4 ms·

What does the article even have to do with the headline?

by kj99 3y ago

retrac 3y ago
"Copyleft compliance". Some argue the GPL and other copyleft licences help ensure the right to repair by helping to enforce the availability of source code. > We recently launched Use The Source (alluded to above), which helps device owners and companies see whether source code candidates (the most important part of copyleft compliance) are giving users their software right to repair, i.e. whether they comply with the copyleft licenses they use.
- kj99 3y ago
  Ok, so nothing whatsoever to do with security at all.
  - deleted 3y ago
    [deleted]
  - yjftsjthsd-h 3y ago
    Not nothing; source is necessary (though generally not sufficient) to produce patches.
    - kj99 3y ago
      Sure, but that only applies to devices that aren’t being maintained by someone else, and frankly, it’s not obvious to people who have to maintain their own devices and do a better job, so it’s not clear that there’s any particular argument associated with security here. Just to be clear, I believe that copyleft compliance is important simply because it is the conditions under which the authors made their code available. I just don’t think the headline is honest.
nox101 3y ago
Agreed. The article has almost nothing to with the headline. The article is about copyleft compliance. It is not about "Without software right to repair, your devices are not secure". That is a much larger topic than the article itself which is about auditing that if you're using copyleft software that you're complying with the license. The article itself is not calling for a right to repair all software in all devices.
nfriedly 3y ago
I believe the point of this post is to introduce their "Use The source" mailing list[0] where they publicly track and encourage compliance with the GPL from vendors who release products containing GPL'd software. It's a spiritual successor to the old gpl-violations.org mailing list. The security angle is because fixing a vulnerability is a fairly compelling reason why someone might want to update the software in a device they've purchased. Vulnerabilities found in Linux and other GPL'd software often get fixed fairly quickly, but random Linux-based IoT devices and whatnot often ship with ancient versions of GPL'd software and never see any security fixes. ("The S in IoT stands for security.") If the vendor complies with the GPL, then end-users can patch it themselves. But, many vendors don't, hence the need for the new mailing list. [0]: https://sfconservancy.org/usethesource/ https://sfconservancy.org/usethesource/
dang 3y ago
The submitted title was "Without software right to repair, your devices are not secure". We've changed it now, in keeping with HN's title rule: "Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If it had been a sentence from the article itself, we might have kept it, because "Prioritizing software right to repair: engaging corporate response teams" doesn't say much. But I couldn't find that language in the article, and it seems you couldn't either, so it's probably best to stick to the rule in this case and revert it.
- nfriedly 3y ago
  Huh, I copy-pasted the title when I submitted it, but it looks like the article has since been edited. (There was also an example in the article about updating an insecure baby monitor that made the title make a bit more sense.) Oh well, the new title is probably more clear anyways.
  - dang 3y ago
    Ah thanks and sorry for guessing wrong! - this does happen sometimes. Usually not with smaller publications; more often with NYT, BBC, etc. who frequently change up their titles.

What does the article even have to do with the headline?

by kj99 3y ago

What does the article even have to do with the headline?

"Copyleft compliance". Some argue the GPL and other copyleft licences help ensure the right to repair by helping to enforce the availability of source code. > We recently launched Use The Source (alluded to above), which helps device owners and companies see whether source code candidates (the most important part of copyleft compliance) are giving users their software right to repair, i.e. whether they comply with the copyleft licenses they use.

kj99 3y ago
Ok, so nothing whatsoever to do with security at all.
- deleted 3y ago
  [deleted]
- yjftsjthsd-h 3y ago
  Not nothing; source is necessary (though generally not sufficient) to produce patches.
  - kj99 3y ago
    Sure, but that only applies to devices that aren’t being maintained by someone else, and frankly, it’s not obvious to people who have to maintain their own devices and do a better job, so it’s not clear that there’s any particular argument associated with security here. Just to be clear, I believe that copyleft compliance is important simply because it is the conditions under which the authors made their code available. I just don’t think the headline is honest.

nox101 3y ago

Agreed. The article has almost nothing to with the headline. The article is about copyleft compliance. It is not about "Without software right to repair, your devices are not secure". That is a much larger topic than the article itself which is about auditing that if you're using copyleft software that you're complying with the license. The article itself is not calling for a right to repair all software in all devices.

nfriedly 3y ago

I believe the point of this post is to introduce their "Use The source" mailing list[0] where they publicly track and encourage compliance with the GPL from vendors who release products containing GPL'd software. It's a spiritual successor to the old gpl-violations.org mailing list. The security angle is because fixing a vulnerability is a fairly compelling reason why someone might want to update the software in a device they've purchased. Vulnerabilities found in Linux and other GPL'd software often get fixed fairly quickly, but random Linux-based IoT devices and whatnot often ship with ancient versions of GPL'd software and never see any security fixes. ("The S in IoT stands for security.") If the vendor complies with the GPL, then end-users can patch it themselves. But, many vendors don't, hence the need for the new mailing list. [0]: https://sfconservancy.org/usethesource/ https://sfconservancy.org/usethesource/

dang 3y ago

The submitted title was "Without software right to repair, your devices are not secure". We've changed it now, in keeping with HN's title rule: "Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html If it had been a sentence from the article itself, we might have kept it, because "Prioritizing software right to repair: engaging corporate response teams" doesn't say much. But I couldn't find that language in the article, and it seems you couldn't either, so it's probably best to stick to the rule in this case and revert it.

nfriedly 3y ago
Huh, I copy-pasted the title when I submitted it, but it looks like the article has since been edited. (There was also an example in the article about updating an insecure baby monitor that made the title make a bit more sense.) Oh well, the new title is probably more clear anyways.
- dang 3y ago
  Ah thanks and sorry for guessing wrong! - this does happen sometimes. Usually not with smaller publications; more often with NYT, BBC, etc. who frequently change up their titles.