Richard Fontana wrote at 12:50 (EDT) on Friday:
I have not met one person in the past 5 years not closely affiliated
with the FSF who argues that the anti-Tivoization provisions are a
major feature giving GPLv3 an advantage over GPLv2.
You should definitely talk to some users of electronic devices who are
trying to modify the software for them.
> Lock-down is now common, and is accomplished in four ways: (a)
the
> reading of GPLv2 to say that it doesn't defend users' freedoms to
> install modified versions if cryptography is used for lock-down,
What, incidentally, have you been doing to encourage an alternative
reading? You are one of the most influential people in the world on
what GPLv2 means.
I've been diposed about this matter in a court case [0]. What I said on
the record is that we are "stuck with an interpretation that GPLv2
doesn't cover crypto-lock-down" in large part because of public
statements about GPLv2 that Eben Moglen made as FSF's attorney. I
disagree with those statements, but what can I do? I wasn't on FSF's
Board nor an FSF employee when Eben made those statements. I think it's
a horrible outcome, because I agree with Alan Cox, but I'm one voice
facing estoppel that FSF's law firm generated for it. I've given up
tilting at that particular windmill: even though I think Alan is right,
estoppel has been generated and we're stuck with it.
*However*, note that's narrowed to *crypto* lock-down. I do think any
other means of lock-down relate to GPLv2's "scripts to control
compilation and installation of the executable" -- distributor of binary
works have to give instructions to install. Eben never commented on
this on behalf of FSF to my knowledge, so I believe that GPLv2 as is
stands requires disclosure of all installation information up to but not
including crypto keys.
This is precisely why all future copylefts MUST have explicit clause
defending on this issue of cypto-lock-down, due the estoppel generated
against GPLv2 by public statements by otherwise knowledgeable folks
saying that GPLv2 allows crypto-lock-down. To be abundantly clear
what I mean: I believe GPLv3 merely *clarifies* the existing requirements
with GPLv2 *except* for the disclosure of authorization keys, which I think
*would* be required by GPLv2 too, but for the aformentioned estoppel.
Anyway, as for your direct question "what I'm doing on this myself", you
personally know I spend 8-10 hours every week working to enforce the GPL,
both GPLv2 and GPLv3 (although I just started doing GPLv3 enforcement when
Samba handed their enforcement work to Conservancy a month or two ago).
Thus, it'd be slightly disingenuous for anyone to suggest I'm not doing
everything I possibly can on this issue. I really hope your comment wasn't
intended to suggest that I wasn't so doing.
> In this climate, it's clearer than ever that all copyleft
should
> cover this issue.
This does not seem to me to be the prevailing viewpoint in the
GPL-using community.
I think we have no clear evidence either way. Even in the Linux
project, there is disagreement, and the Linux project probably is the
most opposed to anti-lockdown provisions of any project.
If I start to see GPLv3 having some real-world effect on the
lockdown
issue, maybe I'll change my mind.
This takes time. You've given GPLv2 a full 20 years to establish
itself, and you therefore say it's a valid, useful license. But you've
only given the clarified and improved terms of GPLv3 a mere 5 years, and
now you're saying: "I've decided its terms don't matter and I give up on
its key provisions now".
If you want to be fair, you'd stay neutral on the question for another
15 years, right? Shouldn't copyleft-next include any provision we agree
is good policy?
Where is all the GPLv3 software on these gadgets?
Samba appears in some.
The similarity lies in the "no one should get too upset by
this"
factor:
I get upset when copyleft becomes de-facto permissive licensing, which
is what lock-down yields. I know plenty of users are upset in this way.
Richard Fontana wrote at 23:49 (EDT) on Friday:
Much as I believe I said of the anti-Tivoization provisions: if we
knew that these provisions were being used to discourage or render
ineffective lockdown of consumer devices, the argument for deleting
them might be a lot weaker.
This is argument seems akin to perfection theory of GPLv2.
You're basically saying here that copyleft-next will include no
provision that hasn't been previously directly enforced on. That will
limit the policy positions of copyleft-next to only that narrow work
that Conservancy, FSF and Harald Welte have done. I believe great work
has been done there, but we're limited by our meager resources. It's
somewhat unfair for you to hang all that on us alone.
In other words, you *don't* argue that anti-lock-down provisions are
immoral nor bad policy. Ted does argue that, and I respect his position
on that because it's his belief and he believes that people have a moral
right to lock down users from ever upgrading or improving their
technology. I disagree with him, but it's a disagreement of morality.
You're arguing that certain license terms aren't "popular" or
"enforced
yet" as reasons to have or not have certain things in the license.
What's the point of writing a copyleft license with no morality?
Copyleft *is* a moral position. If you want an amoral license, why not
go make DWTFYW-next instead?
I don't understand what you're saying here. The license that
allowed
those communities to flourish was not GPLv3; it was GPLv2, which has
no (explicit) anti-Tivoization provisions. Are you now agreeing with
Alan Cox (if I am representing his view correctly) that GPLv2 has an
implied anti-Tivoization requirement?
Those products didn't have crypto-lock down, but crypto-lock down is
slowly but surely becoming more common. UEFI even requires it on ARM
now.
Anyway, it sounds like you're rejecting my patch vehemently. Since
copyleft-next is a dictatorship, is there any point in continuing to advocate
for my patch? What would be the necessary requirements those us who oppose
cryto-lock-down to get it added?
Would you at least consider my patch if I rewrite it but leave out
"authorization keys" for now, while we continue this discussion? I've
posted a merge request on this (see elsewhere in the thread).
In my view, that would at least make it equivalent to GPLv2's more terse
version. You do want to make sure it's not a *weaker* copyleft than
GPLv2, right?
[0] I'm seeking to release that deposition of mine, as I think it'd be
useful, but sadly the defendant insisted on a protective order
during discovery, and I need to burn some of Conservancy's outside
counsel's time to figure out if it covers my deposition and what
we'd need to redact if it does. Sadly, again, this is a resource-constraint
problem. Most people don't realize that their local pizza parlor has
more staffing that nearly any given non-profit org in the Free Software
community.
--
-- bkuhn