decoration decoration
Stories

GROKLAW
When you want to know more...
decoration
For layout only
Home
Archives
Site Map
Search
About Groklaw
Awards
Legal Research
Timelines
ApplevSamsung
ApplevSamsung p.2
ArchiveExplorer
Autozone
Bilski
Cases
Cast: Lawyers
Comes v. MS
Contracts/Documents
Courts
DRM
Gordon v MS
GPL
Grokdoc
HTML How To
IPI v RH
IV v. Google
Legal Docs
Lodsys
MS Litigations
MSvB&N
News Picks
Novell v. MS
Novell-MS Deal
ODF/OOXML
OOXML Appeals
OraclevGoogle
Patents
ProjectMonterey
Psystar
Quote Database
Red Hat v SCO
Salus Book
SCEA v Hotz
SCO Appeals
SCO Bankruptcy
SCO Financials
SCO Overview
SCO v IBM
SCO v Novell
SCO:Soup2Nuts
SCOsource
Sean Daly
Software Patents
Switch to Linux
Transcripts
Unix Books

Gear

Groklaw Gear

Click here to send an email to the editor of this weblog.


You won't find me on Facebook


Donate

Donate Paypal


No Legal Advice

The information on Groklaw is not intended to constitute legal advice. While Mark is a lawyer and he has asked other lawyers and law students to contribute articles, all of these articles are offered to help educate, not to provide specific legal advice. They are not your lawyers.

Here's Groklaw's comments policy.


What's New

STORIES
No new stories

COMMENTS last 48 hrs
No new comments


Sponsors

Hosting:
hosted by ibiblio

On servers donated to ibiblio by AMD.

Webmaster
How do you think Canonical is trying to make money? | 474 comments | Create New Account
Comments belong to whoever posts them. Please notify us of inappropriate comments.
How do you think Canonical is trying to make money?
Authored by: pem on Saturday, July 07 2012 @ 10:49 AM EDT
If Canonical does not have control of the hardware then it is not their problem regardless of whether they are getting paid by the hardware manufacturer or not.
You can't know that. The FSF makes it clear that the hardware manufacturer is liable, so, despite your earnest wishes to the contrary, it really does turn on the contract between the hardware manufacturer and Canonical.
The only way your hypothetical situation would play out the way you suggest is if Canonical signed some ridiculous contract with the OEM (creating an "agency" or a "warranty") that specifically shifted the burden back onto Canonical.
It's not really a "ridiculous" contract for Canonical to contract for an initial software load and all required updates during the warranty period. Sounds pretty standard to me, and it would probably shift the burden for the GPL bootloader.
The GPL-3 does not do this yet Shuttleworth claims it is a GPL-3 issue.
The GPL does not do what??!? It certainly makes the vendor (and presumably their agents) responsible for GPL v3 compliance.
[Your scenario] seems identical to the malicious person downstream I was talking about yet you claim your scenario is completely different from mine.
It is completely different, in that you were trying to claim that I was trying to claim that any upstream provider would be snared by the same net, thus there cannot possibly be a net. Most upstream providers won't be contractually obligated to provide fixes.
The only possible difference I see is that in your scenario there is some other contract between Canonical and the OEM and it is that contract, not the GPL-3, which forces Canonical to release their private keys.
As I have already said multiple times, it is the combination of that contract and the GPL v3 that could lead to this outcome. If you remove the contract, there is no problem. If you remove GPL v3, there is no problem.

You (and several other posters) seem to think that it is merely a matter of making the contract better to insulate Canonical. That might or might not be possible, but even if it is, the contract might be so onerous to the hardware vendor that Canonical does no business.

If, for example, a hardware manufacturer has a contract for an ARM device with Microsoft that specifically disallows disabling secure boot, or user modifiable keys, then anybody who buys that device cannot possibly load anything except Windows or other software that has keys preloaded on the device.

In that case, I think it's a net win for free software if Canonical's keys (which will allow their bootloader to run, which will boot any linux) are preloaded on such a device. But this can't possibly happen with a GPL v3 bootloader, because then somebody would be required to release the keys and let the user supply his own bootloader.

You can rail all you want about how such a locked down device is working against the user, but if a gazillion such devices were going to be sold that could only run Windows, I personally think it's a net gain if Canonical can make it where at least some subset of them can run Linux.

You can scream until you're blue in the face about how this is an antitrust issue and Microsoft shouldn't be able to get away with and the laws should be changed, and I will agree -- meanwhile, millions of Microsoft-only capable units will have shipped.

You can keep calling both me and Shuttleworth stupid and/or mendacious, but until you know what the device manufacturers have hinted to him about the contracts Microsoft makes them sign, you can't possibly walk in his shoes. As for me, you keep mis-representing what I am saying.

As far as the GPL-3 is concerned Canonical is strictly upstream even if they are getting paid for the software.
How do you know that it will always be interpreted that way, by every court in the world, when Canonical has a contract to deliver software and updates? And how do you know that some court, somewhere, won't decide that the GPL creates a right of action for a downstream recipient of the software, such that someone who supplies him a device with GPL v3 software on it (and/or their agent, Canonical) might be required to allow the recipient to update the bootloader on his machine?
Canonical would have to sign some additional contract to put themselves in a position where actions by the OEM would force Canonical to release their private key.
Obviously Canonical is signing contracts. That's a prerequisite to revenue at this level. But that all presupposes they have something to sell that somebody will buy. An OEM with its hands tied by Microsoft might not be in a position to buy a package with a GPL v3 bootloader, and in a transaction where Canonical is accepting money from a device manufacturer, it would be remiss (possibly actionably so, but certainly ethically so) for Canonical not to explain thoroughly to the OEM what the OEM's responsibility is when they load up and distribute the software that Canonical gives them. If that responsibility makes it impossible, or even difficult, to use both Canonical and Microsoft, then Canonical might lose the business. In this case, IMHO, we all lose.

If you agree with me that the GPL-3 would not force Canonical to release their private key due to the actions of someone (such as an OEM) downstream then say so.
This is a strawman. I have already said this multiple times, including in the comment to which this is a direct reply. Why do you keep trying to tie me to statements I have explicitly disclaimed? That is the sort of crappy arguing technique that does not belong on groklaw. It is not about upstream or downstream -- it is about whether there is an agency between Canonical and the OEM.
If you still believe the GPL-3 could force Canonical to release their private keys due to actions out of their control taken by the OEM then please explain how that is different from the examples I gave.
Thought experiment -- spot the continuum. Assume for a moment that companies are releasing machines without any GPL v3 software. (This is not really a far-fetched assumption -- the machine might contain Windows, but the user might be able to repurpose the machine to run Linux.) Also assume that the companies don't deliver software themselves.

Any company simply shipping a machine, with no GPL v3 software on it, can't possibly be in violation of the GPL, can it, because it is not a violation of copyright to not create a copy...

(1) Company A releases a machine that only runs a bootloader signed by the Debian team.

(2) Company B releases a machine that only runs a bootloader signed by the Canonical team.

(3) Company C releases a machine that only runs a bootloader signed by the Canonical team, and also pays money to Canonical.

(4) Company D releases a machine that only runs a bootloader signed by the team X, which is a shell company completely funded by the owners of Company D.

(5) Company E releases a machine that only runs a bootloader signed by itself -- it provides a signature for a hash of a binary bootloader created by somebody else. Maybe it does so for money.

Now, is scenario 5 a copyright violation? Does creating a hash and signing it create a derivative work? Possibly.

What about scenario 4? In this case, you can only get software from "approved sources" for the machine. A court might easily find that the two companies were acting in concert, and that it is a GPL violation. If not, there's the start of a blueprint for getting around GPL v3. If so, how is the court to legitimately distinguish between scenario 4 and scenario 3? (Hint: if they can, you've just given a slightly more complicated blueprint for getting around this requirement of the GPL.)

The relevant question is not whether Canonical can sign a ridiculous contract that could end up forcing them to release their private keys.
That's right. The relevant question is whether Canonical wants to sign a contract that only looks ridiculous when paired with a GPL v3 bootloader, and, if so, whether it would be better from their perspective to change the contract, or to change the bootloader.
Of course they can, but that has nothing to do with the GPL-3.
Sure it does. If the OEM won't sign the contract that Canonical needs for GPL v3 protection, or will give significantly less money when those protection clauses are in the contract, then it costs Canonical real money to ship a GPL v3 bootloader under those circumstances.
The relevant question is whether the GPL-3 itself can put Canonical in a position where they might be forced to release their private keys.
You keep bringing up this strawman. It's not about the GPL v3. It's about how it interacts with the real world and real customers and their real (cough, Microsoft, cough...) requirements.
Your position on the relevant question is extremely unclear.
No, it's not. You keep trying to claim it's unclear, but that's just a strawman.
If it is some other contract that is forcing key disclosure then you are spreading anti-GPL FUD.
It is not anti-GPL FUD to state that I can easily envision scenarios where Microsoft has cowed some hardware vendors into signing a contract that would make it impossible for those vendors to ship a GPL v3 bootloader. It is also not anti-GPL FUD to state that I can easily envision a scenario where Canonical might allow a user to download an update to a bootloader during the warranty period for the computer, where the OEM contracted with Canonical for support, and some court might find that Canonical, as well as the OEM, is liable for ensuring that the user can modify and replace the bootloader himself.
If it is not some other contract that is forcing disclosure then leave all the other contracts out of the discussion and explain why you think the GPL-3 itself will force people upstream to be responsible for actions taken by people downstream.
You're still not paying attention. Is it really that hard?

Contract + GPL v2 = no disclosure required

Contract + GPL v3 = disclosure required

You can whine all you want about how the contract is bad, but Shuttleworth isn't whining. He's just protecting himself (and everybody else who is using a Secure Boot computer that has a Canonical key on it.)

[ Reply to This | Parent | # ]

Groklaw © Copyright 2003-2013 Pamela Jones.
All trademarks and copyrights on this page are owned by their respective owners.
Comments are owned by the individual posters.

PJ's articles are licensed under a Creative Commons License. ( Details )