Re: [9fans] Redistribution

Re: [9fans] Redistribution

[rob pike]

	But note that these export restrictions only apply to compiled binaries.
	If you want to, e.g., provide a CVS archive of the Plan 9 source code,
	all you have to do to comply with the export regulations is notify the
	appropriate folks (I suggest going through the crypto registration tee
	at crypto.com so that other people know that you have cryptographic
	source code for download).

If you know how to honor the government requirements on crypto
stuff, then feel free to provide the crypto sources to your users.
I don't claim to understand the rules; I just know how we met them.

You still have to honor our license, and that includes making
people agree to it.

	I won't comment on the whole license restrictions thingy, except to note
	that dozens of other major corporations have no problem with providing
	their software via a Mozilla-type license like the Plan 9 license
	without having to go through some sort of license front end.

Requiring a clicked check box next to a link to our license before you
let users at the source does not strike me as an onerous burden.
It's what happens with just about every piece of software I download
nowadays.

-rob

Re: [9fans] Redistribution

[Lutz Donnerhacke]

* rob pike wrote:
>If you know how to honor the government requirements on crypto
>stuff, then feel free to provide the crypto sources to your users.
>I don't claim to understand the rules; I just know how we met them.

Deregulation in Europe caused a similar deregulation of export controls in
the USA. So please publish the sources. If you run into trouble (very
unlikly) tell them, I gave you the permission.

Re: [9fans] Redistribution

[Eric Lee Green]

rob pike wrote:
>         But note that these export restrictions only apply to compiled binaries.
>         If you want to, e.g., provide a CVS archive of the Plan 9 source code,
>         all you have to do to comply with the export regulations is notify the
>         appropriate folks
>
> If you know how to honor the government requirements on crypto
> stuff, then feel free to provide the crypto sources to your users.

Yes, I did have to research the issue because I do have some crypto
applications that are released as open source. In addition, I am the
author of the cryptographic components of an upcoming commercial
product, and had to research the issue because I had to know what was
allowed and not allowed for me to write. On January 15, 2000,
cryptographic source code was almost entirely deregulated with no "click
wrap" license required, and export restrictions of cryptographic
mass-market commercial software were greatly relaxed. Today you can
export cryptographic "mass market" binaries via the Internet and via
CD-ROM or other media to all but 10 nations, as long as they go through
a "click-wrap" license that requires them to agree that a) they're not a
government user, b) they are not located in the T-10 terrorist states,
and c) they're not going to redistribute it to the T-10 terrorist
states. It is sad that Lucent's lawyers have not caught up with the
changes in cryptographic export regulations. I know that those changes
certainly made my life as a cryptographic components engineer a whole
lot easier, because I no longer have to support 56-bit DES encryption
for export in addition to "real" encryption.

Note that, under these terms (i.e., not government user, not T-10, no
export to T-10), it is legal for me to export this software to Germany
with nothing but the above click-wrap license. Both Netscape and
Microsoft are now exporting their browser software with full 128-bit
encryption with the above click-wrap license. That German user may place
the cryptographic components online (under German law) with nothing but
a README file explaining the T10 licensing restrictions.

>         I won't comment on the whole license restrictions thingy, except to note
>         that dozens of other major corporations have no problem with providing
>         their software via a Mozilla-type license like the Plan 9 license
>         without having to go through some sort of license front end.
>
> Requiring a clicked check box next to a link to our license before you
> let users at the source does not strike me as an onerous burden.

It does not happen with Open Source software. I know that you download a
lot of shareware and free (as in beer, not as in freedom) software for
Windows that has such requirements. But it is not the norm in the Open
Source community. The deal is that you are attempting to gain the
support of the Open Source community for the future maintenance and
upgrading of Plan 9, rather than a future of having Plan 9 be this
interesting but largly unused and unmaintained thing internal to Bell
Labs. The Open Source community is accustomed to connecting to an FTP
server with a user ID of 'anonymous' and a password of 'something' and
being able to access the software, or be able to connect to a CVS
depository with a user ID of 'anonymous' and be able to do a 'cvs
update' to access the latest version of the source code. You cannot gain
their support with a 'click-wrap' license.

The Open Source/Free Software community is just that -- a community,
with its own internal mores and standards of behavior. It is completely
different from the academic research environment that spawned Unix and
Plan 9. For a commercial vendor to peacefully co-exist here takes
research and careful positioning to hit "hot buttons". Both as CTO of
Linux Hardware Solutions (RIP) and as senior Unix engineer at Enhanced
Software Technologies I've had to carefully examine the Open Source
marketplace and engineer strategic moves to gain publicity and support
in that marketplace for our products. Various strategic moves have
include: releasing some utilities as Open Source software, "adopting"
various tape drive related Open Source utilities for further enhancement
and maintenance by our engineers, contributing to Linux tape driver
development, announcements to FreshMeat about new versions of our
contributed software, etc.

I have installed Plan 9 on a partition of my computer in order to see
whether there is the possibility of it attaining a critical mass of
programmers and users to make it a viable packaged product similar to
the way that the various Linux distributions are viable products. After
all, every potential entrepeneur is looking for the next great thing to
get in on the groundfloor. Examining how products such as Linux and
Apache grew to be the poster children of the Open Source movement
despite being inferior to many of their competitors makes it clear that,
under Lucent control, Plan 9 can never attain such a status.

Widespread access to the software via mirrors world-wide, swift release
schedules of interim work products and "point" revisions, the ability of
any goober on the planet to submit patches and modifications and, if
they're good, have them appear in a released product within months at
most... all of these were critical to Linux and Apache gaining that
critical mass. Even minor impediments could have short-circuited the
process, because the Open Source community flows to the
easiest-to-deal-with entities, rather than to the technically superior
ones. For example, for many years the BSD operating systems were
technically superior to Linux. Yet Linux won the Open Source Unix war.
Why? Because the maintainers of the various BSD operating systems were
viewed as elitists who were not as interested in accepting modifications
from "outsiders". This was a very minor impediment indeed, but was
enough to drive many potential contributors to Linux.

It becomes apparent, then, that the first step in Plan 9 for World
Domination is for somebody to set up a source code repository, a
procedure for submitting additions or modifications to the repository,
and binary "interim releases" on an early-and-often basis in addition to
the normal "point" releases (the click-wrap could remain for the
binaries, of course). I cannot believe that Bell Labs can long justify
to Lucent the manpower or resources necessary to do this, given that
under the rosiest of projections I don't see Plan 9 being a commercially
viable product for several years and it would need this kind of
treatment for all of those years in order to obtain a critical mass of
contributors and users. It is important to remember that it took 4 years
for Linux to move from being Linus's play toy to being a product with
capabilities and qualities suitable for commercial use, and another 4
years after that for Linux to obtain a significant share of the server
market. It is projected that it will be another 2 years before Linux
companies start turning significant profits. I doubt that Lucent, or any
major company, can wait 10 years for a return on investment. Only
enthusiasts and Open Source fans can afford that kind of time
investment. But because these people are donating their time and efforts
for free, they have no incentive to jump through even modest hurdles.

I could be wrong. But I doubt that I'm far wrong, if so. I've spent too
much time examining the Open Source marketplace, the economics of Open
Source, the sociology of Open Source, etc. to be too wrong. I still
remember reading Richard Stallman's "GNU Manifesto" in Dr. Dobb's
Journal (fresh off the news stand) and saying to myself "it'll never
happen." And it didn't. But it did, because RMS never could have
imagined the modern Open Source movement and its various methodologies.
RMS came from an academic environment similar to Bell Labs, where
individual programs were crafted by individuals. The chaotic, often
seemingly-unproductive way that current Open Source efforts work, where
individual programs may be started by individuals but may have a dozen
people submit patches to fix any particular problem or feature request,
may seem wasteful of resources but has proven to be the best way to
ensure that the highest-quality patch makes it into the product. Call it
software darwinism. The only way to have this is the feedback loop that
I mentioned earlier, "release early and often", easy access to the
source code depository, etc., all of which are what I doubt Lucent and
Bell Labs are going to long dedicate resources to doing. Because,
unfortunately, while this software darwinism works, it is a slow process
-- remember the 10 year span between Linux being started, and Linux
being profitable? Thus it is critical that Plan 9 be offloaded to people
willing to put this kind of effort into it (i.e., enthusiasts and Open
Source fans) as soon as possible if it is to start this process.

--
Eric Lee Green      There is No Conspiracy
eric@badtux.org     http://www.badtux.org

Re: [9fans] Redistribution

[Randolph Fritz]

On Sat, Jun 17, 2000 at 11:21:37AM -0700, Eric Lee Green wrote:
>
> Note that, under these terms (i.e., not government user, not T-10, no
> export to T-10), it is legal for me to export this software to Germany
> with nothing but the above click-wrap license. Both Netscape and
> Microsoft are now exporting their browser software with full 128-bit
> encryption with the above click-wrap license. That German user may place
> the cryptographic components online (under German law) with nothing but
> a README file explaining the T10 licensing restrictions.
>

Do keep in mind that Lucent must comply with US law, regardless of
where they are doing business.  While Lucent's licensees are not bound
by US law, Lucent does a lot of export business--Lucent needs to keep
on the good side of the US export regulators.  I think Lucent's
lawyers are just being cautious.
--
Randolph Fritz
Eugene, Oregon, USA

[9fans] spammers using 9fans?

[Digby Tarvin]

Anyone else get some spam with subject "Welcome New Member!"
recently? I got two copies (relayed through different hosts),
one with the mail headers below which seems to reveal the
source of the name harvesting as this list ...

I am guessing it is a result of mailing list being gatewayed to
the news group, but if anyone who hasn't posted messages has
received it, it would indicate the mailing list itself was
compromised.

 From postmaster Sat Jun 17 23:48:47 2000
Received: (from root@localhost)
	by cthulhu.dircon.co.uk (8.8.5/8.8.5) id XAA17031
	for digbyt (9fans@cse.psu.edu); Sat, 17 Jun 2000 23:48:46 +0100 (GMT/BST)
---------------^^^^^^^^^^^^^^^^^^
X-Envelope-To: <cthulhu@dircon.co.uk>
Received: from midway.uchicago.edu (midway.uchicago.edu [128.135.12.12])
	by popmail.dircon.co.uk  with ESMTP id XAA00224
	for <cthulhu@dircon.co.uk>; Sat, 17 Jun 2000 23:11:07 +0100 (BST)
Received: from harper.uchicago.edu (amukhopa@harper.uchicago.edu [128.135.12.7])
	by midway.uchicago.edu (8.9.3/8.9.3) with ESMTP id RAA13158;
	Sat, 17 Jun 2000 17:10:42 -0500 (CDT)
Received: (from amukhopa@localhost)
	by harper.uchicago.edu (8.9.3/8.9.3) id RAA28506;
	Sat, 17 Jun 2000 17:08:43 -0500 (CDT)
Date: Sat, 17 Jun 2000 17:08:43 -0500 (CDT)
Message-Id: <200006172208.RAA28506@harper.uchicago.edu>
X-Authentication-Warning: harper.uchicago.edu: amukhopa set sender to user using -f
From: ptsconnection@netscape.net
Subject: Welcome New Member!
.....

--
Digby R. S. Tarvin                                              digbyt@acm.org
http://www.cthulhu.dircon.co.uk

Re: [9fans] Redistribution

[dawno5]

IMHO, everyone seems to missing the point; Plan9 doesn't cost to install, 
and you can modify the code to suit yourself.  I play with a variety of operating 
systems, under almost as many different licences, and the small differences 
between them isn't a factor; the fact that I don't have to pay $98US per 
installation is.

-Owen
________________________________________________
|  In this age of digital Darwinism, some of us are ones;  |
|  you're a zero.                                              |
|_______________________________________________|

Re: [9fans] Redistribution

[Russell Nelson]

tg@utstat.toronto.edu (Tom Glinos) writes:

> >Oh, crap; that email was meant for just Tom Glinos, to get his advice
> >because not a lot on info has been posted on the mailing list or the
> >Plan 9 web sites on the process that went into the new license, and he
> >obviously just learned some info, and I was just so curious to pick his
> >brain.
>
> My advice is "don't worry, be happy" and "don't bite the hand that
> feeds you."
>
> (I'm now going to pick my words very carefully)
>
> The current agreement took months of work/anguish.
> I think it's a document that Lucent can live with given THEIR
> business issues.

Nobody who reads the license is going to use Plan 9 in anything other
than a research/hobby mode.  Why?  Because the cost of a Plan 9
license is to cross-license ALL of your intellectual property to
Lucent and anyone who contributes to Plan 9.

If somebody has a patent you want to use, and you see that they're
using Plan 9 in a mission-critical manner, you can just use the patent
without bothering to license it.  6.1(ii) ensures that they will not
sue you.

6.1(ii) will forever keep Plan 9 in the lab, never to be deployed.

--
-russ nelson <sig@russnelson.com>  http://russnelson.com
Crynwr sells support for free software  | PGPok |
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Is Unix compatible with
Potsdam, NY 13676-3213  | +1 315 268 9201 FAX   | Linux?

Re: [9fans] Redistribution

[Jonathan S. Shapiro]

> Binary code which is compiled from TSU source code and which
> is itself publicly available and not subject to licensing or
> royalty fee can also be exported under the provisions of
> license exception TSU.
>
> As a caveat, Cindy Cohn notes in her response (bernstein-bxa2.html on
> the same server) that this interpretation is "new to us and surprised
> numerous people familiar with the new export controls," i.e. it's not
> obvious from reading the new regs, and I'm pretty certain that you
> enjoy no special legal protections in court from having the BXA tell
> you that something is okay.

Actually, James Lewis (at commerce) and I discussed this point at length
when the regs were being reviewed. BXA has issued advisory opinions
(including one to me on EROS) confiming that this is commerce's
interpretation, and an advisory opinion from the folks who do the rulings on
export control is a pretty good defense.


shap

Re: [9fans] Redistribution

[Tom Glinos]

>Oh, crap; that email was meant for just Tom Glinos, to get his advice
>because not a lot on info has been posted on the mailing list or the
>Plan 9 web sites on the process that went into the new license, and he
>obviously just learned some info, and I was just so curious to pick his
>brain.

My advice is "don't worry, be happy" and "don't bite the hand that
feeds you."

(I'm now going to pick my words very carefully)

The current agreement took months of work/anguish.
I think it's a document that Lucent can live with given THEIR
business issues.

--
=================
The hardest thing to see		| Tom Glinos @ U of Toronto Statistics
is the way things REALLY are.		| tg@utstat.toronto.edu

Re: [9fans] Redistribution

[forsyth]

>>because not a lot on info has been posted on the mailing list or the
>>Plan 9 web sites on the process that went into the new license, ...

quite a few people are at usenix.

Re: [9fans] Redistribution

[Richard]

*I* just wrote:

>Tom Glinos writes:
>>
>>After what I've learned at USENIX as to how the license and the release
>>was done, I consider the community very luck.
>
>help me out here please.  <snip>

Oh, crap; that email was meant for just Tom Glinos, to get his advice
because not a lot on info has been posted on the mailing list or the
Plan 9 web sites on the process that went into the new license, and he
obviously just learned some info, and I was just so curious to pick his
brain.

Really: it's only because I made a mistake that it is here on the
mailing list at all.  Once I hit "send" I realized there's just no way
to stop that message from getting to everyone on the list.

Now might be a good time for me to mention that I think that Plan 9 is
an uncommonly beautiful/congenial/useful piece of software and that its
release under the new license is the most exciting software news I heard
in years.

Sheepishly yours,

Richard

Re: [9fans] Redistribution

[Richard]

Tom Glinos writes:
>
>After what I've learned at USENIX as to how the license and the release
>was done, I consider the community very luck.

help me out here please.

I'm not a lawyer but Ive spend 100s of hours over the last 7 years
learning about open-source licenses and how they motivate developers.
the 9 license has a really bad restriction that that none of the other
open-source licenses have that is clearly going to impede the growth of
the userbase/developerbase.

it is not a restriction that gives Lucent any advantages: its in
there because whoever wrote this license just does not understand
open-source licenses very well.  (sadly, it is not a very well
thought out license, but I believe it is unproductive to
bring that up except on this one restriction.)

regarding this one point, do I point it out now or do I wait?  do I
bring it up on the list or email Rob or what?  what do you think?

Re: [9fans] Redistribution

[Tom Glinos]

After what I've learned at USENIX as to how the license and the release
was done, I consider the community very luck.

Repay these kind folks by using the system and contributing in bug
reports or new applications.


--
=================
The hardest thing to see		| Tom Glinos @ U of Toronto Statistics
is the way things REALLY are.		| tg@utstat.toronto.edu

Re: [9fans] Redistribution

[Dave Burton]

On Thu, 22 Jun 2000, Damien Raphael Sullivan wrote:
| >I must admit I find the fissiparous nature of the Open Source/FSF
| >community a little dispiriting.  We're just trying to make stuff
| >available.  Please accept it in the spirit in which it's offered.
|
| One could argue that making stuff available under fissiparous licenses doesn't
| help.  People know what the GPL, LGPL, and BSD licenses mean, and that
| software under those licenses is free.  They may argue over whether the GPL is
| too restrictive or BSD too lax, but they know where the software stands, and
| can work or not as they choose.
|
| When people see yet another license fresh from the corporate lawyers, they
| worry over what's contained in the legalese.  Which people don't like reading
| and decoding.  And they assume there must be some non-free component to the
| license, else why not use one of the existing licenses?

Good grief!  Can this be moved off this list?

I cannot believe that so many people are bitching about the license.
Lucent *GAVE* the sources away.  All you have to do is follow some
pretty basic, common-sense rules to enjoy it.  Or go away and play
with your other licensed software and be happy elsewhere.

If anyone solves world hunger, someone will complain because the food
was not cooked just the way they like it.

-- Dave

Re: [9fans] Redistribution

[Damien Raphael Sullivan]

>I must admit I find the fissiparous nature of the Open Source/FSF
>community a little dispiriting.  We're just trying to make stuff
>available.  Please accept it in the spirit in which it's offered.

One could argue that making stuff available under fissiparous licenses doesn't
help.  People know what the GPL, LGPL, and BSD licenses mean, and that
software under those licenses is free.  They may argue over whether the GPL is
too restrictive or BSD too lax, but they know where the software stands, and
can work or not as they choose.

When people see yet another license fresh from the corporate lawyers, they
worry over what's contained in the legalese.  Which people don't like reading
and decoding.  And they assume there must be some non-free component to the
license, else why not use one of the existing licenses?

It's about branding, really.


Hmm.  I wonder if one could have a license which was the GPL or BSD with a
modification clause, such as "You may not use this code if you have sued
Lucent over IP issues, notwithstanding any other clause of this license."

-xx- Damien X-)

Re: [9fans] Redistribution

[Lukas Petrlik]

In article <200006171848.OAA23776@cse.psu.edu> you wrote:

> I'm confused by your posting.  Plan 9 is available to all and sundry
> to enjoy, change, and play with.  The Plan 9 Open Source license says
> so.

I am eager to play with the system, but it seems to be unavailable to me.
Perhaps I missed something?

I am not a US citizen.

--
Lukas Petrlik  <luki@kiv.zcu.cz>

Re: [9fans] Redistribution

[rob pike]

	Today you can
	export cryptographic "mass market" binaries via the Internet and via
	CD-ROM or other media to all but 10 nations, as long as they go through
	a "click-wrap" license ...
	It is sad that Lucent's lawyers have not caught up with the
	changes in cryptographic export regulations.

Not that I'm one to speak up for lawyers, but I believe the Lucent
lawyers are up to date and the evidence is that the structure on the
download site is exactly what you describe.

	"under Lucent control"

I'm confused by your posting.  Plan 9 is available to all and sundry
to enjoy, change, and play with.  The Plan 9 Open Source license says
so.

As for going to outside repositories to manage stuff, that's
ultimately what will happen.  But It's only been out for 10 days, and
we've been issuing updates to try to make sure that everyone's
starting point is the best we have to offer.  You're right, we don't
have the manpower to maintain this thing for the world.

Lucent already waited 10 years for return on investment in Plan 9.  It
got it in a number of ways, but in the form of 'operating system for
research', the best likelihood for more return is to let it go Open
Source, which is what we did.

I must admit I find the fissiparous nature of the Open Source/FSF
community a little dispiriting.  We're just trying to make stuff
available.  Please accept it in the spirit in which it's offered.

-rob

Re: [9fans] Redistribution

[Greg Hudson]

> rob pike wrote:
>>         2. The export restrictions on cryptography are nasty to implement.

> But note that these export restrictions only apply to compiled
> binaries.

In fact, if you read http://cryptome.org/bxa-bernstein.htm, you'll
find that the BXA doesn't even think it applies to compiled binaries:

	Binary code which is compiled from TSU source code and which
	is itself publicly available and not subject to licensing or
	royalty fee can also be exported under the provisions of
	license exception TSU.

As a caveat, Cindy Cohn notes in her response (bernstein-bxa2.html on
the same server) that this interpretation is "new to us and surprised
numerous people familiar with the new export controls," i.e. it's not
obvious from reading the new regs, and I'm pretty certain that you
enjoy no special legal protections in court from having the BXA tell
you that something is okay.

Anyway, as Rob Pike pointed out, this is between you and the law, and
isn't great fodder for the list.  I'm just sending this for the sake
of accuracy.

While I'm here, Rob wrote:
> Requiring a clicked check box next to a link to our license before
> you let users at the source does not strike me as an onerous burden.
> It's what happens with just about every piece of software I download
> nowadays.

Again we see culture clash between the proprietary software world and
the free software world.  Very little free software requires you to
agree to its license before you download it; the exceptions tend to be
"free" software released by big corporations which have lawyers who
are obviously used to writing proprietary EULAs.

Most users click on the "accept" button without reading the actual
license (I do it all the time, to be honest).  While this practice
makes the requirement non-onerous, it also puts users in the
suboptimal situation of having possibly agreed to legal terms they do
not understand.  Your average free software advocate despises
shrink-wrap and click-through licenses for this reason.

Moreover, Lucent's Plan 9 license places very few restrictions on
downloaders and users of the software (the primary one being that you
can't use it or keep copies of it if you have sued any contributor to
the version of Plan 9 you have, for any intellectual property reason).
All the other restrictions are on actions restricted by copyright,
such as reproducing the work, distributing it, and preparing
derivative works.  So there's very little point in forcing downloaders
to agree to the license; as with the GPL, they will have to agree to
the license before they can do anything interesting anyway.

Re: [9fans] Redistribution

[Eric Lee Green]

rob pike wrote:
>         2. The export restrictions on cryptography are nasty to implement.

But note that these export restrictions only apply to compiled binaries.
If you want to, e.g., provide a CVS archive of the Plan 9 source code,
all you have to do to comply with the export regulations is notify the
appropriate folks (I suggest going through the crypto registration tee
at crypto.com so that other people know that you have cryptographic
source code for download).

I won't comment on the whole license restrictions thingy, except to note
that dozens of other major corporations have no problem with providing
their software via a Mozilla-type license like the Plan 9 license
without having to go through some sort of license front end.

--
Eric Lee Green      There is No Conspiracy
eric@badtux.org     http://www.badtux.org

[9fans] Redistribution

[rob pike]

Several people have asked about how the license affects their ability
to make the sources available on their own sites, such as through
cross-referencing services or as archives on non-Plan 9 systems
that present the source for browsing.

I talked to our lawyers to make sure I understood the rules, and I did.

The rules are simple:

	1. Everyone who sees the material provided by the service must
	have agreed to the terms of the license. The simplest way to do
	this is, as we did in the distribution, is to require people to click a
	check box agreeing to the license. The license should be made
	available to users so they can read it before clicking.

	2. The export restrictions on cryptography are nasty to implement.
	We worked quite hard to do reverse DNS and all that stuff to
	determine the country of origin - and you need to do a lot more
	than that to meet the U.S. Commerce department requirements.
	The easiest way to deal with the issue is to avoid presenting the
	cryptographic code, and that's why I recommend.
	If all your users are known to you, that is, if you don't have outside
	visitors to your site, this is not an issue for American sites.

	Reiterating, if you make the crypto sources available to outsiders
	without these restrictions in place, you are violating Federal law.
	To avoid this, just don't make the crypto sources available, but
	require people to get them from us.

-rob