Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers
by tsimionescu on Friday January 26, 2024 @03:52AM
(#39140259)
Actually, if you ask the Software Freedom Conservancy, not only is this a requirement of the GPLv3, it is in fact also required by the GPLv2 [0]:
> GPLv2 assures, to the purchaser of an embedded product, their absolute right to receive the information necessary to install a modified version of the GPLv2'd works. [...] installation of the GPL'd works must succeed and operate in a useful and functional fashion on the device.
I believe the FSF position is different, but it's unclear. At least one member of the SFC who was a member of the FSF in the past (Bradley Kuhn) [1] believes that the FSF has the same position - that both GPLv2 software and GPLv3 software must be accompanied by full instructions (and ability) for a user to install their own modified versions on any hardware containing this software. He believes that the only difference with GPLv3 is that, in addition to this requirement, other proprietary software on the device must continue to operate just as before; whereas, with the GPLv2, it's fine for other proprietary software to say "you're running an unsigned version of Linux, failing to start". Linus Torvalds' public statements about the GPLv3, as well as the FSF page on Tivoization [2], seem to suggest otherwise.
Either way, this is not some invention of MS lawyers meant to make the GPL look scarier, it is very much how the free software community sees the GPL working.
> GPLv2 assures, to the purchaser of an embedded product, their absolute right to receive the information necessary to install a modified version of the GPLv2'd works. [...] installation of the GPL'd works must succeed and operate in a useful and functional fashion on the device.
I believe the FSF position is different, but it's unclear. At least one member of the SFC who was a member of the FSF in the past (Bradley Kuhn) [1] believes that the FSF has the same position - that both GPLv2 software and GPLv3 software must be accompanied by full instructions (and ability) for a user to install their own modified versions on any hardware containing this software. He believes that the only difference with GPLv3 is that, in addition to this requirement, other proprietary software on the device must continue to operate just as before; whereas, with the GPLv2, it's fine for other proprietary software to say "you're running an unsigned version of Linux, failing to start". Linus Torvalds' public statements about the GPLv3, as well as the FSF page on Tivoization [2], seem to suggest otherwise.
Either way, this is not some invention of MS lawyers meant to make the GPL look scarier, it is very much how the free software community sees the GPL working.
[0] https://sfconservancy.org/blog/2021/mar/25/install-gplv2/
[1] https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t...
[2] https://www.gnu.org/philosophy/tivoization.en.html