Re: [9fans] Redistribution

Re: [9fans] Redistribution

[rob pike]

	But note that these export restrictions only apply to compiled binaries.
	If you want to, e.g., provide a CVS archive of the Plan 9 source code,
	all you have to do to comply with the export regulations is notify the
	appropriate folks (I suggest going through the crypto registration tee
	at crypto.com so that other people know that you have cryptographic
	source code for download).

If you know how to honor the government requirements on crypto
stuff, then feel free to provide the crypto sources to your users.
I don't claim to understand the rules; I just know how we met them.

You still have to honor our license, and that includes making
people agree to it.

	I won't comment on the whole license restrictions thingy, except to note
	that dozens of other major corporations have no problem with providing
	their software via a Mozilla-type license like the Plan 9 license
	without having to go through some sort of license front end.

Requiring a clicked check box next to a link to our license before you
let users at the source does not strike me as an onerous burden.
It's what happens with just about every piece of software I download
nowadays.

-rob

Re: [9fans] Redistribution

[Lutz Donnerhacke]

* rob pike wrote:
>If you know how to honor the government requirements on crypto
>stuff, then feel free to provide the crypto sources to your users.
>I don't claim to understand the rules; I just know how we met them.

Deregulation in Europe caused a similar deregulation of export controls in
the USA. So please publish the sources. If you run into trouble (very
unlikly) tell them, I gave you the permission.

Re: [9fans] Redistribution

[Eric Lee Green]

rob pike wrote:
>         But note that these export restrictions only apply to compiled binaries.
>         If you want to, e.g., provide a CVS archive of the Plan 9 source code,
>         all you have to do to comply with the export regulations is notify the
>         appropriate folks
>
> If you know how to honor the government requirements on crypto
> stuff, then feel free to provide the crypto sources to your users.

Yes, I did have to research the issue because I do have some crypto
applications that are released as open source. In addition, I am the
author of the cryptographic components of an upcoming commercial
product, and had to research the issue because I had to know what was
allowed and not allowed for me to write. On January 15, 2000,
cryptographic source code was almost entirely deregulated with no "click
wrap" license required, and export restrictions of cryptographic
mass-market commercial software were greatly relaxed. Today you can
export cryptographic "mass market" binaries via the Internet and via
CD-ROM or other media to all but 10 nations, as long as they go through
a "click-wrap" license that requires them to agree that a) they're not a
government user, b) they are not located in the T-10 terrorist states,
and c) they're not going to redistribute it to the T-10 terrorist
states. It is sad that Lucent's lawyers have not caught up with the
changes in cryptographic export regulations. I know that those changes
certainly made my life as a cryptographic components engineer a whole
lot easier, because I no longer have to support 56-bit DES encryption
for export in addition to "real" encryption.

Note that, under these terms (i.e., not government user, not T-10, no
export to T-10), it is legal for me to export this software to Germany
with nothing but the above click-wrap license. Both Netscape and
Microsoft are now exporting their browser software with full 128-bit
encryption with the above click-wrap license. That German user may place
the cryptographic components online (under German law) with nothing but
a README file explaining the T10 licensing restrictions.

>         I won't comment on the whole license restrictions thingy, except to note
>         that dozens of other major corporations have no problem with providing
>         their software via a Mozilla-type license like the Plan 9 license
>         without having to go through some sort of license front end.
>
> Requiring a clicked check box next to a link to our license before you
> let users at the source does not strike me as an onerous burden.

It does not happen with Open Source software. I know that you download a
lot of shareware and free (as in beer, not as in freedom) software for
Windows that has such requirements. But it is not the norm in the Open
Source community. The deal is that you are attempting to gain the
support of the Open Source community for the future maintenance and
upgrading of Plan 9, rather than a future of having Plan 9 be this
interesting but largly unused and unmaintained thing internal to Bell
Labs. The Open Source community is accustomed to connecting to an FTP
server with a user ID of 'anonymous' and a password of 'something' and
being able to access the software, or be able to connect to a CVS
depository with a user ID of 'anonymous' and be able to do a 'cvs
update' to access the latest version of the source code. You cannot gain
their support with a 'click-wrap' license.

The Open Source/Free Software community is just that -- a community,
with its own internal mores and standards of behavior. It is completely
different from the academic research environment that spawned Unix and
Plan 9. For a commercial vendor to peacefully co-exist here takes
research and careful positioning to hit "hot buttons". Both as CTO of
Linux Hardware Solutions (RIP) and as senior Unix engineer at Enhanced
Software Technologies I've had to carefully examine the Open Source
marketplace and engineer strategic moves to gain publicity and support
in that marketplace for our products. Various strategic moves have
include: releasing some utilities as Open Source software, "adopting"
various tape drive related Open Source utilities for further enhancement
and maintenance by our engineers, contributing to Linux tape driver
development, announcements to FreshMeat about new versions of our
contributed software, etc.

I have installed Plan 9 on a partition of my computer in order to see
whether there is the possibility of it attaining a critical mass of
programmers and users to make it a viable packaged product similar to
the way that the various Linux distributions are viable products. After
all, every potential entrepeneur is looking for the next great thing to
get in on the groundfloor. Examining how products such as Linux and
Apache grew to be the poster children of the Open Source movement
despite being inferior to many of their competitors makes it clear that,
under Lucent control, Plan 9 can never attain such a status.

Widespread access to the software via mirrors world-wide, swift release
schedules of interim work products and "point" revisions, the ability of
any goober on the planet to submit patches and modifications and, if
they're good, have them appear in a released product within months at
most... all of these were critical to Linux and Apache gaining that
critical mass. Even minor impediments could have short-circuited the
process, because the Open Source community flows to the
easiest-to-deal-with entities, rather than to the technically superior
ones. For example, for many years the BSD operating systems were
technically superior to Linux. Yet Linux won the Open Source Unix war.
Why? Because the maintainers of the various BSD operating systems were
viewed as elitists who were not as interested in accepting modifications
from "outsiders". This was a very minor impediment indeed, but was
enough to drive many potential contributors to Linux.

It becomes apparent, then, that the first step in Plan 9 for World
Domination is for somebody to set up a source code repository, a
procedure for submitting additions or modifications to the repository,
and binary "interim releases" on an early-and-often basis in addition to
the normal "point" releases (the click-wrap could remain for the
binaries, of course). I cannot believe that Bell Labs can long justify
to Lucent the manpower or resources necessary to do this, given that
under the rosiest of projections I don't see Plan 9 being a commercially
viable product for several years and it would need this kind of
treatment for all of those years in order to obtain a critical mass of
contributors and users. It is important to remember that it took 4 years
for Linux to move from being Linus's play toy to being a product with
capabilities and qualities suitable for commercial use, and another 4
years after that for Linux to obtain a significant share of the server
market. It is projected that it will be another 2 years before Linux
companies start turning significant profits. I doubt that Lucent, or any
major company, can wait 10 years for a return on investment. Only
enthusiasts and Open Source fans can afford that kind of time
investment. But because these people are donating their time and efforts
for free, they have no incentive to jump through even modest hurdles.

I could be wrong. But I doubt that I'm far wrong, if so. I've spent too
much time examining the Open Source marketplace, the economics of Open
Source, the sociology of Open Source, etc. to be too wrong. I still
remember reading Richard Stallman's "GNU Manifesto" in Dr. Dobb's
Journal (fresh off the news stand) and saying to myself "it'll never
happen." And it didn't. But it did, because RMS never could have
imagined the modern Open Source movement and its various methodologies.
RMS came from an academic environment similar to Bell Labs, where
individual programs were crafted by individuals. The chaotic, often
seemingly-unproductive way that current Open Source efforts work, where
individual programs may be started by individuals but may have a dozen
people submit patches to fix any particular problem or feature request,
may seem wasteful of resources but has proven to be the best way to
ensure that the highest-quality patch makes it into the product. Call it
software darwinism. The only way to have this is the feedback loop that
I mentioned earlier, "release early and often", easy access to the
source code depository, etc., all of which are what I doubt Lucent and
Bell Labs are going to long dedicate resources to doing. Because,
unfortunately, while this software darwinism works, it is a slow process
-- remember the 10 year span between Linux being started, and Linux
being profitable? Thus it is critical that Plan 9 be offloaded to people
willing to put this kind of effort into it (i.e., enthusiasts and Open
Source fans) as soon as possible if it is to start this process.

--
Eric Lee Green      There is No Conspiracy
eric@badtux.org     http://www.badtux.org

Re: [9fans] Redistribution

[Randolph Fritz]

On Sat, Jun 17, 2000 at 11:21:37AM -0700, Eric Lee Green wrote:
>
> Note that, under these terms (i.e., not government user, not T-10, no
> export to T-10), it is legal for me to export this software to Germany
> with nothing but the above click-wrap license. Both Netscape and
> Microsoft are now exporting their browser software with full 128-bit
> encryption with the above click-wrap license. That German user may place
> the cryptographic components online (under German law) with nothing but
> a README file explaining the T10 licensing restrictions.
>

Do keep in mind that Lucent must comply with US law, regardless of
where they are doing business.  While Lucent's licensees are not bound
by US law, Lucent does a lot of export business--Lucent needs to keep
on the good side of the US export regulators.  I think Lucent's
lawyers are just being cautious.
--
Randolph Fritz
Eugene, Oregon, USA

[9fans] spammers using 9fans?

[Digby Tarvin]

Anyone else get some spam with subject "Welcome New Member!"
recently? I got two copies (relayed through different hosts),
one with the mail headers below which seems to reveal the
source of the name harvesting as this list ...

I am guessing it is a result of mailing list being gatewayed to
the news group, but if anyone who hasn't posted messages has
received it, it would indicate the mailing list itself was
compromised.

 From postmaster Sat Jun 17 23:48:47 2000
Received: (from root@localhost)
	by cthulhu.dircon.co.uk (8.8.5/8.8.5) id XAA17031
	for digbyt (9fans@cse.psu.edu); Sat, 17 Jun 2000 23:48:46 +0100 (GMT/BST)
---------------^^^^^^^^^^^^^^^^^^
X-Envelope-To: <cthulhu@dircon.co.uk>
Received: from midway.uchicago.edu (midway.uchicago.edu [128.135.12.12])
	by popmail.dircon.co.uk  with ESMTP id XAA00224
	for <cthulhu@dircon.co.uk>; Sat, 17 Jun 2000 23:11:07 +0100 (BST)
Received: from harper.uchicago.edu (amukhopa@harper.uchicago.edu [128.135.12.7])
	by midway.uchicago.edu (8.9.3/8.9.3) with ESMTP id RAA13158;
	Sat, 17 Jun 2000 17:10:42 -0500 (CDT)
Received: (from amukhopa@localhost)
	by harper.uchicago.edu (8.9.3/8.9.3) id RAA28506;
	Sat, 17 Jun 2000 17:08:43 -0500 (CDT)
Date: Sat, 17 Jun 2000 17:08:43 -0500 (CDT)
Message-Id: <200006172208.RAA28506@harper.uchicago.edu>
X-Authentication-Warning: harper.uchicago.edu: amukhopa set sender to user using -f
From: ptsconnection@netscape.net
Subject: Welcome New Member!
.....

--
Digby R. S. Tarvin                                              digbyt@acm.org
http://www.cthulhu.dircon.co.uk