Hacker News Reader

Comment by SeanLuke | Hacker News Reader

I am not familiar with the Tivoization issue, but v3 solves one showstopper problem with v2: v2 has no real patent release. To me this puts v2 in the same category as MIT/X11 and BSD: archaic licenses that no one should ever use except for the most trivial of projects.

Linux is chock full of potential patent release deathtraps: that it is still using v2 is kinda scary.

View on HN

Tivoization is when a computer comes with GPL code, but refuses to run it if there have been any modifications to the code. Tivo used to ship GPL'd software, and provide the source, but they had some kind of lock that checked the authenticity of the code being run. So it defeated the entire purpose of the GPL, which is so the end users have control of their own computers.

...which was of largely academic interest when it was DVRs, but is now a pants-on-fire emergency with the "advent" of Linux-powered pocket spy devices masquerading as telephones - with huge consequences for ordinary, non-nerd people.

The stakes for software freedom have never been higher.

Giving end users control of their own computers is not a stated goal of GPL 2.

From the preamble:

  Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

This jives well with Linus's intention of "I give you software to do whatever you want with, and if you make improvements you have to give them back"

isnt this why they made gplv3 then

It is. My point is that saying Tivoization went against "the entire purpose of the GPL" (which would include v2) isn't backed up by the text of v2 itself.

I agree. GPLv2 was about keeping the software free. The tivoization issue addresses a (relatively) newer issue, to protect full control over hardware and software. Which is, IMO, not within the scope of a software license -- it took many of us by surprise that the "or later" clause was used to change the fundamental meaning of the license in that manner.

Some of us were always suspicious before the change -- "what if RMS sells out and v(n+1) grants non-reciprocity to his employer" type of crap -- but we went with v2+ because it was popular at the time. I don't think I've seen "v3 or later", probably because we've been burned already.

Eh... it seems more like “the authors of GPLv2 didn’t even think of Tivoization when it was written”.... I think the assumption was that if you have access to the code and the rights to change it, that meant you could be in control of your software. They didn’t think of the possibility that hardware would restrict what could be run.

I don’t think it is that much of a stretch to say preventing people from running modified versions of the software went against the goals of GPLv2 to allow users the ability to “change the software or use pieces of it in new free programs”

Not being able to run the software you change certainly means you can’t use it.

It's very clearly backed up by the history of how the GPL came to be in the first place.

There was a printer driver that RMS wanted to change but couldn't. If the system he was working with had had code signing for printer drivers and refused to run with his modifications because of it, we'd have had the TiVo clause in the very first version of the GPL already.

It wasn't an explicitly stated goal, but thats exactly what those freedoms were meant to do. Atleast in regards to the software being provided under the license. They just didn't foresee a future where computers would refuse to run a modified version of the code they came with. Remember, the impetus for GNU was a closed source printer driver that rms wanted to modify, and was not allowed to.

This jives well with Linus's intention of "I give you software to do whatever you want with, and if you make improvements you have to give them back"

Except the GPL does not require you give any improvements back. It only requires that you give the same freedoms to whoever you give the improved software to. That is, the end users. There are plenty of enterprise "appliances" that come with modified GPL code that is only given to the companies that pay for these computers. That is perfectly within the spirit of the gpl, because it's goal is to give the end users freedom.

edit:

What else would be the point of "that you can change the software" without having a means to run it?

What else would be the point of "that you can change the software" without having a means to run it?

Porting the software to new hardware?

Of course it was, implicitly. Go back an read Stallman's writings from the time. It was all about giving end users control. The end users of the early GNU software were mostly programmers so providing them with source code was providing them with control.

Giving end users control of their own computers is not a stated goal of GPL 2.

But it is. Let's quote another paragraph of the preamble too, shall we?

  if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have.

This surely says, in spirit, that if you as manufacturer have the right to deploy this software on certain hardware, that the recipient must have the same rights?

Linus's intention of "I give you software to do whatever you want with, and if you make improvements you have to give them back"

This, on the other hand, is not a stated goal of GPLv2. Your obligation, as a software distributor, is only downstream (your recipients/customers), not upstream (your suppliers).

> Giving end users control of their own computers is not a stated goal of GPL 2.

It is the goal of Stallman and the Free Software Foundation. Free software licenses are one of the means to that end.

Free software started in universities decades ago. The software was written for Unix computers, many years before things like trusted computing. The GPLv2 reflects this environment: it takes hardware freedom for granted and focuses entirely on software freedom. Tivoization was an unforeseen development.

Because software patents should not be legal, and are not enforceable in many sane jurisdictions, e.g: Europe.

I'd much rather stick with "archaic" but understandable licenses like BSD, over verbose licenses that intertwine US Patent Law with Copyright law, such as Apache 2 or GPLv3.

Apache 2 is a terrible license for another reason anyway: it requires modified versions to carry notice of the modification on every modified source file. This means that tons of people who fork Apache 2 projects on GitHub are in violation of the license without even being aware of it.

I like Linus's generalization of (in my words):

- If you like the idea of sharing code and want people to share code back. Use GPL

- If you like the idea of sharing code, and merely want credit for it. Use BSD.

Your point about patent is an import part of his generalization that is not addressed.

GPLv3 solves the first bucket WRT patents. Is there a license that falls under Linus's SECOND bucket, that solves the patent issue?

EDIT: formatting and clarifying words.

> Is there a license that falls under Linus's SECOND bucket, that solves the patent issue?

Apache 2.0 License.

Good to know. Thanks!

And BSD + Patents

I think this is a common misconception. The Apache 2.0 license isn't all that similar to simpler licenses BSD/MIT/X11.

Apache 2.0 has some clauses which (most people tend to ignore and which) make it somewhat incompatible with modern open-source fork and pull request workflows.

In particular 4.b)

> You must cause any modified files to carry prominent notices stating that You changed the files;

For the most part, people just throw their name in the file, in an attempt to "meet" this requirement without massacring the file header/notice.

However, if the Apache 2 license is taken at face value, when you fork and modify a file, you have to mark it as such. Then when you submit back, the project (in adherence with the Apache 2.0 license) has to retain this notice. Technically the project may even then need to add their own notice to indicate they modified the file since you did.

Clearly, that's not tenable, so most (small) projects just offer leeway. Larger projects instead have contributor agreements (AOSP and alike).

Yeah it's a bit troubling that such weird clauses exist in the Apache license, and that the Apache license has become this popular lately. The main motivator is that everyone else is doing it I think, and the patent license.

Large Apache licensed projects without contributor agreements exist (LLVM for example).

I would argue that git blame is prominent enough. And as long as you don't distribute sources in any other way than a git repo you are fine.

Assuming this is true (hopefully it never comes down to it, but I'll leave that for the courts), then the simple act of hosting on Github, with its download source functionality, would make you in violation.

You can argue all you want, ultimately it's for courts to decide, and in the meantime the Apache 2 license creates a ton of legal uncertainty for no good reason.

For example, GPL has language requiring you to make clear that you changed the software, but leaves open how you do it, and doesn't require you to mark individual files.

I guess I assumed you only need to be clear about the modifications if you are not also releasing them as Apache 2.0. is that not the case?

If not, is there any other similar standard license with a patent clause that I could use?

The "default" license for Java libraries being Apache 2.0 shouldn't be overlooked as a reason for the success of Java in the corporate world IMO. It's a perfect license to make corp lawyers comfortable.

I believe Apache solves the second bucket with respect to patents.

I actually really like the idea of a license that forces changes to the licensed code to be made available to be merged back upstream, at least in theory. The issue I have with the GPL is that it doesn't, in my opinion, do a good enough job of distinguishing between "changes to the licensed code" and "changes to unrelated code which happens to be integrated with the licensed code". I would prefer not to impose restrictions on the latter, because in my mind that effectively restricts what people are allowed to DO with my code by making it harder for them to use it with code that's available under a different license.

For example, if I were writing some kind of calendar application which contained a date parsing module within it and someone wanted to copy some code out of that date parsing module and paste it into their own application, I'd be perfectly fine with that. If they later make improvements to that code they copied, I'd prefer it if they'd contribute those changes back, but I absolutely don't want to try to force them to make their entire application open-source, or if it's already open source, to force them to re-license it under my license.

I recognize that the line between "unrelated code" and "improvements to my code" can get really blurry, which is why right now I prefer to err on the side of freedom by using permissive licenses like the MIT, but I wouldn't mind using a copyleft license that took greater pains to ensure it isn't "viral" like the GPL.

If you haven't already, you might take a look at the LGPL.

Linus is also against enforcing the GPLv2 against violators because it alienates companies and contributors.

Their preferred strategy apparently consists of using two properties of the Linux kernel as leverage: the massive scale of its development and the instability of its internal interfaces. Linux kernel hackers get about 20 patches every hour and that figure comes from a video I watched years ago. Those patches improve things all over the place and nobody cares about code that isn't in the kernel tree. As a result, out-of-tree code quickly becomes out of date and the companies must pay the constant maintenance costs or be left behind.

To me this puts v2 in the same category as MIT/X11 and BSD: archaic licenses that no one should ever use except for the most trivial of projects.

Isn't BSD widely accepted to have an implicit patent license? e.g.: https://github.com/facebook/zstd/issues/335

No, nor MIT/X11. There is debate as to whether its wording might provide some protection through accident of history, but that's not how the law should work: a proper license is unambiguous.

In common law countries, it's nearly impossible to write a legal document that's completely unambiguous. Even if it's unambiguous at the time the document is written, the underlying law could change at any time. Of course that could happen in civil law countries too, but it'd be from a statute being changed.

Whataboutism. There's a massive difference between "no license is 100% unambiguous" and "BSD is maximally ambiguous".

Yes but:

- There is no legal viable way to upgrade to v3, even if the "or later" clause would be there it would have been a legal disaster.

- It's also makes it much more viable to upstream drivers in Linux

- Let's be honest the patent system is by now utter garbage failing the one fundamental thing it was invented for: Driving/Improving Innovation. The only reason it didn't fall on our head yet is because many companies simple don't enforce patents. Also you could argue it already fell on our head in some areas due to innovation having slowed to a crawl, while certain competitions (mostly in Asia) are not affected as they ignore patents. I mean sharing and cloning software (between companies!) is what enabled us to have massive innovations (through some maybe stupid) in software space. Non of this would have been possible with enforced software patents.

I wasn't familiar with "Tivoization" either but I found that there's a Wikipedia article about it: https://en.wikipedia.org/wiki/Tivoization

I just looked up the history of it. Interesting characterization.

The "medical devices" loophole in GPLv3 makes the whole thing kinda insane

http://gplv3.fsf.org/dd3-faq

Look at that table!

I don't understand how this table relates to medical devices? Could you explain?

The table is a second thing - Section 6 is the medical devices loophole; I was just amazed by seeing that (unrelated) table.

Certainly simple! /s

This is basically why apple stopped shipping GPL software when GPL3 came along.

Apple takes away the ability to run the software, then sells it back to you.

Reply on news.ycombinator.com