3 ms·

My understanding is that they threaten to never give someone who distributes their patches any more updates. While the GPL does not forbid this (it's a contract

by cyphar 10y ago

My understanding is that they threaten to never give someone who distributes their patches any more updates. While the GPL does not forbid this (it's a contract you agreed to with the party), I'm fairly sure that such a contract would be considered acting in bad faith (you're adding additional restrictions through coercion rather than changing the license terms). I'm not a lawyer, but I'd be surprised if such sneakiness hasn't already been deemed illegal by the courts. I'm also surprised nobody has asked the SFConservancy to take GRSecurity to court over it. You'd think even Linus (who doesn't agree with the underlying spirit of the GPL -- all software should be free) would have a problem with "not getting patches back".

xyz123xyz 10y ago
You are correct. I've been trying to explain this very thing to people, but every #fsf, #gnu, /tech/ etc lay person just screams that I'm wrong and I'm and idiot, and I that I'm lying when I say I have a law degree and passed the bar etc. I have contacted the SFConservancy in the chat room (#conservancy or irc.freenode.net ) as-well as by email (I don't know if that went through or straight to spam though, I didn't get a response yet). I don't assume that they have a lawyer in the chat room though, especially during the day I contacted them (was a holiday). I encourage you and others to also contact them, to push this issue and show people care. Also if anyone is a linux code contributor, especially if they contributed a portion of code that is touched by grsecurity (grsecurity touches alot of things), you are a potential plaintiff. Here is the log:
xyz123xyz 10y ago
(Chat log:) -30 gnu_user http://pastebin.ca/3614117 http://pastebin.ca/3614117 -39 kfogel gnu_user: I am not a lawyer, and I don't represent the Conservancy, but this does sound disturbing. It is not a new situation even back in the 1990s, there were cases where some companies attempted to sign private contracts with customers whereby the customers agreed to give up some of their rights under the GPLv2, as a condition of receiving patches under the GPLv2. My memory is that the FSF determined this to be a violation of the GPL (on the patch -39 kfogel supplier's part), but I am not positive of that, nor do I remember the specific parties involved. However, the case was very similar to what you are describing with grsecurity. -42 kfogel gnu_user: It is quite likely, by the way, that grsecurity is delivering slightly different patches (you know, whitespace differences or trivial variable name differences, that sort of thing) to different customers, in order to be able to identify who leaks a patch in violation of the contract. (See https://en.wikipedia.org/wiki/Trap_street https://en.wikipedia.org/wiki/Trap_street for maps, but on a per-customer basis.) -43 kfogel gnu_user: I'm pointing this out because some customer might be tempted to leak anonymously. They should be aware that they are probably identifiable, unless they try to scrub the diff in some way (might be hard). If you can get multiple customers to privately compare their patches, you can determine if grsecurity is using this technique. -45 kfogel gnu_user: bkuhn knows a lot about GPL compliance; I hope he reads the above and can recommend and/or take some action. -45 gnu_user kfogel: I hope so too. -45 vmbrasseur IIRC, bkuhn may be in transit right now. -45 gnu_user kfogel: this situation is not new to the law -45 gnu_user companies do this all the time against one another and are brought to court for tort violations -46 gnu_user the difference here is that they all have direct privity with eachother -46 gnu_user here the linux rightsholder does not have direct privity with the sublicensor that is prevented from redistirbuting -47 gnu_user thus a quazi-contractual argument might have to be made -47 kfogel gnu_user: Ah, sounds like you know much more about the history & context than I do anyway, good. Thanks for pointing this one out I'm very curious to see what happensW! -48 gnu_user the remedy would likely be in equity thusly (since quazi-contract etc) -50 -!- JordiGH [jordi] has joined #conservancy -51 -!- kfogel [~Karl] has quit [Ping timeout: 258 seconds] -52 -!- kfogel [~Karl] has joined #conservancy -04 @bkuhn gnu_user: I'm familiar with the public discussion about the grsecurity situation. If a customer thinks they have a tort claim of some sort under GPL in a situation like this, they should certainly bring it on their own. -05 @bkuhn Whether it's a GPL violation depends on various details that I'm not privy to. Redistribution is not mandatory under GPL, so there would have to be some sort of specific GPLv2 Secition 6/7 problem shown. -05 JordiGH Funding cuts have also tightened the conference travel budget, eh? -05 @bkuhn JordiGH: huh? -05 JordiGH Sorry, I thought you said you weren't at Pycon this year. -06 @bkuhn JordiGH: if you are asking about PyCon, my talk wasn't accepted. -06 JordiGH What was your proposal? Did you get any attention at all? Last time I submitted a talk, I'm sure nobody even looked at the proposal beyond the title. -06 @bkuhn JordiGH: I forget, anyway I was asked to keynote another conference elsewhere in the world tomorrow, so I am there now. -07 JordiGH Oh! Neat! Where? -07 @bkuhn JordiGH: http://oss2016.org/speakers http://oss2016.org/speakers -08 JordiGH Finland! -08 @bkuhn gnu_user: showing a GPLv2 Section 6 or 7 problem often require seeing what written agreements people have with the party. If someone has specifics, they can certainly report the violation officially to compliance@sfconservancy.org
xyz123xyz 10y ago
cyphar: Your understanding is correct, but free software "proponents" and techies will swear up and down that you and I do not know what we are talking about and years of law school makes no difference and in-fact it's all lies: https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html >>605494 >And, to reiterate, you're basically arguing that if I create a derivative of the Linux kernel on my computer, and I share the patches with others, but not you, I'm legally obligated to share the tree with you. You are not permitted to erect barriers in the way of sublicencees making use of their right to redistribute, a right that is granted by the original rights-holder. That is called bad faith on your part and your rights to the copyrighted work are dissolved since you have acted in bad faith towards the agreement you have with the original rightsholder (who has stipulated that sublicensees may redistribute at will: a purpose you are attempting (and succeding at) frustrating). It does not matter what form these barriers take. The original licensor has a claim against you, then, for copyright infringement. The sublicensees have tort claims such as tortious interference (with their quazi-contactual business relationship with the original licensor). The original licensor has the same such tort claim.
xyz123xyz 10y ago
The techies at https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html still swear to high heaven everything is fine and dandy, no gpl violation, there is no convincing them. Eventually any counter-argument is met by "jew", "gas chamber", and "kill all laywers". The techies on #fsf and #gnu have a similar opinion, without the name calling. SFConservancy also seems to have a similar opinion, but I'm not sure. None seem to have ever heard of bad faith.

by cyphar 10y ago

xyz123xyz 10y ago

You are correct. I've been trying to explain this very thing to people, but every #fsf, #gnu, /tech/ etc lay person just screams that I'm wrong and I'm and idiot, and I that I'm lying when I say I have a law degree and passed the bar etc. I have contacted the SFConservancy in the chat room (#conservancy or irc.freenode.net ) as-well as by email (I don't know if that went through or straight to spam though, I didn't get a response yet). I don't assume that they have a lawyer in the chat room though, especially during the day I contacted them (was a holiday). I encourage you and others to also contact them, to push this issue and show people care. Also if anyone is a linux code contributor, especially if they contributed a portion of code that is touched by grsecurity (grsecurity touches alot of things), you are a potential plaintiff. Here is the log:

xyz123xyz 10y ago

(Chat log:) -30 gnu_user http://pastebin.ca/3614117 http://pastebin.ca/3614117 -39 kfogel gnu_user: I am not a lawyer, and I don't represent the Conservancy, but this does sound disturbing. It is not a new situation even back in the 1990s, there were cases where some companies attempted to sign private contracts with customers whereby the customers agreed to give up some of their rights under the GPLv2, as a condition of receiving patches under the GPLv2. My memory is that the FSF determined this to be a violation of the GPL (on the patch -39 kfogel supplier's part), but I am not positive of that, nor do I remember the specific parties involved. However, the case was very similar to what you are describing with grsecurity. -42 kfogel gnu_user: It is quite likely, by the way, that grsecurity is delivering slightly different patches (you know, whitespace differences or trivial variable name differences, that sort of thing) to different customers, in order to be able to identify who leaks a patch in violation of the contract. (See https://en.wikipedia.org/wiki/Trap_street https://en.wikipedia.org/wiki/Trap_street for maps, but on a per-customer basis.) -43 kfogel gnu_user: I'm pointing this out because some customer might be tempted to leak anonymously. They should be aware that they are probably identifiable, unless they try to scrub the diff in some way (might be hard). If you can get multiple customers to privately compare their patches, you can determine if grsecurity is using this technique. -45 kfogel gnu_user: bkuhn knows a lot about GPL compliance; I hope he reads the above and can recommend and/or take some action. -45 gnu_user kfogel: I hope so too. -45 vmbrasseur IIRC, bkuhn may be in transit right now. -45 gnu_user kfogel: this situation is not new to the law -45 gnu_user companies do this all the time against one another and are brought to court for tort violations -46 gnu_user the difference here is that they all have direct privity with eachother -46 gnu_user here the linux rightsholder does not have direct privity with the sublicensor that is prevented from redistirbuting -47 gnu_user thus a quazi-contractual argument might have to be made -47 kfogel gnu_user: Ah, sounds like you know much more about the history & context than I do anyway, good. Thanks for pointing this one out I'm very curious to see what happensW! -48 gnu_user the remedy would likely be in equity thusly (since quazi-contract etc) -50 -!- JordiGH [jordi] has joined #conservancy -51 -!- kfogel [~Karl] has quit [Ping timeout: 258 seconds] -52 -!- kfogel [~Karl] has joined #conservancy -04 @bkuhn gnu_user: I'm familiar with the public discussion about the grsecurity situation. If a customer thinks they have a tort claim of some sort under GPL in a situation like this, they should certainly bring it on their own. -05 @bkuhn Whether it's a GPL violation depends on various details that I'm not privy to. Redistribution is not mandatory under GPL, so there would have to be some sort of specific GPLv2 Secition 6/7 problem shown. -05 JordiGH Funding cuts have also tightened the conference travel budget, eh? -05 @bkuhn JordiGH: huh? -05 JordiGH Sorry, I thought you said you weren't at Pycon this year. -06 @bkuhn JordiGH: if you are asking about PyCon, my talk wasn't accepted. -06 JordiGH What was your proposal? Did you get any attention at all? Last time I submitted a talk, I'm sure nobody even looked at the proposal beyond the title. -06 @bkuhn JordiGH: I forget, anyway I was asked to keynote another conference elsewhere in the world tomorrow, so I am there now. -07 JordiGH Oh! Neat! Where? -07 @bkuhn JordiGH: http://oss2016.org/speakers http://oss2016.org/speakers -08 JordiGH Finland! -08 @bkuhn gnu_user: showing a GPLv2 Section 6 or 7 problem often require seeing what written agreements people have with the party. If someone has specifics, they can certainly report the violation officially to compliance@sfconservancy.org

xyz123xyz 10y ago

cyphar: Your understanding is correct, but free software "proponents" and techies will swear up and down that you and I do not know what we are talking about and years of law school makes no difference and in-fact it's all lies: https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html >>605494 >And, to reiterate, you're basically arguing that if I create a derivative of the Linux kernel on my computer, and I share the patches with others, but not you, I'm legally obligated to share the tree with you. You are not permitted to erect barriers in the way of sublicencees making use of their right to redistribute, a right that is granted by the original rights-holder. That is called bad faith on your part and your rights to the copyrighted work are dissolved since you have acted in bad faith towards the agreement you have with the original rightsholder (who has stipulated that sublicensees may redistribute at will: a purpose you are attempting (and succeding at) frustrating). It does not matter what form these barriers take. The original licensor has a claim against you, then, for copyright infringement. The sublicensees have tort claims such as tortious interference (with their quazi-contactual business relationship with the original licensor). The original licensor has the same such tort claim.

xyz123xyz 10y ago

The techies at https://sys.8ch.net/tech/res/605120.html https://sys.8ch.net/tech/res/605120.html still swear to high heaven everything is fine and dandy, no gpl violation, there is no convincing them. Eventually any counter-argument is met by "jew", "gas chamber", and "kill all laywers". The techies on #fsf and #gnu have a similar opinion, without the name calling. SFConservancy also seems to have a similar opinion, but I'm not sure. None seem to have ever heard of bad faith.