5 ms·

Fails to state why using a different license would have been any different in outcome.

eesmith 5y ago
I think it's so clear that nearly any proprietary license would have given Tannenbaum the ability to prevent this from happening that there was no need to state why. For example, the Minix 2 license pre-April 2000 would have been a no-go for Intel. Furthermore, GPLv3 says that user products ("A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.") which support updates must provide access to source code AND installation instructions. The article mentions "Intel released a patch" and the Wikipedia page at https://en.wikipedia.org/wiki/Intel_Management_Engine#Assertions_that_ME_is_a_backdoor https://en.wikipedia.org/wiki/Intel_Management_Engine#Assert... says patching is possible via firmware (UEFI, BIOS) updates , so this clause clearly applies. Thus, there are alternative preventative license even within the FOSS space.
- garmaine 5y ago
  I would think if he was considering a proprietary license it would be phrased differently, e.g. "Why I no longer use an open source license for new projects." The anti-Tivo clause in GPLv3 is probably the only thing in available licenses that would affect the outcome here. Specifically that is because it would require Intel to release the keys needed to build and install your own firmware patches. But that doesn't seem to be OP's direct complaint, which is more about being morally upset with the code being used in a backdoor. I'm not sure GPLv3 would address that? While I'm sure Intel is happy they don't have to release any source code for their management engine, it would not be a show stopper if they did. GPLv2 or MPL wouldn't be substantially different in outcomes as far as I can see.
  - sreevisakh 5y ago
    Not releasing the source code of IME gives Intel plausible deniability against allegations of intentionally inserting backdoors. Especially for IME, which is much harder than regular software to extract and reverse engineer. Given the competition they face now, that would be a major show-stopper for Intel if the allegations could be proved true.
    - garmaine 5y ago
      It’s the OS only though. They wouldn’t have to release their user-land security stuff no matter the license of MINIX.
    - CRConrad 5y ago
      > Not releasing the source code of IME gives Intel plausible deniability against allegations of intentionally inserting backdoors. Huh? One would think releasing the source should give them much better plausible deniability. Like, they'd just have to go: "Look at the source. See? No backdoors in there!" > Especially for IME, which is much harder than regular software to extract and reverse engineer. Yeah, so people would be all "Just because I couldn't find it doesn't mean it isn't hidden in there somewhere." See? Not very plausible deniability at all.
  - eesmith 5y ago
    I find it difficult to guess the author's intent given the paucity of information on that site.
    - garmaine 5y ago
      Fair enough.

I think it's so clear that nearly any proprietary license would have given Tannenbaum the ability to prevent this from happening that there was no need to state why. For example, the Minix 2 license pre-April 2000 would have been a no-go for Intel. Furthermore, GPLv3 says that user products ("A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.") which support updates must provide access to source code AND installation instructions. The article mentions "Intel released a patch" and the Wikipedia page at https://en.wikipedia.org/wiki/Intel_Management_Engine#Assertions_that_ME_is_a_backdoor https://en.wikipedia.org/wiki/Intel_Management_Engine#Assert... says patching is possible via firmware (UEFI, BIOS) updates , so this clause clearly applies. Thus, there are alternative preventative license even within the FOSS space.

garmaine 5y ago
I would think if he was considering a proprietary license it would be phrased differently, e.g. "Why I no longer use an open source license for new projects." The anti-Tivo clause in GPLv3 is probably the only thing in available licenses that would affect the outcome here. Specifically that is because it would require Intel to release the keys needed to build and install your own firmware patches. But that doesn't seem to be OP's direct complaint, which is more about being morally upset with the code being used in a backdoor. I'm not sure GPLv3 would address that? While I'm sure Intel is happy they don't have to release any source code for their management engine, it would not be a show stopper if they did. GPLv2 or MPL wouldn't be substantially different in outcomes as far as I can see.
- sreevisakh 5y ago
  Not releasing the source code of IME gives Intel plausible deniability against allegations of intentionally inserting backdoors. Especially for IME, which is much harder than regular software to extract and reverse engineer. Given the competition they face now, that would be a major show-stopper for Intel if the allegations could be proved true.
  - garmaine 5y ago
    It’s the OS only though. They wouldn’t have to release their user-land security stuff no matter the license of MINIX.
  - CRConrad 5y ago
    > Not releasing the source code of IME gives Intel plausible deniability against allegations of intentionally inserting backdoors. Huh? One would think releasing the source should give them much better plausible deniability. Like, they'd just have to go: "Look at the source. See? No backdoors in there!" > Especially for IME, which is much harder than regular software to extract and reverse engineer. Yeah, so people would be all "Just because I couldn't find it doesn't mean it isn't hidden in there somewhere." See? Not very plausible deniability at all.
- eesmith 5y ago
  I find it difficult to guess the author's intent given the paucity of information on that site.
  - garmaine 5y ago
    Fair enough.