The FSF's being stupid again, it seems...

[Rob Landley]

On Wednesday 28 June 2006 5:02 pm, Paul Fox wrote:
>  > And I just thought I'd ping the list about changing our
>  > licensing page to say that if you have a statement about what
>  > exact version of busybox you used, with what .config file, and
>  > that you didn't modify it, then you don't need to provide the
>  > source code.
>
> why?  you're letting my company off the hook for providing source
> for the code we put into our products?  i don't understand the
> rationale.  why should my customers have to go to busybox.net
> for sources?  why should busybox.net have to provide them?  (as
> maintainer, you're under no obligation to keep old releases
> around.)

Currently, the GPL says (section 3b) that all you need is a written offer, 
good for three years, saying you'll send the source to people who ask for it.  
(For example, you'll notice that the downloads/qemu directory says I can send 
you the source ISOs to the Red Hat 9 image if you really want me to, or you 
can just get them from Red Hat's archive site which I give the URL to.  Since 
I'm doing noncommercial distribution, this is _both_ 3b and 3c.)  But 
apparently, this is not good enough for the FSF, and in GPLv3 they're making 
it so you have to mirror the source on the web 24/7, whether you want to or 
not, even if you didn't modify it.

What's important to me is that people can _get_ the source code to reproduce 
the binary they've got.  (Nobody's letting anyone off the hook for that.  It 
must be available.)  And it can be tricky to make sure you've got the _right_ 
source code, and that it's complete enough to actually reproduce the binary 
in question.  But if somebody actually is using vanilla unmodified BusyBox 
1.1.3, I'm actually more interested in confirming that and getting 
their .config file than getting another copy of the same source tarball.

Now if Morris was still on Erik's DSL line, rather than hosted by OSL, 
conserving bandwidth for the project would be important.  But these days 
there's things like sourceforge that are quite happy to mirror open source 
projects, so getting extra mirrors of vanilla release tarballs generally 
isn't a major limiting factor.

By harassing Mepis (and presumably others like them), as far as I can tell the 
FSF is just making a neusance of itself, scaring people away from using GPL 
software and trying to solve a non-problem.  I'm curious what other people's 
opinions are.

Rob
-- 
Never bet against the cheap plastic solution.