4 ms·

While a nice idea, licensing issues are a problem for this project... I don't understand why they didn't use the standard MIT license, but instead went for GPL3

While a nice idea, licensing issues are a problem for this project... I don't understand why they didn't use the standard MIT license, but instead went for GPL3, but still chose a proprietary encryption method. iSSH on iOS now also experimentally supports it with an own independent implementation, with an in-app purchase, since the encryption uses a proprietary encryption method only freely licensed for opensource projects.

eli 14y ago
I definitely get the concern over proprietary encryption, but why does the license matter for an end user like me?
- daenney 14y ago
  Because due to the license the code can not be included on certain platforms or in applications which is preventing wider adoption.
  - geofft 14y ago
    Are there particular platforms you're thinking of? The big complaint was iOS, which was resolved a while ago. (The legal constraints around the app store are complicated, but basically, Apple does not reject GPL apps. So it merely requires the copyright holders to agree that distribution on the App Store does not infringe their rights under the GPL, which is a reasonable position to take.)
    - zacwest 14y ago
      For a library that is GPL, you would need that library's authors to relicense it to allow it on the App Store. It's not that reasonable: the Apple EULA requires things that directly conflict with the GPL, such as the EULA requiring non-distribution of the binary.
      - geofft 14y ago
        Take a look at this note: https://github.com/keithw/mosh/blob/master/COPYING.iOS https://github.com/keithw/mosh/blob/master/COPYING.iOS
    - mitchty 14y ago
      Well Panic said they wouldn't be including mosh support into Prompt, their iOS app due to the license. So there is that.
      - geofft 14y ago
        That seems to be at odds with this other comment in the thread: http://news.ycombinator.com/item?id=5017160 http://news.ycombinator.com/item?id=5017160 Was this statement before the mosh repo gained the COPYING.iOS file and the iOS-related waiver from the OCB patent holder (July 20, 2012)?
        nwh 14y ago
        http://twitter.com/panic/status/281208183094145024 http://twitter.com/panic/status/281208183094145024
        mitchty 14y ago
        From April of this year at least, i'll have to dig up the tweet. edit: was this tweet http://twitter.com/panic/status/195938318536544257 http://twitter.com/panic/status/195938318536544257
- offbyone 14y ago
  Because depending on the policies of your workplace, GPLv3 may be blacklisted; the nature of that license makes its use in certain classes of business very, very dangerous.
  - benedikt 14y ago
    > the nature of that license makes its use in certain classes of business very, very dangerous Well, thats the point of it.
- michael_miller 14y ago
  Many paranoid companies will often prohibit all use of GPLv3 software. The justification I've heard is that the terms of the license make it possible that anything you produce using GPLv3 software is also GPLv3. So, for example, if you use a GPLv3 licensed version of emacs, and you write some code, the code you wrote will also become GPLv3. It's a very conservative reading of the terms of the license, but understandable for companies which have most of their net worth tied up in source code.
  - hdevalence 14y ago
    > The terms of the licence make it possible.... No, they do not. In fact, the example you gave is exactly the example given by the FSF to explain why this does not occur. http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForNF http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForN... It's not a conservative reading so much as an incorrect one, and it's also nothing to do with v3 versus v2. The concern about v3 is that it means that companies are not allowed to use patent or hardware restrictions to do an end-run around the GPL's user protections. The "viral contamination" FUD has been around for over a decade at least; it's nothing to do with version 3.
  - lwf 14y ago
    This shows a bit of a misunderstanding of how copyright law works. Just because a tool was used in creating a work does not mean that the created work is a derivative, unless the work somehow incorporates the tool.
- deleted 14y ago
  [deleted]
- michael_miller 14y ago
  Many paranoid companies will often prohibit all use of GPLv3 software. The justification I've heard is that the terms of the license make it possible that anything you produce using GPLv3 software is also GPLv3. So, for example, if you use a GPLv3 licensed version of emacs, and you write some code, the code you wrote will also become GPLv3. It's a very conservative reading of the terms of the license, but understandable for companies which have most of their net worth tied up in source code.
- geofft 14y ago
  I forgot to point out while the discussion was still active that "proprietary encryption" is a bit of a misnomer. 90% of people who use that phrase mean "we use a super-secret algorithm and if we tell you how the algorithm works the bad guys will break it", aka, a weak and unaudited security-by-obscurity algorithm. OCB is no more proprietary than RSA was when it was still under patent protection (throughout the '90s, I believe), the reference implementation is public, and Mosh incorporates the reference implementation into its GPL source. The algorithm is well-documented in the research literature, and the implementation is available under a free software (though strong copyleft) license.
geofft 14y ago
OCB has a clean, short, embeddable reference implemention, and there's a patent grant permitting usage in GPL projects. (Calling it "proprietary" is a stretch, but I understand what you mean.) GCM didn't have any great implementations. There's starting to be an implementation in OpenSSL 1.0, but at the time mosh was written, that was difficult to count on, and even now that's still shaky. It's important that the crypto algorithm implementation be known to be correct and safe (avoid side channels, etc.). As far as I know there's no particular reason that iSSH does not use the standard mosh implementation. One thing to note is that iSSH is not free software (everything it embeds -- PuTTY, Xorg, dwm, etc. -- is under an MIT-style license), so embedding a GPL project would have forced them to open up the iSSH source code. It would be great if someone wanted to write a free software terminal emulator for iOS, and at that point you can absolutely include mosh. (I'd probably encourage _building_ on mosh, which happens to include a rigorous terminal implementation.) But it's true that you can't embed GPL software inside proprietary software.
- philjohn 14y ago
  I was under the impression that you can't include GPL stuff in App Store apps full stop.

eli 14y ago

I definitely get the concern over proprietary encryption, but why does the license matter for an end user like me?

daenney 14y ago
Because due to the license the code can not be included on certain platforms or in applications which is preventing wider adoption.
- geofft 14y ago
  Are there particular platforms you're thinking of? The big complaint was iOS, which was resolved a while ago. (The legal constraints around the app store are complicated, but basically, Apple does not reject GPL apps. So it merely requires the copyright holders to agree that distribution on the App Store does not infringe their rights under the GPL, which is a reasonable position to take.)
  - zacwest 14y ago
    For a library that is GPL, you would need that library's authors to relicense it to allow it on the App Store. It's not that reasonable: the Apple EULA requires things that directly conflict with the GPL, such as the EULA requiring non-distribution of the binary.
    - geofft 14y ago
      Take a look at this note: https://github.com/keithw/mosh/blob/master/COPYING.iOS https://github.com/keithw/mosh/blob/master/COPYING.iOS
  - mitchty 14y ago
    Well Panic said they wouldn't be including mosh support into Prompt, their iOS app due to the license. So there is that.
    - geofft 14y ago
      That seems to be at odds with this other comment in the thread: http://news.ycombinator.com/item?id=5017160 http://news.ycombinator.com/item?id=5017160 Was this statement before the mosh repo gained the COPYING.iOS file and the iOS-related waiver from the OCB patent holder (July 20, 2012)?
      - nwh 14y ago
        http://twitter.com/panic/status/281208183094145024 http://twitter.com/panic/status/281208183094145024
      - mitchty 14y ago
        From April of this year at least, i'll have to dig up the tweet. edit: was this tweet http://twitter.com/panic/status/195938318536544257 http://twitter.com/panic/status/195938318536544257
offbyone 14y ago
Because depending on the policies of your workplace, GPLv3 may be blacklisted; the nature of that license makes its use in certain classes of business very, very dangerous.
- benedikt 14y ago
  > the nature of that license makes its use in certain classes of business very, very dangerous Well, thats the point of it.
michael_miller 14y ago
Many paranoid companies will often prohibit all use of GPLv3 software. The justification I've heard is that the terms of the license make it possible that anything you produce using GPLv3 software is also GPLv3. So, for example, if you use a GPLv3 licensed version of emacs, and you write some code, the code you wrote will also become GPLv3. It's a very conservative reading of the terms of the license, but understandable for companies which have most of their net worth tied up in source code.
- hdevalence 14y ago
  > The terms of the licence make it possible.... No, they do not. In fact, the example you gave is exactly the example given by the FSF to explain why this does not occur. http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForNF http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForN... It's not a conservative reading so much as an incorrect one, and it's also nothing to do with v3 versus v2. The concern about v3 is that it means that companies are not allowed to use patent or hardware restrictions to do an end-run around the GPL's user protections. The "viral contamination" FUD has been around for over a decade at least; it's nothing to do with version 3.
- lwf 14y ago
  This shows a bit of a misunderstanding of how copyright law works. Just because a tool was used in creating a work does not mean that the created work is a derivative, unless the work somehow incorporates the tool.
deleted 14y ago
[deleted]
michael_miller 14y ago
Many paranoid companies will often prohibit all use of GPLv3 software. The justification I've heard is that the terms of the license make it possible that anything you produce using GPLv3 software is also GPLv3. So, for example, if you use a GPLv3 licensed version of emacs, and you write some code, the code you wrote will also become GPLv3. It's a very conservative reading of the terms of the license, but understandable for companies which have most of their net worth tied up in source code.
geofft 14y ago
I forgot to point out while the discussion was still active that "proprietary encryption" is a bit of a misnomer. 90% of people who use that phrase mean "we use a super-secret algorithm and if we tell you how the algorithm works the bad guys will break it", aka, a weak and unaudited security-by-obscurity algorithm. OCB is no more proprietary than RSA was when it was still under patent protection (throughout the '90s, I believe), the reference implementation is public, and Mosh incorporates the reference implementation into its GPL source. The algorithm is well-documented in the research literature, and the implementation is available under a free software (though strong copyleft) license.

geofft 14y ago

OCB has a clean, short, embeddable reference implemention, and there's a patent grant permitting usage in GPL projects. (Calling it "proprietary" is a stretch, but I understand what you mean.) GCM didn't have any great implementations. There's starting to be an implementation in OpenSSL 1.0, but at the time mosh was written, that was difficult to count on, and even now that's still shaky. It's important that the crypto algorithm implementation be known to be correct and safe (avoid side channels, etc.). As far as I know there's no particular reason that iSSH does not use the standard mosh implementation. One thing to note is that iSSH is not free software (everything it embeds -- PuTTY, Xorg, dwm, etc. -- is under an MIT-style license), so embedding a GPL project would have forced them to open up the iSSH source code. It would be great if someone wanted to write a free software terminal emulator for iOS, and at that point you can absolutely include mosh. (I'd probably encourage _building_ on mosh, which happens to include a rigorous terminal implementation.) But it's true that you can't embed GPL software inside proprietary software.

philjohn 14y ago
I was under the impression that you can't include GPL stuff in App Store apps full stop.