5 ms·

This kind of behavior is one of the things that kills me about grsecurity. They're completely abusing the spirit of the GPLv2 license but are probably following

This kind of behavior is one of the things that kills me about grsecurity. They're completely abusing the spirit of the GPLv2 license but are probably following the letter of it. If you choose to exercise your GPLv2 rights, your contract with them is terminated and you will receive no further security updates (considering this is a security product, it makes it pretty useless to you). You are then blacklisted from doing business with them ever again.

andreareina 6y ago
Bruce Perens argues[1] that this is a penalty for exercising your rights under the GPL and therefore violates section 6[2]: "You may not impose any further restrictions on the recipients' exercise of the rights granted herein" [1] https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c... [2] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
- st1ck 6y ago
  Open Source Security (company behind grsecurity) sued him for that post, but the case got dismissed and looks like OSS has to pay his legal fees: https://www.digitalmunition.me/maker-of-linux-patch-batch-grsecurity-cant-duck-260000-legal-bills-says-cali-appeals-court-in-anti-slapp-case/ https://www.digitalmunition.me/maker-of-linux-patch-batch-gr...
- tzs 6y ago
  He argues contributory infringement and breach of contract, but he really only goes into the breach of contract theory. I'm more curious about the contributory infringement theory. You cannot have contributory infringement without there being a direct infringement by someone else for the contributory infringer to have contributed to. I don't see offhand who would be the direct infringer whose infringement Grsecurity is contributing to.
  - chaosite 6y ago
    The way I'm readying it, his point is that a Grsecurity customer, who is not infringing Linux copyright (because they're not distributing kernels) would still be on the hook for contributory infringement because they contributed to Grsecurity's infringement.
sanxiyn 6y ago
After you are blacklisted, can't you still get security updates from other grsecurity subscribers? I suppose grsecurity could also blacklist any subscribers sharing to blacklisted people, but how could they possibly enforce this, if your friendly subscriber doesn't tell?
- p0llard 6y ago
  The "obvious solution" would surely be for grsecurity's customers to band together into a cartel to put an end to this pretty unpleasant behaviour?
- arp242 6y ago
  According to the Reddit thread linked in this thread, no one has ever been blacklisted: > We have in fact never had to terminate a relationship with any customer of ours. We build trusted relationships with our customers, so any talk of "threats" or anything else is simply completely fabricated (as you obviously noted, anyone repeating such claims has no evidence whatsoever for them).
elliekelly 6y ago
If someone chooses to exercise those rights does grsecurity comply? Or just terminate the contract and ignore all further communication?
- staticassertion 6y ago
  From the reddit thread I linked elsewhere (https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_linux_security_a_report_card/fwv4np2/ https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_...): > There is no restriction or prohibition, correct. In fact, we are far more lenient than other companies when it comes to our policies. We have in fact never had to terminate a relationship with any customer of ours. > We're generally only concerned with fraudulent customers who would lie during the quoting process with the intent to cause damage to the business by intentionally reposting all updates received online. Obviously, they have the right under the GPL to do that (the fraudulent representation notwithstanding), but we also obviously have the right to refuse future business with them. As noted by the lawyer in the link above, that right has been repeatedly reaffirmed by the US Supreme Court. It's not controversial whatsoever.
crazypython 6y ago
GPL protects the rights of users. It does not protect the rights of creators.
staticassertion 6y ago
https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_linux_security_a_report_card/fwv4np2/ https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_... Brad goes into this here. Grsecurity has written extensively about this. Read the links to their site where they go even further into detail. Grsecurity is not violating any license. There are multiple quotes from authorities on the matter in that link. If they were, so would Redhat, Canonical, etc.
- jasondclinton 6y ago
  Wow, that post is so ad hominem that it makes him less credible. Is this how he usually responds?
  - staticassertion 6y ago
    If I had to deal with constantly having my name dragged over something I wasn't doing, I would probably be pretty upset about it as well. Further, the Linux Kernel community tends to have... some negative communication patterns. But the content is very valid, you should give it a fair read, regardless of how you view Brad's language.
    - arp242 6y ago
      The comment they're replying to is also not exactly smelling of roses. It makes some pretty unsubstantiated claims. I read Peren's claims, and IMHO they're very thin. It seems to be a classic case of "I don't like this" (which is fair enough) and then trying to find "objective" arguments to support that position. Not impressed.

andreareina 6y ago

Bruce Perens argues[1] that this is a penalty for exercising your rights under the GPL and therefore violates section 6[2]: "You may not impose any further restrictions on the recipients' exercise of the rights granted herein" [1] https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c... [2] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

st1ck 6y ago
Open Source Security (company behind grsecurity) sued him for that post, but the case got dismissed and looks like OSS has to pay his legal fees: https://www.digitalmunition.me/maker-of-linux-patch-batch-grsecurity-cant-duck-260000-legal-bills-says-cali-appeals-court-in-anti-slapp-case/ https://www.digitalmunition.me/maker-of-linux-patch-batch-gr...
tzs 6y ago
He argues contributory infringement and breach of contract, but he really only goes into the breach of contract theory. I'm more curious about the contributory infringement theory. You cannot have contributory infringement without there being a direct infringement by someone else for the contributory infringer to have contributed to. I don't see offhand who would be the direct infringer whose infringement Grsecurity is contributing to.
- chaosite 6y ago
  The way I'm readying it, his point is that a Grsecurity customer, who is not infringing Linux copyright (because they're not distributing kernels) would still be on the hook for contributory infringement because they contributed to Grsecurity's infringement.

sanxiyn 6y ago

After you are blacklisted, can't you still get security updates from other grsecurity subscribers? I suppose grsecurity could also blacklist any subscribers sharing to blacklisted people, but how could they possibly enforce this, if your friendly subscriber doesn't tell?

p0llard 6y ago
The "obvious solution" would surely be for grsecurity's customers to band together into a cartel to put an end to this pretty unpleasant behaviour?
arp242 6y ago
According to the Reddit thread linked in this thread, no one has ever been blacklisted: > We have in fact never had to terminate a relationship with any customer of ours. We build trusted relationships with our customers, so any talk of "threats" or anything else is simply completely fabricated (as you obviously noted, anyone repeating such claims has no evidence whatsoever for them).

elliekelly 6y ago

If someone chooses to exercise those rights does grsecurity comply? Or just terminate the contract and ignore all further communication?

staticassertion 6y ago
From the reddit thread I linked elsewhere (https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_linux_security_a_report_card/fwv4np2/ https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_...): > There is no restriction or prohibition, correct. In fact, we are far more lenient than other companies when it comes to our policies. We have in fact never had to terminate a relationship with any customer of ours. > We're generally only concerned with fraudulent customers who would lie during the quoting process with the intent to cause damage to the business by intentionally reposting all updates received online. Obviously, they have the right under the GPL to do that (the fraudulent representation notwithstanding), but we also obviously have the right to refuse future business with them. As noted by the lawyer in the link above, that right has been repeatedly reaffirmed by the US Supreme Court. It's not controversial whatsoever.

crazypython 6y ago

GPL protects the rights of users. It does not protect the rights of creators.

staticassertion 6y ago

https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_linux_security_a_report_card/fwv4np2/ https://www.reddit.com/r/netsec/comments/hkg8co/10_years_of_... Brad goes into this here. Grsecurity has written extensively about this. Read the links to their site where they go even further into detail. Grsecurity is not violating any license. There are multiple quotes from authorities on the matter in that link. If they were, so would Redhat, Canonical, etc.

jasondclinton 6y ago
Wow, that post is so ad hominem that it makes him less credible. Is this how he usually responds?
- staticassertion 6y ago
  If I had to deal with constantly having my name dragged over something I wasn't doing, I would probably be pretty upset about it as well. Further, the Linux Kernel community tends to have... some negative communication patterns. But the content is very valid, you should give it a fair read, regardless of how you view Brad's language.
  - arp242 6y ago
    The comment they're replying to is also not exactly smelling of roses. It makes some pretty unsubstantiated claims. I read Peren's claims, and IMHO they're very thin. It seems to be a classic case of "I don't like this" (which is fair enough) and then trying to find "objective" arguments to support that position. Not impressed.