5 ms·

Is there an actual license file somewhere? Not only is the title of the page not necessarily authoritative enough, but public-domain dedication is not a thing i

by remram 4y ago

Is there an actual license file somewhere? Not only is the title of the page not necessarily authoritative enough, but public-domain dedication is not a thing in many countries, which is why CC-0 exists.

tptacek 4y ago
This is a whole can of worms with Bernstein. But the library is pretty trivial, so if this really worries you, just use `getrandom`. The actual source files are all labeled "public domain". That's all you're going to get from him.
LarryMullins 4y ago
> but public-domain dedication is not a thing in many countries, which is why CC-0 exists. Has there ever been a real instance of this distinction actually mattering? Has a German software company ever gotten into real trouble because they used American public domain code without a locally valid license? It seems like an academic objection for lawyers to wring their hands about. Risk adverse organizations with investors will demand licenses for software like SQLite because a few thousand dollars to eliminate a minuscule remote risk is basically nothing to a software business. But does your average German FOSS hacker bother to buy a license to SQLite? Would that really be a rational use of their own money? I doubt it.
- remram 4y ago
  On some level, no open-source license matters, you are not going to get in trouble for stealing some rando's GitHub repository. In fact they would never find out. However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people.
  - LarryMullins 4y ago
    > However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people. I assert that public domain does work for people, even Germans in practice. It doesn't work for risk averse corporations.
    - remram 4y ago
      The point of a license is entirely to mitigate risk. I trust open-source developers to not go after me and my meager projects, but still I appreciate when they take the 2min needed to slap a legal-like document on their library. When you refuse to do that, and decide to spend way more than 2min explaining your belief that this might not be required (though you are not a lawyer, have no court decisions to back it up, and have otherwise done a limited review of a few countries), you are making the conscious decision to go out of your way to increase the risk on me. I don't appreciate that, but does that really make me "risk-averse"?
      - LarryMullins 4y ago
        American FOSS developers who put their code in the public domain are taking those 2 minutes to slap a legal-like document on their code. A short document telling other programmers that the code is public domain clearly communicates the intent and wishes of the author to other developers. They're giving something to the world for free, with no strings attached, clearly communicated. But despite that, some people will complain because it wasn't done in precisely the correct way to keep corporate lawyers in a notoriously legalistic and pedantic foreign country happy.
      - dragonwriter 4y ago
        Any legal-like document that mitigates risk for one parry does so by restricting another party. So, its natural that people will choose not to do more of than they see as necessary to deal with speculative risks raised by third-parties who are often either not attorneys, or attorneys for people whose interests are not aligned with those whose action is sought, based on some foreign legal system with which thr actor is unfamiliar. If you don't like what you are being offered for free, you are, of course, at liberty to move along.
        remram 4y ago
        > you are, of course, at liberty to move along I am also at liberty to offer a comment on it on this here comment section... If you feel like the point of this site is to offer silent upvotes, you are at liberty to do that.
  - loeg 4y ago
    DJB has also written about the public domain: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html
- deleted 4y ago
  [deleted]
- adamgordonbell 4y ago
  Not sure. But I think SQLite won't look at contributions from non-public domain countries. I mean, they aren't really open to contributions anyhow, but being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with.
  - LarryMullins 4y ago
    > being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with This doesn't sound right. Did he explain to you why he thinks he's stuck with it? He has the legal right to release SQLite other some other license and does so when companies pay him for it. Generally speaking, nothing about putting code in the public domain precludes collaborating with other developers. SQLite's caution against accepting contributions (even when the contributor is another American willing to sign over their contribution to the public domain) probably has more to do with Oracle being notoriously litigious and nasty. Not accepting contributions reduces the risk of one day being sued by Oracle, since it reduces the risk that Oracle IP might accidentally show up in SQLite. This would be a concern regardless of what sort of license SQLite used. If you're not worried about that sort of thing, there is nothing which prevents an American FOSS developer from accepting public domain contributions from other developers.
    - adamgordonbell 4y ago
      Going from memory, he was warned by legal or something, that someone from a place where public domain didn't exist as a concept couldn't give them code and say it was public domain. He's on here occasionally, so maybe he'll jump in but I think the issue is the contributors might not be able to put things into the public domain.
- cryptonector 4y ago
  SQLite3 is in every phone and every laptop and... Do Apple, Google, etc. have to do something special in order to use SQLite3 in Germany? Have there been any court cases about this? Have there been any fines issued or paid over this? IMO the whole Germany-doesn't-have-public-domain thing is just FUD.
  - LarryMullins 4y ago
    SQLite offers to sell licenses to organizations that worry about it, Apple and Google have probably bought such licenses to cover their asses in Germany just in case.
    - cryptonector 4y ago
      Yeah, but does anyone really bother? Is there any German case law about this?
      - GoblinSlayer 4y ago
        Germany uses civil law (Roman system), not common law.
        cryptonector 4y ago
        The courts might not make common law, but there could still be no court cases at all about public domain software, which would be pretty telling that those just don't come up even though there's an abundance of public domain source code.
  - remram 4y ago
    That is true, still it has a comprehensive copyright page which includes this rather explicit permission: > Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means. https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html This is quite different from librandombytes...
- GoblinSlayer 4y ago
  Usually copyright is the author's right and only the author can enforce that right, so it would take the public domain author to sue users, which I suppose rarely happens.
orlp 4y ago
https://cr.yp.to/publicdomain.html https://cr.yp.to/publicdomain.html I'm not taking a stance, I'm just the messenger.
- remram 4y ago
  Interesting. It is on purpose then, for equal or worse. Maybe he's right, maybe he's wrong. What he's not is a judge or lawyer, so I'll keep with the status quo of licensing.
  - loeg 4y ago
    What he isn't is a German. He's an American and the public domain is healthy and well established here.
    - madars 4y ago
      djb is also a German citizen https://cr.yp.to/cv/cv-20080915.pdf https://cr.yp.to/cv/cv-20080915.pdf (Citizenships: USA; Germany; Native language: English. Language courses: French (advanced), German, Danish.)
    - deleted 4y ago
      [deleted]
loeg 4y ago
> public-domain dedication is not a thing in many countries See the author's other page with thoughts on this subject: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html
1vuio0pswjnm7 4y ago
Wow, is this really going to be the top comment. This library has been around since 2008 and chances are you are using software that includes it right now, e.g., if your web browser used djb-derived cryptography included in your browser when connecting to HN. If I wrote software using djb code and made money from it, and djb asked me for a percentage, then I would happily pay. The chances of that happening are probably nil, particularly the first part. Alternatively, if I wrote software using djb code and he asked me to refrain from doing something, then I would probably comply. He has a strong reputation for being right. Again, the chances of being asked for anything seem to be nil anyway. Assuming devurandom.c, i.e., randombytes(), is used in djb-authored cryptography, which itself or close derivatives are now used widely, how many of the folks working on the projects listed at the web pages below are using public domain djb code without a license (I don't know the answer, I'm asking a question). One might guess by looking at these lists that the "status quo" is to accept djb's public domain designation. https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/chacha-deployment.html https://ianix.com/pub/chacha-deployment.html Take OpenSSH for example. https://raw.githubusercontent.com/openssh/openssh-portable/master/crypto_api.h https://raw.githubusercontent.com/openssh/openssh-portable/m... OpenSSH uses djb cryptography for generating ed25519 keys, among other things. That uses randombytes() as in crypto_api.h above. djb's randombytes() is simply a wrapper around /dev/urandom, OpenSSH's randombytes() in ed25519.c is a wrapper around arc4random_buf(). arcrandom_buf() is a wrapper around arc4random(). arc4random() uses djb cryptography placed in the public domain. https://raw.githubusercontent.com/openssh/openssh-portable/master/openbsd-compat/chacha_private.h https://raw.githubusercontent.com/openssh/openssh-portable/m... No idea what software the parent writes but as an end user I would prefer to avoid it since apparently they have to avoid widely used, publicly vetted code because it's in the public domain.
- remram 4y ago
  If you don't care whether it's public domain, that's fine. That seems completely orthogonal to the discussion of whether that works, though.
deleted 4y ago
[deleted]

by remram 4y ago

tptacek 4y ago

This is a whole can of worms with Bernstein. But the library is pretty trivial, so if this really worries you, just use `getrandom`. The actual source files are all labeled "public domain". That's all you're going to get from him.

LarryMullins 4y ago

> but public-domain dedication is not a thing in many countries, which is why CC-0 exists. Has there ever been a real instance of this distinction actually mattering? Has a German software company ever gotten into real trouble because they used American public domain code without a locally valid license? It seems like an academic objection for lawyers to wring their hands about. Risk adverse organizations with investors will demand licenses for software like SQLite because a few thousand dollars to eliminate a minuscule remote risk is basically nothing to a software business. But does your average German FOSS hacker bother to buy a license to SQLite? Would that really be a rational use of their own money? I doubt it.

remram 4y ago
On some level, no open-source license matters, you are not going to get in trouble for stealing some rando's GitHub repository. In fact they would never find out. However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people.
- LarryMullins 4y ago
  > However if this aspect is important enough to you that you put it in the very title of your site, you should probably do it in a way that actually works for people. I assert that public domain does work for people, even Germans in practice. It doesn't work for risk averse corporations.
  - remram 4y ago
    The point of a license is entirely to mitigate risk. I trust open-source developers to not go after me and my meager projects, but still I appreciate when they take the 2min needed to slap a legal-like document on their library. When you refuse to do that, and decide to spend way more than 2min explaining your belief that this might not be required (though you are not a lawyer, have no court decisions to back it up, and have otherwise done a limited review of a few countries), you are making the conscious decision to go out of your way to increase the risk on me. I don't appreciate that, but does that really make me "risk-averse"?
    - LarryMullins 4y ago
      American FOSS developers who put their code in the public domain are taking those 2 minutes to slap a legal-like document on their code. A short document telling other programmers that the code is public domain clearly communicates the intent and wishes of the author to other developers. They're giving something to the world for free, with no strings attached, clearly communicated. But despite that, some people will complain because it wasn't done in precisely the correct way to keep corporate lawyers in a notoriously legalistic and pedantic foreign country happy.
    - dragonwriter 4y ago
      Any legal-like document that mitigates risk for one parry does so by restricting another party. So, its natural that people will choose not to do more of than they see as necessary to deal with speculative risks raised by third-parties who are often either not attorneys, or attorneys for people whose interests are not aligned with those whose action is sought, based on some foreign legal system with which thr actor is unfamiliar. If you don't like what you are being offered for free, you are, of course, at liberty to move along.
      - remram 4y ago
        > you are, of course, at liberty to move along I am also at liberty to offer a comment on it on this here comment section... If you feel like the point of this site is to offer silent upvotes, you are at liberty to do that.
- loeg 4y ago
  DJB has also written about the public domain: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html
deleted 4y ago
[deleted]
adamgordonbell 4y ago
Not sure. But I think SQLite won't look at contributions from non-public domain countries. I mean, they aren't really open to contributions anyhow, but being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with.
- LarryMullins 4y ago
  > being public domain was mentioned to me by Richard as a mistake they made that they've had to deal with This doesn't sound right. Did he explain to you why he thinks he's stuck with it? He has the legal right to release SQLite other some other license and does so when companies pay him for it. Generally speaking, nothing about putting code in the public domain precludes collaborating with other developers. SQLite's caution against accepting contributions (even when the contributor is another American willing to sign over their contribution to the public domain) probably has more to do with Oracle being notoriously litigious and nasty. Not accepting contributions reduces the risk of one day being sued by Oracle, since it reduces the risk that Oracle IP might accidentally show up in SQLite. This would be a concern regardless of what sort of license SQLite used. If you're not worried about that sort of thing, there is nothing which prevents an American FOSS developer from accepting public domain contributions from other developers.
  - adamgordonbell 4y ago
    Going from memory, he was warned by legal or something, that someone from a place where public domain didn't exist as a concept couldn't give them code and say it was public domain. He's on here occasionally, so maybe he'll jump in but I think the issue is the contributors might not be able to put things into the public domain.
cryptonector 4y ago
SQLite3 is in every phone and every laptop and... Do Apple, Google, etc. have to do something special in order to use SQLite3 in Germany? Have there been any court cases about this? Have there been any fines issued or paid over this? IMO the whole Germany-doesn't-have-public-domain thing is just FUD.
- LarryMullins 4y ago
  SQLite offers to sell licenses to organizations that worry about it, Apple and Google have probably bought such licenses to cover their asses in Germany just in case.
  - cryptonector 4y ago
    Yeah, but does anyone really bother? Is there any German case law about this?
    - GoblinSlayer 4y ago
      Germany uses civil law (Roman system), not common law.
      - cryptonector 4y ago
        The courts might not make common law, but there could still be no court cases at all about public domain software, which would be pretty telling that those just don't come up even though there's an abundance of public domain source code.
- remram 4y ago
  That is true, still it has a comprehensive copyright page which includes this rather explicit permission: > Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means. https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html This is quite different from librandombytes...
GoblinSlayer 4y ago
Usually copyright is the author's right and only the author can enforce that right, so it would take the public domain author to sue users, which I suppose rarely happens.

orlp 4y ago

https://cr.yp.to/publicdomain.html https://cr.yp.to/publicdomain.html I'm not taking a stance, I'm just the messenger.

remram 4y ago
Interesting. It is on purpose then, for equal or worse. Maybe he's right, maybe he's wrong. What he's not is a judge or lawyer, so I'll keep with the status quo of licensing.
- loeg 4y ago
  What he isn't is a German. He's an American and the public domain is healthy and well established here.
  - madars 4y ago
    djb is also a German citizen https://cr.yp.to/cv/cv-20080915.pdf https://cr.yp.to/cv/cv-20080915.pdf (Citizenships: USA; Germany; Native language: English. Language courses: French (advanced), German, Danish.)
  - deleted 4y ago
    [deleted]

loeg 4y ago

> public-domain dedication is not a thing in many countries See the author's other page with thoughts on this subject: http://cr.yp.to/publicdomain.html http://cr.yp.to/publicdomain.html

1vuio0pswjnm7 4y ago

Wow, is this really going to be the top comment. This library has been around since 2008 and chances are you are using software that includes it right now, e.g., if your web browser used djb-derived cryptography included in your browser when connecting to HN. If I wrote software using djb code and made money from it, and djb asked me for a percentage, then I would happily pay. The chances of that happening are probably nil, particularly the first part. Alternatively, if I wrote software using djb code and he asked me to refrain from doing something, then I would probably comply. He has a strong reputation for being right. Again, the chances of being asked for anything seem to be nil anyway. Assuming devurandom.c, i.e., randombytes(), is used in djb-authored cryptography, which itself or close derivatives are now used widely, how many of the folks working on the projects listed at the web pages below are using public domain djb code without a license (I don't know the answer, I'm asking a question). One might guess by looking at these lists that the "status quo" is to accept djb's public domain designation. https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/curve25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/ed25519-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/salsa20-deployment.html https://ianix.com/pub/chacha-deployment.html https://ianix.com/pub/chacha-deployment.html Take OpenSSH for example. https://raw.githubusercontent.com/openssh/openssh-portable/master/crypto_api.h https://raw.githubusercontent.com/openssh/openssh-portable/m... OpenSSH uses djb cryptography for generating ed25519 keys, among other things. That uses randombytes() as in crypto_api.h above. djb's randombytes() is simply a wrapper around /dev/urandom, OpenSSH's randombytes() in ed25519.c is a wrapper around arc4random_buf(). arcrandom_buf() is a wrapper around arc4random(). arc4random() uses djb cryptography placed in the public domain. https://raw.githubusercontent.com/openssh/openssh-portable/master/openbsd-compat/chacha_private.h https://raw.githubusercontent.com/openssh/openssh-portable/m... No idea what software the parent writes but as an end user I would prefer to avoid it since apparently they have to avoid widely used, publicly vetted code because it's in the public domain.

remram 4y ago
If you don't care whether it's public domain, that's fine. That seems completely orthogonal to the discussion of whether that works, though.

deleted 4y ago

[deleted]