3 ms·

> It's only a common interpretation if you believe the rumors about Apple's view Why do you keep talking about rumors? And why do you keep talking as if this i

> It's only a common interpretation if you believe the rumors about Apple's view Why do you keep talking about rumors? And why do you keep talking as if this is somehow unique to Apple? I'm pretty sure Apple's not the only company that believes this. In fact, I have no idea why the FSF would even claim otherwise; Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. If Apple were to accidentally ship GPLv3 software on iOS 11, under whatever interpretation you subscribe to, how is Apple supposed to remain in compliance with GPLv3 without releasing their root signing keys? Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You keep insisting that Apple's interpretation is wrong, but you haven't provided any alternative interpretation. > If you want to start claiming that it's a "common interpretation" you need to show that there is a larger community than the Linux community that uses the GPLv3 That's a catch-22. There isn't a larger community because GPLv3 is toxic to companies. Nobody else is going to create a larger ecosystem of GPLv3 code because doing so basically means turning into Linux.

cyphar 9y ago
> Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. Apple's interpretation of "we cannot design a system where you can have signed binaries [where you can replace the root signing keys] that complies with the GPLv3"? That's not what the GPLv3 changes meant. Please just read the GPLv3 and make up your own mind, this is getting ridiculous. No reasonable interpretation of that section means that it is not possible to design a system that has binary signing and complies with the GPLv3. Apple's current system could not comply without releasing the root signing keys, but that's because they decided to design their system that way. > If Apple were to accidentally ship GPLv3 software on iOS 11 ... We're not talking about them accidentally shipping it. We're talking about them deciding to not update to GPLv3, and the justification being "security". Obviously accidentally shipping it would cause them issues, but that's > Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You might be talking about that. That's not what I was talking about. I was talking about them designing products that explicitly don't allow user-swapping is the problem, and that there is no fundamental reason why you cannot have a secure system that allows user-swapping keys. Of course a current device would be insecure if the root signing keys were released, because their threat model doesn't take that into account. > There isn't a larger community because GPLv3 is toxic to companies. I work for a company that releases GPLv3 software all the time. I've started projects that are GPLv3 as an employee. It's only toxic to companies that don't want to comply with free software licenses. This is all just more FUD.
- eridius 9y ago
  Nobody said Apple is incapable of designing such a system. But that's not the system they have today. It seems your entire argument is based on a hypothetical alternate universe where iOS allowed for user-swappable keys. But that's not what this thread was about, so your entire argument is completely moot. > This is all just more FUD. Please stop calling things FUD just because you don't like it.
  - cyphar 9y ago
    > But that's not what this thread was about, so your entire argument is completely moot. I guess you were in a different thread than me. The discussion started with saying that "they don't use GPLv3 purely because of security concerns as they cannot have a secure system". I outlined that yes you can, you said that "currently Apple's system doesn't work that way" and now you're saying that discussing whether or not it is possible to create such a system is off-topic. Maybe I just misunderstood what you meant, but if that's the case then it still doesn't justify you broadly making incorrect claims about the GPLv3. You should say something like "Because Apple doesn't have the ability to replace the keys by the user, they cannot use GPLv3 as that would make their system insecure". You cannot omit the first part as it makes the statement incorrect. > Please stop calling things FUD just because you don't like it. "GPLv3 is toxic to companies" is FUD. It promotes fear through the use of the word "toxic", it promotes uncertainty by challenging a well-established license with vague concerns, and it seeds doubt in whether the license will be toxic to their company. As many companies do use and ship GPLv3 software and aren't being killed by this hypothetical toxicity, this is FUD. It just so happens that I don't like that you said it, but that's because I don't like people spreading FUD. ;)

cyphar 9y ago

> Apple's interpretation seems to be perfectly in line with the entire point of the anti-TiVoization clause. Apple's interpretation of "we cannot design a system where you can have signed binaries [where you can replace the root signing keys] that complies with the GPLv3"? That's not what the GPLv3 changes meant. Please just read the GPLv3 and make up your own mind, this is getting ridiculous. No reasonable interpretation of that section means that it is not possible to design a system that has binary signing and complies with the GPLv3. Apple's current system could not comply without releasing the root signing keys, but that's because they decided to design their system that way. > If Apple were to accidentally ship GPLv3 software on iOS 11 ... We're not talking about them accidentally shipping it. We're talking about them deciding to not update to GPLv3, and the justification being "security". Obviously accidentally shipping it would cause them issues, but that's > Remember, we're talking about shipping this on existing devices, not on some hypothetical future device where they can add extra user-swappable keys to the bootloader. You might be talking about that. That's not what I was talking about. I was talking about them designing products that explicitly don't allow user-swapping is the problem, and that there is no fundamental reason why you cannot have a secure system that allows user-swapping keys. Of course a current device would be insecure if the root signing keys were released, because their threat model doesn't take that into account. > There isn't a larger community because GPLv3 is toxic to companies. I work for a company that releases GPLv3 software all the time. I've started projects that are GPLv3 as an employee. It's only toxic to companies that don't want to comply with free software licenses. This is all just more FUD.

eridius 9y ago
Nobody said Apple is incapable of designing such a system. But that's not the system they have today. It seems your entire argument is based on a hypothetical alternate universe where iOS allowed for user-swappable keys. But that's not what this thread was about, so your entire argument is completely moot. > This is all just more FUD. Please stop calling things FUD just because you don't like it.
- cyphar 9y ago
  > But that's not what this thread was about, so your entire argument is completely moot. I guess you were in a different thread than me. The discussion started with saying that "they don't use GPLv3 purely because of security concerns as they cannot have a secure system". I outlined that yes you can, you said that "currently Apple's system doesn't work that way" and now you're saying that discussing whether or not it is possible to create such a system is off-topic. Maybe I just misunderstood what you meant, but if that's the case then it still doesn't justify you broadly making incorrect claims about the GPLv3. You should say something like "Because Apple doesn't have the ability to replace the keys by the user, they cannot use GPLv3 as that would make their system insecure". You cannot omit the first part as it makes the statement incorrect. > Please stop calling things FUD just because you don't like it. "GPLv3 is toxic to companies" is FUD. It promotes fear through the use of the word "toxic", it promotes uncertainty by challenging a well-established license with vague concerns, and it seeds doubt in whether the license will be toxic to their company. As many companies do use and ship GPLv3 software and aren't being killed by this hypothetical toxicity, this is FUD. It just so happens that I don't like that you said it, but that's because I don't like people spreading FUD. ;)