Category: Uncategorized

Eric Raymond wrote a blog post about the Lerna license, the license I commented upon yesterday in my post When Licenses Discriminate. Eric says non-discrimination is a core value of Open Source, which of course I agree with.

Eric takes it a bit over the top, though. He writes “Lerna has defected from the open-source community and should be shunned by anyone who values the health of that community.” Yes, over the top.

It’s OK to create a non-Open-Source paradigm. Lots of people do so, including me.  Just don’t call it Open Source. Lerna, for a day, wasn’t an Open Source project. Contributors who didn’t approve the license change also had their copyrights infringed, but that’s been taken care of because the license change has already been backed out and Lerna is back to being an Open Source project.

It’s true these non-Open-Source paradigms are often boring and non-productive, but people have a right to waste their own time on what they wish.

It also seems over the top that the Lerna project expelled the developer behind the license change. If the developer wanted to leave, fine, but if the developer was willing to stay with the project without this change, expulsion seems over the top.

We can follow the ethos of Open Source perfectly, without being draconian. Please try to do so.

A long time ago, well-meaning people at the University of California, Berkeley created a license for their SPICE electronic simulation software that prohibited use by the Police of South Africa. This was, of course, during Apartheid.

Years later, Apartheid ended. The Police of South Africa now included Blacks and Whites with the same duties and powers. And they were still prohibited from using Berkeley SPICE. Getting the University of California to change the license, so that the software could be carried in Debian as “Free Software”, was impossible at the time.

I took this example (among others) and wrote into the Open Source Definition (then the Debian Free Software Guidelines) that licenses could not discriminate against persons or groups, or against fields of endeavor.

This implements a major principle of Free Software. Freedom means Freedom for Everyone, not Freedom For People I Approve Of. Even when those folks abuse the freedom of others.

Someone recently created a license that discriminates against companies that have contracts with the U.S. Immigration and Customs Enforcement (ICE), a division of the Department of Homeland Security. Ironically, this is called “Moral Programming” or “Moral Licensing”. I have to object to it on moral grounds.

I don’t approve of the recent conduct of ICE under the direction of Donald Trump and his gang. Far, far from it. I am happy to say so, to participate in protests, and most importantly, I will not vote Republican in upcoming elections.

But if you insist on denying them the right to run your software in your license, please be careful not to call it Open Source or Free Software. Because your license will not comply with the Open Source Definition or the Four Freedoms of the Free Software Foundation. Which protect Freedom for everyone.

Redis has recently created something called the “Commons Clause”, which takes the Apache license and makes it a non-Open-Source license. And they still call it the Apache license. This is a problem. Someone creating yet another non-Open-Source paradigm is not a problem, if they do it correctly.

Redis doesn’t deny that it’s not an Open Source license any longer once their clause is added.

It’s a bad idea to add a any text whatsoever to an Open Source license, and still call that license by it’s old name. Once the Commons Clause is added, it’s no longer the Apache license, and calling it so confuses people about what is Open Source and what isn’t. Hopefully that’s not meant deliberately. Now stop it. Take the license and the clause together, and title it the Redis license or another name of your choice that doesn’t confuse people that it’s an Open Source license. “Commons” is the name of an Apache project, so that is probably a bad choice for the name of the overall license.

You’ll note that I worked on the Business Source License with MariaDB. They paid a day’s consulting fee. I made it very clear that they were not to tell people it was Open Source, and I made changes that made the license less ambiguous and confusing than their previous version. Please follow that example.

I never met Lisa Brennan-Jobs, and I only met with Steve Jobs at Pixar. When Reed Jobs was born, in 1991, Ed Catmull (then president of Pixar and now CTO of Disney) showed me the email from Steve, on his NeXT workstation, announcing Reed’s birth. Steve used a then-new feature of NeXT email to put a photo and background music in the email.

We all knew about Lisa and that Steve didn’t acknowledge her. There was a sour note as we viewed the announcement, as Steve was treating Reed’s birth with a joy that he clearly didn’t have for his relationship with Lisa.

Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here.

UPDATE: Intel has resolved their microcode licensing issue which I complained about in this blog post. The new license text is here.

This was my complaint:

Intel is updating its loadable CPU microcode to handle various side-channel and timing attacks. There is a new license term applied to the new microcode:

You will not, and will not allow any third party to (i) use, copy, distribute, sell or offer to sell the Software or associated documentation; (ii) modify, adapt, enhance, disassemble, decompile, reverse engineer, change or create derivative works from the Software except and only to the extent as specifically required by mandatory applicable laws or any applicable third party license terms accompanying the Software; (iii) use or make the Software available for the use or benefit of third parties; or (iv) use the Software on Your products other than those that include the Intel hardware product(s), platform(s), or software identified in the Software; or (v) publish or provide any Software benchmark or comparison test results.

Since the microcode is running for every instruction, this seems to be a use restriction on the entire processor. Don’t run your benchmarker at all, not even on your own software, if you “provide” or publish the results.

The security fixes are known to significantly slow down Intel processors, which won’t just disappoint customers and reduce the public regard of Intel, it will probably lead to lawsuits (if it hasn’t already). Suddenly having processors that are perhaps 5% to 10% slower, if they are to be secure, is a significant damage to many companies that run server farms or provide cloud services. I’m not blaming Intel for this, I don’t know if Intel could have forseen the problem. Since some similar exploits have been discovered for AMD and ARM CPUs, the answer is probably “no”. But certainly customers are upset.

Another issue is whether the customer should install the fix at all. Many computer users don’t allow outside or unprivileged users to run on their CPUs the way a cloud or hosting company does. For them, these side-channel and timing attacks are mostly irrelevant, and the slowdown incurred by installing the fix is unnecessary.

So, lots of people are interested in the speed penalty incurred in the microcode fixes, and Intel has now attempted to gag anyone who would collect information for reporting about those penalties, through a restriction in their license. Bad move. The correct way to handle security problems is to own up to the damage, publish mitigations, and make it possible for your customers to get along. Hiding how they are damaged is unacceptable. Silencing free speech by those who would merely publish benchmarks? Bad business. Customers can’t trust your components when you do that.

In writing this story, I used news in this article in The Register and this copy of the license. That’s all the information I have on this issue, at this writing.

Last year, Open Source Security and its CEO, Bradley Spengler, brought suit against me for defamation and related torts regarding this blog post and this Slashdot discussion. After the lower court ruled against them, I asked for my defense costs and was awarded about $260K for them by the court. The plaintiffs brought two appeals, one on the merits of the lower court’s ruling and one on the fees charged to them for my defense. In order to bring these appeals without first paying for my defense, the plaintiffs purchased a supersedeas bond for $300,000, for the cost awarded to me plus possible interest, which will be paid to my attorneys if I win the appeals. The Electronic Frontier Foundation took on the merits appeal, pro-bono (for free, for the public good), with the pro-bono assistance of my attorneys at O’Melveny who handled the lower court case. EFF has now filed an answering brief and supplemental excerpts of the record in the merits appeal. Please join EFF and support them. You can follow the court proceedings here. I will continue to publish what’s happened in the court, but can’t comment upon the case at this time.

Please read and comment, I’m sending this out on the 25th. Thanks!

ORI_ARRL_Letter_1

I attended a ham radio conference over the weekend, and sat at dinner with a couple from that usually-liberal encampment, Palo Alto. But this couple were clearly conservative and Republican. I had identified myself as coming from Berkeley, so I would imagine they understood I was liberal.

At ham radio conferences, I generally talk about ham radio and its issues. I don’t usually get into politics, because I’m lobbying for some changes in ham radio policy, and it simply isn’t productive to confuse issues. Just as I wouldn’t talk about those things when appearing at an Open Source event – it’s more important to lobby people on Open Source policy issues.

But what interested me was the degree of denial I heard. The woman’s husband probably understood that I wasn’t the person to discuss his politics with, and limited his conversation to issues of attracting young people to ham radio, an issue we both felt was important.

His wife had a comment about living in Palo Alto, and this is an exact quote: “My friends say the most absurd things about President Trump. I just ignore it and let them talk.”

She also mentioned that her husband listened to conservative talk shows that “kept her honest”.

Now, the last time I checked, it was pretty clear that President Trump had cheated on his wife with a porn star and a “Playboy bunny” whom he had – as taped by his own lawyer – discussed paying for her silence during the election in possible contravention of national election funding law. He chummed with Vladimir Putin, publicly dismissing a vast pile of evidence from our nation’s security professionals that Putin had authorized interference with U.S. elections, and even high officials of his own party felt a need to contradict Trump about that. And I guess I could write about 100 more things we’ve learned about Mr. Trump that would be equally disturbing.

I didn’t engage her about this. It wouldn’t have been productive.

Somewhere in Palo Alto is a lady who listens only to Fox News, some internet sites, and conservative talk shows. And – I guess like very many people – news that concerns the rest of us that the president is unsavory, various sorts of criminal, and possibly even a Russian agent goes right over her head.

Now I understand how the people of Germany let all of the evil of the Nazis go on with their full acceptance. They had a great capacity for denial, one that we are now seeing in our own nation.

It is difficult to have hope in the face of this.

Unfortunately, I will no longer be able to allow conferences to purchase my airline tickets. I must purchase them myself and be reimbursed. I will purchase the lowest price un-refundable coach-class tickets available for flights of a reasonable duration. These will be insured with cancel-for-any-reason travel insurance which the conference must pay for, and which will protect them from having to pay if I am not able to appear.

The reason for this is that I’ve had a number of bad experiences when I’m not the one who books my travel. The worst was when my wife was hospitalized, and I was not able to change my flight to get back to her quickly. But there have been others, including calling the booking travel agency for help only to find we didn’t have any language in common, not being able to buy my own ticket for my wife because the conference took too long to secure my ticket, and the time a conference stuck me in a city I didn’t want to be in for a long weekend, with no regard to my own plans.

I will usually buy tickets less expensive than are available through a conference’s travel agency. Part of this is because they are un-refundable, but in general I’ve not found institutional travel agencies to be able to access better bargains than available online, if one books far enough in advance.

Note also that when I am traveling for your conference, I am not running my consulting business, and will have no billable time. So, I go through quite a lot of expense to appear there.