What is the conflict between GPL3's anti-tivoisation clause and government regulations?
Edit since the parent was in fact speaking about the end-user, which I misunderstood: I don't see the problem either. The manufacturer has no obligation to prevent the end user from updating his car's software. There is no locks that prevents the car owner to just disable his airbag[2], or remove the safety belt. It's illegal to do so in most countries, and if the user do do and injure himself or somebody else because of that modification, they are on their own. I don't think it should be any different for software actually.
[1]: https://news.ycombinator.com/item?id=26397176 [2] Edit: in fact, this is a bad example, because you need to be able to disable the airbag to put an infant car seat next to the driver.
The chain of software delivery often looks like this:
Small subcontractor delivers parts of system→ big company provides ready to use solution → hardware vendor uses the solution and gets their devices certified → end user uses the final product
In this case, the hardware vendor is mostly interested in having their devices work as intended. Everyone up the delivery chain has to meet their requirements in some way to basically get paid. That's not a position where it's easy to make demands regarding certifications, since the hardware vendor may just go to someone else.
drm.
ps: airbags not working is less of a software problem than airbags misfiring.
GPLv3 says that manufacturers have to release all the information needed to run modified software on the device, it doesn't mean that there is one (and one only) certified version that can legally run on the device for safety reasons.
GPLv3 in this case would force manufacturers to release the information so that the owner of the car could run modified software, but legally if you do it, you, the user, not the manufacturer, are violating the law.
It's the same thing that happens with electronic blueprints, you can modify the HW, it will void the warranty if you do it.
--------------------------------------------
Tivoization is a dangerous attempt to curtail users' freedom: the right to modify your software will become meaningless if none of your computers let you do it. GPLv3 stops tivoization by requiring the distributor to provide you with whatever information or data is necessary to install modified software on the device. This may be as simple as a set of instructions, or it may include special data such as cryptographic keys or information about how to bypass an integrity check in the hardware. It will depend on how the hardware was designed—but no matter what information you need, you must be able to get it.
This requirement is limited in scope. Distributors are still allowed to use cryptographic keys for any purpose, and they'll only be required to disclose a key if you need it to modify GPLed software on the device they gave you. The GNU Project itself uses GnuPG to prove the integrity of all the software on its FTP site, and measures like that are beneficial to users. GPLv3 does not stop people from using cryptography; we wouldn't want it to. It only stops people from taking away the rights that the license provides you—whether through patent law, technology, or any other means.
But as I've said I'm no law expert and I wouldn't put my hand on fire about it.
In many projects there is the requirement of a fixed release for 3rd party dependencies, versions for which all tests have been checked to pass (this is what is done in NodeJS with packages.json). There is even a requirement of reproducible build sometimes (like with the ongoing project to reach full reproducibility in Debian builds).
Wouldn't these fit the same thinking pattern as the requirements of certification of software for the industry?
I'd love to hear RMS on this subject, maybe he would, too, say that the solution exists inside of GPL3 rather than outside of it.
Sure. Starting price for a car would be several years salary but at least you could abide by GPLv3 licensing should any part manufacturer choose to use it.
then you do not need to make it modifiable under GPLv3. It explicitly states that.
anyways, it's generally not, expect any Linux system in a car to run from flash memory.
I deal with manufacturers and OEMs putting software in cars for a living. I am not speculating, I am just reporting the reasons they tell me they will not accept any GPLv3 software for anything that gets loaded into their target devices.
1. They are lying, and spreading FUD about regulations and licenses as an excuse to hide the real reason why they don't want to let user install their software. (Eg, because options costs extra and if it was free software one could install it for free)
2. Or, they are mistaken and don't understand the license. Maybe the cost to use alternative is less than the cost of figuring out.
3. They are right and that is a sad reality that the government give more power to companies than power to end users for things they owe.
Since you mentioned something about the ROM which was clearly false, that could very well be option 1 or 2.
I mean, why would the gouvernement want to restrict users to update the GPS software or the media player?
Some governments require that automotive manufacturers implement these kinds of certificates to prohibit the installation of custom software in automotive applications for safety reasons, as they do not wish that users could install their own, potentially buggy software, at the potential cost of human lives.
Older coreutils were licensed under GPLv2, which has no such restriction.
If there was a will to do something about it, GPL3 wouldn't be in the way.
Unfortunately, challenging the status quo is difficult when your customers are not the final users, but other companies: if you don't deliver them a free software firmware without GPLv3 components, someone else will, or someone else will deliver something that's completely proprietary.
good.
It means that GPLv3 works as intended.
EDIT: as intended by the software authors, that chose freely GPLv3 as license, they were not forced to.
I'm quite sure they knew what they were doing.
If car manufacturers want to use GPLv3 software, they simply need to respect the license the author released their software under or rewrite the software.
That's false.
It simply prevents the Tivoization.
GPLv3 was created exactly with the purpose of preventing free software from becoming a commodity.
There's a cost involved when you use free software:
- the software must stay free
- if you include software licensed under a FOSS license, you have to adhere to the license terms
simple as that.
If the authors of software X or Y chose the GPLv3 as license I imagine they were completely aware and agreed to the terms of the license they used, including the limitations it enforces.
That is certainly not universally true. It is common, but not universally true.
And we should assume that the authors were NOT aware of real ecosystem implications of licenses - because nobody understands these in detail. I've been trying to understand them since the mid 1990s when I started contributing in a BSD environment, and I won't say that I properly understand them. I understand parts of them, but I don't understand all of them.
As developer of free software, I don't care about those, who don't care about me.
and always is. and people like you are part of the problem, since you want to enable them in their ways.
Why? why cannot we just enable companies to behave mor ethically?
Please read the rest of the sentence, it answers the question.
> people like you are part of the problem
Thank you for turning the licensing question into ad hominem.
That isn't allowed -- you fail verification if you give users a documented way to disable required safety features.