2 ms·
The point re tivoizing for security (as opposed to protecting copyprotection schemes, say) that I have in mind is as a measure to ensure that the operating syst
by Nomentatus 10y ago
The point re tivoizing for security (as opposed to protecting copyprotection schemes, say) that I have in mind is as a measure to ensure that the operating system isn't replaced or modified by a user who isn't the owner (particularly, without the owner's knowledge - the owner may be a corporation that wants to prevent one planted employee from pwning all their servers, for example); or modified by apps authorized by the user inadvertently or without full knowledge. The GPL 3 license isn't designed to allow such fine distinctions; and there's probably no practical way for it to do so - sometimes you want to employee-and-visitor-proof things. Maybe tivoization with a password (which the corporation could deep six to truly prevent pwnage?) Their explanations "The usual motive for tivoization is that the software has features the manufacturer knows people will want to change, and aims to stop people from changing them." suggest they wouldn't welcome this solution either, but I'd be interested to know otherwise.
The more I look at the license
https://www.gnu.org/licenses/gpl-3.0.txt https://www.gnu.org/licenses/gpl-3.0.txt
the more discouraged I get - it covers user products (consumer, household use) and as part of a building (???) and that's it! Never gets near making room for the security cases that worry me most.
In fact this language: "For a particular product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product." pretty much rules out allowing tivoization for my security cases. The only obvious way to read "regardless of the status of the particular user" would mean that employees would have to have the ability to modify the product without the company's knowledge, which is precisely what I'd like to be able to prevent of course.