That's actually working? I had heaps of things I shitcanned as not even remotely profitable to do because all common sense told me that this exact tactic would not work.
    - striking 10y ago
      You can. It seems legal (tho IANAL) and it seems to be working in practice. Thing is, your distribution chain needs to be extremely tight (watermarked data or careful chain of trust) or else content will just get leaked every patch.
    - cyphar 10y ago
      I'm fairly sure it's not legal, because you're acting in bad faith (while you haven't changed the License terms, you are effectively coercing people into not being able to take advantage of the license). I'd also consider the tactic immoral because you're adding restrictions to free (and copylefted) software.
  - geofft 10y ago
    How do they reconcile this with the statement on https://grsecurity.net/download.php https://grsecurity.net/download.php that the patches are under GPLv2 and distributors must ship the complete corresponding source? What happens if I redistribute grsecurity binary kernels with no other patches, and offer source as I am obligated to do?
- xyz123xyz 10y ago
  >How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Because ignorance (of the law) is bliss. Here are some discussions on this topic and some excerps: http://boards.4chan.org/g/thread/54839391 http://boards.4chan.org/g/thread/54839391 https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html ---------------------- GRsecurity is preventing others from employing their rights under version 2 the GPL to redistribute (by threatening them with a non-renewal of a contract to recive this patch to the linux kernel.) (GRsecurity is a derivative work of the linux kernel (it is a patch)) People who have dealt with them have attested to this fact: https://www.reddit.com/r/KotakuInAction/comments/4grdtb/censorship_linux_developer_steals_page_from_randi/ https://www.reddit.com/r/KotakuInAction/comments/4grdtb/cens... "You will also lose the access to the patches in the form of grsec not renewing the contract. Also they've asked us (a Russian hosting company) for $17000+ a year for access their stable patches. $17k is quite a lot for us. A question about negotiating a lower price was completely ignored. Twice." -- fbt2lurker And it is suggested to be the case here aswell: https://www.reddit.com/r/linux/comments/4gxdlh/after_15_years_of_research_grsecuritys_rap_is_here/ https://www.reddit.com/r/linux/comments/4gxdlh/after_15_year... "Do you work for some company that pays for Grsecurity? If so then would you kindly excersise the rights given to you by GPL and send me a tarball of all the latest patches and releases?" -- lolidaisuki "sadly (for this case) no, i work in a human rights organization where we get the patches by a friendly and richer 3rd party of the same field. we made the compromise to that 3rd party to not distribute the patches outside and as we deal with some critical situations i cannot afford to compromise that even for the sake of gpl :/ the "dumber" version for unstable patches will make a big problem for several projects, i would keep an eye on them. this situation cannot be hold for a long time" -- disturbio Is this not tortious interference, on grsecurity's (Brad Spengler) part, with the quazi-contractual relationship the sublicensee has with the original licensor? (Also Note: the stable branch now contains features that will never make it to the "testing" branch, and are not allowed to be redistributed, per the scheme mentioned above (which has been successful: not one version of the stable branch has been released by anyone, even those asked to do so, since the scheme has been put in place (they say they cannot as they cannot lose access to the patch as that may cost the lives and freedom of activists in latin america))) https://twitter.com/marcan42/status/726101158561882112 https://twitter.com/marcan42/status/726101158561882112 @xoreipeip @grsecurity they call it a "demo" version "20:14 < spender> what's in the public version is < 1/5th the size of the full version" oreipeip @grsecurity "20:21 < spender> also it wouldn't be as fast as the commercial version [...] there are missing optimization passes" ------------------------------
- xyz123xyz 10y ago
  >How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Some more excerpts: --------------------------------- >>54842691 >Are they not redistributing the source? Correct > Are they forbidding others from redistributing the source? Correct. > Seems to me they're saying "if you redistribute the source, we won't do business with you again/charge you a lot for a renewal". >How is this illegal? Hmm so there is Licensor (Linux Devs), they place their copyrighted work out there, under conditions. There is Licensee (Brad Spengler, Grsecurity), he takes the copyrighted work under the terms and conditions and creates a derivative work (not allowed under pure copyright, only permissible as per the will of the rightsholder, as stated in the agreement) The license states that, for permission to create a derivative work, one must allow others who gain access to that derivative work to redistribute said work, modify it, so on and so forth (otherwise there is no permission under the agreement). Licensee creates derivative work. Licensee sublicenses derivative work to sublicensee. Licensee stipulates that sublicensee may not redistribute derivative work. Licensee makes threats to ensure compliance with this demand that sublicensee not distribute derivative work. These demands are met: sublicensee dares not redistribute the work. The conditions the Licensor placed on his work have been spurned, ignored, and abolished by the actions of the licensee. Licensee has frustrated the purpose of the grant he has been give by licensor. It does not matter specifically how he went about doing so. He did so. >You can argue that they're assholes, but this isn't illegal. So in other words you are saying "you can argue that Brad Spengler has treated the agreement in... bad faith". Thank you for restating a portion of my case, in inadvertently "But JUDGE, bad faith, when it comes to business dealings, contracts, grants, and the like is fine and good!" >bla bla So have you attended law school and passed the bar? I have.
- xyz123xyz 10y ago
  >How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Here are some additional arguments by lay people defending GRSecurity and rebuttals based in an understanding of the law (which are rejected with bays and hollers from the lay crowd who seem to believe that an NDA makes the GPL equal in fact to the BSD license grant): --------------- >>54842745 >>54842791 >>54842820 There is a legal term for this. It's called acting in bad faith. That often gets your contract nullified. Here there is a license grant. Spengler is acting in bad faith to frustrate its purpose. It does not matter if he is breaking legs, threatening to expose secrets, or threatining to raise prices to exorbidant rates, or to cease sending the patches: What matters is that his goal is to deny the sublicensee the right given to the sublicensee by the original licensor, and that he has obtained that goal via his actions (the threats here). He has frustrated the purpose of the agreement (the grant) he had with the original licensor, and thus the grant fails. In other words: he has violated the license. It's very simple, I don't know why some here do not understand it, it's like you never graduated law school nor passed the bar. The courts are not dumb, they've seen people try to be "clever" like this before for well over 100 years. Just because some here have never heard of any of it doesn't mean what they then grind together their uneducated brain is correct (even though they will swear to high heaven it is, cuz it makes sence to them, centuries of caselaw and even black letter law be damned).
- xyz123xyz 10y ago
  Additionally: ----------------- >54843968 The GPLv2 is a text that outlines by what ways a licensee may use a copyrighted work provided by the licensor. In the case that the agreement is not followed standard copyright law applies (all rights reserved). Contracts are often known as "private law", it allows parties to make their own agreement. So yes, the agreement here is controlling "law", while the public law that allows such agreements to alienate rights to copyrighted works to be enforceable by the licensee so as to protect him against the licensor is the 1973 us copyright act. However when the licensee violates the agreement he cannot find refuge in that agreement any longer. Go attend law school. And YES, I have both graduated law school and passed the bar. Have you? No. Might be a reason why you don't know what your talking about and can only cite the GPL itself (a small 1 page document) and nothing that surrounds it (you don't even know what it hangs on). Please people, do not listen to that fool
- xyz123xyz 10y ago
  Here the discussion gets a little more heated as the crowd keeps simply repeating themselves and ignoring all legal arguments. -------------------------- >>54844263 >Which was not broken since the sub-licensee still has all the privileges and obligations given to them by the GPL. Incorrect in practice: the sublicensees have been effectively prevented from exercising the right given to them by the original licensor (linux devs) by the action of the intimediary (grsecurity). In this case, since spengler is working to frustrate the purpose of the grant given by the original licensor the court may very well nullify his right to seek cover of the license: IE: he has acted in bad faith in attempting (successfully here) to DENY a permission granted to the sublicensee by the original licensor and thus has violated the license and can be sued by the original licensor for copyright infringement. (Not to mention the sublicensee for tort violations). Spengler has interfered with the relationship between the licensor (the rightsholder) and the sublicensee (likely a quazi-contractual relationship). Why is this so hard for you to understand? Please, go to law school or keep you mouth shut. And other people here, why is it that you choose to believe people who have not been to law school and who have not passed the bar, over me, who has done both? Why? They read ONE document, the agreement. I've read books. Yet you decide that THEY know what they are talking about? That the written grant exists in a vacume. It's ONE FUCKING PAGE. That's a completely integrated, four corners, covers all cases document to you people? Do you even know what I just said?
  - xyz123xyz 10y ago
    A nice response was posted, ad-mists the bays and hollers: Anonymous 06/01/16 (Wed) 01:14:43 No.605380 >>605361 Whoever you are, good luck trying to educate your fellow cattle-minded goyim. They've not done their due diligence and until you point to the source, there's no chance for them to understand what you're talking about. Hell, most bar lawyers wouldn't understand what you're saying. I do, but I'm anon so it doesn't matter. What do you know about procedure for filing suits at law in international courts? You would obviously be the one passionate enough to pursue such a lofty goal as freeing up security for all.
- cyphar 10y ago
  My understanding is that they threaten to never give someone who distributes their patches any more updates. While the GPL does not forbid this (it's a contract you agreed to with the party), I'm fairly sure that such a contract would be considered acting in bad faith (you're adding additional restrictions through coercion rather than changing the license terms). I'm not a lawyer, but I'd be surprised if such sneakiness hasn't already been deemed illegal by the courts. I'm also surprised nobody has asked the SFConservancy to take GRSecurity to court over it. You'd think even Linus (who doesn't agree with the underlying spirit of the GPL -- all software should be free) would have a problem with "not getting patches back".
  - xyz123xyz 10y ago
    You are correct. I've been trying to explain this very thing to people, but every #fsf, #gnu, /tech/ etc lay person just screams that I'm wrong and I'm and idiot, and I that I'm lying when I say I have a law degree and passed the bar etc. I have contacted the SFConservancy in the chat room (#conservancy or irc.freenode.net ) as-well as by email (I don't know if that went through or straight to spam though, I didn't get a response yet). I don't assume that they have a lawyer in the chat room though, especially during the day I contacted them (was a holiday). I encourage you and others to also contact them, to push this issue and show people care. Also if anyone is a linux code contributor, especially if they contributed a portion of code that is touched by grsecurity (grsecurity touches alot of things), you are a potential plaintiff. Here is the log:
  - xyz123xyz 10y ago
    (Chat log:) -30 gnu_user http://pastebin.ca/3614117 http://pastebin.ca/3614117 -39 kfogel gnu_user: I am not a lawyer, and I don't represent the Conservancy, but this does sound disturbing. It is not a new situation even back in the 1990s, there were cases where some companies attempted to sign private contracts with customers whereby the customers agreed to give up some of their rights under the GPLv2, as a condition of receiving patches under the GPLv2. My memory is that the FSF determined this to be a violation of the GPL (on the patch -39 kfogel supplier's part), but I am not positive of that, nor do I remember the specific parties involved. However, the case was very similar to what you are describing with grsecurity. -42 kfogel gnu_user: It is quite likely, by the way, that grsecurity is delivering slightly different patches (you know, whitespace differences or trivial variable name differences, that sort of thing) to different customers, in order to be able to identify who leaks a patch in violation of the contract. (See https://en.wikipedia.org/wiki/Trap_street https://en.wikipedia.org/wiki/Trap_street for maps, but on a per-customer basis.) -43 kfogel gnu_user: I'm pointing this out because some customer might be tempted to leak anonymously. They should be aware that they are probably identifiable, unless they try to scrub the diff in some way (might be hard). If you can get multiple customers to privately compare their patches, you can determine if grsecurity is using this technique. -45 kfogel gnu_user: bkuhn knows a lot about GPL compliance; I hope he reads the above and can recommend and/or take some action. -45 gnu_user kfogel: I hope so too. -45 vmbrasseur IIRC, bkuhn may be in transit right now. -45 gnu_user kfogel: this situation is not new to the law -45 gnu_user companies do this all the time against one another and are brought to court for tort violations -46 gnu_user the difference here is that they all have direct privity with eachother -46 gnu_user here the linux rightsholder does not have direct privity with the sublicensor that is prevented from redistirbuting -47 gnu_user thus a quazi-contractual argument might have to be made -47 kfogel gnu_user: Ah, sounds like you know much more about the history & context than I do anyway, good. Thanks for pointing this one out I'm very curious to see what happensW! -48 gnu_user the remedy would likely be in equity thusly (since quazi-contract etc) -50 -!- JordiGH [jordi] has joined #conservancy -51 -!- kfogel [~Karl] has quit [Ping timeout: 258 seconds] -52 -!- kfogel [~Karl] has joined #conservancy -04 @bkuhn gnu_user: I'm familiar with the public discussion about the grsecurity situation. If a customer thinks they have a tort claim of some sort under GPL in a situation like this, they should certainly bring it on their own. -05 @bkuhn Whether it's a GPL violation depends on various details that I'm not privy to. Redistribution is not mandatory under GPL, so there would have to be some sort of specific GPLv2 Secition 6/7 problem shown. -05 JordiGH Funding cuts have also tightened the conference travel budget, eh? -05 @bkuhn JordiGH: huh? -05 JordiGH Sorry, I thought you said you weren't at Pycon this year. -06 @bkuhn JordiGH: if you are asking about PyCon, my talk wasn't accepted. -06 JordiGH What was your proposal? Did you get any attention at all? Last time I submitted a talk, I'm sure nobody even looked at the proposal beyond the title. -06 @bkuhn JordiGH: I forget, anyway I was asked to keynote another conference elsewhere in the world tomorrow, so I am there now. -07 JordiGH Oh! Neat! Where? -07 @bkuhn JordiGH: http://oss2016.org/speakers http://oss2016.org/speakers -08 JordiGH Finland! -08 @bkuhn gnu_user: showing a GPLv2 Section 6 or 7 problem often require seeing what written agreements people have with the party. If someone has specifics, they can certainly report the violation officially to compliance@sfconservancy.org
- zyx123zyx 10y ago
  RMS has weighed in (responded to my email (the email I sent is the same text as the current originating post at: https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html )) Re: GRsecurity is preventing others from employing their rights under version 2 the GPL to redistribute source code Richard Stallman (May 31 2016 10:27 PM) [[[ To any NSA and FBI agents reading my email: please consider ]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] If I understand right, this is a matter of GPL 2 on the Linux patches. Is that right? If so, I think GRsecurity is violating the GPL on Linux. -- Dr Richard Stallman President, Free Software Foundation (gnu.org, fsf.org) Internet Hall-of-Famer (internethalloffame.org) Skype: No way! See stallman.org/skype.html.

by gbrown_ 10y ago

neoCrimeLabs 10y ago

IIRC, established linux distributions that were using the stable patch set before could still have access to the stable patch after it closed. Did that change?

lolidaisuki 10y ago
At least Alpine and Arch use the demo (testing) version. IIRC their initial announcement said that the distros can continue using the demo version and not the stable version unless they pay. And no distro can get the stable version even by paying because Brad knows that the distro would have to redistribute the sources as per GPLv2 and thus he will only make ridiculously high offers. There is no distro or any other consumer product that does or ever will have the stable patches. Brad is a greedy asshole and all around a bad person.

geofft 10y ago

How exactly are they doing this without either violating the GPL or failing to keep their patches secret?

striking 10y ago
If you release the content to people who shouldn't have it, the next set will not be distributed to you. Your contract will not be renewed. https://archive.is/qt0n2 https://archive.is/qt0n2
- techdragon 10y ago
  Wait ... That's actually working? I had heaps of things I shitcanned as not even remotely profitable to do because all common sense told me that this exact tactic would not work.
  - striking 10y ago
    You can. It seems legal (tho IANAL) and it seems to be working in practice. Thing is, your distribution chain needs to be extremely tight (watermarked data or careful chain of trust) or else content will just get leaked every patch.
  - cyphar 10y ago
    I'm fairly sure it's not legal, because you're acting in bad faith (while you haven't changed the License terms, you are effectively coercing people into not being able to take advantage of the license). I'd also consider the tactic immoral because you're adding restrictions to free (and copylefted) software.
- geofft 10y ago
  How do they reconcile this with the statement on https://grsecurity.net/download.php https://grsecurity.net/download.php that the patches are under GPLv2 and distributors must ship the complete corresponding source? What happens if I redistribute grsecurity binary kernels with no other patches, and offer source as I am obligated to do?
xyz123xyz 10y ago
>How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Because ignorance (of the law) is bliss. Here are some discussions on this topic and some excerps: http://boards.4chan.org/g/thread/54839391 http://boards.4chan.org/g/thread/54839391 https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html ---------------------- GRsecurity is preventing others from employing their rights under version 2 the GPL to redistribute (by threatening them with a non-renewal of a contract to recive this patch to the linux kernel.) (GRsecurity is a derivative work of the linux kernel (it is a patch)) People who have dealt with them have attested to this fact: https://www.reddit.com/r/KotakuInAction/comments/4grdtb/censorship_linux_developer_steals_page_from_randi/ https://www.reddit.com/r/KotakuInAction/comments/4grdtb/cens... "You will also lose the access to the patches in the form of grsec not renewing the contract. Also they've asked us (a Russian hosting company) for $17000+ a year for access their stable patches. $17k is quite a lot for us. A question about negotiating a lower price was completely ignored. Twice." -- fbt2lurker And it is suggested to be the case here aswell: https://www.reddit.com/r/linux/comments/4gxdlh/after_15_years_of_research_grsecuritys_rap_is_here/ https://www.reddit.com/r/linux/comments/4gxdlh/after_15_year... "Do you work for some company that pays for Grsecurity? If so then would you kindly excersise the rights given to you by GPL and send me a tarball of all the latest patches and releases?" -- lolidaisuki "sadly (for this case) no, i work in a human rights organization where we get the patches by a friendly and richer 3rd party of the same field. we made the compromise to that 3rd party to not distribute the patches outside and as we deal with some critical situations i cannot afford to compromise that even for the sake of gpl :/ the "dumber" version for unstable patches will make a big problem for several projects, i would keep an eye on them. this situation cannot be hold for a long time" -- disturbio Is this not tortious interference, on grsecurity's (Brad Spengler) part, with the quazi-contractual relationship the sublicensee has with the original licensor? (Also Note: the stable branch now contains features that will never make it to the "testing" branch, and are not allowed to be redistributed, per the scheme mentioned above (which has been successful: not one version of the stable branch has been released by anyone, even those asked to do so, since the scheme has been put in place (they say they cannot as they cannot lose access to the patch as that may cost the lives and freedom of activists in latin america))) https://twitter.com/marcan42/status/726101158561882112 https://twitter.com/marcan42/status/726101158561882112 @xoreipeip @grsecurity they call it a "demo" version "20:14 < spender> what's in the public version is < 1/5th the size of the full version" oreipeip @grsecurity "20:21 < spender> also it wouldn't be as fast as the commercial version [...] there are missing optimization passes" ------------------------------
xyz123xyz 10y ago
>How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Some more excerpts: --------------------------------- >>54842691 >Are they not redistributing the source? Correct > Are they forbidding others from redistributing the source? Correct. > Seems to me they're saying "if you redistribute the source, we won't do business with you again/charge you a lot for a renewal". >How is this illegal? Hmm so there is Licensor (Linux Devs), they place their copyrighted work out there, under conditions. There is Licensee (Brad Spengler, Grsecurity), he takes the copyrighted work under the terms and conditions and creates a derivative work (not allowed under pure copyright, only permissible as per the will of the rightsholder, as stated in the agreement) The license states that, for permission to create a derivative work, one must allow others who gain access to that derivative work to redistribute said work, modify it, so on and so forth (otherwise there is no permission under the agreement). Licensee creates derivative work. Licensee sublicenses derivative work to sublicensee. Licensee stipulates that sublicensee may not redistribute derivative work. Licensee makes threats to ensure compliance with this demand that sublicensee not distribute derivative work. These demands are met: sublicensee dares not redistribute the work. The conditions the Licensor placed on his work have been spurned, ignored, and abolished by the actions of the licensee. Licensee has frustrated the purpose of the grant he has been give by licensor. It does not matter specifically how he went about doing so. He did so. >You can argue that they're assholes, but this isn't illegal. So in other words you are saying "you can argue that Brad Spengler has treated the agreement in... bad faith". Thank you for restating a portion of my case, in inadvertently "But JUDGE, bad faith, when it comes to business dealings, contracts, grants, and the like is fine and good!" >bla bla So have you attended law school and passed the bar? I have.
xyz123xyz 10y ago
>How exactly are they doing this without either violating the GPL or failing to keep their patches secret? Here are some additional arguments by lay people defending GRSecurity and rebuttals based in an understanding of the law (which are rejected with bays and hollers from the lay crowd who seem to believe that an NDA makes the GPL equal in fact to the BSD license grant): --------------- >>54842745 >>54842791 >>54842820 There is a legal term for this. It's called acting in bad faith. That often gets your contract nullified. Here there is a license grant. Spengler is acting in bad faith to frustrate its purpose. It does not matter if he is breaking legs, threatening to expose secrets, or threatining to raise prices to exorbidant rates, or to cease sending the patches: What matters is that his goal is to deny the sublicensee the right given to the sublicensee by the original licensor, and that he has obtained that goal via his actions (the threats here). He has frustrated the purpose of the agreement (the grant) he had with the original licensor, and thus the grant fails. In other words: he has violated the license. It's very simple, I don't know why some here do not understand it, it's like you never graduated law school nor passed the bar. The courts are not dumb, they've seen people try to be "clever" like this before for well over 100 years. Just because some here have never heard of any of it doesn't mean what they then grind together their uneducated brain is correct (even though they will swear to high heaven it is, cuz it makes sence to them, centuries of caselaw and even black letter law be damned).
xyz123xyz 10y ago
Additionally: ----------------- >54843968 The GPLv2 is a text that outlines by what ways a licensee may use a copyrighted work provided by the licensor. In the case that the agreement is not followed standard copyright law applies (all rights reserved). Contracts are often known as "private law", it allows parties to make their own agreement. So yes, the agreement here is controlling "law", while the public law that allows such agreements to alienate rights to copyrighted works to be enforceable by the licensee so as to protect him against the licensor is the 1973 us copyright act. However when the licensee violates the agreement he cannot find refuge in that agreement any longer. Go attend law school. And YES, I have both graduated law school and passed the bar. Have you? No. Might be a reason why you don't know what your talking about and can only cite the GPL itself (a small 1 page document) and nothing that surrounds it (you don't even know what it hangs on). Please people, do not listen to that fool
xyz123xyz 10y ago
Here the discussion gets a little more heated as the crowd keeps simply repeating themselves and ignoring all legal arguments. -------------------------- >>54844263 >Which was not broken since the sub-licensee still has all the privileges and obligations given to them by the GPL. Incorrect in practice: the sublicensees have been effectively prevented from exercising the right given to them by the original licensor (linux devs) by the action of the intimediary (grsecurity). In this case, since spengler is working to frustrate the purpose of the grant given by the original licensor the court may very well nullify his right to seek cover of the license: IE: he has acted in bad faith in attempting (successfully here) to DENY a permission granted to the sublicensee by the original licensor and thus has violated the license and can be sued by the original licensor for copyright infringement. (Not to mention the sublicensee for tort violations). Spengler has interfered with the relationship between the licensor (the rightsholder) and the sublicensee (likely a quazi-contractual relationship). Why is this so hard for you to understand? Please, go to law school or keep you mouth shut. And other people here, why is it that you choose to believe people who have not been to law school and who have not passed the bar, over me, who has done both? Why? They read ONE document, the agreement. I've read books. Yet you decide that THEY know what they are talking about? That the written grant exists in a vacume. It's ONE FUCKING PAGE. That's a completely integrated, four corners, covers all cases document to you people? Do you even know what I just said?
- xyz123xyz 10y ago
  A nice response was posted, ad-mists the bays and hollers: Anonymous 06/01/16 (Wed) 01:14:43 No.605380 >>605361 Whoever you are, good luck trying to educate your fellow cattle-minded goyim. They've not done their due diligence and until you point to the source, there's no chance for them to understand what you're talking about. Hell, most bar lawyers wouldn't understand what you're saying. I do, but I'm anon so it doesn't matter. What do you know about procedure for filing suits at law in international courts? You would obviously be the one passionate enough to pursue such a lofty goal as freeing up security for all.
cyphar 10y ago
My understanding is that they threaten to never give someone who distributes their patches any more updates. While the GPL does not forbid this (it's a contract you agreed to with the party), I'm fairly sure that such a contract would be considered acting in bad faith (you're adding additional restrictions through coercion rather than changing the license terms). I'm not a lawyer, but I'd be surprised if such sneakiness hasn't already been deemed illegal by the courts. I'm also surprised nobody has asked the SFConservancy to take GRSecurity to court over it. You'd think even Linus (who doesn't agree with the underlying spirit of the GPL -- all software should be free) would have a problem with "not getting patches back".
- xyz123xyz 10y ago
  You are correct. I've been trying to explain this very thing to people, but every #fsf, #gnu, /tech/ etc lay person just screams that I'm wrong and I'm and idiot, and I that I'm lying when I say I have a law degree and passed the bar etc. I have contacted the SFConservancy in the chat room (#conservancy or irc.freenode.net ) as-well as by email (I don't know if that went through or straight to spam though, I didn't get a response yet). I don't assume that they have a lawyer in the chat room though, especially during the day I contacted them (was a holiday). I encourage you and others to also contact them, to push this issue and show people care. Also if anyone is a linux code contributor, especially if they contributed a portion of code that is touched by grsecurity (grsecurity touches alot of things), you are a potential plaintiff. Here is the log:
- xyz123xyz 10y ago
  (Chat log:) -30 gnu_user http://pastebin.ca/3614117 http://pastebin.ca/3614117 -39 kfogel gnu_user: I am not a lawyer, and I don't represent the Conservancy, but this does sound disturbing. It is not a new situation even back in the 1990s, there were cases where some companies attempted to sign private contracts with customers whereby the customers agreed to give up some of their rights under the GPLv2, as a condition of receiving patches under the GPLv2. My memory is that the FSF determined this to be a violation of the GPL (on the patch -39 kfogel supplier's part), but I am not positive of that, nor do I remember the specific parties involved. However, the case was very similar to what you are describing with grsecurity. -42 kfogel gnu_user: It is quite likely, by the way, that grsecurity is delivering slightly different patches (you know, whitespace differences or trivial variable name differences, that sort of thing) to different customers, in order to be able to identify who leaks a patch in violation of the contract. (See https://en.wikipedia.org/wiki/Trap_street https://en.wikipedia.org/wiki/Trap_street for maps, but on a per-customer basis.) -43 kfogel gnu_user: I'm pointing this out because some customer might be tempted to leak anonymously. They should be aware that they are probably identifiable, unless they try to scrub the diff in some way (might be hard). If you can get multiple customers to privately compare their patches, you can determine if grsecurity is using this technique. -45 kfogel gnu_user: bkuhn knows a lot about GPL compliance; I hope he reads the above and can recommend and/or take some action. -45 gnu_user kfogel: I hope so too. -45 vmbrasseur IIRC, bkuhn may be in transit right now. -45 gnu_user kfogel: this situation is not new to the law -45 gnu_user companies do this all the time against one another and are brought to court for tort violations -46 gnu_user the difference here is that they all have direct privity with eachother -46 gnu_user here the linux rightsholder does not have direct privity with the sublicensor that is prevented from redistirbuting -47 gnu_user thus a quazi-contractual argument might have to be made -47 kfogel gnu_user: Ah, sounds like you know much more about the history & context than I do anyway, good. Thanks for pointing this one out I'm very curious to see what happensW! -48 gnu_user the remedy would likely be in equity thusly (since quazi-contract etc) -50 -!- JordiGH [jordi] has joined #conservancy -51 -!- kfogel [~Karl] has quit [Ping timeout: 258 seconds] -52 -!- kfogel [~Karl] has joined #conservancy -04 @bkuhn gnu_user: I'm familiar with the public discussion about the grsecurity situation. If a customer thinks they have a tort claim of some sort under GPL in a situation like this, they should certainly bring it on their own. -05 @bkuhn Whether it's a GPL violation depends on various details that I'm not privy to. Redistribution is not mandatory under GPL, so there would have to be some sort of specific GPLv2 Secition 6/7 problem shown. -05 JordiGH Funding cuts have also tightened the conference travel budget, eh? -05 @bkuhn JordiGH: huh? -05 JordiGH Sorry, I thought you said you weren't at Pycon this year. -06 @bkuhn JordiGH: if you are asking about PyCon, my talk wasn't accepted. -06 JordiGH What was your proposal? Did you get any attention at all? Last time I submitted a talk, I'm sure nobody even looked at the proposal beyond the title. -06 @bkuhn JordiGH: I forget, anyway I was asked to keynote another conference elsewhere in the world tomorrow, so I am there now. -07 JordiGH Oh! Neat! Where? -07 @bkuhn JordiGH: http://oss2016.org/speakers http://oss2016.org/speakers -08 JordiGH Finland! -08 @bkuhn gnu_user: showing a GPLv2 Section 6 or 7 problem often require seeing what written agreements people have with the party. If someone has specifics, they can certainly report the violation officially to compliance@sfconservancy.org
zyx123zyx 10y ago
RMS has weighed in (responded to my email (the email I sent is the same text as the current originating post at: https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html )) Re: GRsecurity is preventing others from employing their rights under version 2 the GPL to redistribute source code Richard Stallman (May 31 2016 10:27 PM) [[[ To any NSA and FBI agents reading my email: please consider ]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] If I understand right, this is a matter of GPL 2 on the Linux patches. Is that right? If so, I think GRsecurity is violating the GPL on Linux. -- Dr Richard Stallman President, Free Software Foundation (gnu.org, fsf.org) Internet Hall-of-Famer (internethalloffame.org) Skype: No way! See stallman.org/skype.html.