6 ms·

I'm obviously misunderstanding something about this. Since grsecurity is GPL'd (being modifications to the GPL'd kernel), anyone that is "a customer of any pro

I'm obviously misunderstanding something about this. Since grsecurity is GPL'd (being modifications to the GPL'd kernel), anyone that is "a customer of any product that uses grsecurity in binary form, [is] entitled to the complete corresponding source code." Which means their stable patches will get requested and released by someone anyway. Help me understand how this will have any effect on the actual availability of their stable series?

ars 11y ago
The sponsors use it (Kernel+Grsecurity), they don't distribute it. Since they don't distribute it, they also don't distribute the patches.
- ploxiln 11y ago
  That assumes that the sponsors don't distribute operating systems or devices containing them, only services in the cloud (or user-space software). And even still, they could re-distribute the grsecurity code if they wanted to. But they probably won't bother. So yes this private-patches policy will have a big impact on availability, at least on convenience.
- coderjames 11y ago
  Ah, that makes sense. I didn't look into what businesses the sponsors were in.
awalton 11y ago
It basically just adds a level of indirection. Rather than going straight to the grsecurity folks, you now have to go to whichever downstream is disseminating the kernel based on that patch. Bummer. Really, it's just weakening the brand they've created for themselves. It always sounds really great in theory, but it's almost never worth it. It's the GPL, they've literally signed up for this type of code (ab)use. I'm not sure why people have trouble understanding this concept. (Though if they wanted to be really snarky, they'd relicense their code GPLv3 and watch these companies go into complete hysterics.)
- 0x0 11y ago
  But wouldn't they need to follow the Linux license, which is GPL2only?
  - awalton 11y ago
    That'd be the joy of their paralegal auditing team's life for the next year to figure out: does all of the code that they're building into their version of the kernel include the "either version 2 of the License, or (at your option) any later version" clause, such that the resulting binary can be a legal GPLv3 binary? I haven't a clue. The GRsec people wouldn't care, their patch can be whatever GPLv2-compatible license it wants to be.
  - RaleyField 11y ago
    Code will be available to sponsors and sponsors would be entitled to release it to the public, but presumably they will threaten to cut you from future updates if they did that, otherwise these is no point in raising the paywall. Unless you are willing to burn dozens of shell companies for each update there is no way of stopping them.
    - teraflop 11y ago
      Is that actually allowed by the GPL? The text says: > Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. (emphasis mine) Is it legal to penalize someone for exercising their redistribution rights, or would that count as a de facto restriction?
      - RaleyField 11y ago
        > you may not impose any further restrictions on the recipients' exercise of the rights granted herein. Further restrictions probably aren't introduced if they packaged this the right way i.e. not bind the GPL license with whatever agreement they will come up with. Sponsors will still have the same rights they are now used to, but GPL never speaks obligations on the distributor having to provide updated versions.

ars 11y ago

The sponsors use it (Kernel+Grsecurity), they don't distribute it. Since they don't distribute it, they also don't distribute the patches.

ploxiln 11y ago
That assumes that the sponsors don't distribute operating systems or devices containing them, only services in the cloud (or user-space software). And even still, they could re-distribute the grsecurity code if they wanted to. But they probably won't bother. So yes this private-patches policy will have a big impact on availability, at least on convenience.
coderjames 11y ago
Ah, that makes sense. I didn't look into what businesses the sponsors were in.

awalton 11y ago

It basically just adds a level of indirection. Rather than going straight to the grsecurity folks, you now have to go to whichever downstream is disseminating the kernel based on that patch. Bummer. Really, it's just weakening the brand they've created for themselves. It always sounds really great in theory, but it's almost never worth it. It's the GPL, they've literally signed up for this type of code (ab)use. I'm not sure why people have trouble understanding this concept. (Though if they wanted to be really snarky, they'd relicense their code GPLv3 and watch these companies go into complete hysterics.)

0x0 11y ago
But wouldn't they need to follow the Linux license, which is GPL2only?
- awalton 11y ago
  That'd be the joy of their paralegal auditing team's life for the next year to figure out: does all of the code that they're building into their version of the kernel include the "either version 2 of the License, or (at your option) any later version" clause, such that the resulting binary can be a legal GPLv3 binary? I haven't a clue. The GRsec people wouldn't care, their patch can be whatever GPLv2-compatible license it wants to be.
- RaleyField 11y ago
  Code will be available to sponsors and sponsors would be entitled to release it to the public, but presumably they will threaten to cut you from future updates if they did that, otherwise these is no point in raising the paywall. Unless you are willing to burn dozens of shell companies for each update there is no way of stopping them.
  - teraflop 11y ago
    Is that actually allowed by the GPL? The text says: > Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. (emphasis mine) Is it legal to penalize someone for exercising their redistribution rights, or would that count as a de facto restriction?
    - RaleyField 11y ago
      > you may not impose any further restrictions on the recipients' exercise of the rights granted herein. Further restrictions probably aren't introduced if they packaged this the right way i.e. not bind the GPL license with whatever agreement they will come up with. Sponsors will still have the same rights they are now used to, but GPL never speaks obligations on the distributor having to provide updated versions.