4 ms·

Wasn’t their own program. They have a binary they distribute, this was some other binary calling itself Signal without their approval.

teraflop 4y ago
If that's the issue, it's (at most) a trademark violation instead of a copyright violation, which means the DMCA complaint was filed under false premises.
- crumpled 4y ago
  A trademark violation is a copyright violation, because a trademark is copyrighted at first inception, before anyone adds the '™'. A company is also compelled to take actions like this to maintain the rights to thier own trademarks. That's my understanding; IANAL.
  - monocasa 4y ago
    That's not the case. And if it were, it still wouldn't matter because the AGPLv3 source would have granted you a license to that too being a copyright license.
    - tingletech 4y ago
      AGPLv3 allows one to add trademark terms that, when violated, revoke the copyright license.
      - cmeacham98 4y ago
        Link to where Signal added these terms? You've posted a variant of this claim several times on this post but as far as I can see Signal-Desktop is licensed under a pure AGPLv3 which definitely does not have such terms.
      - galgalesh 4y ago
        This is not correct. The trademark doesn't affect the copyright but you need both in order to publish binaries with the original name and logo in a store. You need a copyright license to use the binary. You need a trademark license to use the trademark. See the firefox -> iceweasel kerfuffle
  - scott_w 4y ago
    No, it’s not. Copyright and trademarks are two completely different things with different rules that apply to them.
  - crumpled 4y ago
    There's no need to downvote me, as I'm only engaging in polite conversation, just explain it. And if you can support your argument with qualifications, that would be nice. It sounds like people are saying that a company can have their trademarks used by downstream distributors of AGPLv3 software, if the license doesn't explicitly prevent that, which just seems wrong. The codebase license is not a license to other company IP I also don't understand why an entity couldn't do a DCMA takedown based on a trademark violation.
    - kube-system 4y ago
      You can't (legally) do a DMCA takedown for a trademark violation. You can use a copyright license that requires a user of a copyrighted work to respect your trademark (or whatever, basically). Then if someone doesn't meet those terms, the copyright license is revoked, and they are in violation of copyright law. However, this is legally just a DMCA takedown for a copyright violation.
- tssva 4y ago
  I don't see where the source was being offered by the distributors of this package which would mean they were in violation of the AGPL and it was therefore a copyright violation.
  - jdiff 4y ago
    The AGPLv3 only requires that you make the source available, that can even be on request, that can be on a CD. You can even, to quote the AGPLv3 itself, charge for that CD "for a price no more than your reasonable cost of physically performing this conveying of source." But that's not what's going on here. If the source is unchanged, it's perfectly valid (and often done) to just point people upstream. That is providing the source. And the code used to build their snap is available*, and you can see all it does is repackage upstream's official package. * https://github.com/snapcrafters/signal-desktop/blob/master/snap/snapcraft.yaml https://github.com/snapcrafters/signal-desktop/blob/master/s...
- tingletech 4y ago
  Copyright license is revoked under AGPL v3 if you violate the AGPL v3 terms. AGPL v3 specifically allows authors to add trademark restrictions that become violating. Don't follow the trademark clauses, lose your copyright license, that becomes a copyright violation, actionable under DMCA.
  - monocasa 4y ago
    Signal doesn't appear to have actually added those restrictions to the license though. https://github.com/signalapp/Signal-Desktop/blob/main/LICENSE https://github.com/signalapp/Signal-Desktop/blob/main/LICENS...
  - deleted 4y ago
    [deleted]
frontiersummit 4y ago
At a naive level, this sounds like the sort of supply chain attack we've all been taught to fear. Asking seriously: has this build been replicated? is the source different from mainline? if so, what changed and who changed it?
- cyberphobe 4y ago
  Yes, this is a supply chain attack. That’s how Snap works. As far as I know, no one is alleging they actually changed anything, just that they could.
  - mananaysiempre 4y ago
    That’s also how free software distros work, and have always worked, in general: their job is[1] to prioritize the interests of the users as they see them over the vision of the developers, so that the users can choose the distro that reflects their interests most and still be able to use the software. [1] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html https://drewdevault.com/2021/09/27/Let-distros-do-their-job....
fweimer 4y ago
What are the terms that Signal attaches to the binaries? If unmodified binaries are redistributed, there is no trademark violation. It's nominative use, and simply not misleading the public because it's the genuine article. Any obstacle to redistribution must therefore come from the copyright licensing terms (if the binaries are available to the general public), or from an individual agreement with the original recipient of the binaries (so no direct free, public downloads even if the binaries are technically under an open-source license, and export compliance is a bit more difficult). Not sure which applies here, but it's not a trademark issue.
galgalesh 4y ago
This is simply incorrect, we were distributing the exact binaries signal produces.

teraflop 4y ago

If that's the issue, it's (at most) a trademark violation instead of a copyright violation, which means the DMCA complaint was filed under false premises.

crumpled 4y ago
A trademark violation is a copyright violation, because a trademark is copyrighted at first inception, before anyone adds the '™'. A company is also compelled to take actions like this to maintain the rights to thier own trademarks. That's my understanding; IANAL.
- monocasa 4y ago
  That's not the case. And if it were, it still wouldn't matter because the AGPLv3 source would have granted you a license to that too being a copyright license.
  - tingletech 4y ago
    AGPLv3 allows one to add trademark terms that, when violated, revoke the copyright license.
    - cmeacham98 4y ago
      Link to where Signal added these terms? You've posted a variant of this claim several times on this post but as far as I can see Signal-Desktop is licensed under a pure AGPLv3 which definitely does not have such terms.
    - galgalesh 4y ago
      This is not correct. The trademark doesn't affect the copyright but you need both in order to publish binaries with the original name and logo in a store. You need a copyright license to use the binary. You need a trademark license to use the trademark. See the firefox -> iceweasel kerfuffle
- scott_w 4y ago
  No, it’s not. Copyright and trademarks are two completely different things with different rules that apply to them.
- crumpled 4y ago
  There's no need to downvote me, as I'm only engaging in polite conversation, just explain it. And if you can support your argument with qualifications, that would be nice. It sounds like people are saying that a company can have their trademarks used by downstream distributors of AGPLv3 software, if the license doesn't explicitly prevent that, which just seems wrong. The codebase license is not a license to other company IP I also don't understand why an entity couldn't do a DCMA takedown based on a trademark violation.
  - kube-system 4y ago
    You can't (legally) do a DMCA takedown for a trademark violation. You can use a copyright license that requires a user of a copyrighted work to respect your trademark (or whatever, basically). Then if someone doesn't meet those terms, the copyright license is revoked, and they are in violation of copyright law. However, this is legally just a DMCA takedown for a copyright violation.
tssva 4y ago
I don't see where the source was being offered by the distributors of this package which would mean they were in violation of the AGPL and it was therefore a copyright violation.
- jdiff 4y ago
  The AGPLv3 only requires that you make the source available, that can even be on request, that can be on a CD. You can even, to quote the AGPLv3 itself, charge for that CD "for a price no more than your reasonable cost of physically performing this conveying of source." But that's not what's going on here. If the source is unchanged, it's perfectly valid (and often done) to just point people upstream. That is providing the source. And the code used to build their snap is available*, and you can see all it does is repackage upstream's official package. * https://github.com/snapcrafters/signal-desktop/blob/master/snap/snapcraft.yaml https://github.com/snapcrafters/signal-desktop/blob/master/s...
tingletech 4y ago
Copyright license is revoked under AGPL v3 if you violate the AGPL v3 terms. AGPL v3 specifically allows authors to add trademark restrictions that become violating. Don't follow the trademark clauses, lose your copyright license, that becomes a copyright violation, actionable under DMCA.
- monocasa 4y ago
  Signal doesn't appear to have actually added those restrictions to the license though. https://github.com/signalapp/Signal-Desktop/blob/main/LICENSE https://github.com/signalapp/Signal-Desktop/blob/main/LICENS...
- deleted 4y ago
  [deleted]

frontiersummit 4y ago

At a naive level, this sounds like the sort of supply chain attack we've all been taught to fear. Asking seriously: has this build been replicated? is the source different from mainline? if so, what changed and who changed it?

cyberphobe 4y ago
Yes, this is a supply chain attack. That’s how Snap works. As far as I know, no one is alleging they actually changed anything, just that they could.
- mananaysiempre 4y ago
  That’s also how free software distros work, and have always worked, in general: their job is[1] to prioritize the interests of the users as they see them over the vision of the developers, so that the users can choose the distro that reflects their interests most and still be able to use the software. [1] https://drewdevault.com/2021/09/27/Let-distros-do-their-job.html https://drewdevault.com/2021/09/27/Let-distros-do-their-job....

fweimer 4y ago

What are the terms that Signal attaches to the binaries? If unmodified binaries are redistributed, there is no trademark violation. It's nominative use, and simply not misleading the public because it's the genuine article. Any obstacle to redistribution must therefore come from the copyright licensing terms (if the binaries are available to the general public), or from an individual agreement with the original recipient of the binaries (so no direct free, public downloads even if the binaries are technically under an open-source license, and export compliance is a bit more difficult). Not sure which applies here, but it's not a trademark issue.

galgalesh 4y ago

This is simply incorrect, we were distributing the exact binaries signal produces.