Slashdot Log In
DJB Releases All Source to Public Domain
Posted by
Zonk
on Fri Nov 30, 2007 02:07 AM
from the play-freebird dept.
from the play-freebird dept.
A Sage Developer writes "During a recent conference, Sage Days 6, Dan Bernstein (who has recently come under attack for his licensing policy) was among the invited speakers. During a panel discussion on the future of open source mathematics software, Bernstein declared that all of his past and future code would be released to the public domain. This includes qmail, primegen, and a number of other projects. Given the headache that incompatibility between GPLv3 and GPLv2 is causing developers, will we see more of this?"
Related Stories
[+]
Developers: Qmail At 10 Years — Reflections On Security 304 comments
os2man writes "Qmail is one of the most widely used MTAs on the Net and has a solid reputation for its level of security. In 'Some thoughts on security after ten years of qmail 1.0' (PDF), Daniel J. Bernstein, reviews the history and security-relevant architecture of qmail; articulates partitioning standards that qmail fails to meet; analyzes the engineering that has allowed qmail to survive this failure; and draws various conclusions regarding the future of secure programming. A good read for anyone involved in secure development."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
In a word... (Score:5, Insightful)
No.
Not in a manner disproportionate to what we've seen in the past anyway. Some people will keep gpl2 as their license, others will go gpl3, bsd, or one of any of the OSI licenses for the most part, because people like attribution, they like retaining (some) control of their work.
Re:In a word... (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re:In a word... (Score:4, Informative)
(DJB's license forbade distribution of modified source - you can only distribute patches. You man not distribute binary files that result from any modification from the distribution source. I argue that it isn't open source at all.)
This might mean that qmail's glaring deficienies will get fixed. That's if qmail is still relevant. Plus, it might be secure on muliti-gigabyte ram 64 bit machines (which, frankly, are run of the mill linux boxes these days.)
Now, arguing a swap from GPL or BSD to/from Public Domain is another thing entirely IMHO.
Parent
Re: (Score:3, Insightful)
(DJB's license forbade distribution of modified source - you can only distribute patches. You man not distribute binary files that result from any modification from the distribution source. I argue that it isn't open source at all.)
This is like arguing RHEL isn't open source because it isn't packaged up in ready to use ISOs.
Re: (Score:3, Funny)
Fanatics of the Church of Stallman aren't capable of logic.
Besides, they think that "freedom" refers to objects and not to people.
Re: (Score:3, Insightful)
I saw Open Source as a free exchange of ideas and code that let you do what ever you wanted with it. Public Domain fits that better than a lot of others.
All the Gotchas and legal overhead built into some of them are just overhead that make the whole process fustrating.
At the same time, Open Source is becomming more of a buzz word than anything else. I hear even Microsoft does Open Source software now.
Re:In a word... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Re:In a word... (Score:5, Insightful)
You may call this a convoluted ideology, but the fact is if I receive a program with GPL code in it, I'm free to modify it as I see fit. If I receive a program with public domain code in it, I may not be able to modify it at all.
I'm interested in a free exchange of code that lets me do whatever I want with it. Public domain does not do that for me.
Parent
Re: (Score:3, Insightful)
Of course, it doesn't matter to you whether some source code is public domain or GPL; if you only acquire GPL binaries (whether they're derived from public domain code or not), you can do what you want with them, while if you acquire non-GPL binaries (whether they're derived from public domain code or not), you may not be able to
Not quite so fast (Score:4, Interesting)
My concern about the GPL is that, while it is very friendly towards businesses who want to release and then control the direction of their open source products (I did not say projects), it can have a stifling effect on community. Compare for example, the MySQL development model (one company *controls* what goes into the next release) with the PostgreSQL development model. In many ways Linux is an exception rather than a rule, and even GNU suffers from politics of internal control (for example RMS dismissing the head HURD architect, Thomas BUshnell, for arguing against considering the GFDL to be "Free" according to Debian's guidelines-- if this is the free speech to be associated with the FSF's free software, I want no part of the FSF).
The GPL is in many ways a sort of halfway house for companies who want to do open source but not community-centered development. If MySQL was under the BSD license, there is no way they could maintain the central control-- they would have to open up the commit access to many people in other companies, and could not sell proprietary licenses because there would be no market for them.
The GPL, while having legitimate uses, is more of a political statement than anything else. I say this as someone who contributes thousands of lines of code per week into GPL'd projects.
THe GPL v3 is confusing in number of ways. For example, there is some concern over whether a company cedes patent rights over their own patents by merely using GPLv3 software, this is because of missing one little definition buried not in the definitions section but elsewhere in the license (section 11. paragraph 6, as much as a quick reading might otherwise support the concern, only applies to distribution relying on *explicit* patent licenses hence one cannot inadvertently license patents by mere distribution of the software).
A larger issue with the GPL v3 is that section 7 can be read to be incompatible with licenses such as the BSD and MIT licenses, perhaps even with the public domain. The question is, whether paragraph 2 (removal of additional permissions) must apply to portions under other licenses as well. A plain reading of the license suggests that this is the case (and my conversations with Eben Moglen suggest he thinks that this is the case, and furthermore that he believes that licenses such as the BSD and MIT licenses allow for additional restrictions to be added to the license when merely copying the software. It is clear from public speeches that this is also the view of RMS).
However, as another member of the SFLC pointed out to me, this was not the intent of a large number of authors of the license, and that few if any lawyers are willing to give advice that changing the license on a verbatim copy of a permissively licensed work is allowed (see the SFLC's memo on ISCL/GPL collaboration). They argue that since compatibility with licenses like the BSD license was a goal, that it needs to be read as compatible. Hence they argue that the additional things you can do with BSD-licensed code fall outside of the definition in section 7 of additional terms and are not governed by the GPL v3 at all.
However, if and until we see a memo from the SFLC on that topic, we will not have a neutral document to point to and say "this is what the license means." Hence it seems to me that every project ought to contemplate these issues, seek legal advice, and include some clarifying statements in the project's documentation.
This is too much trouble for me to go to in my projects so there is no incentive to move. I *am* considering moving a fair bit of my company's projects from the GPL to some variant of the MIT or ISC license however.
Parent
Re: (Score:3, Insightful)
Re:In a word... (Score:4, Informative)
We deliberately put the source codes for the original Web browser and client library into the public domain in order to create the maximum chance of growth.
At the time there was no Apache license and the GPL poison pill simply did not meet our needs. At the time we were actively lobbying Microsoft and IBM to come on board with the Web.
The only regret I have about it is that if we had had a license it would not have been possible for NCSA to put out the early releases of Mosaic which consisted of 75% or more of CERN code without a single mention of CERN or even the Web in the documentation. I would probably recommend that people think about the attribution issue carefully, the behavior of NCSA is the main reason that the Web received very shabby treatment from CERN, in the early days NCSA was getting all the press attention and they simply were not mentioning the fact that the ideas had come from Tim.
I don't think this applies in Bernstein's case. Nor would I be too concerned about possibly insecure extensions. There are some open source projects that have successfully maintained a very strict security process over ten years or more.
Parent
Re: (Score:3, Informative)
Yes; just like everybody else who's publishing Open Source Software, they're doing it using an OSI Approved Open Source License.
Re: (Score:3, Interesting)
This is correct
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Yeah, look at how sqlite has languished by being public domain. No sooner was it released than it was snapped up and closed off and now no one can download the free version anymore.
I am talking about all instances of the software. Of course we can still get sqlite, but most of sqlite users don't know they are using it, and they don't know they can get the actual code to fix an issue. The idea of the GPL is protecting those users. Public domain doesn't help end users, because they don't even need to know what they are using.
Re: (Score:3, Informative)
OK so when exactly? (Score:3, Informative)
Re: (Score:2)
You could switch to postfix.
Re:OK so when exactly? (Score:4, Funny)
Parent
Re:OK so when exactly? (Score:5, Informative)
From http://cr.yp.to/qmail/dist.html [cr.yp.to]:
I hereby place the qmail package (in particular, qmail-1.03.tar.gz, with MD5 checksum 622f65f982e380dbe86e6574f3abcb7c) into the public domain. You are free to modify the package, distribute modified versions, etc.
Parent
Still a dick! (Score:2, Funny)
That may be good. (Score:4, Interesting)
The good is that allows people to fix, and distribute the fixes as part of the package instead of as a bunch of patches.
The bad is the security of the result. One of the hallmarks of the DJB software is that it is secure and he backs it up with a $500 (it may be $1000 now) bounty for security holes in the software. Many people referred to him as arrogant because of his refusal, but when you are good, you sometimes develop an attitude that people mistake for arrogance. Even so, it is HIS code, so he gets to do what he wants with it.
Re: (Score:2)
Re:That may be good. (Score:4, Interesting)
The biggest advantage of Unix is the "We stood on the shoulders of Giants" philosophy. The library functions are continually improved and nowdays there is a library function for nearly everything. Qmail goes completely against this philosophy by rewriting nearly every higher level function in libc it needs. Granted, when qmail came out some of these rewrites were more secure and technically superior implementations. First of all, not contributing them towards the libc's is sociopathic behaviour (I want only my app to benefit, everyone else go suck bricks sidewise through a thin straw). Second, their technical superiority even from a security perspective is no longer there. Libc has moved on and even the worst of them (HPUX and Irix) are now at the same level of the DJB replacements (or better).
Parent
Re: (Score:3, Insightful)
Re:That may be good. (Score:5, Interesting)
Now it is pointless.
Postfix, Exim and even sendmail have made a giant leap forward in terms of code quality, performance and security. So have the underlying libraries.
There simply no point to use qmail or any of its code base now. Too little, too late.
Parent
Re:That may be good. (Score:4, Interesting)
That's because qmail's known exploits [guninski.com] mainly affect new hardware. Cool, huh? Buy a new server and watch it automatically get less secure.
Parent
Re: (Score:3, Insightful)
From a system administrator's point of view qmail does NOT keep adequate logging to track the flow of a message through X MTAs. With Postfix or Sendmail (and I reckon Exim too), I can see the entire flow in the logs. If you ever worked for a company such as an ISP or where someone complained about email gone missing, stuff like this is lifesaving.
From a programmer point of view DJB's software is just the antithesis of everything decent p
Re:That may be good. (Score:5, Insightful)
This is ludicrous. He wrote them because the ones out there weren't good enough. Others can write their own. There is nothing sociopathic about closed source software, no matter how much you may wish it to be.
(It is probably in the realm of sociopathy, as we're using the term, to go after people who reverse engineer your compiled binaries, but that's entirely different from not giving them your code. If they can extract what they need from what you have chosen given them, good for them. It is always wise to remember that while the GPL and the Free Software movement are in favor of unlimited user rights, a developer choosing to exert his own rights is not wrong.)
Parent
Re: (Score:3, Informative)
Qmail stems from a time when serious UNIXen were commercial and closed. Getting the libc source cost big money; fixes were not solicited.
When Qmail was release, glibc was more than a decade old. So though glibc might not have been as widely used as those of commercial Unix versions there were certainly plenty of opportunity to release it.
That said, most of the stuff he reimplemented is not stuff that belongs in libc, and quite a bit of it is pointless paranoia and just contributes to make the Qmail source hard to read.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
For example, str_chr(). The standard strchr returns EITHER a pointer to the found character, or NULL. djb's str_chr always returns a usable pointer; either to the character or to the null terminating the string. Compare this idiom:
strcpy(secondhalf, strchr(wholething, ';'));
to djb's
str_cpy(secondhalf, str_chr(wholething, ';'));
This code works even if ';'
dnscache as an common daemon (Score:3, Insightful)
I would like to use dnscache as a normal daemon, one below the
Re:dnscache as an common daemon (Score:5, Insightful)
Right, since there isn't a standard right now...
That's why I called it "trying".
Well, init.d is complete in the sense that brainfuck is Turing-complete.
Which is to say, it's actually awkward for quite a lot of things. For instance: networking.
On Gentoo, the way multiple network interfaces are dealt with is by assigning each of them an init script, all symlinked to the same one. Gentoo init scripts have dependencies, so I can have something depend on some or all of the network interfaces being up.
On Debian, this is dealt with by having one "networking" init script that then ties into its own init-like system for individual interfaces -- ifup/ifdown. I can force certain scripts to run after an interface comes up or goes down.
On Ubuntu desktops, this is dealt with by having a NetworkManager daemon (started by init.d) that handles everything itself, by communicating with a GUI. I'm fairly sure it uses ifup/ifdown in some way, as it seems to respect some of my static scripts.
Gentoo is the closest to the "right way", in that there's a unified way to start/stop something. That is, on Gentoo, I know I can stop a network device by doing /etc/init.d/net.eth1 stop. But Ubuntu's the most user-friendly way, because I can do it from a GUI, and, for instance, easily migrate between wireless networks.
Now, go read about upstart [ubuntu.com], for a completely different approach. In particular, the ability to receive "events" from, say, udev or HAL, means that the equivalent of "/etc/init.d/net.eth1 start" will be run when I plug a cable into eth1, without removing that functionality, or forcing it into a completely different system (ifup/down).
At least, that's how I think it would work. In practice, while Upstart is used in Ubuntu, it's mostly used just to launch all the old sysv rc scripts, which then launch things like NetworkManager.
Parent
Re: (Score:3, Informative)
It's being worked on. [ubuntu.com]
The software is good. (Score:3, Insightful)
DJBDNS (Score:4, Interesting)
Tom Caudron
http://tom.digitalelite.com/ [digitalelite.com]
Re:Don't be an "indian giver" (Score:5, Informative)
Sigh. No, it doesn't. The GPL sets forth rules you need to follow if you choose to share (i.e. distribute) the software. But nothing in the GPL obliges you to share anything.
Parent
Re:Don't be an "indian giver" (Score:5, Informative)
How is it confusing?
The restrictions are essentially closing loopholes whereby people could either avoid sharing or share something useless.
Under GPLv2, you could create a derivative work and run a website based on it, but not share the changes since you weren't technically distributing the software. Or you could create a signed binary, and hardware that won't run it unless that binary is exactly the same. Or you could patent some procedure used, so that people can see the source code, but if they do anything with it, they violate your patent.
All GPLv3 does is enforce the spirit of GPLv2. Specifically: Everyone has to be able to get the source code, make any change they want, recompile, and run the modified binary.
If you're getting hit with these restrictions, chances are, you, yourself, are an "indian giver" -- you want to pretend to share, except, not really.
Or GPLv2... or BSD... or Apache... or MIT...
You're suggesting that GPLv3 somehow "infected" GPLv2, or every other license out there. That's simply not true. While public domain is perhaps the only way to ensure your code can be included in any kind of project, I see nothing wrong with share alike, and I see no reason why closing the loopholes is "going too far".
Parent
Re: (Score:3, Informative)
As I understand it, the only project in which Modified-BSD code could not be included is a project where the author wanted to claim you recommend their project without your permission. So while it's technically true, I don't think it's fair to say that public domain is the only way to allow code to be used in any project, not realistically speaking anyway. Anyone who insists on falsely claiming I endorse
Re: (Score:3, Interesting)
You still can run a web site on modified GPL3 software and not share the modifications you made. It's
Re: (Score:3, Informative)
Quite correct. Fortunately, it's almost trivially easy to beat the AGPL [honeypot.net].
The GPL v3 *is* confusing (Score:3, Interesting)
1: If you download a copy of the GCC under the GPL v3, are you licensing your patents which the GCC infringes on to all third parties?
After a lot of discussion on and off various lists, the answer is no, but you have to stop using the GCC prior to suing anyone or else other people could conceivably sue you. However, this is confusing because it is easy to miss the definition of patent license
A Linus supporter? (Score:4, Informative)
Linus' interpretation is, so long as we get to see the code, it's fine, even if we can't do anything with it.
That is not the original intent. Say what you will about RMS, but he wrote the damned thing.
Do you know why RMS started this "free software crusade", founded GNU, and wrote any GPL at all? It starts with a printer. He'd messed with the old printer driver for the old printer -- it was prone to paper jams, so his hack was to at least detect a jam and alert the user, even if he couldn't fix it. Well, the new model of printer came in, and he was all set to port his fix, but he didn't have source code.
That's why GPLv2 is all about source code -- RMS wants to be able to tinker with any device he owns, and he saw lack of source code as the only thing stopping him. In the case of this printer driver, it was. But now we have tivoization. Tell me, if the lab computer was set to only accept signed binaries, what good would any amount of source code be? He could change it to do his paper-jam-fixing-hack, and even compile it -- he could do anything but run it -- which makes it completely useless.
Linus has a point, and so do you -- there is some academic value in seeing how people did what they did.
But Linus and you miss the crucial point -- it's not about restricting the developers, it's about empowering the users. The GPLv3 guarantees that any piece of software you get that's GPLv3-licensed, you can modify it, recompile it, and run it in the same way as the original. What's restrictive about that?
Parent
Re:A Linus supporter? (Score:4, Insightful)
The GPL v2 and v3 are, whatever else one may say, the most successful attempt so far at creating a "constitution" that protects users rights in perpetuity, within the current framework of law designed to do just the opposite. It may not be perfect, but it's a damn sight better than most options out there.
Parent
Re: (Score:3, Insightful)
Huh? Why? I mean, I'm no qmail zealot, but if you're afraid of storing data in your filesystem, you have far *far* bigger problems.
Re: (Score:3, Insightful)