News for hackers. Stuff that matters.

A comment on GnuTLS certificate verification vulnerability announced (CVE-2014-0092). Parent comment

Re:GnuTLS certificate verification vulnerability announced (... by sanxiyn on Monday March 03, 2014 @11:56PM (#7338557)
git on Debian, for example. In general, GPL programs need special exception to link to OpenSSL, and git is licensed under GPL without the exception.
[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by nknighthb on Tuesday March 04, 2014 @04:15AM (#7339202)
There's a standing debate regarding whether that actually matters in the case of a distribution that included OpenSSL as a standard component, due to the GPL's system libraries exception. (And, of special relevance to Debian, there is debate even among those who agree that it's probably legal as to the ethics of doing it absent some fairly explicit indication of intent from the author(s) of the GPL'd software.)
[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by dekkers on Tuesday March 04, 2014 @06:00AM (#7339523)
Distributions can't take advantage of the system libraries exception, it only works for software that isn't shipped together with OpenSSL. The whole GPLv2 clause:

"However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by nknighthb on Tuesday March 04, 2014 @06:52AM (#7339673)
That is one reasonable interpretation of "accompanies", but it is not the only one. Hence the existence of debate. (Consider, for example, a CDN that happens to distribute both a Linux distribution that includes OpenSSL, and an unrelated GPL project not included in the distribution and written by people who don't contribute to the distribution. You surely would not believe this meets the definition of "accompanies" as used in the GPL? Now, figure out where the line is crossed.)
[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by taspeotis on Tuesday March 04, 2014 @02:48AM (#7339015)
Off topic but can you explain the exception? I had a look at OpenSSL's license and it seems pretty open.
[ Parent | on HN ]
Re:GnuTLS certificate verification vulnerability announced (... by lifthrasiir on Tuesday March 04, 2014 @03:34AM (#7339109)
https://en.wikipedia.org/wiki/OpenSSL#Licensing

tl;dr: A conjunction of two old licenses, resulting in the advertising requirement that "every occurrence of the license with a different name required a separate acknowledgment", which is incompatible to GNU GPL.

[ Parent | on HN ]