3 ms·

>If the large companies who use Linux really want to improve kernel security, they need to work with Grsecurity and not against them. It's beyond me how this is

>If the large companies who use Linux really want to improve kernel security, they need to work with Grsecurity and not against them. It's beyond me how this isn't happening already. It's more that Grsecurity is working against everyone else. They want to pretend the GPL works in a way that it doesn't so that they can sell their patches. Then they make threats to people who say "that's not how the GPL works" and distribute their patches in accordance with how the GPL actually works. That's not how kernel development is done. I'd rather have an insecure kernel than their bullshit.

eugeneionesco 9y ago
You're spreading FUD. I suggest you educate yourself on the reasons grsecurity patches are no longer public anymore.
- Sir_Cmpwn 9y ago
  You're welcome to present an argument for your case.
tptacek 9y ago
It's their work. We're not entitled to it.
- Sir_Cmpwn 9y ago
  Actually, we are. That's how the GPL works.
  - tptacek 9y ago
    No, it's not. The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it.
    - Sir_Cmpwn 9y ago
      Right, but they do distribute modified kernels, and we are therefore entitled to their work.
    - pcwalton 9y ago
      > If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it. That would be a work for hire, and it is not the same thing as developing patches independently and distributing them with extra terms, because there is no distribution involved. > The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. That would be true if the patches were not derivative works of the Linux kernel in a legal sense. I'm no lawyer, but that seems contrary to the plain meaning of "derivative work". Bruce Perens' argument is persuasive to me: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c... As is Linus Torvalds' ("kernel patches clearly _are_ derived works"): http://yarchive.net/comp/linux/gpl_modules.html http://yarchive.net/comp/linux/gpl_modules.html
      - dctoedt 9y ago
        > That would be a work for hire .... Not necessarily, in fact perhaps not even usually. 1. The consulting contract might or might not provide for the client to own any work product created. Many such contracts provide that the client will own only the specific end product, while the consultant retains ownership of any reusable "Toolkit Items." But what if the contract is silent about ownership of consulting work product? 2. As to copyright: Under U.S. copyright law, the default mode is that IF: An original work of authorship is created outside an employer-employee relationship, THEN: The copyright is owned by the individual author (or jointly by multiple co-authors) UNLESS: A) the work of authorship falls into one of nine specific statutory categories, and B) the parties have expressly agreed in writing, before the work was created, that it would be a work made for hire. [0] [1] 3. Any patentable inventions would be owned by the inventor(s) unless they were employees who were "hired to invent" or "set to experimenting," in which case the inventions would be owned by the employer; so far as I recall, this doesn't apply in the case of outside-contractor consulting projects — the client would not own any resulting inventions unless the contract specifically said otherwise. [2] [0] https://www.law.cornell.edu/uscode/text/17/201 https://www.law.cornell.edu/uscode/text/17/201 (ownership of copyright) [1] "A 'work made for hire' is—(1) a work prepared by an employee within the scope of his or her employment; or (2) a work specially ordered or commissioned [A] for use as a contribution to a collective work, [B] as a part of a motion picture or other audiovisual work, [C] as a translation, [D] as a supplementary work, [E] as a compilation, [F] as an instructional text, [G] as a test, [H] as answer material for a test, or [I] as an atlas, if the parties expressly agree in a written instrument signed by them that the work shall be considered a work made for hire. [¶] For the purpose of the foregoing sentence, a 'supplementary work' is a work prepared for publication as a secondary adjunct to a work by another author for the purpose of introducing, concluding, illustrating, explaining, revising, commenting upon, or assisting in the use of the other work, such as forewords, afterwords, pictorial illustrations, maps, charts, tables, editorial notes, musical arrangements, answer material for tests, bibliographies, appendixes, and indexes, and an 'instructional text' is a literary, pictorial, or graphic work prepared for publication and with the purpose of use in systematic instructional activities." From https://www.law.cornell.edu/uscode/text/17/101 https://www.law.cornell.edu/uscode/text/17/101 [2] See the annotated flowchart at http://www.oncontracts.com/docs/Who-owns-an-employee-invention.pdf http://www.oncontracts.com/docs/Who-owns-an-employee-inventi... (self-cite).
- pcwalton 9y ago
  Bruce Perens, however, is entitled to not be the victim of Spender's legal harassment for exercising his First Amendment rights to disagree [1]. I have no dog in this fight whatsoever; I don't know anybody involved. But in general I have little sympathy for people, however talented, who waste taxpayers' money with bogus legal action. [1]: https://thenewstack.io/open-source-pioneer-bruce-perens-sued-grsecurity/ https://thenewstack.io/open-source-pioneer-bruce-perens-sued...

eugeneionesco 9y ago

You're spreading FUD. I suggest you educate yourself on the reasons grsecurity patches are no longer public anymore.

Sir_Cmpwn 9y ago
You're welcome to present an argument for your case.

tptacek 9y ago

It's their work. We're not entitled to it.

Sir_Cmpwn 9y ago
Actually, we are. That's how the GPL works.
- tptacek 9y ago
  No, it's not. The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it.
  - Sir_Cmpwn 9y ago
    Right, but they do distribute modified kernels, and we are therefore entitled to their work.
  - pcwalton 9y ago
    > If I write a Linux kernel patch on a consulting project, I am absolutely not required to publish it. That would be a work for hire, and it is not the same thing as developing patches independently and distributing them with extra terms, because there is no distribution involved. > The GPL on the Linux kernel means that grsec can't distribute a new Linux kernel with their patches while withholding code. That's not what they're doing. That would be true if the patches were not derivative works of the Linux kernel in a legal sense. I'm no lawyer, but that seems contrary to the plain meaning of "derivative work". Bruce Perens' argument is persuasive to me: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c... As is Linus Torvalds' ("kernel patches clearly _are_ derived works"): http://yarchive.net/comp/linux/gpl_modules.html http://yarchive.net/comp/linux/gpl_modules.html
    - dctoedt 9y ago
      > That would be a work for hire .... Not necessarily, in fact perhaps not even usually. 1. The consulting contract might or might not provide for the client to own any work product created. Many such contracts provide that the client will own only the specific end product, while the consultant retains ownership of any reusable "Toolkit Items." But what if the contract is silent about ownership of consulting work product? 2. As to copyright: Under U.S. copyright law, the default mode is that IF: An original work of authorship is created outside an employer-employee relationship, THEN: The copyright is owned by the individual author (or jointly by multiple co-authors) UNLESS: A) the work of authorship falls into one of nine specific statutory categories, and B) the parties have expressly agreed in writing, before the work was created, that it would be a work made for hire. [0] [1] 3. Any patentable inventions would be owned by the inventor(s) unless they were employees who were "hired to invent" or "set to experimenting," in which case the inventions would be owned by the employer; so far as I recall, this doesn't apply in the case of outside-contractor consulting projects — the client would not own any resulting inventions unless the contract specifically said otherwise. [2] [0] https://www.law.cornell.edu/uscode/text/17/201 https://www.law.cornell.edu/uscode/text/17/201 (ownership of copyright) [1] "A 'work made for hire' is—(1) a work prepared by an employee within the scope of his or her employment; or (2) a work specially ordered or commissioned [A] for use as a contribution to a collective work, [B] as a part of a motion picture or other audiovisual work, [C] as a translation, [D] as a supplementary work, [E] as a compilation, [F] as an instructional text, [G] as a test, [H] as answer material for a test, or [I] as an atlas, if the parties expressly agree in a written instrument signed by them that the work shall be considered a work made for hire. [¶] For the purpose of the foregoing sentence, a 'supplementary work' is a work prepared for publication as a secondary adjunct to a work by another author for the purpose of introducing, concluding, illustrating, explaining, revising, commenting upon, or assisting in the use of the other work, such as forewords, afterwords, pictorial illustrations, maps, charts, tables, editorial notes, musical arrangements, answer material for tests, bibliographies, appendixes, and indexes, and an 'instructional text' is a literary, pictorial, or graphic work prepared for publication and with the purpose of use in systematic instructional activities." From https://www.law.cornell.edu/uscode/text/17/101 https://www.law.cornell.edu/uscode/text/17/101 [2] See the annotated flowchart at http://www.oncontracts.com/docs/Who-owns-an-employee-invention.pdf http://www.oncontracts.com/docs/Who-owns-an-employee-inventi... (self-cite).
pcwalton 9y ago
Bruce Perens, however, is entitled to not be the victim of Spender's legal harassment for exercising his First Amendment rights to disagree [1]. I have no dog in this fight whatsoever; I don't know anybody involved. But in general I have little sympathy for people, however talented, who waste taxpayers' money with bogus legal action. [1]: https://thenewstack.io/open-source-pioneer-bruce-perens-sued-grsecurity/ https://thenewstack.io/open-source-pioneer-bruce-perens-sued...