4 ms·

OVH should really be more clear that their Ubuntu images are modified down at the kernel level, and are not "stock" Ubuntu. This is the first time I've ever he

OVH should really be more clear that their Ubuntu images are modified down at the kernel level, and are not "stock" Ubuntu. This is the first time I've ever heard about this. Say what you want about software patents, or asserting copyright over an API, etc. But trademark law exists entirely to prevent confusion like this, and I think it's valid. Hosts should be required to loudly disclose that images are modified, or else they should get a licensing deal and have them certified by the trademark holder. Users think they're installing "Ubuntu", and they aren't. That's not acceptable to me.

andypants 10y ago
I agree. I thought I had installed ubuntu recently on ovh servers, and found many files/folders in `/sys/kernel` missing. I had to google around a bit to find out that when I installed Ubuntu, it wasn't actually Ubuntu, but OVH-modified Ubuntu. I ended up having 4 servers reinstalled with stock Ubuntu.
pietroalbini 10y ago
I manage a bare metal server rented at OVH, and when I discovered their kernel wasn't the stock one, I also found its last update was months before, without all the security patches released since then. That's not advertised at all in their product pages, and it exposes you to a bunch of security issues elsewhere fixed.
- deleted 10y ago
  [deleted]
- skrowl 10y ago
  To be fair, that's just the default setup. It's 2 commands to update it to the normal stock kernel.
  - pietroalbini 10y ago
    I know and I did that as soon as I discovered they ship a different kernel. The problem is they don't advertise "we ship an insecure kernel by default", and they call those insecure images "Ubuntu".
  - Raed667 10y ago
    May I ask what are those 2 steps?
    - jajern 10y ago
      sudo apt update && sudo apt upgrade -y
      - pietroalbini 10y ago
        That wouldn't work (even if you should do that anyway). The stock kernel is in a separate package.
    - pietroalbini 10y ago
      Check out this post: http://www.sysadminworld.com/2012/how-to-switch-to-the-standard-ubuntu-kernel-on-ovh/ http://www.sysadminworld.com/2012/how-to-switch-to-the-stand...
davb 10y ago
How does this work when Ubuntu package maintainers patch upstream packages? Do they arrange special trademark licensing terms with the upstream maintainer? I think I'm apt-get installing super-foo-blah, but during installation it's actually being patched so is deviating from what upstream are really shipping [1]. As I understand it, Canonical advocate patching upstream packages (with the noble goal of improving compatibility with their platform) and keeping the package under the same name. Just as OVH et al are doing with Ubuntu itself. [1] http://packaging.ubuntu.com/html/patches-to-packages.html http://packaging.ubuntu.com/html/patches-to-packages.html
- pietroalbini 10y ago
  If those packages' names are under trademark and the terms says you can't ship modified versions of the package, they must either: - Ask for the approval of the upstream developer - Rename the package, as Debian did with Firefox/IceWeasel The problem with the OVH images is their kernel lacks months of security patches, so they're advertising insecure images as "Ubuntu".
  - davb 10y ago
    I absolutely agree that downstream packages have some level of responsibility to maintain up-to-date packages. However, this alone isn't necessarily reason to prevent someone from distributing derived versions of your open source project using the original name. If this was the case, Canonical would prevent people from shipping EOL'd versions of Ubuntu under any circumstances. If I ship an appliance with Ubuntu 10.04 (EOL 2013-05-09), it would have the same negative impact as shipping a patched 16.04 with no up-to-date patches or a similarly unpatchable kernel or core package.
    - pietroalbini 10y ago
      Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not. Edit: typo
hoahluke 10y ago
I totally agree with you, but how does the trademark licensing help with confusion in this case? If they were to pay 1-2e/mo to use the trademark legally, wouldn't the confusion still exist? Or is the full story actually that they have to pay _and_ actually offer it as stock Ubuntu?
- pietroalbini 10y ago
  AFAIK they must certify their images, which means they should offer a stock or a stock-like image approved by Canonical. Unfortunately the only source we currently have is that tweet, which isn't the clearest one.
  - icebraining 10y ago
    Ubuntu's IP policies are public, and you're right, modified versions must be approved by Canonical: http://www.ubuntu.com/legal/terms-and-policies/intellectual-property-policy http://www.ubuntu.com/legal/terms-and-policies/intellectual-...
Thaxll 10y ago
Digital Ocean does the same, it's even worse with DO because you run an old Kernel all the time.
- pietroalbini 10y ago
  On the newest images (FreeBSD, Debian 8 and Ubuntu 16.04) you aren't tied to the kernels they provide (and I think they ship the stock kernels by default in them, altough I haven't checked yet). I agree though on older images going to the control panel/use the API to change the kernel is a big annoyance.

andypants 10y ago

I agree. I thought I had installed ubuntu recently on ovh servers, and found many files/folders in `/sys/kernel` missing. I had to google around a bit to find out that when I installed Ubuntu, it wasn't actually Ubuntu, but OVH-modified Ubuntu. I ended up having 4 servers reinstalled with stock Ubuntu.

pietroalbini 10y ago

I manage a bare metal server rented at OVH, and when I discovered their kernel wasn't the stock one, I also found its last update was months before, without all the security patches released since then. That's not advertised at all in their product pages, and it exposes you to a bunch of security issues elsewhere fixed.

deleted 10y ago
[deleted]
skrowl 10y ago
To be fair, that's just the default setup. It's 2 commands to update it to the normal stock kernel.
- pietroalbini 10y ago
  I know and I did that as soon as I discovered they ship a different kernel. The problem is they don't advertise "we ship an insecure kernel by default", and they call those insecure images "Ubuntu".
- Raed667 10y ago
  May I ask what are those 2 steps?
  - jajern 10y ago
    sudo apt update && sudo apt upgrade -y
    - pietroalbini 10y ago
      That wouldn't work (even if you should do that anyway). The stock kernel is in a separate package.
  - pietroalbini 10y ago
    Check out this post: http://www.sysadminworld.com/2012/how-to-switch-to-the-standard-ubuntu-kernel-on-ovh/ http://www.sysadminworld.com/2012/how-to-switch-to-the-stand...

davb 10y ago

How does this work when Ubuntu package maintainers patch upstream packages? Do they arrange special trademark licensing terms with the upstream maintainer? I think I'm apt-get installing super-foo-blah, but during installation it's actually being patched so is deviating from what upstream are really shipping [1]. As I understand it, Canonical advocate patching upstream packages (with the noble goal of improving compatibility with their platform) and keeping the package under the same name. Just as OVH et al are doing with Ubuntu itself. [1] http://packaging.ubuntu.com/html/patches-to-packages.html http://packaging.ubuntu.com/html/patches-to-packages.html

pietroalbini 10y ago
If those packages' names are under trademark and the terms says you can't ship modified versions of the package, they must either: - Ask for the approval of the upstream developer - Rename the package, as Debian did with Firefox/IceWeasel The problem with the OVH images is their kernel lacks months of security patches, so they're advertising insecure images as "Ubuntu".
- davb 10y ago
  I absolutely agree that downstream packages have some level of responsibility to maintain up-to-date packages. However, this alone isn't necessarily reason to prevent someone from distributing derived versions of your open source project using the original name. If this was the case, Canonical would prevent people from shipping EOL'd versions of Ubuntu under any circumstances. If I ship an appliance with Ubuntu 10.04 (EOL 2013-05-09), it would have the same negative impact as shipping a patched 16.04 with no up-to-date patches or a similarly unpatchable kernel or core package.
  - pietroalbini 10y ago
    Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not. Edit: typo

hoahluke 10y ago

I totally agree with you, but how does the trademark licensing help with confusion in this case? If they were to pay 1-2e/mo to use the trademark legally, wouldn't the confusion still exist? Or is the full story actually that they have to pay _and_ actually offer it as stock Ubuntu?

pietroalbini 10y ago
AFAIK they must certify their images, which means they should offer a stock or a stock-like image approved by Canonical. Unfortunately the only source we currently have is that tweet, which isn't the clearest one.
- icebraining 10y ago
  Ubuntu's IP policies are public, and you're right, modified versions must be approved by Canonical: http://www.ubuntu.com/legal/terms-and-policies/intellectual-property-policy http://www.ubuntu.com/legal/terms-and-policies/intellectual-...

Thaxll 10y ago

Digital Ocean does the same, it's even worse with DO because you run an old Kernel all the time.

pietroalbini 10y ago
On the newest images (FreeBSD, Debian 8 and Ubuntu 16.04) you aren't tied to the kernels they provide (and I think they ship the stock kernels by default in them, altough I haven't checked yet). I agree though on older images going to the control panel/use the API to change the kernel is a big annoyance.