3 ms·

I wish it was open source.

AlotOfReading 3y ago
Not only is green hills stuff not open source, the contracts typically include a clause preventing you from compiling open source with their toolchain.
- IAmLiterallyAB 3y ago
  Why would they care about that...
  - zebomon 3y ago
    From my understanding, it's generally the same reason they have made the kernel exceptionally small -- to reduce attack surface.
  - foobiekr 3y ago
    It makes liability for failure more complicated and customers might link their proprietary items to toxic licenses. They don’t want to be involved. Also, just to be frank, if you’re using a solution like this, open source does not meet your requirements.
    - AlotOfReading 3y ago
      No, it's because open source competes with some of their upsell offerings and they want to preserve their auxiliary sales. As for whether it meets your requirements, that's entirely dependent on context. In most cases it's a perfectly valid choice as long as you understand that you're taking on the associated maintenance and certification burden. In our case, it included stuff we had written and open sourced ourselves.
  - mighmi 3y ago
    The Thompson attack's where code is able to secretly modify/exploit the compiler to propagate through future compiled programs or itself when compiled. Preventing the execution of foreign code thus reduces the attack surface even further.
- Veserv 3y ago
  That is just plain untrue under any lay interpretation of your statement. Are you perhaps talking about not being able to open source a work statically linked to proprietary libraries (with or without library source code) such as compiler libraries? The general problem with that is that such a work would be a derivative work [1]. If you are using a copyleft license that would mean you would be required to disclose the source code of all components including the source code of the library you received. If you do not have a license to distribute and relicense that library, it would be copyright infringement to disclose and relicense it under the copyleft license. You can not both statically link a proprietary source code library and release the derivative work under a copyleft license; that is inherently incompatible. [1] https://www.gnu.org/licenses/gpl-faq.html#GPLInProprietarySystem https://www.gnu.org/licenses/gpl-faq.html#GPLInProprietarySy...
  - AlotOfReading 3y ago
    It has nothing to do with copyright or linking. The default green hills contract contains a clause restricting your usage of the toolchain to build code that competes or replaces their other offerings, because they want don't want you avoiding their upsells.
    - Veserv 3y ago
      From what I remember, it does not. I think your legal counsel did a overly-broad reading of some clause or combination of clauses. Given that you keep bringing up open source and mentioned code that you yourselves open sourced, it was probably a copyleft linking clause and your lawyers erred on the side of caution (as lawyers do). To the point, unless you avoided linking the default proprietary compiler libraries (such as the C lib) any work you open sourced under a copyleft license and distributed would be in violation of the copyleft license as you and your downstream would be unable to legally supply the source code to those libraries. You could avoid this by explicitly linking a copyleft compatible library like glibc instead of the default proprietary libraries, but I suspect your lawyers did not want to deal with the hassle of validating conformance. Much easier to just say you can not use it on open source products. This is a general problem when dealing with proprietary software components/libraries, just most people have little familiarity with that since the proprietary library industry largely died since developers do not want to pay for their software dependencies.
msla 3y ago
So there's nothing saying it hasn't been gimmicked in some fashion.

Not only is green hills stuff not open source, the contracts typically include a clause preventing you from compiling open source with their toolchain.

IAmLiterallyAB 3y ago
Why would they care about that...
- zebomon 3y ago
  From my understanding, it's generally the same reason they have made the kernel exceptionally small -- to reduce attack surface.
- foobiekr 3y ago
  It makes liability for failure more complicated and customers might link their proprietary items to toxic licenses. They don’t want to be involved. Also, just to be frank, if you’re using a solution like this, open source does not meet your requirements.
  - AlotOfReading 3y ago
    No, it's because open source competes with some of their upsell offerings and they want to preserve their auxiliary sales. As for whether it meets your requirements, that's entirely dependent on context. In most cases it's a perfectly valid choice as long as you understand that you're taking on the associated maintenance and certification burden. In our case, it included stuff we had written and open sourced ourselves.
- mighmi 3y ago
  The Thompson attack's where code is able to secretly modify/exploit the compiler to propagate through future compiled programs or itself when compiled. Preventing the execution of foreign code thus reduces the attack surface even further.
Veserv 3y ago
That is just plain untrue under any lay interpretation of your statement. Are you perhaps talking about not being able to open source a work statically linked to proprietary libraries (with or without library source code) such as compiler libraries? The general problem with that is that such a work would be a derivative work [1]. If you are using a copyleft license that would mean you would be required to disclose the source code of all components including the source code of the library you received. If you do not have a license to distribute and relicense that library, it would be copyright infringement to disclose and relicense it under the copyleft license. You can not both statically link a proprietary source code library and release the derivative work under a copyleft license; that is inherently incompatible. [1] https://www.gnu.org/licenses/gpl-faq.html#GPLInProprietarySystem https://www.gnu.org/licenses/gpl-faq.html#GPLInProprietarySy...
- AlotOfReading 3y ago
  It has nothing to do with copyright or linking. The default green hills contract contains a clause restricting your usage of the toolchain to build code that competes or replaces their other offerings, because they want don't want you avoiding their upsells.
  - Veserv 3y ago
    From what I remember, it does not. I think your legal counsel did a overly-broad reading of some clause or combination of clauses. Given that you keep bringing up open source and mentioned code that you yourselves open sourced, it was probably a copyleft linking clause and your lawyers erred on the side of caution (as lawyers do). To the point, unless you avoided linking the default proprietary compiler libraries (such as the C lib) any work you open sourced under a copyleft license and distributed would be in violation of the copyleft license as you and your downstream would be unable to legally supply the source code to those libraries. You could avoid this by explicitly linking a copyleft compatible library like glibc instead of the default proprietary libraries, but I suspect your lawyers did not want to deal with the hassle of validating conformance. Much easier to just say you can not use it on open source products. This is a general problem when dealing with proprietary software components/libraries, just most people have little familiarity with that since the proprietary library industry largely died since developers do not want to pay for their software dependencies.

msla 3y ago

So there's nothing saying it hasn't been gimmicked in some fashion.