5 ms·

Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You,

Sure, but there might be out-of-band reasons for users to not do that. For instance, grsecurity will sell you a security-hardening-patched Linux kernel. You, as the user/customer, have the right to take those GPL patches, and share them publicly. But if you do so, grsecurity will blacklist you as a customer, and you won't be able to get any more patches from them.

m4rtink 6y ago
Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?
josephcsible 6y ago
There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...
pabs3 6y ago
IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.
p1necone 6y ago
This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.
- plorntus 6y ago
  It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
  - tremon 6y ago
    The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

m4rtink 6y ago

Didn't that preaty much out grsecurity into (an even bigger) obscurity as no one sane will touch a logic bomb like this, not to mention build their business on it ?

josephcsible 6y ago

There's a strong case to be made that grsecurity is violating the GPL by doing that: https://perens.com/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ https://perens.com/2017/06/28/warning-grsecurity-potential-c...

pabs3 6y ago

IIRC one of grsec's customers did already leak their patches, I can't find the Twitter thread or other discussions about it any more though.

p1necone 6y ago

This just seems like a blatant violation of the license on grsecuritys part. The license requires them to allow people to share the code. "Technically you could share the code, and then we'll blacklist you" isn't letting people share the code, "technically" their customers can do anything. This sounds like the reasoning of a petulant elementary school kid, not a professional security company.

plorntus 6y ago
It sounds pretty reasonable to be honest, youre allowed to share the code and theres no legal reprocussions for doing so but the company should be able to just stop sending you stuff if you do?
- tremon 6y ago
  The GPL states that the company isn't allowed to distribute their modifications with those legal repercussions in the first place: You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice [..] and give any other recipients of the Program a copy of this License along with the Program. This is section 1 of the GPLv2 [1]. This plainly states that if The Company is distributing their code under GPLv2, their customers are plainly permitted to "copy and distribute verbatim copies of the Program's source code". Their whole business model is based on a tortuous reading of this part of section 2: If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Their claim is that they are shipping their patch set as a separate work from the Linux kernel, so that they're not bound by the requirement that "the distribution of the whole must be on the terms of this License", and they're free to choose whatever license they want for their patch set. However, since their patch set is in no way a separate work on its own, only a lawyer could make that case without blinking. [1] https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html