5 ms·

Minix is BSD-licensed. Don't blame the creator for the actions of the licensee. Intels ME is Just that: Intels. Tanenbaum did a one-up on Linus and intentionall

by wjnc 9y ago

Minix is BSD-licensed. Don't blame the creator for the actions of the licensee. Intels ME is Just that: Intels. Tanenbaum did a one-up on Linus and intentionally left out politics. Not every outing should be politics.

calcifer 9y ago
> Don't blame the creator for the actions of the licensee. The creator had the option to choose a license that could have prevented this exact situation. The fact that he didn't, and is perfectly happy with Intel's usage (since he helped them) seems like enough reason to assign blame.
- akerl_ 9y ago
  What license could he have used that would have prevented the thing Intel did? Lets pretend we've rewound the clock and MINIX is GPL licensed. Intel decides they want to write a low-level system that controls their hardware that the user can't modify. They decide to base it on MINIX, so they start from MINIX, and at various points lets assume they customize MINIX's code to make it do what they want (this is questionable, since it seems like many of the things they wanted got published upstream when they asked Tanenbaum to make those changes). At some point, they think "let's also add a backdoor for ourselves/NSA/whatever", so they write a separate daemon to run on their little embedded system to do that. Per the GPL, they publish sources for their modified MINIX, and every person who runs Intel hardware gets a copy of the source for MINIX, but not for the separate daemon, which Intel doesn't need to GPL. The chip doesn't need to allow users to replace or change the install Intel is baking onto it. Now users know they're running MINIX, where they didn't before. They still can't see what custom code runs in the daemon Intel wrote, nor can they change or disable the running MINIX install. What has been improved in this case by Tanenbaum hypothetically changing his licensing choice?
  - calcifer 9y ago
    > Per the GPL, they publish sources for their modified MINIX, and every person who runs Intel hardware gets a copy of the source for MINIX, but not for the separate daemon, which Intel doesn't need to GPL. Actually, there is still controversy surrounding this since there has never been a GPL court case about what exactly counts as a derivative work. There are similiar concerns around proprietary Linux modules that interface with GPL'd kernel interfaces. > What license could he have used that would have prevented the thing Intel did? He could have chosen the JSON approach to licensing [0]. [0] http://www.json.org/license.html http://www.json.org/license.html
    - eesmith 9y ago
      I believe akerl_ means "separate daemon" in about the same way that an Oracle database server runs on top of the Linux kernel. There is no code sharing (outside of permitted uses of header files), so copyright is not involved, so there is no GPL issue. That is, the "separate daemon" really is separate from the kernel.
    - akerl_ 9y ago
      As eesmith suspected, I'm referring to a service running on top of the MINIX kernel, similarly to Apache running on any of the thousands of Linux servers out there. I'd say if one day the courts decided that Apache running on Linux had to be GPL'd by nature of being a derivative work, we'd experience so many fundamental issues with so many projects that Intel ME would barely register on the list.
  - ac29 9y ago
    >What license could he have used that would have prevented the thing Intel did? GPLv3: https://www.gnu.org/licenses/rms-why-gplv3.en.html https://www.gnu.org/licenses/rms-why-gplv3.en.html Specifically: "One major danger that GPLv3 will block is tivoization. Tivoization means certain “appliances” (which have computers inside) contain GPL-covered software that you can't effectively change, because the appliance shuts down if it detects modified software. The usual motive for tivoization is that the software has features the manufacturer knows people will want to change, and aims to stop people from changing them. The manufacturers of these computers take advantage of the freedom that free software provides, but they don't let you do likewise."
    - akerl_ 9y ago
      "But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM)." In our hypothetical (and I suspect in reality), the code doing scary/concerning things sits in userspace on top of MINIX, so they'd just have to constrain their updates to that system.
- lou1306 9y ago
  > The creator had the option to choose a license that could have prevented this exact situation So, since any piece of code can potentially end up in a monitoring, surveillance system, the only logical conclusion is we must kill BSD licensing. > and is perfectly happy with Intel's usage Not really: > Many people (including me) don't like the idea of an all-powerful management engine in there at all (since it is a possible security hole and a dangerous idea in the first place), but that is Intel's business decision and a separate issue from the code it runs.
- probably_wrong 9y ago
  This reminds me of the HN discussion[1] about the JSON license which states "shall be used for Good, not Evil". Commenters in general where not pleased with that. I'm assuming a more restrictive license would have also been a point of criticism. [1] https://news.ycombinator.com/item?id=3693108 https://news.ycombinator.com/item?id=3693108
- late2part 9y ago
  "Information wants to be Free." A.T. made it free. Folks used it. It's a logical fallacy to hold A.T. accountable for the use of his tool.

by wjnc 9y ago

calcifer 9y ago

> Don't blame the creator for the actions of the licensee. The creator had the option to choose a license that could have prevented this exact situation. The fact that he didn't, and is perfectly happy with Intel's usage (since he helped them) seems like enough reason to assign blame.

akerl_ 9y ago
What license could he have used that would have prevented the thing Intel did? Lets pretend we've rewound the clock and MINIX is GPL licensed. Intel decides they want to write a low-level system that controls their hardware that the user can't modify. They decide to base it on MINIX, so they start from MINIX, and at various points lets assume they customize MINIX's code to make it do what they want (this is questionable, since it seems like many of the things they wanted got published upstream when they asked Tanenbaum to make those changes). At some point, they think "let's also add a backdoor for ourselves/NSA/whatever", so they write a separate daemon to run on their little embedded system to do that. Per the GPL, they publish sources for their modified MINIX, and every person who runs Intel hardware gets a copy of the source for MINIX, but not for the separate daemon, which Intel doesn't need to GPL. The chip doesn't need to allow users to replace or change the install Intel is baking onto it. Now users know they're running MINIX, where they didn't before. They still can't see what custom code runs in the daemon Intel wrote, nor can they change or disable the running MINIX install. What has been improved in this case by Tanenbaum hypothetically changing his licensing choice?
- calcifer 9y ago
  > Per the GPL, they publish sources for their modified MINIX, and every person who runs Intel hardware gets a copy of the source for MINIX, but not for the separate daemon, which Intel doesn't need to GPL. Actually, there is still controversy surrounding this since there has never been a GPL court case about what exactly counts as a derivative work. There are similiar concerns around proprietary Linux modules that interface with GPL'd kernel interfaces. > What license could he have used that would have prevented the thing Intel did? He could have chosen the JSON approach to licensing [0]. [0] http://www.json.org/license.html http://www.json.org/license.html
  - eesmith 9y ago
    I believe akerl_ means "separate daemon" in about the same way that an Oracle database server runs on top of the Linux kernel. There is no code sharing (outside of permitted uses of header files), so copyright is not involved, so there is no GPL issue. That is, the "separate daemon" really is separate from the kernel.
  - akerl_ 9y ago
    As eesmith suspected, I'm referring to a service running on top of the MINIX kernel, similarly to Apache running on any of the thousands of Linux servers out there. I'd say if one day the courts decided that Apache running on Linux had to be GPL'd by nature of being a derivative work, we'd experience so many fundamental issues with so many projects that Intel ME would barely register on the list.
- ac29 9y ago
  >What license could he have used that would have prevented the thing Intel did? GPLv3: https://www.gnu.org/licenses/rms-why-gplv3.en.html https://www.gnu.org/licenses/rms-why-gplv3.en.html Specifically: "One major danger that GPLv3 will block is tivoization. Tivoization means certain “appliances” (which have computers inside) contain GPL-covered software that you can't effectively change, because the appliance shuts down if it detects modified software. The usual motive for tivoization is that the software has features the manufacturer knows people will want to change, and aims to stop people from changing them. The manufacturers of these computers take advantage of the freedom that free software provides, but they don't let you do likewise."
  - akerl_ 9y ago
    "But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM)." In our hypothetical (and I suspect in reality), the code doing scary/concerning things sits in userspace on top of MINIX, so they'd just have to constrain their updates to that system.
lou1306 9y ago
> The creator had the option to choose a license that could have prevented this exact situation So, since any piece of code can potentially end up in a monitoring, surveillance system, the only logical conclusion is we must kill BSD licensing. > and is perfectly happy with Intel's usage Not really: > Many people (including me) don't like the idea of an all-powerful management engine in there at all (since it is a possible security hole and a dangerous idea in the first place), but that is Intel's business decision and a separate issue from the code it runs.
probably_wrong 9y ago
This reminds me of the HN discussion[1] about the JSON license which states "shall be used for Good, not Evil". Commenters in general where not pleased with that. I'm assuming a more restrictive license would have also been a point of criticism. [1] https://news.ycombinator.com/item?id=3693108 https://news.ycombinator.com/item?id=3693108
late2part 9y ago
"Information wants to be Free." A.T. made it free. Folks used it. It's a logical fallacy to hold A.T. accountable for the use of his tool.