4 ms·

Oftentimes they require vendors to only allow certified software to be installed for safety or compliance reasons.

by andrewshadura 6y ago

bestouff 6y ago
... and how is GPLv3 incompatible with certification ? I don't get it.
- andrewshadura 6y ago
  Because it doesn't allow users to install software modified by them, which is a requirement in GPLv3.
  - littlestymaar 6y ago
    And then the user loses the certification, as you said in another reply[1] the “user” you're talking about are other companies, so I don't see why they would decide to break the certification they got from their supplier just for fun. Edit since the parent was in fact speaking about the end-user, which I misunderstood: I don't see the problem either. The manufacturer has no obligation to prevent the end user from updating his car's software. There is no locks that prevents the car owner to just disable his airbag[2], or remove the safety belt. It's illegal to do so in most countries, and if the user do do and injure himself or somebody else because of that modification, they are on their own. I don't think it should be any different for software actually. [1]: https://news.ycombinator.com/item?id=26397176 https://news.ycombinator.com/item?id=26397176 [2] Edit: in fact, this is a bad example, because you need to be able to disable the airbag to put an infant car seat next to the driver.
    - detaro 6y ago
      No, the user that matters for GPL is the car owner. The point in the linked comment is that given how the market works, there is little incentive to work towards changing regulation (or even just interpretation of or belief about the regulation, I have clue if there are actually countries where this is impossible, but know for sure it's a widespread belief in the industry), because the company applying for certification is not the one getting annoyed by having to avoid GPLv3.
    - andrewshadura 6y ago
      I obviously meant end users in this case. The chain of software delivery often looks like this: Small subcontractor delivers parts of system→ big company provides ready to use solution → hardware vendor uses the solution and gets their devices certified → end user uses the final product In this case, the hardware vendor is mostly interested in having their devices work as intended. Everyone up the delivery chain has to meet their requirements in some way to basically get paid. That's not a position where it's easy to make demands regarding certifications, since the hardware vendor may just go to someone else.
    - froh 6y ago
      if your car kills your kid, eg the airbag misfired, or the lane assist went into oncoming traffic, then the car vendor will look for any opportunity to evade and refute responsibility. including claims of self tampering with the car. now in the burnt wreck, forensics need to show beyond doubt that it was, indeed, the car vendors shipment that killed the kid. how do you show as DA, that indeed the software was untampered with? drm. ps: airbags not working is less of a software problem than airbags misfiring.
  - africanboy 6y ago
    Not a lawyer, but I don't think that's true. GPLv3 says that manufacturers have to release all the information needed to run modified software on the device, it doesn't mean that there is one (and one only) certified version that can legally run on the device for safety reasons. GPLv3 in this case would force manufacturers to release the information so that the owner of the car could run modified software, but legally if you do it, you, the user, not the manufacturer, are violating the law. It's the same thing that happens with electronic blueprints, you can modify the HW, it will void the warranty if you do it. -------------------------------------------- Protecting Your Right to Tinker Tivoization is a dangerous attempt to curtail users' freedom: the right to modify your software will become meaningless if none of your computers let you do it. GPLv3 stops tivoization by requiring the distributor to provide you with whatever information or data is necessary to install modified software on the device. This may be as simple as a set of instructions, or it may include special data such as cryptographic keys or information about how to bypass an integrity check in the hardware. It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it. This requirement is limited in scope. Distributors are still allowed to use cryptographic keys for any purpose, and they'll only be required to disclose a key if you need it to modify GPLed software on the device they gave you. The GNU Project itself uses GnuPG to prove the integrity of all the software on its FTP site, and measures like that are beneficial to users. GPLv3 does not stop people from using cryptography; we wouldn't want it to. It only stops people from taking away the rights that the license provides you—whether through patent law, technology, or any other means. https://www.gnu.org/licenses/quick-guide-gplv3.html https://www.gnu.org/licenses/quick-guide-gplv3.html
    - detaro 6y ago
      The key point is if certification is possible for a device that allows arbitrary software to be run or not. If it is, we have your scenario. If it isn't, it's not possible. I don't know if the former case is true for all countries, I certainly know that the market overall believes it's not, or not worth the hassle of arguing it with other companies and regulators.
      - africanboy 6y ago
  - matkoniecz 6y ago
    Why certifying specific version of software would conflict with GPLv3?
henearkr 6y ago
What kind of obstacles to the certification process do GPL3 softs typically encounter?
- andrewshadura 6y ago
  You as a user can't get your modified software certified, hence you cannot install it, your GPLv3 rights are violated.
  - henearkr 6y ago
    I think that's a problem of interpretation more than a hard obstacle. In many projects there is the requirement of a fixed release for 3rd party dependencies, versions for which all tests have been checked to pass (this is what is done in NodeJS with packages.json). There is even a requirement of reproducible build sometimes (like with the ongoing project to reach full reproducibility in Debian builds). Wouldn't these fit the same thinking pattern as the requirements of certification of software for the industry? I'd love to hear RMS on this subject, maybe he would, too, say that the solution exists inside of GPL3 rather than outside of it.
    - andrewshadura 6y ago
      I'm sure there are ways to solve it, but they probably require both lawyering and developing technical solutions, which unfortunately the industry isn't much interested in doing, partly because there isn't enough pressure directed at them to change the course of things. Such pressure, in my understanding has to come from the regulators, but for that to happen they need to be convinced this is the right thing to do, and that isn't an easy task.
  - gspr 6y ago
    I'm confused. Surely you can install the modified software? It's just that now the local jurisdiction may not allow you to use your car on public roads. That's a bummer, but a political problem that exists between the user and his government, not a software problem between the user and the car manufacturer?
cue_the_strings 6y ago
You should finish that thought: and the manufacturers won't invest their money to certify something that's open source and can be used by everyone, including their competitors. If there was a will to do something about it, GPL3 wouldn't be in the way.
- andrewshadura 6y ago
  No, manufacturers want to use free software, but they are forced to avoid GPLv3 for this reason alone. Unfortunately, challenging the status quo is difficult when your customers are not the final users, but other companies: if you don't deliver them a free software firmware without GPLv3 components, someone else will, or someone else will deliver something that's completely proprietary.
  - bottled_poe 6y ago
    I think you are both wrong. The purpose of a certification is to mitigate risk. If the licensor of the software has no money, there is no one to sue, and the risk is not mitigated. I’m not advocating this mentality.
  - africanboy 6y ago
    > No, manufacturers want to use free software, but they are forced to avoid GPLv3 for this reason alone. good. It means that GPLv3 works as intended. EDIT: as intended by the software authors, that chose freely GPLv3 as license, they were not forced to. I'm quite sure they knew what they were doing. If car manufacturers want to use GPLv3 software, they simply need to respect the license the author released their software under or rewrite the software.
    - andrewshadura 6y ago
      If by that you mean preventing free software from being more widely used, I agree it does. However, I disagree with that aim.
      - 6y ago

Oftentimes they require vendors to only allow certified software to be installed for safety or compliance reasons.

bestouff 6y ago

... and how is GPLv3 incompatible with certification ? I don't get it.

andrewshadura 6y ago
Because it doesn't allow users to install software modified by them, which is a requirement in GPLv3.
- littlestymaar 6y ago
  And then the user loses the certification, as you said in another reply[1] the “user” you're talking about are other companies, so I don't see why they would decide to break the certification they got from their supplier just for fun. Edit since the parent was in fact speaking about the end-user, which I misunderstood: I don't see the problem either. The manufacturer has no obligation to prevent the end user from updating his car's software. There is no locks that prevents the car owner to just disable his airbag[2], or remove the safety belt. It's illegal to do so in most countries, and if the user do do and injure himself or somebody else because of that modification, they are on their own. I don't think it should be any different for software actually. [1]: https://news.ycombinator.com/item?id=26397176 https://news.ycombinator.com/item?id=26397176 [2] Edit: in fact, this is a bad example, because you need to be able to disable the airbag to put an infant car seat next to the driver.
  - detaro 6y ago
    No, the user that matters for GPL is the car owner. The point in the linked comment is that given how the market works, there is little incentive to work towards changing regulation (or even just interpretation of or belief about the regulation, I have clue if there are actually countries where this is impossible, but know for sure it's a widespread belief in the industry), because the company applying for certification is not the one getting annoyed by having to avoid GPLv3.
  - andrewshadura 6y ago
    I obviously meant end users in this case. The chain of software delivery often looks like this: Small subcontractor delivers parts of system→ big company provides ready to use solution → hardware vendor uses the solution and gets their devices certified → end user uses the final product In this case, the hardware vendor is mostly interested in having their devices work as intended. Everyone up the delivery chain has to meet their requirements in some way to basically get paid. That's not a position where it's easy to make demands regarding certifications, since the hardware vendor may just go to someone else.
  - froh 6y ago
    if your car kills your kid, eg the airbag misfired, or the lane assist went into oncoming traffic, then the car vendor will look for any opportunity to evade and refute responsibility. including claims of self tampering with the car. now in the burnt wreck, forensics need to show beyond doubt that it was, indeed, the car vendors shipment that killed the kid. how do you show as DA, that indeed the software was untampered with? drm. ps: airbags not working is less of a software problem than airbags misfiring.
- africanboy 6y ago
  Not a lawyer, but I don't think that's true. GPLv3 says that manufacturers have to release all the information needed to run modified software on the device, it doesn't mean that there is one (and one only) certified version that can legally run on the device for safety reasons. GPLv3 in this case would force manufacturers to release the information so that the owner of the car could run modified software, but legally if you do it, you, the user, not the manufacturer, are violating the law. It's the same thing that happens with electronic blueprints, you can modify the HW, it will void the warranty if you do it. -------------------------------------------- Protecting Your Right to Tinker Tivoization is a dangerous attempt to curtail users' freedom: the right to modify your software will become meaningless if none of your computers let you do it. GPLv3 stops tivoization by requiring the distributor to provide you with whatever information or data is necessary to install modified software on the device. This may be as simple as a set of instructions, or it may include special data such as cryptographic keys or information about how to bypass an integrity check in the hardware. It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it. This requirement is limited in scope. Distributors are still allowed to use cryptographic keys for any purpose, and they'll only be required to disclose a key if you need it to modify GPLed software on the device they gave you. The GNU Project itself uses GnuPG to prove the integrity of all the software on its FTP site, and measures like that are beneficial to users. GPLv3 does not stop people from using cryptography; we wouldn't want it to. It only stops people from taking away the rights that the license provides you—whether through patent law, technology, or any other means. https://www.gnu.org/licenses/quick-guide-gplv3.html https://www.gnu.org/licenses/quick-guide-gplv3.html
  - detaro 6y ago
    The key point is if certification is possible for a device that allows arbitrary software to be run or not. If it is, we have your scenario. If it isn't, it's not possible. I don't know if the former case is true for all countries, I certainly know that the market overall believes it's not, or not worth the hassle of arguing it with other companies and regulators.
    - africanboy 6y ago
- matkoniecz 6y ago
  Why certifying specific version of software would conflict with GPLv3?

henearkr 6y ago

What kind of obstacles to the certification process do GPL3 softs typically encounter?

andrewshadura 6y ago
You as a user can't get your modified software certified, hence you cannot install it, your GPLv3 rights are violated.
- henearkr 6y ago
  I think that's a problem of interpretation more than a hard obstacle. In many projects there is the requirement of a fixed release for 3rd party dependencies, versions for which all tests have been checked to pass (this is what is done in NodeJS with packages.json). There is even a requirement of reproducible build sometimes (like with the ongoing project to reach full reproducibility in Debian builds). Wouldn't these fit the same thinking pattern as the requirements of certification of software for the industry? I'd love to hear RMS on this subject, maybe he would, too, say that the solution exists inside of GPL3 rather than outside of it.
  - andrewshadura 6y ago
    I'm sure there are ways to solve it, but they probably require both lawyering and developing technical solutions, which unfortunately the industry isn't much interested in doing, partly because there isn't enough pressure directed at them to change the course of things. Such pressure, in my understanding has to come from the regulators, but for that to happen they need to be convinced this is the right thing to do, and that isn't an easy task.
- gspr 6y ago
  I'm confused. Surely you can install the modified software? It's just that now the local jurisdiction may not allow you to use your car on public roads. That's a bummer, but a political problem that exists between the user and his government, not a software problem between the user and the car manufacturer?

cue_the_strings 6y ago

You should finish that thought: and the manufacturers won't invest their money to certify something that's open source and can be used by everyone, including their competitors. If there was a will to do something about it, GPL3 wouldn't be in the way.

andrewshadura 6y ago
No, manufacturers want to use free software, but they are forced to avoid GPLv3 for this reason alone. Unfortunately, challenging the status quo is difficult when your customers are not the final users, but other companies: if you don't deliver them a free software firmware without GPLv3 components, someone else will, or someone else will deliver something that's completely proprietary.
- bottled_poe 6y ago
  I think you are both wrong. The purpose of a certification is to mitigate risk. If the licensor of the software has no money, there is no one to sue, and the risk is not mitigated. I’m not advocating this mentality.
- africanboy 6y ago
  > No, manufacturers want to use free software, but they are forced to avoid GPLv3 for this reason alone. good. It means that GPLv3 works as intended. EDIT: as intended by the software authors, that chose freely GPLv3 as license, they were not forced to. I'm quite sure they knew what they were doing. If car manufacturers want to use GPLv3 software, they simply need to respect the license the author released their software under or rewrite the software.
  - andrewshadura 6y ago
    If by that you mean preventing free software from being more widely used, I agree it does. However, I disagree with that aim.
    - 6y ago