6 ms·

It's interesting that his perception of the GPL v3.0 and LGPL v3.0 is that it has higher "confusion" than the v2.0 versions (and the highest confusion rating of

It's interesting that his perception of the GPL v3.0 and LGPL v3.0 is that it has higher "confusion" than the v2.0 versions (and the highest confusion rating of any of the licenses, only matched by WTFPL, which even I, a laymen, lack confidence in). I get that the 2.0 versions have been in use a lot longer, and have had some tests in court. But, my understanding was that part of v3.0's purpose was to clarify the license and remove uncertainty about its meaning. They certainly had a lot more resources and experience when constructing the v3.0 versions. It's been many years since I read them side-by-side, but I recall liking the language in 3.0 more than in 2.0.

Matthias247 10y ago
The v3 versions also have the additions that require to provide the end user with the means to update/exchange the [L]GPLed software binaries with custom ones. Which is mostly interpreted as "I have to provide my customer not only my application sources (in case of GPL), but also a way to deploy custom binaries of with arbitrary code and behavior". This causes gigantic headaches for most embedded device manufactureres, and the outcome is ususally the the [L]GPLv3 licenses are strictly avoided.
- swiley 10y ago
  Is that really such a headache? Usually all of that is already there but the manufacturer is doing signature checking.
  - Matthias247 10y ago
    Technically it's of course doable without too much headaches. But it causes some other headaches: One is IP protection: If you provide the enduser with a way to upload arbitrary code which might often get run with root rights (because that's what the application requires) then you essentially provide the user a backdoor that gives access to the whole system. Which then can be used extract everything including proprietary code and also exchange other components and not only the GPL ones. It also causes headaches regarding device qualification and associated warranties: In many industries (automotive, medical, etc.) devices have to go through a very rigorous qualification and test process, which ensures that exactly the 1 software snapshot on the device is OK. The manufacturer then takes liability for that and gives warranties. If the customer can exchange some parts of it then the device basically counts as untested, and nobody can and will guarantee anything. Device manufacturers will be scared, that they could get sued for device malfunctions that are caused by arbitrary code injection. It might of course be a solution that the user-code upload process triggers some anti-tamper switch which auto-revokes the warranty/liability. But I think as a car manufacturer you don't want to give the user a way to drive around with untested code, which might cause really really big headaches if an accident happens with it. Lawyers will discuss endlessly if the tempered software could have been the root cause or not, and even if it is the manufacturer might get bad press why he allows endusers to decrease safety levels.
    - swiley 10y ago
      I understand what you're saying but it's not like the user couldn't physically change the device and create similar dangers. This is why uploading custom firmware on most devices voids the warranty, but I don't think you can make it impossible for someone to "break" their device if they really want to.
  - phkahler 10y ago
    What if the only way to update software on a device is through a JTAG connector?
    - swiley 10y ago
      Sure that sounds reasonable (although IANAL and don't know if it's enough legally), as long as you don't need special secret keys.
pythonaut_16 10y ago
What confidence is there to lack in the WTFPL? Saying I license you to use this source code/software however you see fit seems pretty straight forward to me.
- jerf 10y ago
  It doesn't actually say anything. It doesn't say you have permission to do anything, it doesn't say "If you do this I won't sue you", it doesn't license patents, it doesn't promise that as long as you conform to the license that you won't get in trouble in the future (that's the "estoppel" comment in the article [1]). A normal human being reading the license will get the almost-certainly-correct impression that the author of the code will not come after them for anything they do, especially if it's a small usage. Lawyers must worry about two reasonable scenarios: First, some large usage causing the original licenser to decide to change their mind [2]. To put it in terms most of HN will understand, what if you release some code under the WTFPL license and discover that the Trump administration is using it. Would you be tempted to wedge your way into the legal ambiguity and sue them over it? Your specific answer doesn't matter; you need merely believe that there are plenty of people jumping out of their seats and yelling YES! to make my point, as that is enough to send shivers down a big-company lawyer's spine. And second, even if you are confident that the original author wouldn't sue, if the rights to the package get transferred to someone else, you have to worry about whether that licenser will change their mind as above. If a new party changes their mind about the license, some of your legal defenses get a lot harder. The bigger you are as a target, the more you have to worry about being a bit, juicy target. A 5-person unfunded startup doesn't have a problem where Google does. It isn't really a license so much as an assertion that the author won't come after you if you use or modify their code with no legal meaning. [1]: https://en.wikipedia.org/wiki/Estoppel https://en.wikipedia.org/wiki/Estoppel [2]: http://dev.hasenj.org/post/3272592502/ibm-and-its-minions http://dev.hasenj.org/post/3272592502/ibm-and-its-minions
  - dragonwriter 10y ago
    Note that as gratuitous licenses are, irrespective of their language, revocable at will (in US law), basically everything you say applies to any license that is not a contract, it's not special to the WTFPL.

Matthias247 10y ago

The v3 versions also have the additions that require to provide the end user with the means to update/exchange the [L]GPLed software binaries with custom ones. Which is mostly interpreted as "I have to provide my customer not only my application sources (in case of GPL), but also a way to deploy custom binaries of with arbitrary code and behavior". This causes gigantic headaches for most embedded device manufactureres, and the outcome is ususally the the [L]GPLv3 licenses are strictly avoided.

swiley 10y ago
Is that really such a headache? Usually all of that is already there but the manufacturer is doing signature checking.
- Matthias247 10y ago
  Technically it's of course doable without too much headaches. But it causes some other headaches: One is IP protection: If you provide the enduser with a way to upload arbitrary code which might often get run with root rights (because that's what the application requires) then you essentially provide the user a backdoor that gives access to the whole system. Which then can be used extract everything including proprietary code and also exchange other components and not only the GPL ones. It also causes headaches regarding device qualification and associated warranties: In many industries (automotive, medical, etc.) devices have to go through a very rigorous qualification and test process, which ensures that exactly the 1 software snapshot on the device is OK. The manufacturer then takes liability for that and gives warranties. If the customer can exchange some parts of it then the device basically counts as untested, and nobody can and will guarantee anything. Device manufacturers will be scared, that they could get sued for device malfunctions that are caused by arbitrary code injection. It might of course be a solution that the user-code upload process triggers some anti-tamper switch which auto-revokes the warranty/liability. But I think as a car manufacturer you don't want to give the user a way to drive around with untested code, which might cause really really big headaches if an accident happens with it. Lawyers will discuss endlessly if the tempered software could have been the root cause or not, and even if it is the manufacturer might get bad press why he allows endusers to decrease safety levels.
  - swiley 10y ago
    I understand what you're saying but it's not like the user couldn't physically change the device and create similar dangers. This is why uploading custom firmware on most devices voids the warranty, but I don't think you can make it impossible for someone to "break" their device if they really want to.
- phkahler 10y ago
  What if the only way to update software on a device is through a JTAG connector?
  - swiley 10y ago
    Sure that sounds reasonable (although IANAL and don't know if it's enough legally), as long as you don't need special secret keys.

pythonaut_16 10y ago

What confidence is there to lack in the WTFPL? Saying I license you to use this source code/software however you see fit seems pretty straight forward to me.

jerf 10y ago
It doesn't actually say anything. It doesn't say you have permission to do anything, it doesn't say "If you do this I won't sue you", it doesn't license patents, it doesn't promise that as long as you conform to the license that you won't get in trouble in the future (that's the "estoppel" comment in the article [1]). A normal human being reading the license will get the almost-certainly-correct impression that the author of the code will not come after them for anything they do, especially if it's a small usage. Lawyers must worry about two reasonable scenarios: First, some large usage causing the original licenser to decide to change their mind [2]. To put it in terms most of HN will understand, what if you release some code under the WTFPL license and discover that the Trump administration is using it. Would you be tempted to wedge your way into the legal ambiguity and sue them over it? Your specific answer doesn't matter; you need merely believe that there are plenty of people jumping out of their seats and yelling YES! to make my point, as that is enough to send shivers down a big-company lawyer's spine. And second, even if you are confident that the original author wouldn't sue, if the rights to the package get transferred to someone else, you have to worry about whether that licenser will change their mind as above. If a new party changes their mind about the license, some of your legal defenses get a lot harder. The bigger you are as a target, the more you have to worry about being a bit, juicy target. A 5-person unfunded startup doesn't have a problem where Google does. It isn't really a license so much as an assertion that the author won't come after you if you use or modify their code with no legal meaning. [1]: https://en.wikipedia.org/wiki/Estoppel https://en.wikipedia.org/wiki/Estoppel [2]: http://dev.hasenj.org/post/3272592502/ibm-and-its-minions http://dev.hasenj.org/post/3272592502/ibm-and-its-minions
- dragonwriter 10y ago
  Note that as gratuitous licenses are, irrespective of their language, revocable at will (in US law), basically everything you say applies to any license that is not a contract, it's not special to the WTFPL.