6 ms·

Mullvad highlighting the fact that Malwareware bytes is using their network: https://mullvad.net/en/help/partnerships-and-resellers/ https://mullvad.net/en/hel

Mullvad highlighting the fact that Malwareware bytes is using their network: https://mullvad.net/en/help/partnerships-and-resellers/ https://mullvad.net/en/help/partnerships-and-resellers/ The essence of the article: Except that Malwarebytes Privacy is just some paint on top of Mullvad and various open-source tools, which would be a parasitic albeit fine behaviour if this was clearly disclosed (as Mullvad is (amusingly) doing on its website), but there is no mention of this whatsoever on Malwarebytes' one. Worse, they're using a possessive voice when talking about the servers (that are Mullvad's) and the code (mostly Wintun and wireguard-windows amongst other, to which they didn't contribute back a single line of code. Speaking of code, it's shipping 7z.dll from 2018, licensed under LGPL, and some parts under BSD, violating this license. wintun.dll, from the Wintun project, without mentioning it, thus violating its license. Most of the embedded dependencies are from 2018, and subject to documented vulnerabilities: OpenSSL 1.1.0h pcre2 7z, as mentioned above Poco 1.9.0

deleted 5y ago
[deleted]
eurasiantiger 5y ago
Why is bundling a (L)GPL .dll considered a violation?
- smitop 5y ago
  They have to provide the source code for those DLLs, which they aren't doing.
  - deleted 5y ago
    [deleted]
  - suvo 5y ago
    Actually I wanted to know, which clause says that. Is it Section 4d0?
  - dubcanada 5y ago
    No they don't, if I am correct all they need to do is allow you to swap out the dll for your own and put a license.txt or what not with the license. As long as the DLL is setup as a shared library (which it is) it is fine.
    - FeepingCreature 5y ago
      The source code is necessary to create "your own".
      - atatatat 5y ago
        Not always, but, practically.
- grahamlee 5y ago
  Because you have to make the source code available to people who receive your distribution of the library.
  - rndgermandude 5y ago
    So? Maybe malwarebytes are doing that?
    - deelowe 5y ago
      Are they? I got the sense that this is the issue.
  - jcun4128 5y ago
    I'll have to brush up on this, GPL that's not seen by people say it does something in messaging or part of DNS or something, it would still have to be public? Use case is part of some web-app that isn't installed.
    - dfatduck 5y ago
      I am quite sure that you only need to publish the source if you are distributing the GPLed code.
    - singlow 5y ago
      If its running on your server, then you aren't distributing it. There are licenses like AGPL that do try to limit that usage but GPL does not. Now if it is a web app that has client code that gets executed in the browser, that is distributed to the end user and GPL would apply, so you would need to include license notifications for that within your app or as part of the source code distributed. In that case you are already distributing source but you may need to make an unobfuscated source available if your distribution is minified/uglified.
      - jcun4128 5y ago
        YANAL ha, but I was curious even if we did have to disclose the specific GPL piece of software, do we only have to release that part? Not the entire app. > web app that has client code that gets executed in the browser, That's the technicality stuff, the client triggers an event, that then uses this GPL piece of code that is on the server. I went through our stuff (mostly NPM) and they all are either Apache/MIT but there was one piece like ahh... Anyway not making money yet but will bring this up for review with legal. Thanks
- deleted 5y ago
  [deleted]
  - deleted 5y ago
    [deleted]
- CGamesPlay 5y ago
  If my dubious understanding of the GPL is correct, you can link to an LGPL DLL without assuming the LGPL. Distributing that DLL modified/unmodified would require also distributing the corresponding modified/unmodified source code. I don't think that in this case we have a violation (for the LGPL code) since it's unlikely that they modified the source code for the named libraries (and would provide links to the unmodified source code after application of legal pressure). I also would assume that the copyright notices required to be displayed are all listed somewhere buried in the about dialog of the running software. [append] > wintun.dll, from the Wintun project, without mentioning it, thus violating its license. Also, after reading the license, I don't see this particular clause at all.
  - contravariant 5y ago
    From what I remember someone should basically be free to modify the DLL distributed under the LGPL license, so they need to be able to access the corresponding source-code and whatever logic is necessary to link a new DLL to the application (if required).
    - stonemetal12 5y ago
      According to clause 4, you either provide enough source to compile and load a modified lib, or you use a dynamically linked lib. If you go the dynamic linking route no source distribution is required. I guess they figure the end user can get source from the library project themselves.
      - wizzwizz4 5y ago
        > If you go the dynamic linking route no source distribution is required. For your code. The LGPL code still requires source distribution. (Plus, the BSD clause requires attribution.)
        eurasiantiger 5y ago
        Certainly the authors of said LGPL code are distributing that source. Would it make sense to distribute the source of every .dll included in a project?
WesolyKubeczek 5y ago
It has always amused me that despite how liberal BSD licenses are, there are always those guys that manage to violate even them.
zinekeller 5y ago
Why 7z and not the fully public-source version 7za? I'm really confused here, there's a way to avoid this problem, and Malwarebytes just failed it. I don't think that they need to use other decompression methods.
dahart 5y ago
> wintun.dll, from the Wintun project, without mentioning it, thus violating its license. I am curious and want to understand, not arguing, but this is a serious allegation. Can someone point out exactly where the Wintun violation is? I’m not a lawyer, but I’ve read the license [1] carefully, and I don’t see an obvious violation for failure to mention Wintun. Section 3 “RESTRICTIONS” does say no removing of proprietary notices, labels or copyrights - is that the problem? It says no redistributing the “rights of the Software” which is different than using the Software directly. And maybe(?) most relevant it says you cannot use the name Wintun to promote your own software, which seems potentially almost opposite of this claim of violation. The license does not seem to mention any requirement to post the name of the project, did I miss something subtle? [1] https://git.zx2c4.com/wintun/tree/prebuilt-binaries-license.txt https://git.zx2c4.com/wintun/tree/prebuilt-binaries-license....
- zinekeller 5y ago
  Needs to be analysed one-by-one. > Section 3 “RESTRICTIONS” does say no removing of proprietary notices, labels or copyrights - is that the problem? The license in itself doesn't say that, but the header to link to the DLL is dual-licensed under GPL and 3-BSD (note that the rest of WinTun is solely GPL), and all BSD variants requires notices (even if it is in an About section). > It says no redistributing the “rights of the Software” which is different than using the Software directly. So no sub-licensing, for example. They can distribute the software as-is (if using this license), but they cannot adjust the restrictions to a more permissive software (say, BSD or MIT license). This is to enforce GPL2 in other scenarios. This is equivalent in proprietary licenses, where it says that the software is licensed to you but its IP is not transferred. > And maybe(?) most relevant it says you cannot use the name Wintun to promote your own software, which seems potentially almost opposite of this claim of violation. "Promotion" here has a specific meaning, at least in the US. Mentioning that your software uses WinTun for legal compliance is not promotion. Mentioning WinTun in your advertisement for the software (unless to mention that it uses WinTun for its VPN), and especially mentioning that WinTun reccomends your software is banned. This might be very obvious, but even 3-BSD (example follows) has maintained this language because trademark laws are weird. Extract of 3-BSD: 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

deleted 5y ago

[deleted]

eurasiantiger 5y ago

Why is bundling a (L)GPL .dll considered a violation?

smitop 5y ago
They have to provide the source code for those DLLs, which they aren't doing.
- deleted 5y ago
  [deleted]
- suvo 5y ago
  Actually I wanted to know, which clause says that. Is it Section 4d0?
- dubcanada 5y ago
  No they don't, if I am correct all they need to do is allow you to swap out the dll for your own and put a license.txt or what not with the license. As long as the DLL is setup as a shared library (which it is) it is fine.
  - FeepingCreature 5y ago
    The source code is necessary to create "your own".
    - atatatat 5y ago
      Not always, but, practically.
grahamlee 5y ago
Because you have to make the source code available to people who receive your distribution of the library.
- rndgermandude 5y ago
  So? Maybe malwarebytes are doing that?
  - deelowe 5y ago
    Are they? I got the sense that this is the issue.
- jcun4128 5y ago
  I'll have to brush up on this, GPL that's not seen by people say it does something in messaging or part of DNS or something, it would still have to be public? Use case is part of some web-app that isn't installed.
  - dfatduck 5y ago
    I am quite sure that you only need to publish the source if you are distributing the GPLed code.
  - singlow 5y ago
    If its running on your server, then you aren't distributing it. There are licenses like AGPL that do try to limit that usage but GPL does not. Now if it is a web app that has client code that gets executed in the browser, that is distributed to the end user and GPL would apply, so you would need to include license notifications for that within your app or as part of the source code distributed. In that case you are already distributing source but you may need to make an unobfuscated source available if your distribution is minified/uglified.
    - jcun4128 5y ago
      YANAL ha, but I was curious even if we did have to disclose the specific GPL piece of software, do we only have to release that part? Not the entire app. > web app that has client code that gets executed in the browser, That's the technicality stuff, the client triggers an event, that then uses this GPL piece of code that is on the server. I went through our stuff (mostly NPM) and they all are either Apache/MIT but there was one piece like ahh... Anyway not making money yet but will bring this up for review with legal. Thanks
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
CGamesPlay 5y ago
If my dubious understanding of the GPL is correct, you can link to an LGPL DLL without assuming the LGPL. Distributing that DLL modified/unmodified would require also distributing the corresponding modified/unmodified source code. I don't think that in this case we have a violation (for the LGPL code) since it's unlikely that they modified the source code for the named libraries (and would provide links to the unmodified source code after application of legal pressure). I also would assume that the copyright notices required to be displayed are all listed somewhere buried in the about dialog of the running software. [append] > wintun.dll, from the Wintun project, without mentioning it, thus violating its license. Also, after reading the license, I don't see this particular clause at all.
- contravariant 5y ago
  From what I remember someone should basically be free to modify the DLL distributed under the LGPL license, so they need to be able to access the corresponding source-code and whatever logic is necessary to link a new DLL to the application (if required).
  - stonemetal12 5y ago
    According to clause 4, you either provide enough source to compile and load a modified lib, or you use a dynamically linked lib. If you go the dynamic linking route no source distribution is required. I guess they figure the end user can get source from the library project themselves.
    - wizzwizz4 5y ago
      > If you go the dynamic linking route no source distribution is required. For your code. The LGPL code still requires source distribution. (Plus, the BSD clause requires attribution.)
      - eurasiantiger 5y ago
        Certainly the authors of said LGPL code are distributing that source. Would it make sense to distribute the source of every .dll included in a project?

WesolyKubeczek 5y ago

It has always amused me that despite how liberal BSD licenses are, there are always those guys that manage to violate even them.

zinekeller 5y ago

Why 7z and not the fully public-source version 7za? I'm really confused here, there's a way to avoid this problem, and Malwarebytes just failed it. I don't think that they need to use other decompression methods.

dahart 5y ago

> wintun.dll, from the Wintun project, without mentioning it, thus violating its license. I am curious and want to understand, not arguing, but this is a serious allegation. Can someone point out exactly where the Wintun violation is? I’m not a lawyer, but I’ve read the license [1] carefully, and I don’t see an obvious violation for failure to mention Wintun. Section 3 “RESTRICTIONS” does say no removing of proprietary notices, labels or copyrights - is that the problem? It says no redistributing the “rights of the Software” which is different than using the Software directly. And maybe(?) most relevant it says you cannot use the name Wintun to promote your own software, which seems potentially almost opposite of this claim of violation. The license does not seem to mention any requirement to post the name of the project, did I miss something subtle? [1] https://git.zx2c4.com/wintun/tree/prebuilt-binaries-license.txt https://git.zx2c4.com/wintun/tree/prebuilt-binaries-license....

zinekeller 5y ago
Needs to be analysed one-by-one. > Section 3 “RESTRICTIONS” does say no removing of proprietary notices, labels or copyrights - is that the problem? The license in itself doesn't say that, but the header to link to the DLL is dual-licensed under GPL and 3-BSD (note that the rest of WinTun is solely GPL), and all BSD variants requires notices (even if it is in an About section). > It says no redistributing the “rights of the Software” which is different than using the Software directly. So no sub-licensing, for example. They can distribute the software as-is (if using this license), but they cannot adjust the restrictions to a more permissive software (say, BSD or MIT license). This is to enforce GPL2 in other scenarios. This is equivalent in proprietary licenses, where it says that the software is licensed to you but its IP is not transferred. > And maybe(?) most relevant it says you cannot use the name Wintun to promote your own software, which seems potentially almost opposite of this claim of violation. "Promotion" here has a specific meaning, at least in the US. Mentioning that your software uses WinTun for legal compliance is not promotion. Mentioning WinTun in your advertisement for the software (unless to mention that it uses WinTun for its VPN), and especially mentioning that WinTun reccomends your software is banned. This might be very obvious, but even 3-BSD (example follows) has maintained this language because trademark laws are weird. Extract of 3-BSD: 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.