If Canonical does not have control of the hardware then it is not
their problem regardless of whether they are getting paid by the hardware
manufacturer or not.
You can't know that. The FSF makes it clear
that the hardware manufacturer is liable, so, despite your earnest wishes to the
contrary, it really does turn on the contract between the hardware manufacturer
and Canonical.
The only way your hypothetical situation would
play out the way you suggest is if Canonical signed some ridiculous contract
with the OEM (creating an "agency" or a "warranty") that specifically shifted
the burden back onto Canonical.
It's not really a "ridiculous"
contract for Canonical to contract for an initial software load and all required
updates during the warranty period. Sounds pretty standard to me, and it would
probably shift the burden for the GPL bootloader.
The GPL-3 does
not do this yet Shuttleworth claims it is a GPL-3 issue.
The GPL
does not do what??!? It certainly makes the vendor (and presumably their
agents) responsible for GPL v3 compliance.
[Your scenario] seems
identical to the malicious person downstream I was talking about yet you claim
your scenario is completely different from mine.
It is completely
different, in that you were trying to claim that I was trying to claim that
any upstream provider would be snared by the same net, thus there cannot
possibly be a net. Most upstream providers won't be contractually obligated to
provide fixes.
The only possible difference I see is that in your
scenario there is some other contract between Canonical and the OEM and it is
that contract, not the GPL-3, which forces Canonical to release their private
keys.
As I have already said multiple times, it is the
combination of that contract and the GPL v3 that could lead to this
outcome. If you remove the contract, there is no problem. If you remove GPL
v3, there is no problem.
You (and several other posters) seem to think that
it is merely a matter of making the contract better to insulate Canonical. That
might or might not be possible, but even if it is, the contract might be so
onerous to the hardware vendor that Canonical does no business.
If, for
example, a hardware manufacturer has a contract for an ARM device with Microsoft
that specifically disallows disabling secure boot, or user modifiable keys, then
anybody who buys that device cannot possibly load anything except Windows or
other software that has keys preloaded on the device.
In that case, I think
it's a net win for free software if Canonical's keys (which will allow their
bootloader to run, which will boot any linux) are preloaded on such a device.
But this can't possibly happen with a GPL v3 bootloader, because then
somebody would be required to release the keys and let the user supply
his own bootloader.
You can rail all you want about how such a locked down
device is working against the user, but if a gazillion such devices were going
to be sold that could only run Windows, I personally think it's a net gain if
Canonical can make it where at least some subset of them can run Linux.
You
can scream until you're blue in the face about how this is an antitrust issue
and Microsoft shouldn't be able to get away with and the laws should be changed,
and I will agree -- meanwhile, millions of Microsoft-only capable units will
have shipped.
You can keep calling both me and Shuttleworth stupid and/or
mendacious, but until you know what the device manufacturers have hinted
to him about the contracts Microsoft makes them sign, you can't possibly walk in
his shoes. As for me, you keep mis-representing what I am
saying.
As far as the GPL-3 is concerned Canonical is strictly
upstream even if they are getting paid for the software.
How do
you know that it will always be interpreted that way, by every court in the
world, when Canonical has a contract to deliver software and updates? And how
do you know that some court, somewhere, won't decide that the GPL creates a
right of action for a downstream recipient of the software, such that someone
who supplies him a device with GPL v3 software on it (and/or their agent,
Canonical) might be required to allow the recipient to update the bootloader on
his machine?
Canonical would have to sign some additional contract
to put themselves in a position where actions by the OEM would force Canonical
to release their private key.
Obviously Canonical is signing
contracts. That's a prerequisite to revenue at this level. But that all
presupposes they have something to sell that somebody will buy. An OEM with its
hands tied by Microsoft might not be in a position to buy a package with a GPL
v3 bootloader, and in a transaction where Canonical is accepting money from a
device manufacturer, it would be remiss (possibly actionably so, but certainly
ethically so) for Canonical not to explain thoroughly to the OEM what the OEM's
responsibility is when they load up and distribute the software that Canonical
gives them. If that responsibility makes it impossible, or even difficult, to
use both Canonical and Microsoft, then Canonical might lose the business. In
this case, IMHO, we all lose.
If you agree with me that the
GPL-3 would not force Canonical to release their private key due to the actions
of someone (such as an OEM) downstream then say so.
This is a
strawman. I have already said this multiple times, including in the
comment to which this is a direct reply. Why do you keep trying to tie me to
statements I have explicitly disclaimed? That is the sort of crappy arguing
technique that does not belong on groklaw. It is not about upstream or
downstream -- it is about whether there is an agency between Canonical and the
OEM.
If you still believe the GPL-3 could force Canonical to
release their private keys due to actions out of their control taken by the OEM
then please explain how that is different from the examples I
gave.
Thought experiment -- spot the continuum. Assume for a
moment that companies are releasing machines without any GPL v3 software. (This
is not really a far-fetched assumption -- the machine might contain Windows, but
the user might be able to repurpose the machine to run Linux.) Also assume that
the companies don't deliver software themselves.
Any company simply shipping
a machine, with no GPL v3 software on it, can't possibly be in violation of the
GPL, can it, because it is not a violation of copyright to not create a
copy...
(1) Company A releases a machine that only runs a bootloader signed
by the Debian team.
(2) Company B releases a machine that only runs a
bootloader signed by the Canonical team.
(3) Company C releases a machine
that only runs a bootloader signed by the Canonical team, and also pays money to
Canonical.
(4) Company D releases a machine that only runs a bootloader
signed by the team X, which is a shell company completely funded by the owners
of Company D.
(5) Company E releases a machine that only runs a bootloader
signed by itself -- it provides a signature for a hash of a binary bootloader
created by somebody else. Maybe it does so for money.
Now, is scenario 5 a
copyright violation? Does creating a hash and signing it create a derivative
work? Possibly.
What about scenario 4? In this case, you can only get
software from "approved sources" for the machine. A court might easily find
that the two companies were acting in concert, and that it is a GPL violation.
If not, there's the start of a blueprint for getting around GPL v3. If so, how
is the court to legitimately distinguish between scenario 4 and scenario 3?
(Hint: if they can, you've just given a slightly more complicated blueprint for
getting around this requirement of the GPL.)
The relevant
question is not whether Canonical can sign a ridiculous contract that could end
up forcing them to release their private keys.
That's right. The
relevant question is whether Canonical wants to sign a contract that only looks
ridiculous when paired with a GPL v3 bootloader, and, if so, whether it would be
better from their perspective to change the contract, or to change the
bootloader.
Of course they can, but that has nothing to do with
the GPL-3.
Sure it does. If the OEM won't sign the contract that
Canonical needs for GPL v3 protection, or will give significantly less money
when those protection clauses are in the contract, then it costs Canonical real
money to ship a GPL v3 bootloader under those circumstances.
The
relevant question is whether the GPL-3 itself can put Canonical in a position
where they might be forced to release their private keys.
You
keep bringing up this strawman. It's not about the GPL v3. It's about how it
interacts with the real world and real customers and their real (cough,
Microsoft, cough...) requirements.
Your position on the relevant
question is extremely unclear.
No, it's not. You keep trying to
claim it's unclear, but that's just a strawman.
If it is some
other contract that is forcing key disclosure then you are spreading anti-GPL
FUD.
It is not anti-GPL FUD to state that I can easily envision
scenarios where Microsoft has cowed some hardware vendors into signing a
contract that would make it impossible for those vendors to ship a GPL v3
bootloader. It is also not anti-GPL FUD to state that I can easily envision a
scenario where Canonical might allow a user to download an update to a
bootloader during the warranty period for the computer, where the OEM contracted
with Canonical for support, and some court might find that Canonical, as well as
the OEM, is liable for ensuring that the user can modify and replace the
bootloader himself.
If it is not some other contract that is
forcing disclosure then leave all the other contracts out of the discussion and
explain why you think the GPL-3 itself will force people upstream to be
responsible for actions taken by people downstream.
You're still
not paying attention. Is it really that hard?
Contract + GPL v2 = no
disclosure required
Contract + GPL v3 = disclosure required
You can
whine all you want about how the contract is bad, but Shuttleworth isn't
whining. He's just protecting himself (and everybody else who is using a Secure
Boot computer that has a Canonical key on it.) [ Reply to This | Parent | # ]
|