4 ms·

One thing that's worth considering making an exception for, no matter your ideological stand point, is cryptography libraries. I want everyone to get cryptogra

One thing that's worth considering making an exception for, no matter your ideological stand point, is cryptography libraries. I want everyone to get cryptographic code right, ideally with one implementation that is correct, and then that's the end of it for everyone. Because if commerical vendors do their own thing because of copyleft on a piece of cryptographic code, the one that really ends up suffering is all the users that didn't have a choice in the matter of using said commercial software.

jeena 7y ago
Or, if its a permissive license then the company makes changes to it which break it so that it's less secure and the end user can't even check that (or ask someone to check that) it's not broken. Then the user ends up suffering because they didn't have the choice in the matter of using to be able to check if everything is ok. This is even worse because it pretends making security better but does not deliver. Then it would be better if this commercial software would not exist.
- ronsor 7y ago
  This is illogical because (1) why would the company break the algorithm? (2) it's relatively easy to hide backdoors in plain sight (it just looks like poorly written code)
  - mcguire 7y ago
    Incompetence is the simple answer.
mplanchard 7y ago
Do the LGPL and similar weak copyleft licenses not satisfy this goal? As long as the company publishes any modifications to the library itself, they are free to use it, whether or not they open source their project.
- beefhash 7y ago
  I don't think that the LGPL can satisfy this goal when it comes to embedded devices, where the whole notion of “dynamic linking” may not reasonably exist in the first place. The state of IoT security is a hopeless trashfire already; every bit of help is needed there.