6 ms·

“The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a)

“The Software Conservancy analysis summarized the conundrum as a pick-your-poison scenario: “In essence, Red Hat requires their customers to choose between (a) their software freedom and rights, and (b) remaining a Red Hat customer.” End-users are allowed to exercise their right to redistribute the code but if they do, they face the consequence of Red Hat canceling their subscription and being cut off from future versions of the software and Red Hat services.” —- This is the key issue imo. How can you be in compliance with “..if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have.” … if you make non-redistribution a requirement to even get access to begin with..? I’m sure I’m misunderstanding though at some level

soneil 3y ago
The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide you future binaries is your contract with them - and exercising those rights jeopardises that contract. Which technically works because the GPL only concerns the software you've received - it does not concern nor compel the software you've yet you receive.
- indigodaddy 3y ago
  So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..
  - spullara 3y ago
    You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
  - Semaphor 3y ago
    I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.
  - dxf 3y ago
    No, you can redistribute it. RedHat can't stop you. But you might only be able to do this once. Because what RedHat can do is cancel your contract, and stop you from using RedHat services, and you won't have access to future versions or updates.
    - indigodaddy 3y ago
      Right that ends up being the same thing. They are making your redistribution a violation of that (sub?)contract
      - insanitybit 3y ago
        That's not the same thing. You can do everything the GPL allows you to do, you are not restricted from that. But RHEL gets to choose who their customers are and they won't choose you. You can't force them to take you on as a customer, no license can
        indigodaddy 3y ago
        You’re misunderstanding me. RHEL is saying that to be/maintain as a customer, you have to not redistribute the received product, correct? So, again, to become a customer and receive a product where the license of that product dictates you CAN redistribute, you MUST first enter into another contract that says if you redistribute the product, it may violate your standing as a customer and jeopardize your chances of receiving any future product. Of course it’s a loophole, and I really hope it gets to court somehow because I doubt it would stand up. Just my opinion. I don’t know anything about GPL law, but it doesn’t seem logical that this is something that would be able to stand.
        insanitybit 3y ago
        It's not a loophole. You have every right you were guaranteed by the license. RHEL also has the right to choose their customers. They choose customers who don't exercise the rights granted by the license. This is all fine and compatible. I hate to use an anecdote but consider that you have some rights that you may exercise - say, free speech. You then come to me and enter into a contract. I am within my rights to not renew that contract if I dislike the things you say under your pre-existing right to free speech, and in fact, I can put it into our contract that I will cancel it if you exercise that right in a way I don't like. This is normal and commonplace. edit: Please do not engage with the anecdote. It's meant to be helpful, not be literally equivalent in a legal sense. This is why I hate anecdotesssss
  - raincom 3y ago
    Well, the law profession wouldn't exist if it weren't for loopholes.
    - andromeduck 3y ago
      I wouldn't call this a loophole.
  - midasuni 3y ago
    Seen this before with some company selling some form of “security” branch of the kernel or similar.
    - insanitybit 3y ago
      You're thinking of grsecurity, the out of tree Kernel patches from the folks who invented almost every major security mitigation in modern computers, who gave away their patches for free for decades, and then recently moved to only give away their stable patches to customers under the same contractual obligation. Their customers are still entirely free to redistribute under the GPL but Grsecurity is not forced to take people who do so as customers.
      - rixthefox 3y ago
        > from the folks who invented almost every major security mitigation in modern computers I wouldn't praise them that much. Linus himself called the code quality "questionable" at best and for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. If true security is something you can only achieve by having "hidden" patches, I don't buy your snakeoil and will gladly take security advice with the people who actually share that information rather than lock it behind a paywall. Edit: This is not to say if your contributing a lot of time and effort into securing the Linux kernel that you shouldn't get paid, you should. I just think you need to be realistic. If the patches work, cool. Now work on making it capable to be merged into the mainline tree. If your not actively contributing to the product as a whole then the only thing your doing is building a business solely to keep those patches working. That does not inspire confidence with me. God forbid the company go under and all that work never makes it into the main tree. Now you've wasted yours and everyone else's time. You have furthered Cyber Security by exactly 0 points. Good job.
        insanitybit 3y ago
        > Linus himself called the code quality "questionable" at best Linus hates them. There's a very long history there. > for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. You have no idea what you're talking about. edit: > You have furthered Cyber Security by exactly 0 points. Notably, despite never upstreaming their work, they are still responsible for inventing the most important mitigations in your computer, including your hardware (ASLR, SMAP, SMEP, to name a few). So no matter what they have absolutely furthered security by much more than 0.
- hughw 3y ago
  Some lawyers figured out how to legally steal IP from all the creators who have contributed to Linux.
- acters 3y ago
  My biggest question is how they are going to police this. Will each download contain hidden flags to mark it as your account? How will they be able to discern what account it came from? Sounds like a nightmare to control and may end up costing them more in the long run.
  - freedomben 3y ago
    I doubt they will do anything to police it, and I don't think they need to. They're not trying to murder/kill rebuilds, they're trying to make it so that a CTO can't say "I can just use <copy> and it's free RHEL." You could still say "I can just use <copy> and it's close to a free RHEL, but it's not exactly a free RHEL". In the world of support, contracts, and certification, that detail is really important.
spiffytech 3y ago
This makes me think of the React patent license issue from some years ago. React was licensed under BSD, but had a patent license that many interpreted as saying if Facebook sued you (among other things) you'd lose rights to any Facebook patents, including any that applied to React. Having rights under the BSD license didn't override that. Different situation, but same vibe.
- dralley 3y ago
  Not really the same. Red Hat isn't revoking your ability to use the software you've already received. There's no "kill switch" for RHEL nor does the contract remove your legal rights to use the software you have received. However, you do lose the right to access Red Hat-provided services, including the software update repositories, should you break the contract. My understanding of the React license is that it remove[d] your legal rights to use React in any form, immediately, if you sue Facebook for Patent infringement. That's significantly harsher.
  - angus-prune 3y ago
    Worth noting for the audience - this is a historical issue. Facebook removed the restriction and changed to a straight forward MIT license in 2017.
insanitybit 3y ago
You have the right to distribute the code. You don't have a right to be a RHEL customer.
- derekp7 3y ago
  Just like there is a federal law that says you have a write to receive over the air communications, yet there are some states that stop you from driving while receiving those radio communications (i.e., they make radar detectors illegal in the car). The prohibition isn't on using a radar detector (you can walk around all you want with one), but against driving with one.
m463 3y ago
What I think was really happening was that customers who subscribed were: - subscription for some core systems - centos elsewhere I suspect redhat is just going to continue to bleed customers.
jeroenhd 3y ago
GPL only provides you rights and freedoms as a customer/end user. Companies are free to choose who their customers/end users are. IBM can make sure Alma and Rocky aren't their customers, don't legitimately receive the binaries, and therefore under GPL don't have the rights to the source code.

soneil 3y ago

The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide you future binaries is your contract with them - and exercising those rights jeopardises that contract. Which technically works because the GPL only concerns the software you've received - it does not concern nor compel the software you've yet you receive.

indigodaddy 3y ago
So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..
- spullara 3y ago
  You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
- Semaphor 3y ago
  I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.
- dxf 3y ago
  No, you can redistribute it. RedHat can't stop you. But you might only be able to do this once. Because what RedHat can do is cancel your contract, and stop you from using RedHat services, and you won't have access to future versions or updates.
  - indigodaddy 3y ago
    Right that ends up being the same thing. They are making your redistribution a violation of that (sub?)contract
    - insanitybit 3y ago
      That's not the same thing. You can do everything the GPL allows you to do, you are not restricted from that. But RHEL gets to choose who their customers are and they won't choose you. You can't force them to take you on as a customer, no license can
      - indigodaddy 3y ago
        You’re misunderstanding me. RHEL is saying that to be/maintain as a customer, you have to not redistribute the received product, correct? So, again, to become a customer and receive a product where the license of that product dictates you CAN redistribute, you MUST first enter into another contract that says if you redistribute the product, it may violate your standing as a customer and jeopardize your chances of receiving any future product. Of course it’s a loophole, and I really hope it gets to court somehow because I doubt it would stand up. Just my opinion. I don’t know anything about GPL law, but it doesn’t seem logical that this is something that would be able to stand.
        insanitybit 3y ago
        It's not a loophole. You have every right you were guaranteed by the license. RHEL also has the right to choose their customers. They choose customers who don't exercise the rights granted by the license. This is all fine and compatible. I hate to use an anecdote but consider that you have some rights that you may exercise - say, free speech. You then come to me and enter into a contract. I am within my rights to not renew that contract if I dislike the things you say under your pre-existing right to free speech, and in fact, I can put it into our contract that I will cancel it if you exercise that right in a way I don't like. This is normal and commonplace. edit: Please do not engage with the anecdote. It's meant to be helpful, not be literally equivalent in a legal sense. This is why I hate anecdotesssss
- raincom 3y ago
  Well, the law profession wouldn't exist if it weren't for loopholes.
  - andromeduck 3y ago
    I wouldn't call this a loophole.
- midasuni 3y ago
  Seen this before with some company selling some form of “security” branch of the kernel or similar.
  - insanitybit 3y ago
    You're thinking of grsecurity, the out of tree Kernel patches from the folks who invented almost every major security mitigation in modern computers, who gave away their patches for free for decades, and then recently moved to only give away their stable patches to customers under the same contractual obligation. Their customers are still entirely free to redistribute under the GPL but Grsecurity is not forced to take people who do so as customers.
    - rixthefox 3y ago
      > from the folks who invented almost every major security mitigation in modern computers I wouldn't praise them that much. Linus himself called the code quality "questionable" at best and for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. If true security is something you can only achieve by having "hidden" patches, I don't buy your snakeoil and will gladly take security advice with the people who actually share that information rather than lock it behind a paywall. Edit: This is not to say if your contributing a lot of time and effort into securing the Linux kernel that you shouldn't get paid, you should. I just think you need to be realistic. If the patches work, cool. Now work on making it capable to be merged into the mainline tree. If your not actively contributing to the product as a whole then the only thing your doing is building a business solely to keep those patches working. That does not inspire confidence with me. God forbid the company go under and all that work never makes it into the main tree. Now you've wasted yours and everyone else's time. You have furthered Cyber Security by exactly 0 points. Good job.
      - insanitybit 3y ago
        > Linus himself called the code quality "questionable" at best Linus hates them. There's a very long history there. > for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. You have no idea what you're talking about. edit: > You have furthered Cyber Security by exactly 0 points. Notably, despite never upstreaming their work, they are still responsible for inventing the most important mitigations in your computer, including your hardware (ASLR, SMAP, SMEP, to name a few). So no matter what they have absolutely furthered security by much more than 0.
hughw 3y ago
Some lawyers figured out how to legally steal IP from all the creators who have contributed to Linux.
acters 3y ago
My biggest question is how they are going to police this. Will each download contain hidden flags to mark it as your account? How will they be able to discern what account it came from? Sounds like a nightmare to control and may end up costing them more in the long run.
- freedomben 3y ago
  I doubt they will do anything to police it, and I don't think they need to. They're not trying to murder/kill rebuilds, they're trying to make it so that a CTO can't say "I can just use <copy> and it's free RHEL." You could still say "I can just use <copy> and it's close to a free RHEL, but it's not exactly a free RHEL". In the world of support, contracts, and certification, that detail is really important.

spiffytech 3y ago

This makes me think of the React patent license issue from some years ago. React was licensed under BSD, but had a patent license that many interpreted as saying if Facebook sued you (among other things) you'd lose rights to any Facebook patents, including any that applied to React. Having rights under the BSD license didn't override that. Different situation, but same vibe.

dralley 3y ago
Not really the same. Red Hat isn't revoking your ability to use the software you've already received. There's no "kill switch" for RHEL nor does the contract remove your legal rights to use the software you have received. However, you do lose the right to access Red Hat-provided services, including the software update repositories, should you break the contract. My understanding of the React license is that it remove[d] your legal rights to use React in any form, immediately, if you sue Facebook for Patent infringement. That's significantly harsher.
- angus-prune 3y ago
  Worth noting for the audience - this is a historical issue. Facebook removed the restriction and changed to a straight forward MIT license in 2017.

insanitybit 3y ago

You have the right to distribute the code. You don't have a right to be a RHEL customer.

derekp7 3y ago
Just like there is a federal law that says you have a write to receive over the air communications, yet there are some states that stop you from driving while receiving those radio communications (i.e., they make radar detectors illegal in the car). The prohibition isn't on using a radar detector (you can walk around all you want with one), but against driving with one.

m463 3y ago

What I think was really happening was that customers who subscribed were: - subscription for some core systems - centos elsewhere I suspect redhat is just going to continue to bleed customers.

jeroenhd 3y ago

GPL only provides you rights and freedoms as a customer/end user. Companies are free to choose who their customers/end users are. IBM can make sure Alma and Rocky aren't their customers, don't legitimately receive the binaries, and therefore under GPL don't have the rights to the source code.