Hacker News Reader

Comment by StevePerkins | Hacker News Reader

OVH should really be more clear that their Ubuntu images are modified down at the kernel level, and are not "stock" Ubuntu. This is the first time I've ever heard about this.

Say what you want about software patents, or asserting copyright over an API, etc. But trademark law exists entirely to prevent confusion like this, and I think it's valid. Hosts should be required to loudly disclose that images are modified, or else they should get a licensing deal and have them certified by the trademark holder.

Users think they're installing "Ubuntu", and they aren't. That's not acceptable to me.

View on HN

I manage a bare metal server rented at OVH, and when I discovered their kernel wasn't the stock one, I also found its last update was months before, without all the security patches released since then.

That's not advertised at all in their product pages, and it exposes you to a bunch of security issues elsewhere fixed.

To be fair, that's just the default setup. It's 2 commands to update it to the normal stock kernel.

I know and I did that as soon as I discovered they ship a different kernel.

The problem is they don't advertise "we ship an insecure kernel by default", and they call those insecure images "Ubuntu".

May I ask what are those 2 steps?

sudo apt update && sudo apt upgrade -y

That wouldn't work (even if you should do that anyway). The stock kernel is in a separate package.

Check out this post: http://www.sysadminworld.com/2012/how-to-switch-to-the-stand...

I agree. I thought I had installed ubuntu recently on ovh servers, and found many files/folders in `/sys/kernel` missing. I had to google around a bit to find out that when I installed Ubuntu, it wasn't actually Ubuntu, but OVH-modified Ubuntu. I ended up having 4 servers reinstalled with stock Ubuntu.

How does this work when Ubuntu package maintainers patch upstream packages? Do they arrange special trademark licensing terms with the upstream maintainer?

I think I'm apt-get installing super-foo-blah, but during installation it's actually being patched so is deviating from what upstream are really shipping [1].

As I understand it, Canonical advocate patching upstream packages (with the noble goal of improving compatibility with their platform) and keeping the package under the same name. Just as OVH et al are doing with Ubuntu itself.

[1] http://packaging.ubuntu.com/html/patches-to-packages.html

If those packages' names are under trademark and the terms says you can't ship modified versions of the package, they must either:

- Ask for the approval of the upstream developer

- Rename the package, as Debian did with Firefox/IceWeasel

The problem with the OVH images is their kernel lacks months of security patches, so they're advertising insecure images as "Ubuntu".

I absolutely agree that downstream packages have some level of responsibility to maintain up-to-date packages.

However, this alone isn't necessarily reason to prevent someone from distributing derived versions of your open source project using the original name.

If this was the case, Canonical would prevent people from shipping EOL'd versions of Ubuntu under any circumstances. If I ship an appliance with Ubuntu 10.04 (EOL 2013-05-09), it would have the same negative impact as shipping a patched 16.04 with no up-to-date patches or a similarly unpatchable kernel or core package.

Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not.

Edit: typo

Upstream being Debian, afaik they explicitly have permissive clauses regarding trademarks.

Sorry, I should have been clearer. I mean upstream third party packages, not those that form the core of Debian itself. If I create a package which Debian ships unmodified, but it's then subsequently patched by Canonical and shipped with Ubuntu (or via its repositories) under the same name, I'd argue that I could (but possibly shouldn't) cry foul as Canonical are doing with VPS providers.

By uploading it to Debian I think you have to accept terms to match the rest of the system. You have to object at the source; once it's in Debian, then any downstream developer can do anything he wants with it, as long as it abides to Debian licensing terms.

If you don't accept the Debian terms, your package ends up in "nonfree" and I honestly don't know how that is managed downstream.

Yes, you could rightfully do it, and the package mantainer would probably rename the package or just remove it.

This is exactly the reason Iceweasel happened in Debian. Debian was applying security patches, Mozilla objected that the end product wasn't Firefox as distributed. I'm not exactly sure why Ubuntu didn't pick up the Iceweasel branding.

Digital Ocean does the same, it's even worse with DO because you run an old Kernel all the time.

On the newest images (FreeBSD, Debian 8 and Ubuntu 16.04) you aren't tied to the kernels they provide (and I think they ship the stock kernels by default in them, altough I haven't checked yet).

I agree though on older images going to the control panel/use the API to change the kernel is a big annoyance.

I totally agree with you, but how does the trademark licensing help with confusion in this case?

If they were to pay 1-2e/mo to use the trademark legally, wouldn't the confusion still exist? Or is the full story actually that they have to pay _and_ actually offer it as stock Ubuntu?

AFAIK they must certify their images, which means they should offer a stock or a stock-like image approved by Canonical.

Unfortunately the only source we currently have is that tweet, which isn't the clearest one.

Ubuntu's IP policies are public, and you're right, modified versions must be approved by Canonical: http://www.ubuntu.com/legal/terms-and-policies/intellectual-...

Reply on news.ycombinator.com