5 ms·
It was (still is?) really cool to hate on the GPL. I think the long lost root of the discontent is because it restricts developer freedom (in favor of user free
by dcow 6y ago
It was (still is?) really cool to hate on the GPL. I think the long lost root of the discontent is because it restricts developer freedom (in favor of user freedom, of course), but in reality it just became a meme and most people who critique it don't actually understand what its purpose is. It's like PGP, show me a better alternative and I'll gladly jump ship. But it's not terribly productive to complain without offering solutions.
As a developer, you have a choice to make when you encounter GPL bashing: jump on the bandwagon, or rebut. If you choose the bandwagon, don't come crying when you can't make a living building honest software that treats users with respect because you have to compete with large companies who ~~take~~ steal agnostic software and subsidize their products with user disrespect and line their pockets selling ad profiles.
As a user, demand honest software and new companies will rise to meet your demands. Instead of ads, pay $30 and support a project that puts your interests first. Subscribe for $3/mo when you find a product that brings you continuous value.
As a technical leader and someone in a position to make impactful technical decisions at your small company, educate yourself on the license landscape, examine your core product and target market. If you're targeting open source adoption by big companies and expect them to eventually pay for a proprietary overlay, probably avoid the GPL. If you're building a product for _users_, consider enshrining that position in your license terms and simultaneously defending their freedom while deterring predatory abuse by large companies.
It runs contrary to the FSF guidance, but I'd also suggest, out of practicality, patenting your (software) inventions. Ultimately it gives you flexibility and defense in the event that somebody else tries to assert their own patents. It also protects your GPL users because you explicitly license them to use your patented work, and it allows you to license that technology regardless of any software you've written to companies who may not find the GPL palatable but still would like to use your invention. Win win win.
- neolog 6y ago> It's like PGP, show me a better alternative and I'll gladly jump ship. PGP is a bunch of use cases glommed together; for most/all of them there is a better tool https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
- forgotmypw17 6y agoYou are free to only use the PGP features you need.
- iudqnolq 6y agoBut if you want to send secure messages it also matters if your friend has remember to enable --dont-be-stupid and disable --automatically-guess-its-20-year-old-insecure-format
- rakoo 6y agoOr your friend should use a software that does all the PGP mumbo-jumbo for you such as Deltachat
- hansvm 6y agoI'm not quite sure if you're serious or not. The person you're responding to thinks that a special purpose app would be better than PGP, and your response is that the best solution is a special purpose app which calls into PGP. Why is the latter preferable?
- rakoo 6y agoThe person I'm replying to says that PGP is hard to use because there's so many options you have to know and use correctly. I completely agree with that, its UX is most probably the main reason it isn't more widespread. But that doesn't invalidate PGP itself: the format is still useful, we have the tools to use it correctly. So I'm saying that using PGP crypto is still worth it, especially if all the bad bits (configuring, tuning) are managed automatically by the application.
- iudqnolq 6y agoThe problem with a universal format is it's hard to know that everyone you're talking to does things right. If you have end to end security and the other end leaks, that's not very good. Whereas with a limited format I know a non-malicious counterpart probably has their client configured just like mine. Here's a good quote from the article at the top of this chain: > Take AEAD ciphers: the Rust-language Sequoia PGP defaulted to the AES-EAX AEAD mode, which is great, and nobody can read those messages because most PGP installs don’t know what EAX mode is, which is not great. Every well-known bad cryptosystem eventually sprouts an RFC extension that supports curves or AEAD, so that its proponents can claim on message boards that they support modern cryptography. RFC’s don’t matter: only the installed base does. We’ve understood authenticated encryption for 2 decades, and PGP is old enough to buy me drinks; enough excuses. > You can have backwards compatibility with the 1990s or you can have sound cryptography; you can’t have both.