[TUHS] Fwd: Helping in the battle against SCO

[TUHS] Fwd: Helping in the battle against SCO

[Norman Wilson]

Andru Luvisi:

  If SCO holds up a piece of common code and the good guys have no
  response, that is bad.

  If SCO holds up a piece of common code and the good guys already know
  that it actually came from BSD, and are prepared to demonstrate such,
  that is good.

  If SCO holds up a piece of common code and the good guys already know
  that it was contributed to Linux by SCO/Caldera themselves, and are
  prepared to demonstrate such, that is good.

  If there is infringing code, it should be taken out of Linux as quickly
  as possible.

======

I'll grant all those points, but if the idea is to defang SCO, the
effort still seems fruitless to me.

System V and Linux both contain appallingly large volumes of code.
(On a list that discusses the UNIX of the 1970s, perhaps I can say
that without creating undue ruckus.)  The odds are that quite a
lot of the code is similar.  Should we really spend months and months
tracking it all down and trying to declare where each line came from,
or should we wait until SCO declares a specific set of cases that matter
(as they must do sooner or later or abandon the court battle)?

When one is faced with an enormous set of possible computations, of
which only a handful are likely to be needed in the end, lazy evaluation
is usually the better choice.

It does seem sensible to me for the Linux community to do its best to
hunt down any infringing code, and to try to assess whether there's a
serious problem lurking that nobody had noticed.  But that ought to be
a matter of basic ethics, having nothing to do with SCO.  I doubt it
is likely to make much difference to the court battle anyway: SCO's
claim is that the infringing code is there now, that it was put there
deliberately at IBM's instigation to do harm to them, and that the harm
already exists; removing it now won't change any of that.  I think it's
a good idea to remove any infringements that are there now, even if they
are trivial ones; but let's not fool ourselves that it will pull SCO's
fangs to do so.

Norman Wilson
Toronto ON

[TUHS] Lexical comparator, was Re: the battle against SCO

[Warren Toomey]

On Mon, Sep 15, 2003 at 04:39:31PM -0400, Norman Wilson wrote:
> It does seem sensible to me for the Linux community to do its best to
> hunt down any infringing code... But that ought to be a matter of basic 
> ethics, having nothing to do with SCO.  I doubt it is likely to make 
> much difference to the court battle anyway... I think it's
> a good idea to remove any infringements that are there now, even if they
> are trivial ones; but let's not fool ourselves that it will pull SCO's
> fangs to do so.
 
For me it's not just a matter of defeating SCO, it's also one of sheer
indignation in the face of Saganesque FUD ("billions and billions of
lines of code"). I seriously want to know if there's even the tiniest
possibility that SCO is right, or if they're are just Smoking Crack Often.
 
While we're on the topic, I saw esr's code shredder/comparator that works
on lines of code. This isn't going to work if variables get renamed etc.
I'm writing a code comparator that works on a lexical basis, comparing
C tokens. It's only going to be proof of concept (i.e. slow), but I
should have it done by week's end and I'll pop a notice in here when it's
ready.
 
Cheers,
        Warren

[TUHS] Lexical comparator, was Re: the battle against SCO

[Rhys Weatherley]

On Tuesday 16 September 2003 08:48 am, Warren Toomey wrote:

> While we're on the topic, I saw esr's code shredder/comparator that works
> on lines of code. This isn't going to work if variables get renamed etc.

I'd like to point out that the more steps that are taken to factor out 
identifier names, whitespace conventions, etc, the closer you approach a 
situation where the tool says "both programs are written in the same 
programming language" or "both programs use binary searching somewhere in 
their code".  Which, while true, isn't terribly useful to know.  A human 
being still needs to wade through the results and inspect them manually.

Cheers,

Rhys Weatherley.

[TUHS] Fwd: Helping in the battle against SCO

[M. Warner Losh]

In message: <20030915204355.EB9311E5D at minnie.tuhs.org>
            norman at nose.cs.utoronto.ca (Norman Wilson) writes:
: tracking it all down and trying to declare where each line came from,

In BSD land, we can do that.  We have cvs annotate.  Looks like the
stubborn refusal to use source code control, and to have only a few
people putting things together makes it a lot harder to track things
down after the fact.  Good call that.

Warner

[TUHS] Lexical comparator

[Warren Toomey]

On Tue, Sep 16, 2003 at 08:48:53AM +1000, Warren Toomey wrote:
> While we're on the topic, I saw esr's code shredder/comparator that works
> on lines of code. This isn't going to work if variables get renamed etc.
> I'm writing a code comparator that works on a lexical basis, comparing
> C tokens. It's only going to be proof of concept (i.e. slow), but I
> should have it done by week's end and I'll pop a notice in here when it's
> ready.

Well, it's done. The software is now available at
http://minnie.tuhs.org/Programs/Ctcompare. I have also made available
some tokenised source trees so you can do some comparisons straight away.

If anybody has Unix kernel trees which they cannot divulge due to licensing
restrictions, I'd appreciate you creating tokenised files of the kernel
source and e-mailing them to me.

Thanks!
	Warren

[TUHS] Lexical comparator, was Re: the battle against SCO

[M. Warner Losh]

In message: <Pine.LNX.4.56.0309152131290.24213 at zen.canint.timetraveller.org>
            Robert Brockway <robert at timetraveller.org> writes:
: a) Code which is licenced in a manner incompatible with the GPL
: b) Code that the copyright holder did not authorise going into the kernel.

There's a lot of code that originated in the BSD world that had its
copyrights shorn off, a GPL splatted on and the mass hacking began.
Many of these are no longer recognizable from there original form, and
aren't a problem.  Some have much more in common with the original.
Linux is vulnerable to the original author having a shit fit if they
ever find out.  Most of the open source authors are amused when this
happens, so the odds are low a big deal would be made of it.  This
practice was wide-spread in the early 1990s, although things have
improved a lot.

However, without something like CVS and the legal assignment of
copyright (or formal acknowledgement of licensing under the GPL, which
is harder to defend), this will always be a problem with Linux.

The BSD projects are a little tigher about this, but still would be
vulnerable.

Warner

[TUHS] Lexical comparator, was Re: the battle against SCO

[Norman Wilson]

Robert Brockway:

  Hi.  Don't want to nitpick here but many of us think it is important to
  get this point straight whenever we are talking about GPLed code.  The
  kernel is licenced (as I'm sure you know).  What we are of course
  concerned about is:

  a) Code which is licenced in a manner incompatible with the GPL

  b) Code that the copyright holder did not authorise going into the kernel.

  I'm sure you were just speaking in shorthand but it is subtle point that
  many misinterpret.  Many people outside the OSS community think that "all
  that free code" is in the public domain, which it is most definately not.

====

Quite right.  I wasn't speaking in shorthand, I was speaking in
clumsy; what I should have written is `possible that code restricted
by the System V license got into the system.'

Licenses come in all flavours, and whether there is any license
at all is not the issue here.  I certainly didn't mean, for
example, to imply that all licenses are evil, reptilian kitten-
eaters from another planet.

Norman Wilson
Toronto ON

[TUHS] Lexical comparator, was Re: the battle against SCO

[Robert Brockway]

On Mon, 15 Sep 2003, Norman Wilson wrote:

> possible that licensed code got into the system.  Even legally it

Hi.  Don't want to nitpick here but many of us think it is important to
get this point straight whenever we are talking about GPLed code.  The
kernel is licenced (as I'm sure you know).  What we are of course
concerned about is:

a) Code which is licenced in a manner incompatible with the GPL

b) Code that the copyright holder did not authorise going into the kernel.

I'm sure you were just speaking in shorthand but it is subtle point that
many misinterpret.  Many people outside the OSS community think that "all
that free code" is in the public domain, which it is most definately not.

> Norman Wilson
> Toronto ON

A fellow Torontonian, perhaps we may meet at TLUG sometime.  I'm giving
the next talk.

Cheers,
	Rob

-- 
Robert Brockway B.Sc. email: robert at timetraveller.org, zzbrock at uqconnect.net
Linux counter project ID #16440 (http://counter.li.org)
"The earth is but one country and mankind its citizens" -Baha'u'llah

[TUHS] Lexical comparator, was Re: the battle against SCO

[Norman Wilson]

Warren Toomey:

  For me it's not just a matter of defeating SCO, it's also one of sheer
  indignation in the face of Saganesque FUD ("billions and billions of
  lines of code"). I seriously want to know if there's even the tiniest
  possibility that SCO is right, or if they're are just Smoking Crack Often.

That's fair enough.  Just remember that no matter how much you scan
the code, you can't beat the FUD campaign by doing so.  SCO can just
claim their tools are better than yours, and continue to stonewall
about showing their evidence.  

And as I said last week, both legally and morally the onus is on
SCO to provide proof of their claims: the infringement, that it
was done maliciously, that it has caused them harm.  The `evidence'
they have shown so far makes me doubt very much that they can
prove all three of those things, or possibly any but the least-
significant case of the first.

As I also said last week, I don't mean to discourage anyone from
doing code comparisons.  Intellectually it's an interesting exercise.
Ethically it's the right thing to do if the Linux community thinks it's
possible that licensed code got into the system.  Even legally it
might make some difference to have shown due diligence, though not
in the matter presently before the courts.  If it makes someone feel
less frustrated, that's fine too.

But scanning the Linux code won't provide hard proof of anything,
any more than you can claim to prove there are no leaks in your roof
solely by inspection.  If proof is possible, it will work the other way.

Norman Wilson
Toronto ON