3 ms·

> It just means that if you want to extend the software, you must distribute source code with it. It means a lot more than that. The most significant differenc

> It just means that if you want to extend the software, you must distribute source code with it. It means a lot more than that. The most significant difference in my line of work is the anti-tivoization requirements. Essentially if you ship this software in a device, you must allow the user to change the software/firmware on that device. I do embedded Linux work for several different clients, and they are almost never OK with this. So I have to be careful to never use GPLv3 software. Not that I agree completely with the OP. I love when I can customize the firmware on devices I get (that is almost a precondition for my purchasing it), and I wish more manufacturers were OK with it.

pabs3 3y ago
Please note that the GPLv2 has the requirement that users be able to modify and reinstall the GPLed software. "Tivoisation" isn't what Tivo actually did and both the GPLv2 and GPLv3 ban "Tivoisation" but allow what Tivo actually did. "Tivoisation" as it is popularly known refers to blocking the running of modified GPL code, while what Tivo actually did was block running their proprietary software (their UI etc) on top of modified GPL code (here Linux). Both GPL versions block the former while allowing the latter. At least according to Software Freedom Conservancy. https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-the-gpl-right-to-install/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...
- sudobash1 3y ago
  A good point. For completeness though, I think that the way many modern embedded devices accept updates (arguably) skirts around the GPLv2 requirements. For instance many devices will only accept signed updates, or will only accept updates from a particular https server. The GPLv3 is much more explicit about these matters.
  - pabs3 3y ago
    It is fine to require signed updates, as long as the user can get their own updates installed. Usually that involves enrolling a new signing key, signing the updates with the user key and allowing user-signed updates. The shim tool used by Linux distros for Secure Boot is designed to allow that even if the UEFI firmware isn't and some UEFI implementations may allow controlling the signing keys. I expect that most of the cases you cite are simply outright GPL violations though.
- ranger_danger 3y ago
  Either this information is incorrect or a lot of companies have been getting away with violating this for decades with no consequences. Take for example, the Nintendo Switch. It contains GPL'ed software, which Nintendo makes available on their website (https://www.nintendo.co.jp/support/oss/ https://www.nintendo.co.jp/support/oss/), but they make absolutely no interface for the user to modify or replace any (GPL or not) code that was not provided by them. Lots of companies do this in fact... practically every modern car on the road is another example. And allowing them to have user-replaceable code would be a huge no-no for a variety of (potentially deadly) reasons. Same for medical devices.
  - pabs3 3y ago
    Indeed, most companies violate this requirement and copyright holders of GPLed code generally don't have legal/economic resources needed to enforce the license. There is a test case that will, if successful, allow all recipients of GPLed code to sue for GPL compliance, this will open up the possibility of enforcement to users too, which could potentially lead to class action GPL lawsuits. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html On cars, read through the presentation above, it discusses GPLv3 in cars and how that could work. Basically, there is a lot of proprietary software on top of the GPLed software in cars. When you modify the GPLed software, the other software would stop working (or be removed), and so your car would stop driving until you replaced it. You would then need to write replacements, you could then drive on your own property, or get them certified by the relevant authorities for use on public roads. https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...
LoganDark 3y ago
> Essentially if you ship this software in a device, you must allow the user to change the software/firmware on that device. This would have been useful to have for e.g. Android, where tech companies are trying to turn mobile phones into vehicles for their nonsense rather than devices under the user's control. It's gotten to the point where I have to acquire devices with arbitrary R/W vulnerabilities just so I can patch the OS, flash my own AVB signing keys, re-generate vbmeta etc etc just to have a rooted device, but then I have one with an unpatchable arbitrary R/W vulnerability, so it's arguable how "secure" the result is... Secure enough to watch netflix though, which is the real danger. https://xkcd.com/129 https://xkcd.com/129

pabs3 3y ago

Please note that the GPLv2 has the requirement that users be able to modify and reinstall the GPLed software. "Tivoisation" isn't what Tivo actually did and both the GPLv2 and GPLv3 ban "Tivoisation" but allow what Tivo actually did. "Tivoisation" as it is popularly known refers to blocking the running of modified GPL code, while what Tivo actually did was block running their proprietary software (their UI etc) on top of modified GPL code (here Linux). Both GPL versions block the former while allowing the latter. At least according to Software Freedom Conservancy. https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-the-gpl-right-to-install/ https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...

sudobash1 3y ago
A good point. For completeness though, I think that the way many modern embedded devices accept updates (arguably) skirts around the GPLv2 requirements. For instance many devices will only accept signed updates, or will only accept updates from a particular https server. The GPLv3 is much more explicit about these matters.
- pabs3 3y ago
  It is fine to require signed updates, as long as the user can get their own updates installed. Usually that involves enrolling a new signing key, signing the updates with the user key and allowing user-signed updates. The shim tool used by Linux distros for Secure Boot is designed to allow that even if the UEFI firmware isn't and some UEFI implementations may allow controlling the signing keys. I expect that most of the cases you cite are simply outright GPL violations though.
ranger_danger 3y ago
Either this information is incorrect or a lot of companies have been getting away with violating this for decades with no consequences. Take for example, the Nintendo Switch. It contains GPL'ed software, which Nintendo makes available on their website (https://www.nintendo.co.jp/support/oss/ https://www.nintendo.co.jp/support/oss/), but they make absolutely no interface for the user to modify or replace any (GPL or not) code that was not provided by them. Lots of companies do this in fact... practically every modern car on the road is another example. And allowing them to have user-replaceable code would be a huge no-no for a variety of (potentially deadly) reasons. Same for medical devices.
- pabs3 3y ago
  Indeed, most companies violate this requirement and copyright holders of GPLed code generally don't have legal/economic resources needed to enforce the license. There is a test case that will, if successful, allow all recipients of GPLed code to sue for GPL compliance, this will open up the possibility of enforcement to users too, which could potentially lead to class action GPL lawsuits. https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/vizio.html On cars, read through the presentation above, it discusses GPLv3 in cars and how that could work. Basically, there is a lot of proprietary software on top of the GPLed software in cars. When you modify the GPLed software, the other software would stop working (or be removed), and so your car would stop driving until you replaced it. You would then need to write replacements, you could then drive on your own property, or get them certified by the relevant authorities for use on public roads. https://events19.linuxfoundation.org/wp-content/uploads/2017/11/Safely-Copylefted-Cars-Reexamining-GPLv3-Installation-Information-Requirements-ALS-Bradley-Kuhn-Behan-Webster-1.pdf https://events19.linuxfoundation.org/wp-content/uploads/2017...

LoganDark 3y ago

> Essentially if you ship this software in a device, you must allow the user to change the software/firmware on that device. This would have been useful to have for e.g. Android, where tech companies are trying to turn mobile phones into vehicles for their nonsense rather than devices under the user's control. It's gotten to the point where I have to acquire devices with arbitrary R/W vulnerabilities just so I can patch the OS, flash my own AVB signing keys, re-generate vbmeta etc etc just to have a rooted device, but then I have one with an unpatchable arbitrary R/W vulnerability, so it's arguable how "secure" the result is... Secure enough to watch netflix though, which is the real danger. https://xkcd.com/129 https://xkcd.com/129