News for hackers. Stuff that matters.
Re:Theo de Raadt on LLVM license change by robert_tweed on Saturday October 01, 2016 @10:39AM (#12618032)
Reproducing the text because the site is under too much load and Coral Cache can't resolve it:

  List:       openbsd-misc
  Subject:    Re: LLVM license change
  From:       "Theo de Raadt" <deraadt () openbsd ! org>
  Date:       2016-09-28 4:27:44
  Message-ID: 91077.1475036864 () cvs ! openbsd ! org
  [Download message RAW]

  > And that is because corporate "contributor-wannabes" put pressure on the
  > LLVM foundation.
  > http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html
  > 
  > It does say "this is an RFC" but that was last year. We are now in this
  > year:
  > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html
  > 
  > What I particularly do not like is the "IANAL but let's do it anyway"
  > drift emanating from a lot of high profile developers there.

  Well, I hope they do it.

  And then -- I hope a year or two later, some author of a component
  (especially one from Europe where the moral rights of an author still
  carries substantial weight) submarines the new licence, surfacing to
  indicate that they never signed off on the additional terms applied to
  them as a significant author, and will accept no cash to solve the
  problem.

  Then they are dead in the water.

  A cataclysm like CSRG went through.

  Then a fork of code on the original license can flourish.  A fork
  based upon the last free version -- but let's remember that is the
  history of another piece of important software...

  So this problem could be fixed, if enough people care.

  In this situation, I suspect a few people are being paid a lot of
  wages to act as agents permitting theft from their co-contributors.
  They worked with others but now they are ready to steal from them.  A
  list of all contributers (and every single one of them must agree) has
  not been published, so it is really likely this is a well-financed
  effort being performed by paralegals.  Meanwhile day by day that list
  of contributors operating under the existing model is growing..

  Someone is hoping they can get away with copyright theft.

  Want to have fun?  Submit a major diff, which (seperately) in the
  submission says you'll never agree.  Eventually most large projects
  find their inner Xfree86, I'm afraid to say.
Re:Theo de Raadt on LLVM license change by refulgentis on Saturday October 01, 2016 @10:50AM (#12618071)
Painting the situation as "corporate contributer-wannabes" and "IANAL but let's do it anyway" is loaded language that seems intended to bring up negative tropes. The first is sneering at the host of potential contributors, because the host is willing to pay the salary of the contributors. The second is not remotely backed up by the facts.

They've hired lawyers, and consulted the community. The community's predominant concern was whether the new license (Apache2) would be compatible with GPLv2.

In the "We are now in this year" link, it's explicated how they consulted a gaggle of open source lawyers, determined the predominant belief was the new license was compatible with GPLv2. But they didn't stop there – they had a lawyer draft an addendum to really ensure that!

Not a good look. Fever swamp paranoia, and wishing ill on a series of people clearly trying to do well and address every concern.

Re:Theo de Raadt on LLVM license change by protomyth on Saturday October 01, 2016 @01:06PM (#12618755)
> Painting the situation as "corporate contributer-wannabes" and "IANAL but let's do it anyway" is loaded language that seems intended to bring up negative tropes.

Theo de Raadt said neither phrase.

Re:Theo de Raadt on LLVM license change by karlshea on Saturday October 01, 2016 @01:30PM (#12618893)
I think everybody here knows what ">" means.
Re:Theo de Raadt on LLVM license change by notaplumber on Saturday October 01, 2016 @01:33PM (#12618907)
Except for refulgentis, apparently.
Re:Theo de Raadt on LLVM license change by karlshea on Saturday October 01, 2016 @01:37PM (#12618931)
I don't see where refulgentis claims Theo did. Clearly, those are quotes from the person Theo is replying to.

Theo seems to agree with that person though, and "wishing ill on a series of people clearly trying to do well" certainly could apply to both parties in the email.

Re:Theo de Raadt on LLVM license change by refulgentis on Saturday October 01, 2016 @05:18PM (#12619925)
I apologize, I didn't intend to give the impression my post was limited to addressing Theo. I expressly avoided addressing an individual, but clearly that wasn't enough.
Re:Theo de Raadt on LLVM license change by shadowmint on Saturday October 01, 2016 @10:43AM (#12618046)
It's hard to have any idea what that means without the preceding context:

    > > > What does the OpenBSD community think about the LLVM proposal to move
    > > > to the Apache license?
    > > >
    > > > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html
    > >
    > > If LLVM would move to the Apache 2 license, we would become unable
    > > to use versions released after that change, and would be stuck with
    > > version released before the change, just like we are stuck with
    > > pre-GPLv3 gcc now.  So it would be very bad for us.
    > >
    > > See http://www.openbsd.org/policy.html :
    > >
    > >   Apache
    > >     The original Apache license was similar to the Berkeley license,
    > >     but source code published under version 2 of the Apache license
    > >     is subject to additional restrictions and cannot be included
    > >     into OpenBSD.
    > >
    > > In a nutshell, OpenBSD does not consider software released under
    > > Apache 2 to be free software.  At least not free enough for us
Re:Theo de Raadt on LLVM license change by dleslie on Saturday October 01, 2016 @10:56AM (#12618093)
Does anyone recall why they rejected the GPL3?
Re:Theo de Raadt on LLVM license change by DannyBee on Saturday October 01, 2016 @01:37PM (#12618930)
It doesn't really meet any of the goals for relicensing. For example, one goal was to not need CLA's. Apache has a built in CLA, GPLv3 does not. Another is that llvm has no desire to require signing keys for represent or source reproduction of private backend, etc. Using gplv3 as a base would have required an even longer list of exceptions, and the end result would be gutting most of gplv3
Re:Theo de Raadt on LLVM license change by qb45 on Saturday October 01, 2016 @03:13PM (#12619418)
The question was what's OpenBSD's issue with GPL3, not LLVM's.
Re:Theo de Raadt on LLVM license change by dleslie on Sunday October 02, 2016 @12:24AM (#12621028)
Yes, it was; it seems you were the only person to notice that. :(
Re:Theo de Raadt on LLVM license change by Gracana on Sunday October 02, 2016 @12:34AM (#12621052)
From <https://www.openbsd.org/policy.html>:

GNU General Public License, GPL, LGPL, copyleft, etc.

The GNU Public License and licenses modeled on it impose the restriction that source code must be distributed or made available for all works that are derivatives of the GNU copyrighted code.

While this may superficially look like a noble strategy, it is a condition that is typically unacceptable for commercial use of software. So in practice, it usually ends up hindering free sharing and reuse of code and ideas rather than encouraging it. As a consequence, no additional software bound by the GPL terms will be considered for inclusion into the OpenBSD base system.

For historical reasons, the OpenBSD base system still includes the following GPL-licensed components: the GNU compiler collection (GCC) with supporting binutils and libraries, GNU CVS, GNU texinfo, the mkhybrid file system creation tool, and the readline library. Replacement by equivalent, more freely licensed tools is a long-term desideratum.

[edit] removed extra spaces to avoid HN's auto-formatter

Re:Theo de Raadt on LLVM license change by qb45 on Sunday October 02, 2016 @02:12AM (#12621249)
Have read it too, but the question was what's wrong with GPL3 that isn't wrong with GPL2. Am I again the only one to notice? :)

I'll give you folks a hint: the specific quote dleslie responded to says that OpenBSD stuck with GPL2 version of GCC to avoid GPL3.

But, of course, this place being HN, people have attention span of an infant and forget the context by the time they catch something they'd like to respond to :p

Re:Theo de Raadt on LLVM license change by eitland on Sunday October 02, 2016 @07:27AM (#12621888)
I guess because to people who find GPL2 too strict one of the last things they want is a newer, even stricter version of the same?
Re:Theo de Raadt on LLVM license change by coldtea on Saturday October 01, 2016 @11:25AM (#12618228)
Because no company would touch the GPL3 with a 100-ft pole.
Re:Theo de Raadt on LLVM license change by Iv on Saturday October 01, 2016 @11:38AM (#12618289)
No company that intends to use software patents as an offensive weapon, indeed.
Re:Theo de Raadt on LLVM license change by johncolanduoni on Saturday October 01, 2016 @12:45PM (#12618645)
The Apache 2.0 provides a patent grant, and the whole reason they were looking for a new license was to add a patent grant. So if Apple wants to sue anyone who uses LLVM for patent infringement, why are they spending so much money on lawyers to figure out how to switch to a license with a patent grant?
Re:Theo de Raadt on LLVM license change by cyphar on Saturday October 01, 2016 @01:16PM (#12618821)
The Apache 2.0 provides an uneven patent grant. Specifically, it's directed from users to the developers. The GPLv3 makes the patent grants much more copyleft in style to ensure that users cannot be attacked by patents from developers as well.
Re:Theo de Raadt on LLVM license change by johncolanduoni on Saturday October 01, 2016 @01:51PM (#12619009)
Apache 2.0:

> each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted.

GPLv3:

> Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.

The two licenses are definitely not identical on patents, but both are pretty clear that they provide protection to users from developers, insofar as the original code and any modifications downstream were licensed under the Apache 2.0 license. You're right that there's no copyleft, but that doesn't reverse the direction of the patent grant.

Re:Theo de Raadt on LLVM license change by Iv on Saturday October 01, 2016 @09:50PM (#12620737)
The GPLv3 has several paragraphs on patents. Here are some parts you did not mention:

> If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.

> If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.

> A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.

Re:Theo de Raadt on LLVM license change by johncolanduoni on Saturday October 01, 2016 @10:56PM (#12620864)
There's no doubt that the GPLv3 provides broader patent protection for users, but both licenses put the "protect users from developer's patent claims" first.

To be honest if you're hostile to software patents in general (which I am, and the GPL sure as hell is), the part of the Apache 2.0 license's patent clause that prevents users from flipping around the patent claims seems like a non-issue.

Re:Theo de Raadt on LLVM license change by coldtea on Saturday October 01, 2016 @01:46PM (#12618974)
No company that values its patents and will defend them in court, period.

(Because the way you phrased it implies this only holds for patent trolls).

Re:Theo de Raadt on LLVM license change by jra_samba on Saturday October 01, 2016 @01:05PM (#12618752)
All companies who ship Samba in products use GPLv3. There are a lot of companies shipping Samba (one went out with a successful IPO this week). Thus your FUD is disproved.
Re:Theo de Raadt on LLVM license change by dezgeg on Saturday October 01, 2016 @02:58PM (#12619351)
Many of them ship an old version from pre-GPLv3 times though.
Re:Theo de Raadt on LLVM license change by jra_samba on Sunday October 02, 2016 @12:39AM (#12621063)
The old version from pre-GPLv3 times is Samba 3.0.x. It's over nine years old.

No vendor ships that version anymore. I don't think modern Windows clients will even connect to it now (no working NTLMv2).

The ones who didn't want the GPLv3 (Apple) either wrote their own or purchased a proprietary third party server such as Likewise and were left holding a flaming bag of shit when EMC purchased the Likewise codebase and cancelled all existing support contracts. You'd think people would learn, but there are still vendors out there gambling on using proprietary third party SMB3 servers (hoping the same won't happen to them :-).

Re:Theo de Raadt on LLVM license change by dezgeg on Sunday October 02, 2016 @01:38PM (#12623386)
Well as a practical example, I checked the latest firmware of Asus RT-AC88U (HW seems to have shipped in Q4/2015) and the strings in /usr/bin/smbd (binwalk can directly extract the Asus .trx files) point to some derived version of 3.0.37.
Re:Theo de Raadt on LLVM license change by facetube on Saturday October 01, 2016 @11:35AM (#12618280)
Tautology is fun!
Re:Theo de Raadt on LLVM license change by coldtea on Saturday October 01, 2016 @12:31PM (#12618555)
It might be, but this isn't one. There could have been 100 other reasons for not wanting a specific license on their project besides corporate dislike for it.
Re:Theo de Raadt on LLVM license change by Longhanks on Saturday October 01, 2016 @10:52AM (#12618079)
Highly doubt a fork will 'flourish' so easily. LLVM is largely backed by Apple, the founder himself (Chris Lattner) works there. It won't be abandoned in the near future, however the license changes.