2 ms·

"Having complete control over their machines" being a non-goal is not the same thing as "not having complete control over their machines" as a goal. And trying

"Having complete control over their machines" being a non-goal is not the same thing as "not having complete control over their machines" as a goal. And trying to spread malicious rumors about GPLv3 only matters for the latter, not for the former. > What security do you get from not being able to replace the window manager? Well, you could argue that a third-party window manager could be snooping on all of the content visible on your screen (that otherwise isn't available to third-party apps) and could be doing whatever they want with that potentially-sensitive info. But that doesn't even matter, because the real answer here is "it's a massive amount of work to support third-party window managers, since the window manager is such a crucial and low-level and highly-integrated part of the system, and there's no motivation for Apple to expend that tremendous amount of work, especially because they'd likely end up with a far-less-stable system as a result". > Well, we're talking about it right now aren't we? We are, yes. Apple isn't. No matter what I say on the subject, that doesn't mean Apple is spreading rumors. I don't work for Apple. > This is the very definition of a rumor. You're free to accuse me of spreading rumors if you want. And I can't very well deny that because I can't provide any verification, but this interpretation of GPLv3 is a fairly common interpretation so I don't see that there's any reason to doubt it. But you can't accuse Apple of spreading rumors because people like me are making statements about this.

cyphar 9y ago
> Well, you could argue that a third-party window manager could be snooping on all of the content visible on your screen And Apple's APIs let you snoop on those events anyway (that's how the semi-third party window manager-managers work), this is not an argument... > because the real answer here is "it's a massive amount of work to support third-party window managers, since the window manager is such a crucial and low-level and highly-integrated part of the system, and there's no motivation for Apple to expend that tremendous amount of work, ...so what you're saying is "they don't want to put the effort into being able to replace core components of the system"? Because that's what I'm saying. I'm just saying it in a less charitable way than that. > but this interpretation of GPLv3 is a fairly common interpretation so I don't see that there's any reason to doubt it. It's only a common interpretation if you believe the rumors about Apple's view (and you're not the only person spreading them). FSF does not make that claim. Effectively everyone who uses GPLv3 doesn't make that claim (as far as I know). The only people that I've seen make that claim are people who say "this is the justification that Apple told me off-the-record but since they said it off-the-record we can't discuss it's merits". Do you see why I would suspect that this rumor spreading is co-ordinated? We went through this bullshit back with UEFI and GRUB in the Linux community. The agreement was that GPLv3 is fine so long as it is possible to replace the keys (and wiping the machine on key replacement is what you want to happen anyway, so that's fine and it solves the security issues). If you want to start claiming that it's a "common interpretation" you need to show that there is a larger community than the Linux community that uses the GPLv3. And you won't find one. Because it's not a common interpretation in the community that uses that license.
- eridius 9y ago
  > It's only a common interpretation if you believe the rumors about Apple's view Why do you keep talking about rumors? And why do you keep talking as if this is somehow unique to Apple? I'm pretty sure Apple's not the only company that believes this. In fact, I have no idea why the FSF would even claim otherwise; Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. If Apple were to accidentally ship GPLv3 software on iOS 11, under whatever interpretation you subscribe to, how is Apple supposed to remain in compliance with GPLv3 without releasing their root signing keys? Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You keep insisting that Apple's interpretation is wrong, but you haven't provided any alternative interpretation. > If you want to start claiming that it's a "common interpretation" you need to show that there is a larger community than the Linux community that uses the GPLv3 That's a catch-22. There isn't a larger community because GPLv3 is toxic to companies. Nobody else is going to create a larger ecosystem of GPLv3 code because doing so basically means turning into Linux.
  - cyphar 9y ago
    > Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. Apple's interpretation of "we cannot design a system where you can have signed binaries [where you can replace the root signing keys] that complies with the GPLv3"? That's not what the GPLv3 changes meant. Please just read the GPLv3 and make up your own mind, this is getting ridiculous. No reasonable interpretation of that section means that it is not possible to design a system that has binary signing and complies with the GPLv3. Apple's current system could not comply without releasing the root signing keys, but that's because they decided to design their system that way. > If Apple were to accidentally ship GPLv3 software on iOS 11 ... We're not talking about them accidentally shipping it. We're talking about them deciding to not update to GPLv3, and the justification being "security". Obviously accidentally shipping it would cause them issues, but that's > Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You might be talking about that. That's not what I was talking about. I was talking about them designing products that explicitly don't allow user-swapping is the problem, and that there is no fundamental reason why you cannot have a secure system that allows user-swapping keys. Of course a current device would be insecure if the root signing keys were released, because their threat model doesn't take that into account. > There isn't a larger community because GPLv3 is toxic to companies. I work for a company that releases GPLv3 software all the time. I've started projects that are GPLv3 as an employee. It's only toxic to companies that don't want to comply with free software licenses. This is all just more FUD.

cyphar 9y ago

> Well, you could argue that a third-party window manager could be snooping on all of the content visible on your screen And Apple's APIs let you snoop on those events anyway (that's how the semi-third party window manager-managers work), this is not an argument... > because the real answer here is "it's a massive amount of work to support third-party window managers, since the window manager is such a crucial and low-level and highly-integrated part of the system, and there's no motivation for Apple to expend that tremendous amount of work, ...so what you're saying is "they don't want to put the effort into being able to replace core components of the system"? Because that's what I'm saying. I'm just saying it in a less charitable way than that. > but this interpretation of GPLv3 is a fairly common interpretation so I don't see that there's any reason to doubt it. It's only a common interpretation if you believe the rumors about Apple's view (and you're not the only person spreading them). FSF does not make that claim. Effectively everyone who uses GPLv3 doesn't make that claim (as far as I know). The only people that I've seen make that claim are people who say "this is the justification that Apple told me off-the-record but since they said it off-the-record we can't discuss it's merits". Do you see why I would suspect that this rumor spreading is co-ordinated? We went through this bullshit back with UEFI and GRUB in the Linux community. The agreement was that GPLv3 is fine so long as it is possible to replace the keys (and wiping the machine on key replacement is what you want to happen anyway, so that's fine and it solves the security issues). If you want to start claiming that it's a "common interpretation" you need to show that there is a larger community than the Linux community that uses the GPLv3. And you won't find one. Because it's not a common interpretation in the community that uses that license.

eridius 9y ago
> It's only a common interpretation if you believe the rumors about Apple's view Why do you keep talking about rumors? And why do you keep talking as if this is somehow unique to Apple? I'm pretty sure Apple's not the only company that believes this. In fact, I have no idea why the FSF would even claim otherwise; Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. If Apple were to accidentally ship GPLv3 software on iOS 11, under whatever interpretation you subscribe to, how is Apple supposed to remain in compliance with GPLv3 without releasing their root signing keys? Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You keep insisting that Apple's interpretation is wrong, but you haven't provided any alternative interpretation. > If you want to start claiming that it's a "common interpretation" you need to show that there is a larger community than the Linux community that uses the GPLv3 That's a catch-22. There isn't a larger community because GPLv3 is toxic to companies. Nobody else is going to create a larger ecosystem of GPLv3 code because doing so basically means turning into Linux.
- cyphar 9y ago
  > Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. Apple's interpretation of "we cannot design a system where you can have signed binaries [where you can replace the root signing keys] that complies with the GPLv3"? That's not what the GPLv3 changes meant. Please just read the GPLv3 and make up your own mind, this is getting ridiculous. No reasonable interpretation of that section means that it is not possible to design a system that has binary signing and complies with the GPLv3. Apple's current system could not comply without releasing the root signing keys, but that's because they decided to design their system that way. > If Apple were to accidentally ship GPLv3 software on iOS 11 ... We're not talking about them accidentally shipping it. We're talking about them deciding to not update to GPLv3, and the justification being "security". Obviously accidentally shipping it would cause them issues, but that's > Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You might be talking about that. That's not what I was talking about. I was talking about them designing products that explicitly don't allow user-swapping is the problem, and that there is no fundamental reason why you cannot have a secure system that allows user-swapping keys. Of course a current device would be insecure if the root signing keys were released, because their threat model doesn't take that into account. > There isn't a larger community because GPLv3 is toxic to companies. I work for a company that releases GPLv3 software all the time. I've started projects that are GPLv3 as an employee. It's only toxic to companies that don't want to comply with free software licenses. This is all just more FUD.