5 ms·

For those not interested in reading this long arguement the actual license simply says you must release the source code to your application "Complete source co

For those not interested in reading this long arguement the actual license simply says you must release the source code to your application "Complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable." This is relatively routine. The major new claim here is that releasing source code requires folks to unlock secure boot / root of trust / DRM type implementation on HARDWARE they sell. So release a complete work no longer (as plain language would read) means releasing the source code - but now ALSO requires that developers add various features to HARDWARE to bypass root of trust security measures which may include things around power limits or management on equipment or for things like phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone.

deleted 5y ago
[deleted]
josephcsible 5y ago
> phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone. You realize that bootloader unlocking and carrier unlocking are totally separate, orthogonal things, right?
- whoknowswhat11 5y ago
  Do you understand the GPLv3? It made clear that any of this locking on hardware was prohibited. Vendors of products that had these locks have to provide the security / encryption keys to bypass them if they use GPLv3. As a result, they do not.
  - josephcsible 5y ago
    There's two separate sets of keys. One controls what OS the phone's CPU will boot, and the other controls what SIM cards the phone's baseband will use. Nothing would require releasing the second set of keys.
    - whoknowswhat11 5y ago
      Have you talked about this with the FSF? I can sell a GPLv3 device that ships with unmodifiable locks? If this is true (it is not) than we can do all sorts of dongle type locks on devices. GPLv3 is not just about the bootloader. They are very clear actually that vendors must release anything that is needed to bypass locks or integrity checks. " It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it."
      - josephcsible 5y ago
        Can you copy and paste the exact sentence(s) from the GPLv3 that support your position? Because that's not my reading of it at all. EDIT: This? > " It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it." The key word there is "need". You don't need the baseband unlock information to replace the stock kernel with a modified one.
        comex 5y ago
        The GPLv3 requires that if you distribute GPLv3 software as part of a consumer product, users must be able to install a modified version of the software in its place. If the baseband has GPLv3 software on it, then that implies the user has the right to run custom software on the baseband (at least at the same privilege level as said software), which probably implies the ability to connect it to arbitrary networks. If only the application processor has GPLv3 software, then there is no requirement with respect to the baseband. The GPL isn't that viral.
        pabs3 5y ago
        BTW, the PinePhone baseband runs Linux on the non-DSP part of the baseband. There are folks reverse-engineering the proprietary programs running under the Linux kernel on the baseband.
RHSeeger 5y ago
> phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone. To be fair, the fact that they signed a contract saying they would pay for the phone is what's supposed to be what keeps them paying for the phone. There's already laws around paying for things you buy, so the whole "well, people wouldn't pay for their phones" argument is completely invalid.
- whoknowswhat11 5y ago
  It is not completely invalid. This is a ridiculous statement. The stats are actually pretty clear. T-mobile in particular got hit with plenty of fraud and others did too before they got better at locking things down. Activation locks were also a control put in place to reduce what was for a while an epidemic of street crime where phones were stolen. The locks are critical and pretty popular, many DA's and cities demanded Apple put them in to try and reduce street crime - and they did. So the idea that locks prevent theft / crime is not completely invalid. In fact, there are laws against stealing from houses and many people still lock their house. Their are laws against steeling cars and people still use keys for their cars.
  - thatguy0900 5y ago
    From working at a att store for a while, I'll say that there is far more fraud than most would think. Perhaps it was because I worked in a little bit of a poorer area, but we actively turned away 25-40% of customers on any given day out of suspicion of fraud. If a customer stopped paying for their phone we would have that commission taken back next month. Even with that many people being turned down you still lost a lot of commission every month.
    - infogulch 5y ago
      This is more an indication that the problem is being solved at the wrong level of abstraction. The problem is that phone companies are handing out loans with no way to enforce collateral and without tying to some real persons credit. Being able to install your own OS on a phone is orthogonal to being able to use it as a secure collateral.
ineedasername 5y ago
>The major new claim here Per the article and its citation of decade+ old precedent, that is not a new claim. Whether these requirements of the license are reasonable or not is irrelevant. If OEM's don't like the license terms then they can buy/build something else.
infogulch 5y ago
I mean it's right there: "scripts used to control compilation and installation of the executable" If the installer source code is missing the bit that enables installation of the GPL binaries on your device, then I guess it's not in compliance. The fact that the scope of these codes also include device keys seems somewhat irrelevant.
drran 5y ago
> or for things like phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone The solution is simple: develop your own OS, make it bulletproof, then do whatever you want. Nobody will ask to open source code of Symbian device, because it's not a GPL'ed OS.

deleted 5y ago

[deleted]

josephcsible 5y ago

> phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone. You realize that bootloader unlocking and carrier unlocking are totally separate, orthogonal things, right?

whoknowswhat11 5y ago
Do you understand the GPLv3? It made clear that any of this locking on hardware was prohibited. Vendors of products that had these locks have to provide the security / encryption keys to bypass them if they use GPLv3. As a result, they do not.
- josephcsible 5y ago
  There's two separate sets of keys. One controls what OS the phone's CPU will boot, and the other controls what SIM cards the phone's baseband will use. Nothing would require releasing the second set of keys.
  - whoknowswhat11 5y ago
    Have you talked about this with the FSF? I can sell a GPLv3 device that ships with unmodifiable locks? If this is true (it is not) than we can do all sorts of dongle type locks on devices. GPLv3 is not just about the bootloader. They are very clear actually that vendors must release anything that is needed to bypass locks or integrity checks. " It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it."
    - josephcsible 5y ago
      Can you copy and paste the exact sentence(s) from the GPLv3 that support your position? Because that's not my reading of it at all. EDIT: This? > " It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it." The key word there is "need". You don't need the baseband unlock information to replace the stock kernel with a modified one.
      - comex 5y ago
        The GPLv3 requires that if you distribute GPLv3 software as part of a consumer product, users must be able to install a modified version of the software in its place. If the baseband has GPLv3 software on it, then that implies the user has the right to run custom software on the baseband (at least at the same privilege level as said software), which probably implies the ability to connect it to arbitrary networks. If only the application processor has GPLv3 software, then there is no requirement with respect to the baseband. The GPL isn't that viral.
        pabs3 5y ago
        BTW, the PinePhone baseband runs Linux on the non-DSP part of the baseband. There are folks reverse-engineering the proprietary programs running under the Linux kernel on the baseband.

RHSeeger 5y ago

> phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone. To be fair, the fact that they signed a contract saying they would pay for the phone is what's supposed to be what keeps them paying for the phone. There's already laws around paying for things you buy, so the whole "well, people wouldn't pay for their phones" argument is completely invalid.

whoknowswhat11 5y ago
It is not completely invalid. This is a ridiculous statement. The stats are actually pretty clear. T-mobile in particular got hit with plenty of fraud and others did too before they got better at locking things down. Activation locks were also a control put in place to reduce what was for a while an epidemic of street crime where phones were stolen. The locks are critical and pretty popular, many DA's and cities demanded Apple put them in to try and reduce street crime - and they did. So the idea that locks prevent theft / crime is not completely invalid. In fact, there are laws against stealing from houses and many people still lock their house. Their are laws against steeling cars and people still use keys for their cars.
- thatguy0900 5y ago
  From working at a att store for a while, I'll say that there is far more fraud than most would think. Perhaps it was because I worked in a little bit of a poorer area, but we actively turned away 25-40% of customers on any given day out of suspicion of fraud. If a customer stopped paying for their phone we would have that commission taken back next month. Even with that many people being turned down you still lost a lot of commission every month.
  - infogulch 5y ago
    This is more an indication that the problem is being solved at the wrong level of abstraction. The problem is that phone companies are handing out loans with no way to enforce collateral and without tying to some real persons credit. Being able to install your own OS on a phone is orthogonal to being able to use it as a secure collateral.

ineedasername 5y ago

>The major new claim here Per the article and its citation of decade+ old precedent, that is not a new claim. Whether these requirements of the license are reasonable or not is irrelevant. If OEM's don't like the license terms then they can buy/build something else.

infogulch 5y ago

I mean it's right there: "scripts used to control compilation and installation of the executable" If the installer source code is missing the bit that enables installation of the GPL binaries on your device, then I guess it's not in compliance. The fact that the scope of these codes also include device keys seems somewhat irrelevant.

drran 5y ago

> or for things like phones sold on installment plans with a vendor lock would let folks pick up the phone on plan, root it to avoid vendor lock and then stop paying on phone The solution is simple: develop your own OS, make it bulletproof, then do whatever you want. Nobody will ask to open source code of Symbian device, because it's not a GPL'ed OS.