4 ms·

> you should definitely have right to give away binaries without asking Red Hat for permission. You do, and you have to provide sources in that case. But, Red

> you should definitely have right to give away binaries without asking Red Hat for permission. You do, and you have to provide sources in that case. But, Red Hat can choose to stop doing business with you if you give away binaries for reasons that they judge to be against their interest. They aren't forced to accept your money.

AnthonyMouse 3y ago
How would they even know who it is? Alice is a Red Hat customer, gives binaries and sources to Bob in private, now Bob publishes them on the internet for the world without telling anyone it was Alice he got them from. "Tell us who it was so we can retaliate against them for exercising their rights under the license" doesn't seem like a good faith request.
- trimistermota 3y ago
  Nobody's going to use untrusted binaries/sources in this age of supply chain security..
  - AnthonyMouse 3y ago
    Anybody can diff the sources against upstream if they want to. But also, how does that even mean anything? Bob submitted a patch to the mainline Linux kernel which Red Hat forked which Alice downloaded which Bob uploaded and now you're trusting Bob that the code is safe, which you were already doing anyway unless you were comparing the changes to the code yourself, which you can still do.
  - wizzwizz4 3y ago
    Untrusted? They're from RedHatSourceDumps.onion! A few years back, my mate in Contoso gave me some sources a few years back, and they were identical to the ones that showed up on RHSD the next day; I don't know anyone who's ever noticed a bit out of place. Why would they choose today to start injecting malware, when somebody would raise the alarm within a week? Back in the real world: binary RPM packages are cryptographically signed, and I'm pretty sure source packages are as well. Who needs provenance when you can blindly assume that nobody's cracked the crypto yet (or, more realistically, leaked the keys)?
yjftsjthsd-h 3y ago
That is certainly what RH likes to claim, but it always struck me as extremely suspicious logic. If the license says you have to share code with users and cannot restrict their rights to do the same, and they exercise those rights and you immediately retaliate, it sure seems like a reasonable person would say that you're restricting the rights of your customers in direct contravention of the license terms.
- arccy 3y ago
  an ongoing (future) relationship isn't a right
  - torstenvl 3y ago
    Neither is employment. But there are still consequences for firing someone for an unlawful reason. I'm not saying Red Hat is wrong—I'm still undecided—but I don't think your logic is very persuasive.
  - cool_dude85 3y ago
    If you sign an employment contract that specifies you can only be fired for X and Y, and the company fires you for Z, you can sue. That doesn't mean your ongoing relationship is a right, it means one party didn't live up to the contract.
  - yjftsjthsd-h 3y ago
    Of course not. Just as use of GPL software isn't a right. Stop using copyleft software and you won't have to worry about those licenses giving your customers rights.
- bruce511 3y ago
  I think we can agree that businesses have the right to "fire" their customers, for (pretty much) any reason try like. Of course, as with any "subjective" behavior right, there can be regulatory implications (Christian cake shops selling wedding cakes to gay couples springs to mind.) I'm not aware of any regulations though that would force RH to keep customers that broke their source-distribution-embargo. Clearly RH is not impinging on the users rights to distribute the source. They are impinging on the "privilege" of being a customer. Does that second-order effect fall under the GPL? Smarter lawyers than me will decide, but it seems like a tough sell. Of course we may not -like- that restriction, but its a long way from there to -legal- requirements. It's hard really to see how one can mandate an OSS company to -have- to do business with "any customer" when the moral-principle-premise is so high in OSS. I'm not sure that a regulation against RH would be a win for OSS in general.

AnthonyMouse 3y ago

How would they even know who it is? Alice is a Red Hat customer, gives binaries and sources to Bob in private, now Bob publishes them on the internet for the world without telling anyone it was Alice he got them from. "Tell us who it was so we can retaliate against them for exercising their rights under the license" doesn't seem like a good faith request.

trimistermota 3y ago
Nobody's going to use untrusted binaries/sources in this age of supply chain security..
- AnthonyMouse 3y ago
  Anybody can diff the sources against upstream if they want to. But also, how does that even mean anything? Bob submitted a patch to the mainline Linux kernel which Red Hat forked which Alice downloaded which Bob uploaded and now you're trusting Bob that the code is safe, which you were already doing anyway unless you were comparing the changes to the code yourself, which you can still do.
- wizzwizz4 3y ago
  Untrusted? They're from RedHatSourceDumps.onion! A few years back, my mate in Contoso gave me some sources a few years back, and they were identical to the ones that showed up on RHSD the next day; I don't know anyone who's ever noticed a bit out of place. Why would they choose today to start injecting malware, when somebody would raise the alarm within a week? Back in the real world: binary RPM packages are cryptographically signed, and I'm pretty sure source packages are as well. Who needs provenance when you can blindly assume that nobody's cracked the crypto yet (or, more realistically, leaked the keys)?

yjftsjthsd-h 3y ago

That is certainly what RH likes to claim, but it always struck me as extremely suspicious logic. If the license says you have to share code with users and cannot restrict their rights to do the same, and they exercise those rights and you immediately retaliate, it sure seems like a reasonable person would say that you're restricting the rights of your customers in direct contravention of the license terms.

arccy 3y ago
an ongoing (future) relationship isn't a right
- torstenvl 3y ago
  Neither is employment. But there are still consequences for firing someone for an unlawful reason. I'm not saying Red Hat is wrong—I'm still undecided—but I don't think your logic is very persuasive.
- cool_dude85 3y ago
  If you sign an employment contract that specifies you can only be fired for X and Y, and the company fires you for Z, you can sue. That doesn't mean your ongoing relationship is a right, it means one party didn't live up to the contract.
- yjftsjthsd-h 3y ago
  Of course not. Just as use of GPL software isn't a right. Stop using copyleft software and you won't have to worry about those licenses giving your customers rights.
bruce511 3y ago
I think we can agree that businesses have the right to "fire" their customers, for (pretty much) any reason try like. Of course, as with any "subjective" behavior right, there can be regulatory implications (Christian cake shops selling wedding cakes to gay couples springs to mind.) I'm not aware of any regulations though that would force RH to keep customers that broke their source-distribution-embargo. Clearly RH is not impinging on the users rights to distribute the source. They are impinging on the "privilege" of being a customer. Does that second-order effect fall under the GPL? Smarter lawyers than me will decide, but it seems like a tough sell. Of course we may not -like- that restriction, but its a long way from there to -legal- requirements. It's hard really to see how one can mandate an OSS company to -have- to do business with "any customer" when the moral-principle-premise is so high in OSS. I'm not sure that a regulation against RH would be a win for OSS in general.