Licensing.

[Rob Landley <rob@landley.net>]

On 04/26/2013 01:11:07 AM, Igmar Palsenberg wrote:
> 
> >>> incompatible licenses.  The openssl library can't be used with a  
> GNU
> >>> program unless there's a waiver for it because one of the clauses  
> in the
> >>> openssl license goes against the GNU license principles.  The  
> gnutls
> >> Not _used_ but _distributed_. The GPL does not restrict use
...
> > What about explicitly loading the library at run-time using  
> uselib(2) in a plug-in like fashion?  Is that also considered  
> problematic from a GNU perspective?
> 
> I consider this a grey area. I personally don't thing it is  
> considered a problem,
> but there are a number of interesting (theoretical) scenario's :

Um, back up:

You know how cryptographers point and laugh at non-cryptographers  
trying to figure out whether something's breakable?

You know how professional security auditors find most programmers' code  
appallingly insecure, and the best of us have to put out regular  
updates to fix exploits that we didn't personally find?

Now imagine what lawyers think of programmers' legal theories.

To write secure code you need a deep understanding of your operating  
system. To license code securely, you have to understand your legal  
jurisdiction. It's fundamentally not enough to know what the  
code/license says in isolation.

Programming-side example: the /tmp dir has the sticky bit set other  
users running inotify to spot new files being created don't immediately  
delete them and replace with a symlink so your mknod/open pair is now  
accessing the wrong file. What your code is doing worked fine, but the  
context it was running in made it insecure. Now imagine telling a  
lawyer that your license usage is unexploitable in all jurisdictions,  
and you know this because you read the license text and you're sure  
you're using it ok. (The best a lawyer or security professional can  
EVER say is "I can't spot where you screwed up".)

Imagine that GPLv2 code has to run as root, so as soon as part of your  
project is running as root you might as well treat the whole thing like  
it is from a security standpoint. Your question above about mixing GPL  
and non-GPL code is like asking "when is it safe to set the sudo bit on  
this binary while leaving the rest non-root". Suddenly you need to know  
a LOT more about your system's configuration and permissions and use  
cases, and the problematic parts are written in a language (legalese)  
that you don't code in, and the correct answer varies by distro.

If GPLv2 is where everything is root, then you just don't mix untrusted  
code in with that, period. GPLv3 has to run as Windows Administrator,  
an incompatible type of root you can't mix with what GPLv2 needs  
(unless you write dual-mode code full of #ifdefs from day one). Other  
licenses are like other userids each with its own security connotations  
when you have to run code _as_ them and not you; again, it's the mixing  
in the same program that's most problematic.

BSD/MIT/PD code requests no special permissions; legally speaking it  
runs as your login user. It can run as anything else you need it to,  
but doesn't _require_ it. It is not itself opening that can of worms.

It's not a perfect analogy, but it should get the "here there be  
dragons" aspect across. Viral and non-viral licensing can each be made  
to work. Mixing them while keeping them distinct is a MINEFIELD, and  
coming to a local consensus with non-experts doesn't help.

Rob

P.S. Trolls are the legal equivalent of script kiddies, trying to  
figure out where to hit a company to make money come out. Patent  
trolls, copyright trolls, trademark trolls, contract trolls... we've  
even seen trade secret trolling against decss and such. Somebody who  
comes along with an obscure legal interpretation and sends you a "pay  
us now or we'll cost your $50,000 and several months of your life  
defending yourself in court EVEN IF YOU WIN, so give us $20k to go  
away" letter. The fact people have started doing this on behalf of the  
GPL is one of the things that turned me against that license.

P.P.S. I could explain how the real legal issue you were trying to  
tackle above is whether or not something can be considered a "derived  
work" under copyright law of the virally licensed external material,  
but this would be like me explaining cryptography or security to you.  
It's not the same as an audit for any specific usage for  
exploitability, AND I'm not the domain expert you'd need to do that  
audit anyway. I know enough to know I _don't_ know enough to reliably  
answer this question.