11 ms·

License update

113 points by jboynyc 10y ago

richard_mcp 10y ago
This is probably partially in response to some of the issues that were discussed here: https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37
- the_mitsuhiko 10y ago
  The GPL is an amazing license to gag developers while looking like a good person in the process. Not saying that is happening here but I have seen this before where questionable motivations where the driving force behind the license choice.
  - dleslie 10y ago
    How does the GPL gag developers?
    - the_mitsuhiko 10y ago
      The GPL does not but it can be used as a vehicle that does.
      - khedoros 10y ago
        Can you provide a concrete example? I've seen three messages from you, and I still have no idea what you're talking about. Do you have an example of what you mean by "gag", in context of copyright? Do you have an example of how GPL or other licenses allows you to do something negative while maintaining a positive image?
        mhenr18 10y ago
        Not OP, but I think I get what they're trying to say. The GPL requires others to follow its terms, because that's the only license of the code that's available to them. There is no clause of the GPL or any software license that I'm aware of that prevents you from doing whatever you want with your own code under different terms. Therefore, you can do something negative (sell software that uses changes to GPL'd code without providing those sources to others when they ask for it), while maintaining a positive image ("look, I license my code under the GPL because I care about software freedom"). You can see this happening in practice with software that has a "community" edition available under the GPL, but a paid version that's not GPL'd. The holder of the copyright gets to profit off of other people's well meaning contributions (which almost certainly will have had their copyright assigned to the original copyright holder), but the people who contributed don't get the benefit of the copyright holder's changes to that code that are only available to paid customers. You can argue that those contributors made their contributions knowing that would happen, but the fact that it is possible somewhat undermines the entire point of the free software movement.
        khedoros 10y ago
        Those are some good points. Thank you for taking the time to answer!
  - khedoros 10y ago
    The GPL is an amazing license to prevent devs from profiting off others' work without also providing access to their own. Some might call that a "gag" because they're prevented from using the code without opening their own code as well, so it's closed to them for all practical purposes. Is that the kind of gag that you're talking about, or did you mean something different?
    - the_mitsuhiko 10y ago
      > Is that the kind of gag that you're talking about, or did you mean something different? I meant that the GPL as a license can be used to gag others while keeping a positive image as a person yourself. There are many licenses that can be used like this (the CDDL in particular was used for that purpose). That in itself has nothing to do with the GPL, more that you as a copyright holder have the ability to do things that are not available for others.
      - cyphar 10y ago
        I don't understand what you mean by "gag" and "positive image". The GPL is a very good license, because it has one benefit that almost all other licenses don't: it restricts use of your code to free software. If you care about software freedom, or want to live in a world where proprietary software is a thing of the past, then that should be reason enough to use it. Positive image is not a clause in the GPL, so I really don't know what you mean.
    - CaptainZapp 10y ago
      Reminds me of a /. sig, with which I agreed very much (paraphrased): If you don't like my software licensed under the GPL write your own damn software.
- Sir_Cmpwn 10y ago
  Moxie has always been a huge dick in this regard. I have no respect for Signal because of his mistreatment of the open source community.
  - moxie 10y ago
    I think it seems clear that, in some circles, I have a number of unpopular opinions around federation, third party clients, app distribution, and what technologies are necessary or appropriate for large scale adoption of end to end encryption in today's world. However, I'd be interested to hear more about why you think those unpopular opinions constitute "mistreatment." Am I guilty of something more than articulating my preferences and explaining our rationale for the decisions that we've made with our project?
    - mst 10y ago
      It seems to me that your choice to open source the code without also saying "sure, we'll just give away everything else however people who want to use the open source want us to" is resulting in people falling into the Copenhagen Interpretation of Ethics trap ( https://blog.jaibot.com/the-copenhagen-interpretation-of-ethics/ https://blog.jaibot.com/the-copenhagen-interpretation-of-eth... ). Shortest quote that summarises the article's point: "There wouldn’t be any scathing editorials if BBH Labs had just chosen to do nothing – but they did something helpful-but-not-maximally-helpful, and thus are open to judgment." Looking at the LibreSignal thread, you appear to be replying with the sort of snippy tone that I tend to end up using when I'm explaining the same damn thing for the Nth time to an audience that probably isn't going to listen. The only thing I've found that works for me to avoid ending up doing that is to summarise the explanation into (for IRC channels specifically) a factoid entry in an infobot or (for longer things and other distribution means) a blog post. Or, alternatively, (1) people are being entitled as fuck because, well, people are people, (2) you might wish to consider writing up a blog post explaining the reasons for all of said opinions and then just post a link to it, since this will probably achieve just as much as trying to argue and will be far less bloody annoying for you, (3) IMO you're not guilty of anything and "carry on doing exactly how you're already doing" is not a choice I personally can see any good reason to fault you for. (random free opinions of this HN commenter worth exactly what you paid, of course ;)
- tlrobinson 10y ago
  It's a little depressing Moxie believes federated protocols can't compete with unfederated/proprietary ones. I don't like the idea of all future innovation taking place in the Slacks and WhatsApps rather than the IRCs and SMTPs. Are there any recent counter examples of successful federated protocols? It would be an interesting thought experiment to design a protocol that started with the basic features of IRC and incrementally layered on new features in backwards compatible / gracefully degrading ways until you arrived at Slack. Of course it would be a lot easier with the benefit of hindsight than if you started in the 1980s.
  - Arathorn 10y ago
    That thought experiment lives today in the form of Matrix.org :)
  - dlmetcalf 10y ago
    Definitely check out https://matrix.org/ https://matrix.org/ @tlrobinson! It's all that and more. Not only does it have the basic features of XMPP+IRC (and others), but it also federates/bridges with those existing open standards! Plus supports WebRTC signalling and of course end-to-end 1:1 & group encryption (Olm/MegOlm). There's a range of client, server and library options. Vector.IM (with web, iOS and Android clients) is a good place for many to start and you can try on an existing service. Then if you want, just fire up your own server and it'll federate with the rest. If you only needed pure XMPP, Conversations.IM is superb too.
  - deleted 10y ago
    [deleted]
- nchammas 10y ago
  I think this blog post [0] is more of a direct response to the discussion in that thread. [0] https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
geofft 10y ago
The license change is from GPLv3 to, uh, dual GPLv3/MPL-on-the-App-Store-or-something? > Additional Permissions For Submission to Apple App Store: Provided that you are otherwise in compliance with the GPLv3 for each covered work you convey (including without limitation making the Corresponding Source available in compliance with Section 6 of the GPLv3), Open Whisper Systems also grants you the additional permission to convey through the Apple App Store non-source executable versions of the Program as incorporated into each applicable covered work as Executable Versions only under the Mozilla Public License version 2.0 (https://www.mozilla.org/en-US/MPL/2.0/ https://www.mozilla.org/en-US/MPL/2.0/). This seems less straightforward than what e.g. Mosh has. https://github.com/mobile-shell/mosh/blob/master/COPYING.iOS https://github.com/mobile-shell/mosh/blob/master/COPYING.iOS
- moxie 10y ago
  Tough crowd! That's what we used to do, but some extremely vocal people weren't satisfied, so we've done this to integrate our intentions into the license itself.
  - geofft 10y ago
    Oh, I totally missed that the MPL makes you deliver source with binaries. I think I had it confused in my head with the Apache License 2.0 somehow. OK, I'll admit that this is in fact clearer than the Mosh approach. (My main confusion was whether you expected me to offer source if the only binary I distributed was an iOS app; the Mosh waiver is very clear about that.)
    - moxie 10y ago
      "Provided that you are otherwise in compliance with the GPLv3 for each covered work you convey (including without limitation making the Corresponding Source available in compliance with Section 6 of the GPLv3)..." Yes, the expectation is that you still have to comply with the GPLv3 (including making the corresponding source for your derivative work available), at which point you have the additional freedom to distribute the app through the app store.
  - 10y ago
ge0rg 10y ago
Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
- morsch 10y ago
  That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of course the fallout of shutting them out would only grow over time. Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Thirds party clients would be at the mercy of their developers when OWS makes an incompatible change. Caveat emptor, I would say, but again, the problem would only grow. My personal situation is that the only people I talk to via Signal are nerds; the kind of people who jump ship when a sexier alternative comes up -- like we did when TextSecure/Signal offered good e2e crypto. But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal.
  - moxie 10y ago
    > Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who communicate with them as well. For example, LibreSignal doesn't support voice calls. When normal Signal users try to call LibreSignal users, it just doesn't work. Most normal Signal users don't care or understand or sympathize with the idea that the person they're trying to call uses some other app which doesn't support voice calls. They'll just think that Signal voice calls are flaky and randomly don't work sometimes. That's one example, but as development progresses, there will inevitably be more. We're concerned about exactly the same set of problems we found with federation. > But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal. Just to be clear, I think that's great. If people don't feel it's necessary to use Signal because Signal Protocol is "the new normal" in the apps they already use, then I think we've succeeded. Hopefully we'll eventually have the chance to push the envelope forward again and restart that cycle.
chrisballinger 10y ago
Thank you Moxie! Although we personally trusted and would've moved forward with Moxie's informal permission to distribute SignalProtocol within ChatSecure on the App Store, our funder required us to get the legal details squared away or we'd lose our funding. This announcement is an amazing gift for us, and for other GPL compatible Mac/iOS apps. This announcement also more broadly benefits the copyleft community. There has been a decline in GPL apps on Apple platforms, particularly because of this conflict between the GPL and Apple's App Stores. It makes it clumsy to accept pull requests because you need a CLA to allow relicensing for distribution. There's a also lot of FUD from anti-Apple copyleft zealots. Having a good template for other developers who wish to stick to strong copyleft without worrying about App Store issues is a great contribution to the Apple-friendly copyleft community.
- Natanael_L 10y ago
  Apple could always do what Google does, to state that in the case of copyleft licenses their term take precedence over the ToS (neutralizing restrictive terms like the redistribution ban on everything you download from the store).
  - comex 10y ago
    Where does Google state that? This meme keeps going around that the Android store is GPL compatible. But where is the actual license text that allows this, or at least how does the situation differ from that with iOS? I checked the current Google Play Terms of Service and the iTunes Terms and Conditions. The two were alike in several respects: - They had no blanket exception or deference I could find to third party agreements, nor any relevant mention of the terms "open source" or "copyleft". There is something in the Google ToS that could be interpreted as such an exception, but the wording gives it dubious applicability to third party apps, and in any case, the Google Play ToS says that "if there is any conflict between the Google Play Terms of Service and the Google ToS, the Google Play Terms of Service shall prevail". - They dictated various random usage rules, again without any explicit exception clause. - One of those rules was a requirement not to circumvent DRM. AFAIK, both app stores do in fact store apps obfuscated/encrypted on disk, so it wouldn't be possible to usefully redistribute the apps without engaging in such circumvention. (The requirement was in each case worded broadly enough to potentially apply to any DRM included with the app itself, though this is just another example of a random potentially-conflicting usage rule.) - However, they both state that apps are licensed directly from the developer to the user, with the store distributing them on the developer's behalf, rather than licensed to the store and sublicensed from there to the user. (If that even means anything.) Therefore, it could be argued - I don't know how much validity this would have, but it could be argued - that the GPL's "you may not impose any further restrictions" clause is not in fact violated, because you (i.e. the app developer) are not imposing any further restrictions - the restrictions come from a separate contract you're not a party to - and Google/Apple is not bound by the terms because it's just distributing stuff on your behalf rather than on its own authority. Therefore, on both stores GPL compatibility is possible but dubious. Where is the difference? (By the way, I've been lazy and haven't checked the respective developer agreements. It's possible that one or both agreements have clauses that impede legally submitting GPL apps to the store, but they can't generally authorize behavior that the ToS forbids - since users are not party to them - so any such difference wouldn't affect my main point about the Play Store having similar restrictions to what people have complained about wrt the iOS App Store.) Source: == The Google ToS clause == Open source software is important to us. Some software used in our Services may be offered under an open source license that we will make available to you. There may be provisions in the open source license that expressly override some of these terms. http://www.google.com/intl/en/policies/terms/ http://www.google.com/intl/en/policies/terms/ == Random usage rules == Google: Capturing of Streams. You may not use Google Play or any Content in conjunction with any stream-ripping, stream capture or similar software to record or create a copy of any Content that is presented to you in streaming format. Use of Android Apps. You must use apps from Google Play in accordance with the Google Play Business and Program Policies which are in place from time to time, the current version of which can be found at http://play.google.com/about/android-developer-policies.html http://play.google.com/about/android-developer-policies.html Apple: (ii) If you are a commercial enterprise or educational institution, you may download and sync an App Store Product for use by either (a) a single individual on one or more iOS or tvOS Devices used by that individual that you own or control or (b) multiple individuals, on a single shared iOS or tvOS Device you own or control. [..] For the sake of clarity, each iOS or tvOS Device used serially or collectively by multiple users requires a separate license. == No DRM circumvention == Google: Security Features. You may not attempt to, nor assist, authorise or encourage others to circumvent, disable or defeat any of the security features or components, such as digital rights management software or encryption, that protect, obfuscate or otherwise restrict access to any Content or Google Play. If you violate any security feature, you may incur civil or criminal liability. Apple: You agree that the App and Book Services and certain App and Book Products include security technology that limits your use of App and Book Products and that, whether or not App and Book Products are limited by security technology, you shall use App and Book Products in compliance with the applicable usage rules established by Apple and its principals (“Usage Rules”), and that any other use of the App and Book Products may constitute a copyright infringement. Any security technology is an inseparable part of the App and Book Products. Apple reserves the right to modify the Usage Rules at any time. You agree not to violate, circumvent, reverse-engineer, decompile, disassemble, or otherwise tamper with any of the security technology related to such Usage Rules for any reason—or to attempt or assist another person to do so. == On who is licensing apps to whom == Google: When you buy “Content” (defined as data files, applications, written text, mobile device software, music, audio files or other sounds, photographs, videos or other images) on Google Play you will buy it either: [..] (c) in the case of Android apps, from the Provider of the app (an “App Sale”). Each time that you purchase Content, you enter into a separate sale contract: [..] (f) with the Provider of the Content you have purchased (in the case of App Sales). The separate sale contract in (e) or (f) above (as applicable) is in addition to your contract with Google Inc. for the use of the Service (i.e. these Google Play Terms of Service). Apple: You acknowledge that: you are acquiring the license to each Third-Party Product from the Application Provider; Apple is acting as agent for the Application Provider in providing each such Third-Party Product to you; and Apple is not a party to the license between you and the Application Provider with respect to that Third-Party Product. Source: Google: https://play.google.com/about/play-terms.html https://play.google.com/about/play-terms.html Apple: http://www.apple.com/legal/internet-services/itunes/us/terms.html http://www.apple.com/legal/internet-services/itunes/us/terms... (warning: the Apple ToS has separate sections with similar terms for media and apps, and there is also a "Licensed Application End User License Agreement" that specifies it's merely a default for apps without their own terms, so make sure you look in the right sections.)
sigdoubt 10y ago
Tangentially related, but since we're talking about Signal and have Moxie's attention ... Does anybody know how the "privacy preserving contact discovery" works? One of my unpleasant experiences with Signal was receiving a greeting from an unknown number when I installed it. Fortunately, it was a friend with a new number I hadn't known ... but the potential privacy leak - without any apparent warning, consent or opportunity to opt-out - bothered me. Best info I could find is a blog basically saying "privacy preserving contact discovery is an unsolved problem" ... which is hardly reassuring: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ What's the story?
- brbsix 10y ago
  I posted on the issue tracker and a few other places about this and was shut down. Apparently it's a support issue, not a technical one. From my (limited and potentially erroneous) understanding, Signal hashes each of your local contacts and uses that hash to query whether the number is registered with OWS. If so, you receive a notification to that effect. Essentially, you can identify Signal users without actually communicating with them. Though the same is true with PGP if you use a public keyserver. That said, it gave some friends quite a fright. It's really unfortunate this wasn't opt-in or publicized before-hand.
lucb1e 10y ago
The license file in the library linked from the blog post hasn't been changed in 9 months. What am I missing? https://github.com/WhisperSystems/libsignal-protocol-c/blob/master/LICENSE https://github.com/WhisperSystems/libsignal-protocol-c/blob/...

113 points by jboynyc 10y ago

This is probably partially in response to some of the issues that were discussed here: https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37

the_mitsuhiko 10y ago
The GPL is an amazing license to gag developers while looking like a good person in the process. Not saying that is happening here but I have seen this before where questionable motivations where the driving force behind the license choice.
- dleslie 10y ago
  How does the GPL gag developers?
  - the_mitsuhiko 10y ago
    The GPL does not but it can be used as a vehicle that does.
    - khedoros 10y ago
      Can you provide a concrete example? I've seen three messages from you, and I still have no idea what you're talking about. Do you have an example of what you mean by "gag", in context of copyright? Do you have an example of how GPL or other licenses allows you to do something negative while maintaining a positive image?
      - mhenr18 10y ago
        Not OP, but I think I get what they're trying to say. The GPL requires others to follow its terms, because that's the only license of the code that's available to them. There is no clause of the GPL or any software license that I'm aware of that prevents you from doing whatever you want with your own code under different terms. Therefore, you can do something negative (sell software that uses changes to GPL'd code without providing those sources to others when they ask for it), while maintaining a positive image ("look, I license my code under the GPL because I care about software freedom"). You can see this happening in practice with software that has a "community" edition available under the GPL, but a paid version that's not GPL'd. The holder of the copyright gets to profit off of other people's well meaning contributions (which almost certainly will have had their copyright assigned to the original copyright holder), but the people who contributed don't get the benefit of the copyright holder's changes to that code that are only available to paid customers. You can argue that those contributors made their contributions knowing that would happen, but the fact that it is possible somewhat undermines the entire point of the free software movement.
        khedoros 10y ago
        Those are some good points. Thank you for taking the time to answer!
- khedoros 10y ago
  The GPL is an amazing license to prevent devs from profiting off others' work without also providing access to their own. Some might call that a "gag" because they're prevented from using the code without opening their own code as well, so it's closed to them for all practical purposes. Is that the kind of gag that you're talking about, or did you mean something different?
  - the_mitsuhiko 10y ago
    > Is that the kind of gag that you're talking about, or did you mean something different? I meant that the GPL as a license can be used to gag others while keeping a positive image as a person yourself. There are many licenses that can be used like this (the CDDL in particular was used for that purpose). That in itself has nothing to do with the GPL, more that you as a copyright holder have the ability to do things that are not available for others.
    - cyphar 10y ago
      I don't understand what you mean by "gag" and "positive image". The GPL is a very good license, because it has one benefit that almost all other licenses don't: it restricts use of your code to free software. If you care about software freedom, or want to live in a world where proprietary software is a thing of the past, then that should be reason enough to use it. Positive image is not a clause in the GPL, so I really don't know what you mean.
  - CaptainZapp 10y ago
    Reminds me of a /. sig, with which I agreed very much (paraphrased): If you don't like my software licensed under the GPL write your own damn software.
Sir_Cmpwn 10y ago
Moxie has always been a huge dick in this regard. I have no respect for Signal because of his mistreatment of the open source community.
- moxie 10y ago
  I think it seems clear that, in some circles, I have a number of unpopular opinions around federation, third party clients, app distribution, and what technologies are necessary or appropriate for large scale adoption of end to end encryption in today's world. However, I'd be interested to hear more about why you think those unpopular opinions constitute "mistreatment." Am I guilty of something more than articulating my preferences and explaining our rationale for the decisions that we've made with our project?
  - mst 10y ago
    It seems to me that your choice to open source the code without also saying "sure, we'll just give away everything else however people who want to use the open source want us to" is resulting in people falling into the Copenhagen Interpretation of Ethics trap ( https://blog.jaibot.com/the-copenhagen-interpretation-of-ethics/ https://blog.jaibot.com/the-copenhagen-interpretation-of-eth... ). Shortest quote that summarises the article's point: "There wouldn’t be any scathing editorials if BBH Labs had just chosen to do nothing – but they did something helpful-but-not-maximally-helpful, and thus are open to judgment." Looking at the LibreSignal thread, you appear to be replying with the sort of snippy tone that I tend to end up using when I'm explaining the same damn thing for the Nth time to an audience that probably isn't going to listen. The only thing I've found that works for me to avoid ending up doing that is to summarise the explanation into (for IRC channels specifically) a factoid entry in an infobot or (for longer things and other distribution means) a blog post. Or, alternatively, (1) people are being entitled as fuck because, well, people are people, (2) you might wish to consider writing up a blog post explaining the reasons for all of said opinions and then just post a link to it, since this will probably achieve just as much as trying to argue and will be far less bloody annoying for you, (3) IMO you're not guilty of anything and "carry on doing exactly how you're already doing" is not a choice I personally can see any good reason to fault you for. (random free opinions of this HN commenter worth exactly what you paid, of course ;)
tlrobinson 10y ago
It's a little depressing Moxie believes federated protocols can't compete with unfederated/proprietary ones. I don't like the idea of all future innovation taking place in the Slacks and WhatsApps rather than the IRCs and SMTPs. Are there any recent counter examples of successful federated protocols? It would be an interesting thought experiment to design a protocol that started with the basic features of IRC and incrementally layered on new features in backwards compatible / gracefully degrading ways until you arrived at Slack. Of course it would be a lot easier with the benefit of hindsight than if you started in the 1980s.
- Arathorn 10y ago
  That thought experiment lives today in the form of Matrix.org :)
- dlmetcalf 10y ago
  Definitely check out https://matrix.org/ https://matrix.org/ @tlrobinson! It's all that and more. Not only does it have the basic features of XMPP+IRC (and others), but it also federates/bridges with those existing open standards! Plus supports WebRTC signalling and of course end-to-end 1:1 & group encryption (Olm/MegOlm). There's a range of client, server and library options. Vector.IM (with web, iOS and Android clients) is a good place for many to start and you can try on an existing service. Then if you want, just fire up your own server and it'll federate with the rest. If you only needed pure XMPP, Conversations.IM is superb too.
- deleted 10y ago
  [deleted]
nchammas 10y ago
I think this blog post [0] is more of a direct response to the discussion in that thread. [0] https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/

geofft 10y ago

The license change is from GPLv3 to, uh, dual GPLv3/MPL-on-the-App-Store-or-something? > Additional Permissions For Submission to Apple App Store: Provided that you are otherwise in compliance with the GPLv3 for each covered work you convey (including without limitation making the Corresponding Source available in compliance with Section 6 of the GPLv3), Open Whisper Systems also grants you the additional permission to convey through the Apple App Store non-source executable versions of the Program as incorporated into each applicable covered work as Executable Versions only under the Mozilla Public License version 2.0 (https://www.mozilla.org/en-US/MPL/2.0/ https://www.mozilla.org/en-US/MPL/2.0/). This seems less straightforward than what e.g. Mosh has. https://github.com/mobile-shell/mosh/blob/master/COPYING.iOS https://github.com/mobile-shell/mosh/blob/master/COPYING.iOS

moxie 10y ago
Tough crowd! That's what we used to do, but some extremely vocal people weren't satisfied, so we've done this to integrate our intentions into the license itself.
- geofft 10y ago
  Oh, I totally missed that the MPL makes you deliver source with binaries. I think I had it confused in my head with the Apache License 2.0 somehow. OK, I'll admit that this is in fact clearer than the Mosh approach. (My main confusion was whether you expected me to offer source if the only binary I distributed was an iOS app; the Mosh waiver is very clear about that.)
  - moxie 10y ago
    "Provided that you are otherwise in compliance with the GPLv3 for each covered work you convey (including without limitation making the Corresponding Source available in compliance with Section 6 of the GPLv3)..." Yes, the expectation is that you still have to comply with the GPLv3 (including making the corresponding source for your derivative work available), at which point you have the additional freedom to distribute the app through the app store.
- 10y ago

ge0rg 10y ago

Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

morsch 10y ago
That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of course the fallout of shutting them out would only grow over time. Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Thirds party clients would be at the mercy of their developers when OWS makes an incompatible change. Caveat emptor, I would say, but again, the problem would only grow. My personal situation is that the only people I talk to via Signal are nerds; the kind of people who jump ship when a sexier alternative comes up -- like we did when TextSecure/Signal offered good e2e crypto. But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal.
- moxie 10y ago
  > Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who communicate with them as well. For example, LibreSignal doesn't support voice calls. When normal Signal users try to call LibreSignal users, it just doesn't work. Most normal Signal users don't care or understand or sympathize with the idea that the person they're trying to call uses some other app which doesn't support voice calls. They'll just think that Signal voice calls are flaky and randomly don't work sometimes. That's one example, but as development progresses, there will inevitably be more. We're concerned about exactly the same set of problems we found with federation. > But that's stopped being a unique feature since WhatsApp also uses the Signal Protocol, which simultaneously made it feel much less pressing to convince non-nerds to switch from WA to Signal. Just to be clear, I think that's great. If people don't feel it's necessary to use Signal because Signal Protocol is "the new normal" in the apps they already use, then I think we've succeeded. Hopefully we'll eventually have the chance to push the envelope forward again and restart that cycle.

chrisballinger 10y ago

Thank you Moxie! Although we personally trusted and would've moved forward with Moxie's informal permission to distribute SignalProtocol within ChatSecure on the App Store, our funder required us to get the legal details squared away or we'd lose our funding. This announcement is an amazing gift for us, and for other GPL compatible Mac/iOS apps. This announcement also more broadly benefits the copyleft community. There has been a decline in GPL apps on Apple platforms, particularly because of this conflict between the GPL and Apple's App Stores. It makes it clumsy to accept pull requests because you need a CLA to allow relicensing for distribution. There's a also lot of FUD from anti-Apple copyleft zealots. Having a good template for other developers who wish to stick to strong copyleft without worrying about App Store issues is a great contribution to the Apple-friendly copyleft community.

Natanael_L 10y ago
Apple could always do what Google does, to state that in the case of copyleft licenses their term take precedence over the ToS (neutralizing restrictive terms like the redistribution ban on everything you download from the store).
- comex 10y ago
  Where does Google state that? This meme keeps going around that the Android store is GPL compatible. But where is the actual license text that allows this, or at least how does the situation differ from that with iOS? I checked the current Google Play Terms of Service and the iTunes Terms and Conditions. The two were alike in several respects: - They had no blanket exception or deference I could find to third party agreements, nor any relevant mention of the terms "open source" or "copyleft". There is something in the Google ToS that could be interpreted as such an exception, but the wording gives it dubious applicability to third party apps, and in any case, the Google Play ToS says that "if there is any conflict between the Google Play Terms of Service and the Google ToS, the Google Play Terms of Service shall prevail". - They dictated various random usage rules, again without any explicit exception clause. - One of those rules was a requirement not to circumvent DRM. AFAIK, both app stores do in fact store apps obfuscated/encrypted on disk, so it wouldn't be possible to usefully redistribute the apps without engaging in such circumvention. (The requirement was in each case worded broadly enough to potentially apply to any DRM included with the app itself, though this is just another example of a random potentially-conflicting usage rule.) - However, they both state that apps are licensed directly from the developer to the user, with the store distributing them on the developer's behalf, rather than licensed to the store and sublicensed from there to the user. (If that even means anything.) Therefore, it could be argued - I don't know how much validity this would have, but it could be argued - that the GPL's "you may not impose any further restrictions" clause is not in fact violated, because you (i.e. the app developer) are not imposing any further restrictions - the restrictions come from a separate contract you're not a party to - and Google/Apple is not bound by the terms because it's just distributing stuff on your behalf rather than on its own authority. Therefore, on both stores GPL compatibility is possible but dubious. Where is the difference? (By the way, I've been lazy and haven't checked the respective developer agreements. It's possible that one or both agreements have clauses that impede legally submitting GPL apps to the store, but they can't generally authorize behavior that the ToS forbids - since users are not party to them - so any such difference wouldn't affect my main point about the Play Store having similar restrictions to what people have complained about wrt the iOS App Store.) Source: == The Google ToS clause == Open source software is important to us. Some software used in our Services may be offered under an open source license that we will make available to you. There may be provisions in the open source license that expressly override some of these terms. http://www.google.com/intl/en/policies/terms/ http://www.google.com/intl/en/policies/terms/ == Random usage rules == Google: Capturing of Streams. You may not use Google Play or any Content in conjunction with any stream-ripping, stream capture or similar software to record or create a copy of any Content that is presented to you in streaming format. Use of Android Apps. You must use apps from Google Play in accordance with the Google Play Business and Program Policies which are in place from time to time, the current version of which can be found at http://play.google.com/about/android-developer-policies.html http://play.google.com/about/android-developer-policies.html Apple: (ii) If you are a commercial enterprise or educational institution, you may download and sync an App Store Product for use by either (a) a single individual on one or more iOS or tvOS Devices used by that individual that you own or control or (b) multiple individuals, on a single shared iOS or tvOS Device you own or control. [..] For the sake of clarity, each iOS or tvOS Device used serially or collectively by multiple users requires a separate license. == No DRM circumvention == Google: Security Features. You may not attempt to, nor assist, authorise or encourage others to circumvent, disable or defeat any of the security features or components, such as digital rights management software or encryption, that protect, obfuscate or otherwise restrict access to any Content or Google Play. If you violate any security feature, you may incur civil or criminal liability. Apple: You agree that the App and Book Services and certain App and Book Products include security technology that limits your use of App and Book Products and that, whether or not App and Book Products are limited by security technology, you shall use App and Book Products in compliance with the applicable usage rules established by Apple and its principals (“Usage Rules”), and that any other use of the App and Book Products may constitute a copyright infringement. Any security technology is an inseparable part of the App and Book Products. Apple reserves the right to modify the Usage Rules at any time. You agree not to violate, circumvent, reverse-engineer, decompile, disassemble, or otherwise tamper with any of the security technology related to such Usage Rules for any reason—or to attempt or assist another person to do so. == On who is licensing apps to whom == Google: When you buy “Content” (defined as data files, applications, written text, mobile device software, music, audio files or other sounds, photographs, videos or other images) on Google Play you will buy it either: [..] (c) in the case of Android apps, from the Provider of the app (an “App Sale”). Each time that you purchase Content, you enter into a separate sale contract: [..] (f) with the Provider of the Content you have purchased (in the case of App Sales). The separate sale contract in (e) or (f) above (as applicable) is in addition to your contract with Google Inc. for the use of the Service (i.e. these Google Play Terms of Service). Apple: You acknowledge that: you are acquiring the license to each Third-Party Product from the Application Provider; Apple is acting as agent for the Application Provider in providing each such Third-Party Product to you; and Apple is not a party to the license between you and the Application Provider with respect to that Third-Party Product. Source: Google: https://play.google.com/about/play-terms.html https://play.google.com/about/play-terms.html Apple: http://www.apple.com/legal/internet-services/itunes/us/terms.html http://www.apple.com/legal/internet-services/itunes/us/terms... (warning: the Apple ToS has separate sections with similar terms for media and apps, and there is also a "Licensed Application End User License Agreement" that specifies it's merely a default for apps without their own terms, so make sure you look in the right sections.)

sigdoubt 10y ago

Tangentially related, but since we're talking about Signal and have Moxie's attention ... Does anybody know how the "privacy preserving contact discovery" works? One of my unpleasant experiences with Signal was receiving a greeting from an unknown number when I installed it. Fortunately, it was a friend with a new number I hadn't known ... but the potential privacy leak - without any apparent warning, consent or opportunity to opt-out - bothered me. Best info I could find is a blog basically saying "privacy preserving contact discovery is an unsolved problem" ... which is hardly reassuring: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ What's the story?

brbsix 10y ago
I posted on the issue tracker and a few other places about this and was shut down. Apparently it's a support issue, not a technical one. From my (limited and potentially erroneous) understanding, Signal hashes each of your local contacts and uses that hash to query whether the number is registered with OWS. If so, you receive a notification to that effect. Essentially, you can identify Signal users without actually communicating with them. Though the same is true with PGP if you use a public keyserver. That said, it gave some friends quite a fright. It's really unfortunate this wasn't opt-in or publicized before-hand.

lucb1e 10y ago

The license file in the library linked from the blog post hasn't been changed in 9 months. What am I missing? https://github.com/WhisperSystems/libsignal-protocol-c/blob/master/LICENSE https://github.com/WhisperSystems/libsignal-protocol-c/blob/...