5 ms·

The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide yo

by soneil 3y ago

The theory as I understand it is that you have all the expected rights to the binaries you've been provided. But the only thing compelling redhat to provide you future binaries is your contract with them - and exercising those rights jeopardises that contract. Which technically works because the GPL only concerns the software you've received - it does not concern nor compel the software you've yet you receive.

indigodaddy 3y ago
So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..
- spullara 3y ago
  You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
- Semaphor 3y ago
  I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.
- dxf 3y ago
  No, you can redistribute it. RedHat can't stop you. But you might only be able to do this once. Because what RedHat can do is cancel your contract, and stop you from using RedHat services, and you won't have access to future versions or updates.
  - indigodaddy 3y ago
    Right that ends up being the same thing. They are making your redistribution a violation of that (sub?)contract
    - insanitybit 3y ago
      That's not the same thing. You can do everything the GPL allows you to do, you are not restricted from that. But RHEL gets to choose who their customers are and they won't choose you. You can't force them to take you on as a customer, no license can
      - indigodaddy 3y ago
        You’re misunderstanding me. RHEL is saying that to be/maintain as a customer, you have to not redistribute the received product, correct? So, again, to become a customer and receive a product where the license of that product dictates you CAN redistribute, you MUST first enter into another contract that says if you redistribute the product, it may violate your standing as a customer and jeopardize your chances of receiving any future product. Of course it’s a loophole, and I really hope it gets to court somehow because I doubt it would stand up. Just my opinion. I don’t know anything about GPL law, but it doesn’t seem logical that this is something that would be able to stand.
        insanitybit 3y ago
        It's not a loophole. You have every right you were guaranteed by the license. RHEL also has the right to choose their customers. They choose customers who don't exercise the rights granted by the license. This is all fine and compatible. I hate to use an anecdote but consider that you have some rights that you may exercise - say, free speech. You then come to me and enter into a contract. I am within my rights to not renew that contract if I dislike the things you say under your pre-existing right to free speech, and in fact, I can put it into our contract that I will cancel it if you exercise that right in a way I don't like. This is normal and commonplace. edit: Please do not engage with the anecdote. It's meant to be helpful, not be literally equivalent in a legal sense. This is why I hate anecdotesssss
        beanjuiceII 3y ago
        this might be the best way to say it I've seen
  - jonhohle 3y ago
    It sound like RedHat has migrated back to a “purchase” model then. You pay once, get your software and do with it as you please and then they ask you kindly to not pay again, kind of like the old days. Sounds good to me. As long as one subscriber is willing to leave their contract per release, downstream derivatives should have no end of supply for each release. This may not help with patches, but many of those would come from third parties to begin with.
    - zugi 3y ago
      This is the answer. What RedHat is doing is legal but sneaky. So we can be legal but sneaky too. Start a consortium that creates a new LLC or non-profit organization with no ties back to the consortium. That new organization buys a license, and publishes the code until RedHat cuts them off. Start a new one and repeat. Of course it could become a cat and mouse game, where RedHat starts denying customers it deems suspicious. They start demanding more info of their customers. But all that could be bad for business...
      - smsm42 3y ago
        Not a lawyer, but I suspect doing this with prior intent would be fraud (since you enter the contract with intent to violate it) and probably get you sued.
        zugi 3y ago
        I don't think so, the whole point here is that the contract does not - and cannot - bar you from sharing the code. The GPL bars RedHat from imposing additional restrictions on your rights to the code. But RedHat is under no obligation to make future sales to you and can drop you as a customer for any reason, including you exercising your legal right to share the code. So they want to be legal but sneaky? Let the legal but sneaky games begin!
        smsm42 3y ago
        The contract can not remove your legal rights, but can ask you to give them up in exchange for something. For example, I can not prohibit you from driving you own car, but if I rent it from you, and later you just take it back while my rental term still in effect, it would be a breach of contract, despite the car being legally yours. And if I learn that you never intended to let me drive the car, but still pretended to rent if out, then if would be fraud. Same, my employer can not prevent me from exercising my right you free speech, but some of it - eg disclosing trade secrets - may get me fired and sued for damages. Because by signing employment contract I agreed to give up exercise of some rights - like use if my time and some of my speech - in exchange for the salary. If I didn't I could speak of any secrets and they couldn't do a thing. Contract is a meeting of minds honestly intending to perform. If you did not have the good faith intention to perform the contract, it's not just sneaky, it's fraudulent.
- raincom 3y ago
  Well, the law profession wouldn't exist if it weren't for loopholes.
  - andromeduck 3y ago
    I wouldn't call this a loophole.
- midasuni 3y ago
  Seen this before with some company selling some form of “security” branch of the kernel or similar.
  - insanitybit 3y ago
    You're thinking of grsecurity, the out of tree Kernel patches from the folks who invented almost every major security mitigation in modern computers, who gave away their patches for free for decades, and then recently moved to only give away their stable patches to customers under the same contractual obligation. Their customers are still entirely free to redistribute under the GPL but Grsecurity is not forced to take people who do so as customers.
    - rixthefox 3y ago
      > from the folks who invented almost every major security mitigation in modern computers I wouldn't praise them that much. Linus himself called the code quality "questionable" at best and for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. If true security is something you can only achieve by having "hidden" patches, I don't buy your snakeoil and will gladly take security advice with the people who actually share that information rather than lock it behind a paywall. Edit: This is not to say if your contributing a lot of time and effort into securing the Linux kernel that you shouldn't get paid, you should. I just think you need to be realistic. If the patches work, cool. Now work on making it capable to be merged into the mainline tree. If your not actively contributing to the product as a whole then the only thing your doing is building a business solely to keep those patches working. That does not inspire confidence with me. God forbid the company go under and all that work never makes it into the main tree. Now you've wasted yours and everyone else's time. You have furthered Cyber Security by exactly 0 points. Good job.
      - insanitybit 3y ago
        > Linus himself called the code quality "questionable" at best Linus hates them. There's a very long history there. > for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. You have no idea what you're talking about. edit: > You have furthered Cyber Security by exactly 0 points. Notably, despite never upstreaming their work, they are still responsible for inventing the most important mitigations in your computer, including your hardware (ASLR, SMAP, SMEP, to name a few). So no matter what they have absolutely furthered security by much more than 0.
hughw 3y ago
Some lawyers figured out how to legally steal IP from all the creators who have contributed to Linux.
acters 3y ago
My biggest question is how they are going to police this. Will each download contain hidden flags to mark it as your account? How will they be able to discern what account it came from? Sounds like a nightmare to control and may end up costing them more in the long run.
- freedomben 3y ago
  I doubt they will do anything to police it, and I don't think they need to. They're not trying to murder/kill rebuilds, they're trying to make it so that a CTO can't say "I can just use <copy> and it's free RHEL." You could still say "I can just use <copy> and it's close to a free RHEL, but it's not exactly a free RHEL". In the world of support, contracts, and certification, that detail is really important.

by soneil 3y ago

indigodaddy 3y ago

So to receive a product where the GPL dictates you have full right to redistribute that product, you must first enter into a (sub?)contract that says you cannot redistribute it… If that’s not one hell of an ingenious loophole, I don’t know what is..

spullara 3y ago
You are legally allowed to redistribute it but RedHat is not compelled to continue to have you as a customer.
Semaphor 3y ago
I even had some person argue (kinda, pretty bad faith arguments) that this is not even against the spirit of the gpl.
dxf 3y ago
No, you can redistribute it. RedHat can't stop you. But you might only be able to do this once. Because what RedHat can do is cancel your contract, and stop you from using RedHat services, and you won't have access to future versions or updates.
- indigodaddy 3y ago
  Right that ends up being the same thing. They are making your redistribution a violation of that (sub?)contract
  - insanitybit 3y ago
    That's not the same thing. You can do everything the GPL allows you to do, you are not restricted from that. But RHEL gets to choose who their customers are and they won't choose you. You can't force them to take you on as a customer, no license can
    - indigodaddy 3y ago
      You’re misunderstanding me. RHEL is saying that to be/maintain as a customer, you have to not redistribute the received product, correct? So, again, to become a customer and receive a product where the license of that product dictates you CAN redistribute, you MUST first enter into another contract that says if you redistribute the product, it may violate your standing as a customer and jeopardize your chances of receiving any future product. Of course it’s a loophole, and I really hope it gets to court somehow because I doubt it would stand up. Just my opinion. I don’t know anything about GPL law, but it doesn’t seem logical that this is something that would be able to stand.
      - insanitybit 3y ago
        It's not a loophole. You have every right you were guaranteed by the license. RHEL also has the right to choose their customers. They choose customers who don't exercise the rights granted by the license. This is all fine and compatible. I hate to use an anecdote but consider that you have some rights that you may exercise - say, free speech. You then come to me and enter into a contract. I am within my rights to not renew that contract if I dislike the things you say under your pre-existing right to free speech, and in fact, I can put it into our contract that I will cancel it if you exercise that right in a way I don't like. This is normal and commonplace. edit: Please do not engage with the anecdote. It's meant to be helpful, not be literally equivalent in a legal sense. This is why I hate anecdotesssss
        beanjuiceII 3y ago
        this might be the best way to say it I've seen
- jonhohle 3y ago
  It sound like RedHat has migrated back to a “purchase” model then. You pay once, get your software and do with it as you please and then they ask you kindly to not pay again, kind of like the old days. Sounds good to me. As long as one subscriber is willing to leave their contract per release, downstream derivatives should have no end of supply for each release. This may not help with patches, but many of those would come from third parties to begin with.
  - zugi 3y ago
    This is the answer. What RedHat is doing is legal but sneaky. So we can be legal but sneaky too. Start a consortium that creates a new LLC or non-profit organization with no ties back to the consortium. That new organization buys a license, and publishes the code until RedHat cuts them off. Start a new one and repeat. Of course it could become a cat and mouse game, where RedHat starts denying customers it deems suspicious. They start demanding more info of their customers. But all that could be bad for business...
    - smsm42 3y ago
      Not a lawyer, but I suspect doing this with prior intent would be fraud (since you enter the contract with intent to violate it) and probably get you sued.
      - zugi 3y ago
        I don't think so, the whole point here is that the contract does not - and cannot - bar you from sharing the code. The GPL bars RedHat from imposing additional restrictions on your rights to the code. But RedHat is under no obligation to make future sales to you and can drop you as a customer for any reason, including you exercising your legal right to share the code. So they want to be legal but sneaky? Let the legal but sneaky games begin!
        smsm42 3y ago
        The contract can not remove your legal rights, but can ask you to give them up in exchange for something. For example, I can not prohibit you from driving you own car, but if I rent it from you, and later you just take it back while my rental term still in effect, it would be a breach of contract, despite the car being legally yours. And if I learn that you never intended to let me drive the car, but still pretended to rent if out, then if would be fraud. Same, my employer can not prevent me from exercising my right you free speech, but some of it - eg disclosing trade secrets - may get me fired and sued for damages. Because by signing employment contract I agreed to give up exercise of some rights - like use if my time and some of my speech - in exchange for the salary. If I didn't I could speak of any secrets and they couldn't do a thing. Contract is a meeting of minds honestly intending to perform. If you did not have the good faith intention to perform the contract, it's not just sneaky, it's fraudulent.
raincom 3y ago
Well, the law profession wouldn't exist if it weren't for loopholes.
- andromeduck 3y ago
  I wouldn't call this a loophole.
midasuni 3y ago
Seen this before with some company selling some form of “security” branch of the kernel or similar.
- insanitybit 3y ago
  You're thinking of grsecurity, the out of tree Kernel patches from the folks who invented almost every major security mitigation in modern computers, who gave away their patches for free for decades, and then recently moved to only give away their stable patches to customers under the same contractual obligation. Their customers are still entirely free to redistribute under the GPL but Grsecurity is not forced to take people who do so as customers.
  - rixthefox 3y ago
    > from the folks who invented almost every major security mitigation in modern computers I wouldn't praise them that much. Linus himself called the code quality "questionable" at best and for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. If true security is something you can only achieve by having "hidden" patches, I don't buy your snakeoil and will gladly take security advice with the people who actually share that information rather than lock it behind a paywall. Edit: This is not to say if your contributing a lot of time and effort into securing the Linux kernel that you shouldn't get paid, you should. I just think you need to be realistic. If the patches work, cool. Now work on making it capable to be merged into the mainline tree. If your not actively contributing to the product as a whole then the only thing your doing is building a business solely to keep those patches working. That does not inspire confidence with me. God forbid the company go under and all that work never makes it into the main tree. Now you've wasted yours and everyone else's time. You have furthered Cyber Security by exactly 0 points. Good job.
    - insanitybit 3y ago
      > Linus himself called the code quality "questionable" at best Linus hates them. There's a very long history there. > for people who care so much about "improving the security landscape" by walling off the very contributions that can help keep others safe online.... I don't really care what they put on their CV I wouldn't want them on my security team. You have no idea what you're talking about. edit: > You have furthered Cyber Security by exactly 0 points. Notably, despite never upstreaming their work, they are still responsible for inventing the most important mitigations in your computer, including your hardware (ASLR, SMAP, SMEP, to name a few). So no matter what they have absolutely furthered security by much more than 0.

hughw 3y ago

Some lawyers figured out how to legally steal IP from all the creators who have contributed to Linux.

acters 3y ago

My biggest question is how they are going to police this. Will each download contain hidden flags to mark it as your account? How will they be able to discern what account it came from? Sounds like a nightmare to control and may end up costing them more in the long run.

freedomben 3y ago
I doubt they will do anything to police it, and I don't think they need to. They're not trying to murder/kill rebuilds, they're trying to make it so that a CTO can't say "I can just use <copy> and it's free RHEL." You could still say "I can just use <copy> and it's close to a free RHEL, but it's not exactly a free RHEL". In the world of support, contracts, and certification, that detail is really important.