Please tone down the GPL3 paranoia

[Rob Landley]

On Thursday 14 September 2006 4:53 pm, Bruce Perens wrote:
> > We will never accept GPLv3-only patches into the project.
> I can think of some cases where you might have to positively abandon
> GPL2 in response to some legislative or court action.

In which case the Linux kernel would have to abandon GPLv2.  Now which is more 
likely to be able to legally defend itself: a multi-billion dollar industry, 
or a boston foundation?

> > There's nothing wrong with GPLv2, and if there was it would be wrong with 
the 
> > Linux kernel, a project at the center of a multi-billion dollar industry 
with 
> > the resources to lobby for changes in the law to protect itself.
> >   
> This is an entirely different argument, but if you are talking about
> OSDL's patent project,

No, I was talking about IBM, HP, SGI, Sony, Toshiba, Samsung...

> > You seem to be suggesting it would be acceptable to simplify the project's 
> > license to GPLv3 only, but not to GPLv2 only.\
> I think you need to leave the option to progress to GPL3

It is.  For versions 1.2.2 and earlier.  I'm under no obligation to write new 
code under GPLv3, and I don't plan on it.  Several GPLv2 only applets have 
been proposed for inclusion in busybox (and a quick check found that some of 
the ones already in the tree are only usable under GPLv2 only).  If you merge 
GPLv2 only code with GPLv2 or later code, you get GPLv2 only code.

The "or later" is in the suggested permission grant, which is not required.  
The license says "end of terms and conditions", and that's where the actual 
license ends.

> only for a 
> future in which GPL2 may no longer be viable because major license
> circumventions are found acceptable by some court and thus gain the
> strength of law.

And you're calling _me_ paranoid?  (Yes you did, check the title.)

Entities like SCO and Microsoft have spent a lot of time, effort and money 
trying to make exactly that happen, and have had 15 years to do it in.  But 
if it did happen, it would affect the Linux kernel, which is the foundation 
of a multi-billion dollar industry that is quite capable of lobbying for 
changes in the law to actually _fix_ whatever went wrong.

If the question is "Who do I trust the judgement of more, the Linux kernel 
developers or the FSF", it's not even a close call.

> I am saying that you should not close out your options 
> in case that happens.

Requiring "or later" on incoming patches, and rewriting ones that haven't got 
it, has a maintenance burden.  Since the Linux kernel developers tend to 
write code we're interested in (and write it under GPlv2 only), this is not a 
theoretical problem but a real, existing problem.

This real maintenance burden is balanced against a hedge for a purely 
theoretical problem which has had almost half my life to manifest.

> > What's wrong with GPLv2?  It strikes an excellent balance that's lasted 15 
> > years already.  It's been a stable social contract the entire time I've 
been 
> > using Linux.
> >   
> When the GPL was drafted, dynamic linking was not in common use.

And hence the LGPL was created.  It's a good thing.  The FSF tried to 
deprecate the LGPL, calling it the "Lesser" license.  I didn't like that.

> There 
> were no ASPs. Both of these represent oft-used loopholes. There had been
> no cases like Nintendo v. Goloob or Specht v. Netscape, either of which
> might be used as precedent to weaken the GPL in a later case.

Global warming is risk.  Oil production peaking is risk.  The possibility of a 
meteor strike is risk.  The upcoming inversion of the planet's magnetic field 
occurring within our lifetimes and sending out repeated planetwide EMP is 
risk.

Despite the universe being a dangerous place, I'm willing to live without a 
tinfoil hat.

> >> rather than a license that would have allowed improvements to 
> >> the package to be locked down in some way.
> >>     
> >
> > You're implying GPLv2 would allow this?
> >   
> Well, there is the DRM issue. Do you really want unmodifiable signed
> busybox binaries that circumvent your GPL-granted right to modify the
> software within hardware that you own?

Want, no.  Willing to live with?  Yes.

I want access to the source code.  I never asked for the ability to install it 
on any given piece of hardware.  If the hardware is not general purpose, then 
the hardware is not general purpose.  I don't see how this is any different 
from burning busybox into ROM, which I have no problem with.

If they burn it into ROM, I still want the changes they made to the source 
code.  If I can't install unsigned binaries I still want the changes they 
made to the source code.  That's all I ever asked for.

> Linus says yes. I'm not sure you should agree.

Whether or not I "should" agree, I've generally come to trust Linus's 
judgement.  He's got an excellent track record.

> > you thought Sun was being divisive with CDDL:
> > http://developers.slashdot.org/comments.pl?sid=137327&cid=11480318
> >   
> CDDL was written for deliberate GPL incompatibility, indeed I still
> believe that to be its primary aim. A major goal in the drafting of GPL3
> is compatibility with legacy GPL2 code.

How?  The new DRM provisions are a restriction that GPLv2 didn't require (no 
matter how you phrase them), so GPLv3 can't relicense GPLv2 code in the 
absence of the purely optional wording in the permission grant, which is not 
actually part of the license and was clearly not universally adopted or we 
wouldn't even be having this discussion.

I did think about this a lot.  I've been thinking (and talking) about it for 
months now.  The timing of your message sucked: the _only_ thing I had left 
to do on this topic was ask Erik Andersen if he minded.  I'd already asked 
the Software Freedom Law Center (what the license _is_ is irrelevant if we 
can't enforce it, they're the guys doing that for us) and they were still 
willing to represent us.  I'd brought it up repeatedly on the list in case 
anyone could come up with a compelling counter-argument.  I'd asked Greg 
Kroah-Hartmann to give us an "or later" on the diethotplug code (he 
explicitly declined).  I'd done a quick audit of the BusyBox code to look for 
GPLv2-only code and I found a dozen files (many of them oversights over the 
years, but not all.  And even the oversights have been accepted patches after 
shipping with a GPLv2 only permission grant.)

I spent months on this, and a few hours before you posted your message I 
posted this (check the PS at the end):
http://busybox.net/lists/busybox/2006-September/024397.html

I.E. I'd already made the decision about what I wanted to do, the one thing I 
hadn't done was taken my arguments to the previous maintainer (Erik Andersen) 
to see whether or not he objected to this course of action.

Erik Andersen made BusyBox what it is today.  I spent almost three years 
contributing patches to the project he maintained, and I never actually tried 
to become maintainer (I was simply trying to handle some of the grunt work to 
give him more time to work on other parts of the project).  I'd still give it 
back to him if he asked.  If Erik had said "please do not do this", I would 
not have done it.  I wasn't even comfortable not explicitly asking him "Do 
you mind?"

The last time you touched this project, I'd never even heard of it.  Before 
Erik took over, it wasn't even an independent project but a niche utility for 
the Debian boot disk.  Erik took what you had lost interest in and turned it 
into a real project (presumably with your blessing since Erik was a debian 
developer, certainly with a lack of objection up until now).  And then Erik 
handed it off to me.

Have you ever even posted to this list before?

Despite having already made my decision, and simply awaiting confirmation of 
it, I did stop to reconsider when I got your message.  I stopped what I was 
doing, read your arguments, and thought through what you had to say.

You seemed to believe it would be ok if I dropped GPLv2 and went to GPLv3 
only.  But you don't seem to think it's ok to drop GPLv3 and go with GPLv2 
only.  I do not consider that position internally consistent.  This is aside 
from the fact that GPLv3 doesn't even exist yet and GPLv2 is the only actual 
license the project has ever been under.  That doesn't matter: if it's 
morally ok to drop GPLv2 and go to GPLv3 at some point in the future, then it 
must be ok to drop GPLv3 and stick with GPLv2 now.

And thus I stuck by my original decision.

Thank you for expressing your opinion.  I did take it into consideration.  I 
disagree.

>     Thanks
> 
>     Bruce

Rob
-- 
Never bet against the cheap plastic solution.