Hacker News Reader

Comment by koffiezet | Hacker News Reader

While a nice idea, licensing issues are a problem for this project... I don't understand why they didn't use the standard MIT license, but instead went for GPL3, but still chose a proprietary encryption method.

iSSH on iOS now also experimentally supports it with an own independent implementation, with an in-app purchase, since the encryption uses a proprietary encryption method only freely licensed for opensource projects.

View on HN

OCB has a clean, short, embeddable reference implemention, and there's a patent grant permitting usage in GPL projects. (Calling it "proprietary" is a stretch, but I understand what you mean.)

GCM didn't have any great implementations. There's starting to be an implementation in OpenSSL 1.0, but at the time mosh was written, that was difficult to count on, and even now that's still shaky.

It's important that the crypto algorithm implementation be known to be correct and safe (avoid side channels, etc.).

As far as I know there's no particular reason that iSSH does not use the standard mosh implementation. One thing to note is that iSSH is not free software (everything it embeds -- PuTTY, Xorg, dwm, etc. -- is under an MIT-style license), so embedding a GPL project would have forced them to open up the iSSH source code.

It would be great if someone wanted to write a free software terminal emulator for iOS, and at that point you can absolutely include mosh. (I'd probably encourage _building_ on mosh, which happens to include a rigorous terminal implementation.) But it's true that you can't embed GPL software inside proprietary software.

I was under the impression that you can't include GPL stuff in App Store apps full stop.

I definitely get the concern over proprietary encryption, but why does the license matter for an end user like me?

Because due to the license the code can not be included on certain platforms or in applications which is preventing wider adoption.

Are there particular platforms you're thinking of? The big complaint was iOS, which was resolved a while ago. (The legal constraints around the app store are complicated, but basically, Apple does not reject GPL apps. So it merely requires the copyright holders to agree that distribution on the App Store does not infringe their rights under the GPL, which is a reasonable position to take.)

For a library that is GPL, you would need that library's authors to relicense it to allow it on the App Store.

It's not that reasonable: the Apple EULA requires things that directly conflict with the GPL, such as the EULA requiring non-distribution of the binary.

Take a look at this note:

https://github.com/keithw/mosh/blob/master/COPYING.iOS

Well Panic said they wouldn't be including mosh support into Prompt, their iOS app due to the license.

So there is that.

That seems to be at odds with this other comment in the thread: http://news.ycombinator.com/item?id=5017160

Was this statement before the mosh repo gained the COPYING.iOS file and the iOS-related waiver from the OCB patent holder (July 20, 2012)?

http://twitter.com/panic/status/281208183094145024

From April of this year at least, i'll have to dig up the tweet.

edit: was this tweet http://twitter.com/panic/status/195938318536544257

Because depending on the policies of your workplace, GPLv3 may be blacklisted; the nature of that license makes its use in certain classes of business very, very dangerous.

> the nature of that license makes its use in certain classes of business very, very dangerous

Well, thats the point of it.

Many paranoid companies will often prohibit all use of GPLv3 software. The justification I've heard is that the terms of the license make it possible that anything you produce using GPLv3 software is also GPLv3. So, for example, if you use a GPLv3 licensed version of emacs, and you write some code, the code you wrote will also become GPLv3. It's a very conservative reading of the terms of the license, but understandable for companies which have most of their net worth tied up in source code.

> The terms of the licence make it possible....

No, they do not. In fact, the example you gave is exactly the example given by the FSF to explain why this does not occur.

http://www.gnu.org/licenses/gpl-faq.html#CanIUseGPLToolsForN...

It's not a conservative reading so much as an incorrect one, and it's also nothing to do with v3 versus v2. The concern about v3 is that it means that companies are not allowed to use patent or hardware restrictions to do an end-run around the GPL's user protections.

The "viral contamination" FUD has been around for over a decade at least; it's nothing to do with version 3.

This shows a bit of a misunderstanding of how copyright law works. Just because a tool was used in creating a work does not mean that the created work is a derivative, unless the work somehow incorporates the tool.

I forgot to point out while the discussion was still active that "proprietary encryption" is a bit of a misnomer. 90% of people who use that phrase mean "we use a super-secret algorithm and if we tell you how the algorithm works the bad guys will break it", aka, a weak and unaudited security-by-obscurity algorithm.

OCB is no more proprietary than RSA was when it was still under patent protection (throughout the '90s, I believe), the reference implementation is public, and Mosh incorporates the reference implementation into its GPL source. The algorithm is well-documented in the research literature, and the implementation is available under a free software (though strong copyleft) license.

Reply on news.ycombinator.com