Yesterday, Tovalds offered his opinion as to where the battle over DRM should take place:
I would suggest that anybody who wants to fight DRM practices seriously look at the equivalent angle. If you create interesting content, you can forbid that _content_ to ever be encrypted or limited.In other words, I personally think that the anti-DRM clause is much more sensible in the context of the Creative Commons licenses, than in software licenses. If you create valuable and useful content that other people want to be able to use (catchy tunes, funny animation, good icons), I would suggest you protect that _content_ by saying that it cannot be used in any content-protection schemes.
Afaik, all the Creative Commons licenses already require that you can't use technological measures to restrict the rights you give with the CC licenses. The "Share Alike" license in particular requires all work based on it to also be shared alike, ie it has the "GPL feel" to it.
If enough interesting content is licensed that way, DRM eventually becomes marginalized. Yes, it takes decades, but that's really no different at all from how the GPL works. The GPL has taken decades, and it hasn't "marginalized" commercial proprietary software yet, but it's gotten to the point where fewer people at least _worry_ about it.
As long as you expect Disney to feed your brain and just sit there on your couch, Disney & co will always be able to control the content you see. DRM is the smallest part of it - the crap we see and hear every day (regardless of any protection) is a much bigger issue.
The GPL already requires source code (ie non-protected content). So the GPL already _does_ have an anti-DRM clause as far as the _software_ is concerned. If you want to fight DRM on non-software fronts, you need to create non-software content, and fight it _there_.
I realize that programmers are bad at content creation. So many programmers feel that they can't fight DRM that way. Tough. Spread the word instead. Don't try to fight DRM the wrong way.
In a later post, Tovalds replied to Pierre Ossman, who suggested the GPL can currently be thwarted by DRM measures:
> The point is not only getting access to the source code, but also being able
> to change it. Being able to freely study the code is only half of the beauty
> of the GPL. The other half, being able to change it, can be very effectively
> stopped using DRM.No it cannot.
Sure, DRM may mean that you can not _install_ or _run_ your changes on somebody else's hardware. But it in no way changes the fact that you got all the source code, and you can make changes (and use their changes) to it. That requirement has always been there, even with plain GPLv2. You have the source.
The difference? The hardware may only run signed kernels. The fact that the hardware is closed is a _hardware_ license issue. Not a software license issue. I'd suggest you take it up with your hardware vendor, and quite possibly just decide to not buy the hardware. Vote with your feet. Join the OpenCores groups. Make your own FPGA's.
And it's important to realize that signed kernels that you can't run in modified form under certain circumstances is not at all a bad idea in many cases.
For example, distributions signing the kernel modules (that are distributed under the GPL) that _they_ have compiled, and having their kernels either refuse to load them entirely (under a "secure policy") or marking the resulting kernel as "Tainted" (under a "less secure" policy) is a GOOD THING.
Notice how the current GPLv3 draft pretty clearly says that Red Hat would have to distribute their private keys so that anybody sign their own versions of the modules they recompile, in order to re-create their own versions of the signed binaries that Red Hat creates. That's INSANE.
Btw, what about signed RPM archives? How well do you think a secure auto-updater would work if it cannot trust digital signatures?
I think a lot of people may find that the GPLv3 "anti-DRM" measures aren't all that wonderful after all.
Because digital signatures and cryptography aren't just "bad DRM". They very much are "good security" too.
Babies and bathwater..
And finally, in yet another response to Ossman and others on the LKML, he wrote:
> So taking open software and closed hardware and combining it into something
> that I cannot modify is ok by you?But you CAN modify the software part of it. You can run it on other hardware.
It boils down to this: we wrote the software. That's the only part _I_ care about, and perhaps (at least to me) more importantly, because it's the only part we created, it's the only part that I feel we have a moral right to control.
I _literally_ feel that we do not - as software developers - have the moral right to enforce our rules on hardware manufacturers. We are not crusaders, trying to force people to bow to our superior God. We are trying to show others that co-operation and openness works better.
That's my standpoint, at least. Always has been. It's the reason I chose the GPL in the first place (and it's the exact same reason that I wrote the original Linux copyright license). I do _software_, and I license _software_.
And I realize that others don't always agree with me. That's fine. You don't have to. But I licensed my project under a license _I_ agreed with, which is the GPLv2. Others who feel differently can license under their own licenses. Including, very much, the GPLv3.
I'm not arguing against the GPLv3.
I'm arguing that the GPLv3 is wrong for _me_, and it's not the license I ever chose.
Note: Comments are owned by the poster. We are not responsible for their content.
In this new group of posts on the mailing list, he goes into great detail about WHY he feels that way, and where he thinks the DRM battle should be fought.
You may not agree with his views, many don't, but this is a critical time for the GPL, and what Torvalds thinks, does, and says about it is very much news.
What this draft of the GPLv3 does prevent is the Tivo scenario. Apparently, Tivo uses the Linux kernel and obeys the letter of GPLv2, but no user can run a modified kernel on their Tivo, because the hardware won't run an unsigned kernel.
But what happens when (1) you find a serious bug in your phone's code, report it to the vendor, and the vendor replies that they don't intend to fix the bug, for whatever reason? Or (2) same scenario, but what if your vendor tells you that your phone model 101K is "obsolete" and that you can upgrade to a new 101L for just $99? Or (3) what if you just want to add some really cool functionality to the phone that the phone company doesn't want? There are both ethically based (#3) and practically based (#1, #2) reasons for the freedom to modify GPLed apps and run them.<snip>But would this apply to other devices, like a mobile phone?</snip><snip>I personally would like to be able to view the source for the code running on my phone to make sure it doesn't have any flaws</snip>
In your mobile phone example, you are misplacing responsibility for network security. It the responsibility of the phone vendor to ensure that their physical hardware is not capable of doing anything it should not. For example, the phone should be incapable of transmitting at a power level higher than that authorized by relevant government standards. Likewise, it is the responsibility of the network provider to ensure network security. For example, the phone network should use some kind of authentication system to ensure a given client (phone) is who it claims to be; the network should not just accept the client's word. If, as I infer from your post, the phone hardware vendors and network providers are cutting corners with physical and network security and using this as an excuse to lock us out of our right to use modified GPL software, then it is their responsibility to fix their flaws.<snip>Is it a good idea for people to be able to control what information their phone sends or receives?</snip><snip>but I'd also want to be sure that not just anybody to load whatever code they see fit and impersonate me or interfere with my service</snip>
The whole point of any version of the GPL has always been to guarantee all users of the software 4 freedoms, including the rights to modify the software and run modifications. To some extent, this has always implied certain restrictions on hardware, in that the hardware must not be designed in such a way as to render those rights unexercisable. This draft of the GPLv3 just makes that implication explicit. Furthermore, hardware vendors are not unduly restricted. For example, the phone manufacturer could still cut corners and use a general purpose radio, but could limit that radio using some ultra-small non-GPLed firmware or microkernel, on top of which all of the GPLed software could run. This would be neither a technical nor ethical violation of the 4 freedoms, and only the most hardened open-hardware folks would oppose it. What ordinary Free Software people oppose is the use of our GPLed software in environments such that users (and by user we mean owner of the hardware) are effectively not allowed to modify our GPLed software and run it.I still think it's a little extreme for a software license to be dictating how a hardware device that runs the code is manufactured
This is exactly the situation this draft of GPLv3 intends to prevent. Preventing this situation may by extension prevent some "security by top-down control of clients", but I think that kind of security is just a specialized form of "security by obscurity" anyway.On the other hand if that prevents the hardware from loading encrypted software that isn't released to other people yet is required for the code to run, again, I'm for that.
Or burn the bit of software that it controls onto a ROM, they should be doing that anyway--binary only is not enough to stop dedicated crackers.It the responsibility of the phone vendor to ensure that their physical hardware is not capable of doing anything it should not. For example, the phone should be incapable of transmitting at a power level higher than that authorized by relevant government standards.
But wait a minute. If I bought that hardware, it's not "somebody else's" hardware. It's my hardware. Hardware is not licensed with a EULA in two pages of small print, like software. Hardware is just sold.
How can you not expect the hardware vendor to follow the license while distributing software? If the vendor has a problem with the license they can take it up with the copyright holder.But how can you expect a software license to affect the rights you have to your hardware?
Especially not for your children. Imagine how you will affect the social life of your children, if you enforce such a rule on what they can use.
Yeah, and imagine what it would do to your poor, helpless tots if you deprive them of Windows: nothing bad.
Somehow, I managed to survive childhood without seeing every single item of Disney tripe the instant it was made available for sale. I suspect that yours would, as well. But if you're keen to make sure that they think and act exactly as their peer group does, then by all means get started teaching them to shotgun beer.
I don't really understand the issue, but it seems to me that the GPLv3 guys are trying to define "admin". As "anyone who could possibly be considered one". And this is much broader (in this case better) then "real admin". Don't you think?
This way, you don't have to fight anyone just to convince people that *your* point of view that you are a "real" admin is somehow valid. That is quite complicated!
Freedom 0: <a href="http://www.gnu.org/philosophy/free-sw.html" title="gnu.org">http://www.gnu.org/philosophy/free-sw.html</a gnu.org>
The freedom to run the program, for any purpose (freedom 0).
It is NOT enough to have source code. You MUST be able to RUN the code! On some DRM-encumbered hardware THAT MAY NOT HAPPEN without the DRM keys!
The FSF/GNU sre fighting, via the GPLv3 to protect this fundamental right of users of FREE software. Linus is NOT getting this. Sad.
The issue with Freedom 0 <a href="http://www.gnu.org/philosophy/free-sw.html" title="gnu.org">http://www.gnu.org/philosophy/free-sw.html</a gnu.org> is that IF I can run any "free" software that I want then I can run it for any purpose. Additionally, The other freedoms that the GPL is trying to preserve come into play: I start with the ability to run "free" program X. Because it is "free" (as in GPLv3) I can modify it (Freedom 1) and still retain FREEDOM 0! If DRM gets in the way of this then by definition some or all of my freedoms have been taken away.
So, does this mean I can tell hardware manufacturers what to do, or for that matter can I tell other software vendors that I have to interact with via my "free" program what to do. Yes and no. I can certainly TELL them anything I want, try to stop me. But they are not obligated to do as I tell them. In the case of hardware vendors I WILL NOT BUY THEIR HARDWARE! Get enough people to follow suit, and you bet I can tell them what to do. Same is true for software.
Now what the GPLv3 is basically saying is that you can write DRM code protected under GPLv3, you can even DRM the code itself. But such measures are academic as you cannot use such encumbrances to take away any freedoms. So, you are still free to write anything you want, modify anything you want, run anything you want. You are NOT free to take such rights away from others.
I stand firmly on my original point: Linus does not get it (there appears to be evidence that he never got it) and he is off the mark by a wide margin on the GPLv3.
How is any of this news?
Posted by: Anonymous Coward on February 03, 2006 02:26 AMTorvalds won't be releasing code under GPL3, we SHOULD have known that for a while now.
The FSF is doing everything in its power to ensure maximum freedom of information by limiting the use of DRM with GPLed software, we should have seen that coming too...
Not news...
#