Hacker News Reader

Heavens, imagine how terrible it might have been if one person on a 16 person board disagreed with the consensus of the board. How could they have continued to perform their valuable work?

Sarcasm aside, you're presenting an argument against the GPL and the FSF. I might even agree, but that seems irrelevant to a more specific question of corporate governance of the Linux Foundation.

You're talking about avoiding headaches, but if you want to represent a diverse group of stakeholders, you're going to have some headaches. If the current role of the Linux Foundation is purely to be a voice for large enterprises who wish to exploit Linux, then why did this change? Is it a good change? What organisation does represent the interests of Linux stakeholders?

I mean, keep in mind, the core policy difference is whether or not the Linux Foundation supports following the license of Linux. That's the reason (as far as anyone can tell) that Sandler is disliked and the at large board seats were removed. Can you imagine the BSA working to keep a lawyer who sued software pirates off their board? The very idea is absurd.

First, the GPLv3 has absolutely nothing to do with this. The enforcement cases in question involve the GPLv2.

Second, it hardly seems "anti-business" to require everyone (businesses included) to comply with the license agreements of the software they use.

And third, the entire issue of enforcement only came up in this context because of this remarkably coincidental timing for LF to decide that it no longer wants community representation. It's sad that the best-case scenario is "just" that this change occurred for entirely unrelated reasons, despite the timing; I'd certainly hope that was the reason, rather than the much scummier possibility of changing the rules with one specific candidate in mind, out of fear that they might get elected.

> Second, it hardly seems "anti-business" to require everyone (businesses included) to comply with the license agreements of the software they use.

I'm old enough to remember when following license agreements was pro-business. Has anyone told the BSA yet?

For those of us not quite so old, who are the BSA?

I presume you don't mean the Birmingham Small Arms Company

Likely the Software Alliance.

http://www.bsa.org/about-bsa

Like Icelancer said, the Business Software Alliance (although apparently they've dropped the "Business" part of the name). Back in the day, they tried to be the RIAA/MPAA of the business software industry; somewhat infamously they ran campaigns urging employees to "bust their boss" by turning the company they work for in for using unlicensed software, and ran cringe-worthy PSAs about the evils of piracy.

A relic of the days when Microsoft was powerful and evil, Apple was for hippies, and clouds were things in the sky. Seemed kind of scary back then though. :)

Wikipedia has some juicy details (cash bounties, hounding third world countries, etc): https://en.wikipedia.org/wiki/BSA_(The_Software_Alliance)

> large parts of the GNU/Linux community are just irrational idealists hard to work with. ... Linus always said: He cares about the code back and otherwise not what vendors do with it.

I imagine they were called "irrational" when they started the FOSS movement and created the licenses and other tools that are part of it. Yet look what they built and what has been built on top of it. Now it's cool for people who benefit enormously from it, including Linus Torvalds, to disparage it. It's all lefty, hippy 'idealism' after all - if you ignore the enormous practical results.

What foundation are we building for the next generation of engineers and tinkerers? Spying and tracking systems? Closed proprietary silos (like smartphones and web applications)? HTTP/2 and systemd - which may be technically great, but don't provide that same freedom-to-tinker for future hackers.

HTTP/2 really doesn't belong in that basket. One of these things is not like the others.

I really haven't dealt with HTTP/2 so perhaps I misunderstand: Doesn't it replace hacker-friendly (and flexible) plain text with a binary code?

I'm not saying the trade-off is bad or good, but there is a cost; it's not free.

Last I checked, ASCII is an encoding, and was transmitted in packets, so if you're relying on tools to decode and unpack your messages, why not simply upgrade them?

Also, people don't seem to complain about the cost of HTTP over SSL in these discussions on HTTP/2. I've never understood that. If you're allowing for TLS, why not HTTP/2?

Because TLS works with many protocols. Encryption software is hard to write and should be reusable for multiple services; the world is not the web.

> ASCII is an encoding, and was transmitted in packets, so if you're relying on tools to decode and unpack your messages, why not simply upgrade them?

ASCII has a much lower barrier to entry. By the same reasoning, everything is 1's and 0's so everything is the same - just use better tools.

Plain text protocols suck. They give you the illusion of readability, and they can make what looks like the obvious solution turn out to be bug-ridden and rife with security holes. The readability is overrated--even in protocols like XML or JSON, most of the time I need to filter down to a small subset anyways, which requires me to write some sort of tool. And if you're already using a tool for all of your poking, what's the benefit to the input format? A good tag/length/value format (particularly when the tag implies how to interpret the value without needing to know a grammar, sorry ASN.1) is even easier to decode than a CRLF-based protocol, since you don't worry about things like "how long could this line be" or "does a bare LF count as a CRLF? What do I need to do for compatibility?"

Plain text protocols help keep interoperability honest and open. They also have benefits that are often overlooked, such as more easily avoiding integer overflow and endian issues.

> If you're already using a tool

Often, I'm not.

> illusion of readability

That depends entirely on the protocol design; some are better than others. Binary protocol can also be a mess. More importantly, binary protocols will always require external definitions, while some text protocols do not.

> bug-ridden and rife with security holes

Changing from readable tokens and ASCIIified intege4rs to packed binary doesn't magically fix bus or security holes.

> what do I need to do for compatibility

That's easy: use the robustness principle[1].

(and most RFC-based protocols say you should send a CRLF).

A possible argument against this could...

> how long could this line be

...also be an argument against length fields. If you want reliable parsing - a very good idea - a good argument[2] can be made to only use context-free protocols (i.e. use parser-combinators).

[1] https://en.wikipedia.org/wiki/Robustness_principle

[2] https://media.ccc.de/v/28c3-4763-en-the_science_of_insecurit...

To anyone who takes your advice on the robustness principle, don't. Liberal acceptance is a maintenance and security nightmare. Be strict on all boundaries and provide clear errors.

The robustness principle is fine, but it does need to be strictly interpreted, which I should have mentioned. Too often robustness is used as a license to be sloppy or to abuse lenient parsers with invalid input.

Meredith covers this specific issue at 33:25 in her 28c3 talk I referenced ([2]). "Be definite in what you accept" can emulate traditional "liberal" parsers if the compatibility is strictly defined in the grammar.

I really should have phrased that better; the robustness principle is great historically, and is therefor necessary in many current protocols, but newer protocols should be using well-defined either regular grammars or deterministic context-free grammars. As Meredith and Sergey explain in that talk, moving away form Turing complete protocols would prevent an important class of exploits.

> Plain text protocols suck. They give you the illusion of readability...

They don't, and the readability is a feature.

I'm not sure how you conflate XML and JSON as synonymous to "protocol" and also requiring tools to filter, but than imply that a "good tag/length/value" format would somehow be superior to the former.

Exactly what feature binary protocols can have that make protocols less bug ridden and with less security holes?

Because, well except for readability and ease of debug, that you lose completely by going binary, and message size that improves by going binary, I can't find any other difference.

> Plain text protocols suck

An honest question: Is it possible that they suck for you and people like you, skilled, experienced engineers with sophisticated tools, and with much less time than money - but they don't suck for less experienced, less equipped, hackers or tinkerers with time to try things but little money or expertise?

Remember that those people built quite a few things, from Facebook to Napster to Dell to the web browser to the web itself (just off the top of my head). Empowering them is arguably the key to innovation.

While I agree with that view on GPLv3, the foundation went much further by actually supporting companies which ignore software licenses. You may not like GPLv3, but you're bound by the rules.

In the commercial license world it would be like starting an organisation of companies which repackage windows with new features and sell it, never acknowledging or paying MS.

There's debatable right or wrong and understanding or not, but what some of those companies do is just violation of law and supporting illegal activities. That is what GPL violators do.

Without bad intentions: Could you point me to some of the cases you are talking about? I am honestly interested, can't promise I will read everything the next hours, but I will definitely read up on it.

Allwinner: https://linux-sunxi.org/GPL_Violations

VMWare: https://lwn.net/Articles/635290/

The links are already in the comments here... but here you go again:

"Allwinner is joining the Linux Foundation to support Linux and to improve what we see as two important open source software development capabilities: collaboration and compliance" http://www.linuxfoundation.org/news-media/announcements/2015...

Allwinner GPL violations: https://linux-sunxi.org/GPL_Violations

Other ones - just google big sponsors of LF + gpl violation, there are a few.

Context:

"Allwinner is joining the Linux Foundation to support Linux and to improve what we see as two important open source software development capabilities: collaboration and compliance," said Jack Lee, Chief Marketing Officer, Allwinner Technology. "These two concepts are critical yet difficult to master for new Linux community entrants like ourselves."

Is the Linux Foundation "supporting" Allwinner? Or is, as I suspect, Allwinner paying them dues?

https://wiki.linuxfoundation.org/en/Corporate_Membership

Consider LF goals "The Linux Foundation protects and promotes the ideals of freedom and generous collaboration established through the development of Linux, and shares these ideals to power any endeavor aiming to make the future a better place in which to live."

How can they have a member organisation which plainly goes against the goals of the foundation? And yes, even by statements like the one published on joining, it's supporting Allwinner by giving them recognition.

Is the Linux Foundation "supporting" Allwinner? Or is, as I suspect, Allwinner paying them dues?

Both? The accusation being made is that Allwinner are bribing them to ignore GPL non-compliance.

@grsecurity went to a sponsor-based model because they kept getting ripped off

Edit: Source https://grsecurity.net/announce.php

> While I agree with that view on GPLv3, the foundation went much further by actually supporting companies which ignore software licenses. You may not like GPLv3, but you're bound by the rules.

Just to note: the Linux kernel is explicitly[1] licensed under GPLv2 (without the the "or later" clause). This makes GP even more offtopic.

1. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

Linus is not a god, and his proclamations are not gospel.

He can crow all he likes about how he wishes he never used the GPL and how he is not political... but the truth is, no one knows what would have happened if he didn't use the GNU license or distribute GNU software. Its theoretically possible that his project would have died on the vine without members of the community who cared about those things and made considerable contributions. Nobody knows, not even Linus.

Linux would have never been as successful if someone like rms would have called the shots. People still tinker with the GNU Hurd microkernel and it's less usable than Minix. Linus is also no god for me, but he is delightfully pragmatic, someone companies can work with, not against.

    Let me ask you one question
    Is your money that good
    Will it buy you forgiveness
    Do you think that it could

    I think you will find
    When your death takes its toll
    All the money you made
    Will never buy back your soul

1. Attribute that quote.

2. This has nothing to do with Linus, and from what I can tell, parent did not deserve it either.

Linus hasn't made a fortune off Linux. He could have, but he didn't.

1. http://www.bobdylan.com/us/songs/masters-war

2. To clarify, I wasn't referring to Linus

However, if there is no forgiveness and no soul, money is a useful (but not the only) metric.

"Linux would have never been as successful if someone like rms would have called the shots."

I'm not sure how you can think that when GNU, which is the operating system for just about every single server running Linux, was started by RMS.

https://en.wikipedia.org/wiki/GNU

A lot of userland-stuff is GNU, Linux is the kernel. Kernel + Userland is OS!

So saying "GNU ... is the operating system for just about every single server running Linux" does not make sense.

Don't start that again. The "GNU/Linux" vs. "GNU" vs. "Linux" argument has been going on long enough without resolution that it's pointless to rehash it.

I vote for LiGNUx. (Always add one more option when there is already a lot of confusion).

I've seen some of RMS's early work in relation to LMI, TI, and open source in the early days, before Linux. RMS has never been anti-business. Just anti the idea that closed-source software licensing is a sustainable business model. Very few people in any part of any flavor of FOSS are actively anti-business.

The problem with that statement is that the vast majority of the software business world interprets anti-proprietary software as being anti-business. And, not entirely without reason given that it's extremely difficult (almost impossible) to build a large software business without licensing. If you're RMS then you point to things like contracting for changes, but much of the software industry would be unsustainable on that footing. For a bad analogy - it's like watching two people speaking variants of English - they're using roughly the right words but both come away confused.

You say "but much of the software industry would be unsustainable on that footing." That's what you call a tautology: It's very difficult to charge a unit license for open source software. Sure, but is taht relevant anymore?

Android is the most widely used OS on the planet, and it became so faster than anyone expected. What advantage do closed-source vendors actually derive from a fetish for secrecy? Do their customers believe they've got some secret advantage? Does anyone believe Windows has some secret sauce in it that makes it better than other OSs?

Much of the software industry today sustains itself on indirect revenue. Even Microsoft admits it must pivot to ecosystem revenue and away from unit licensing revenue.

This explains the failure of gcc, glibc and gnu utils/userland to completely fail to gain traction too! /sarcasm

(Although the egcc split was painful, and at long last there are some viable alternatives - it took decades for them to rise up. So it's a little odd that the FSF/RMS would never have successfully been able to develop a project? Obviously the need for a (new) GPL licensed [kernel] is less when there exists a decent GPL licensed kernel (Linux)).

gcc is already beginning to lose traction to llvm.

My point was that "already", means "it took a long time". See also: embedded development.

could you elaborate ?

I've heard this unsubstantiated claim for years now. It certainly depends on your metric. LLVM still lacks behind in generated code quality on most mainstream platforms [my own unpublished benchmarks]. LLVM appears to attract more mind-share from people leveraging the infrastructure, including writing new front- and back-ends; I'm guessing the code is easier to understand and better documented.

A few years ago I had expected LLVM to have caught up to GCC by now, but I hadn't anticipated the accelerated pace of GCC improvements. I don't know if the competition from LLVM had anything to do with this, but GCC is showing no signs of slowing down.

gcc was largely ignored until UNIX vendors started to sell the development tools instead of bundling them with the OS.

The majority of FOSS users are actually people that don't want to pay for software and never give anything back to the community.

> The majority of FOSS users are actually people that don't want to pay for software and never give anything back to the community.

That's two pretty bold (perhaps even inflammatory) statements.

[Perhaps contigent on a) the number of users of commmercial software that either do not pay, or do pay, but do not want to pay - and b) the definition of "giving back to the community" (Is paying for a Windows license "giving back to the community"?) and to wich extent most users of (any-license) software ever give anything back to the community.]

It is based on my experience on how most companies I ever had any sort of contact, work with FOSS.

Also how the majority of everyone that I know, that isn't a technical user, deals with FOSS. They don't care if it is pirated or FOSS, just that they didn't pay for it.

Why do you think there is hardly any money to be done for desktop FOSS software, which usually isn't subjected to trainings or consulting fees?

I don't think the issue is that they don't want to pay, but that they don't realize they can. Often, when a open source solution lacks some required feature, a proprietary one is chosen. Paying the developer to implement that feature is just not something that comes to mind.

I agree but the opposite is also true. For many developers who may or may not know very much about the FSF and RMS, Linux represents the "free as in libre" operating system. They compare it to Apple and Microsoft and see it favorably.

Without the GPL and GNU, Linux would not have the same brand. The GPL is part of Linux's public image and a public image is what drives usage.

To ne fair, if many hackers hadnt embraced linux in the 90s, they might have worked on hurd, there is only a finite amount of hackerness.

> He can crow all he likes about how he wishes he never used the GPL

Torvalds seems to like v2 and not v3[1]. I can't find a source of him saying he wishes he hadn't used the GPL at all - do you have one? It seems that v2 does exactly what he wants - get code back.

[1] "I still think version 2 is a great license": https://www.youtube.com/watch?v=PaKIZ7gJlRU - in fact, in this talk, he says v3 is fine as a license (though not for his needs), but his problems with it were the way that the FSF was trying to submarine it into all existing v2 licenses, and misleading people about how it worked.

Has Linus said he wishes he'd never used the GPL? That's news to me. I guess it'd have to have been after he wrote Git?

> He can crow all he likes about how he wishes he never used the GPL

Wikipedia [1] has this quote:

> Torvalds has described licensing Linux under the GPL as the "best thing I ever did."

[1] https://en.wikipedia.org/wiki/Linux_kernel#Licensing_terms

That quotation is from 1997.

He didn't reverse course as late as 2007 [1]. Where's the article/quote where he "wishes he never used the GPL"?

[1] http://www.informationweek.com/the-torvalds-transcript-why-i...?

Like it or not, but those "irrational idealists" are also contributors to the Linux kernel anyway. I do not understand that it is reasonable to remove some stakeholders' rights at all.

(I have another words to say about the GNU/Linux ideology, but I think that's close to irrelevant here.)

Agreed, Linus is a man with great knowledge of kernel, but he may be wrong at times, just like RMS ( ;-) )

I can see why anti-corporate licenses are big win for users. PS4 and Macs use BSD kernel. The whole PS4 is locked up and it totally blocks users from doing anything else, though Sony built it from the components they took from community (BSD, LLVM etc.), they don't have to give it back.

On the other hand, I am still waiting for a distro based on Apple's OSS.

Linux, GCC, KDE, Qt, GNOME, Java are GPL (or at least LGPL) and there lies the innovation by masses, we see them running on so much variety of form factors. IMHO they need polish and marketing, but at the end of the day my work gets done and I am very much happy with it.

As a contributor I am sure if I work on OSS, no company should take it, make a product selling like hotcakes (PS4, Macs, iPhone) and then refuse to open it, lock down the devices and not even be obliged publish the modifications.

GPL rocks!

Idealists made the world we live in, usually for the better.

In any case, I don't understand how "pro-freedom-everywhere" is in any sense a slur.

"Idealist" is one of those non-descriptive and popular terms like "Agnostic". They describe everyone.

The GPL has always been political.

I'd like to add that a few "anti-business pro-freedom-everywhere radical[s]" thrown in the mix might be just what consumer software needs...