GPLv2 or GPLv3?

Which is best?

  • GPLv1

    Votes: 0 0.0%
  • GPLv2

    Votes: 0 0.0%
  • GPLv3

    Votes: 2 66.7%
  • GPLv1 or later

    Votes: 0 0.0%
  • GPLv2 or later

    Votes: 0 0.0%
  • GPLv3 or later

    Votes: 1 33.3%
  • GPLv2 OR GPLv3

    Votes: 0 0.0%
  • GPLv2 AND GPLv3

    Votes: 0 0.0%
  • Other GPL related license

    Votes: 0 0.0%
  • Non-GPL

    Votes: 0 0.0%

  • Total voters
    3

λ the β-Redex Reducer

β-Redex Reducing Member
Joined
Sep 13, 2016
Messages
1,559
Age
55
Location
Lambda Centre
Which one is better?

I am in doubt. I am not sure if the tivoization clause is good. What about dangerous things like medical equipment and cars? Although I think alcohol would probably be a lot more dangerous because anyone can go drunk driving but not anyone would be able to install new software on his car. And cars are dangerous anyway if used by irresponsable people.

Also, why would cars and medical equipment need software updates? GPLv3 allows the hardware to prevent updates from the user if no one else can update the software. So a car could just be made so that no one can update the software on it and the GPLv3 would be fine with that.

When would you want a device that the vendor can update but the user cannot update?

If it were not for tivoization I would be in the GPLv3 camp, but right now I am not sure which is better. I like the anti-patent trolling clause of GPLv3 a lot. Imagine making free software only for MS to then take control over it using silly software patents on simple concepts. And thern people would have to pay MS in order to use your software! Terrible. About as terrible as what Intel did with Tanenbaum and Minix.

I wish I could use GPLv3 without tivoization. Adding the tivoization clause may have been a mistake IMO.
 
Depends if you approach software from a moral or ecosystem-compatibility perspective. I see open-source as a moral stance to begin with, so GPLv3 protects the user better. While GPLv2 might be adopted more by commercial products as it's less strict compared to v3.

Personally I think a product is my product and I should be able to modify it however I wish. For example Comma.ai allows a user to add an advanced cruise-control ('self-driving') to a supported car. https://github.com/commaai/openpilot
I understand that adding such a thing in Europe isn't allowed as we need to guarantee that traffic is safe and follows some standards. But a user should, consciously, be able to change these kind of things.
For example: the Flipper Zero made it easy to copy codes to remotely open a car. Those cars are old and won't get updated to prevent this kind of attack. If the user was allowed to change the code, a patch could be made.
To regulate this stuff you could make the car maintenance person responsible for tracking software versions of a car for example, so there is legally always a qualified person responsible for your cars software. If you do it yourself, you would be responsible.
So, there could be GPLv3 by having a clearer legal process. But that puts the work/responsibility at the government/companies and I guess without that happening GPLv3 will remain more difficult to deploy. But when it has happened tivoization should be less of a problem.

You could have a GPLv3-lite as a light-version without tivoization, or GPLv2+strict which has the nice parts of GPLv3 added, but that could also cause confusion.
 
I think tivoization may be useful. For example, if you have a cold wallet for cryptocurrencies then you would probably want to update the firmware on the wallet with newer versions from the vendor. But if you could place any firmware on the wallet then so could any malware on your system. So in this case it is safer for the user if the wallet has a part that cannot be changed and that checks whether the new firmware is signed by the vendor and that refuses all other firmware or takes special measures like a warning on boot or ereasing the contents when it gets unsigned firmware.

This type of tivoisation really is a feature for the user, without which cold storage would be significantly less useful. If anyone can sign the new firmware for your wallet, then you would be at risk when upgrading the wallet's firmware.

So tivoisation can be good. I think the anti-tivoisation clause takes it too far.
 
I think you are confusing signature verification with tivoization ?
A non-tivoized device can still check signatures on firmware. It just has to have a way to let the owner choose the trusted keys.
A good device would be one that ships with a device-unique root of trust that is given by the seller to the buyer at the moment of sale. By default, this key trusts the vendor key, but the owner, with the key he got from the vendor, can change all trusted keys, so
it can put the buyer's own key in the root of trust (so that the vendor has no copy) and can change the key used to verify the firmware to his own key (if the owner is compiling the firmware) or a distro key (if the owner trusts a distro).
No attacker could take the device and install malicious firmware because the attacker wouldn't have a trusted key.
This isn't rocket science. It's a straightforward feature that's standarised in any verified boot, secure boot, etc. protocol.

Now, if your problem is that you fear social engineering or fallible users who could be tricked into trusting a malicious distro or to endorse an attacker's key, then you are condemning users to never being free for the sin of their own incompetence.
I don't like this. And I don't think vendors are any more competent than users. Vendors have financial incentives to abandon products, and are centralized points of failure that justify a bigger effort to compromise (by governments, attackers, bribers...).
So users are no better in trading their freedom for faith in a vendor. Let the users do what they want with the devices they own, and then prosecute them if what they actually did turns out to be illegal.

So for me preventing tivoization is necessary. And the GPL3 is right.
[Edited for clarity, grammar...]
 
Last edited:
Depends if you approach software from a moral or ecosystem-compatibility perspective. I see open-source as a moral stance to begin with, so GPLv3 protects the user better. While GPLv2 might be adopted more by commercial products as it's less strict compared to v3.

Personally I think a product is my product and I should be able to modify it however I wish. For example Comma.ai allows a user to add an advanced cruise-control ('self-driving') to a supported car. https://github.com/commaai/openpilot
I understand that adding such a thing in Europe isn't allowed as we need to guarantee that traffic is safe and follows some standards. But a user should, consciously, be able to change these kind of things.
For example: the Flipper Zero made it easy to copy codes to remotely open a car. Those cars are old and won't get updated to prevent this kind of attack. If the user was allowed to change the code, a patch could be made.
To regulate this stuff you could make the car maintenance person responsible for tracking software versions of a car for example, so there is legally always a qualified person responsible for your cars software. If you do it yourself, you would be responsible.
So, there could be GPLv3 by having a clearer legal process. But that puts the work/responsibility at the government/companies and I guess without that happening GPLv3 will remain more difficult to deploy. But when it has happened tivoization should be less of a problem.

You could have a GPLv3-lite as a light-version without tivoization, or GPLv2+strict which has the nice parts of GPLv3 added, but that could also cause confusion.
Cool, I just recently stumbled about OpenPilot, nice to see someone else who is aware of the project.
I, too want the user to be able to modify their devices. It's theirs in the end. Be it cars or not. That OpenPilot thing for example might be way more secure than the built in driving assist.
Also, legalization may change, so if any modifications will be allowed in the future, users shall not be blocked bu needless software restrictions.

For me, Smartphones are a case that need to be open like computers. Imagine buying a computer and not being able to install your Os of choice or not even to have admin/root privileges. Smartphones are computers and need to be open, IMO.
 
I'm sure there's a class of devices where it makes sense to not allow it (phones are not that, nor tablets or PCs), but in times of everything closing down I sure prefer being able to really own the device I bought and install software on it. Be it that it was forced through something like GPLv3 or not.

Reproducible builds would be ideal, but if there's some GPL release without being able to ever install it on the device it belongs to, how do we even know it's the code running on there? I suppose that might fall into a rabbit hole of not being able to verify for sure with all the moving parts either way... but still.

I've released stuff under GPLv3, MIT and even WTFPL. Really depends on the level of care and intent for me. Complete application with bells and whistles is GPL so I can scream at a theoretical bogeyman ripping it off in its entirety without giving back. MIT where I'm fine if someone integrates it in their thing as long as they put my name somewhere. WTFPL if I just want a code snippet to be out there (and I've still been contacted about usage permission for one of those once).

And maybe I'm missing some legal nuances in the licenses. I'm probably never gonna try to actually go to court over any of this stuff. But at least I'll be able to be publicly mad about people doing things they agreed not to do with my software.
 
Depends if you approach software from a moral or ecosystem-compatibility perspective. I see open-source as a moral stance to begin with, so GPLv3 protects the user better. While GPLv2 might be adopted more by commercial products as it's less strict compared to v3.
GPLv2 is great as a means to work together with others. The extra clauses of GPLv3 do nothing to help you develop software as GPLv2 already ensures you get the sources for the changes others make and distribute. But GPLv3 does drive companies who would otherwise have submitted patches away. So from a software developer standpoint GPLv2 seems better.

Though GPLv3 is often better from a user perspective as it grants more protection, which was probably the real intent of GPL all along.

I think you are confusing signature verification with tivoization ?
A non-tivoized device can still check signatures on firmware. It just has to have a way to let the owner choose the trusted keys.
A good device would be one that ships with a device-unique root of trust that is given by the seller to the buyer at the moment of sale. By default, this key trusts the vendor key, but the owner, with the key he got from the vendor, can change all trusted keys, so
it can put the buyer's own key in the root of trust (so that the vendor has no copy) and can change the key used to verify the firmware to his own key (if the owner is compiling the firmware) or a distro key (if the owner trusts a distro).
No attacker could take the device and install malicious firmware because the attacker wouldn't have a trusted key.
This isn't rocket science. It's a straightforward feature that's standarised in any verified boot, secure boot, etc. protocol.
That is pretty cool. I guess tivoisation is useless. If it is then GPLv3 is probably better. It has many advantages over GPLv2.

Smartphones are a case that need to be open like computers.
Would GPLv3 have prevented Android if Linux was GPLv3? I thought phones were already pretty open, just difficult to install other systems on due to a lack of universal low-level interface like the BIOS or UEFI. On my phone I can dual boot between Maemo 5 and Maemo 7 so my phone is already pretty open.

That's just an edgy CC0.
 
I thought phones were already pretty open, just difficult to install other systems on due to a lack of universal low-level interface like the BIOS or UEFI. On my phone I can dual boot between Maemo 5 and Maemo 7 so my phone is already pretty open.
Depends on the brand of phone you buy I guess. iPhone is locked down pretty much, which can also be good as people try not the steal these as they are pretty much useless when locked.
Android phones used to be more open but many popular brands started locking their phones down also.

There aren't many phones where you can freely install your own OS out-of-the-box or flash a new baseband firmware.

Personally I think people will invest more time if hardware is relevant for a long period of time, like the Open-Pandora. With popular phones you have a large audience if you can do custom ROMS or have hacked/tweaked OS, but usually support is dropped quickly for those things when a new shiny phone arrives.

Commercial hardware just has a bigger push behind it, hence open-source hardware usually becomes less attractive to the average consumer. A thing like GPLv3 is an open-source vision that's probably not adopted by commercial hardware producers. Hence the question if you want to be moral about it (and support GPLv3) or want commercial hardware vendors to adopt open-source software and use the less strict GPLv2 (else you get nothing).
Personally I find supporting the morally better one the best choice, but I also know the commercial option usually wins.
 
That is pretty cool. I guess tivoisation is useless. If it is then GPLv3 is probably better. It has many advantages over GPLv2.
Let me correct myself. That is pretty cool but that's not how most things work now.
I meant the features are standard, like in the infrastructure to do that is standarised, it's not something extraordinary, but I didn't mean that's how the industry is doing things.
Intel, AMD, Nvidia... lock their keys in the hardware and don't allow anyone to change them. Firmware can only be updated by the manufacturer,
so they're effectively tivoized but then they allow other players some degree of control down the trust chain, and so there are MS signed shims that Linux distros can sometimes use,
or OSes that look more or less free because people can change user level apps or even kernel stuff, but then they keep proprietary bits and pieces for DRM or some such.
I say it because people here are saying phones should be open like computers, but very very few computers are open.
I understand that the degree in which vendors allow others to play is greater in many computers than in many phones, but in both cases the vendors retain a control they shouldn't have.
And content providers deny their content to users of computers/phones/whatever that are not vendor controlled, and users often don't care.
And law tends to increasingly impose unjust vendor control. But that doesn't mean you should surrender and help the injustice, so that's why GPL3 is useful.
Just to do the little you can do with your own software.

Also note that there is no way a normal owner can be sure the hardware is doing what it claims. Buying hardware is a decision to trust the hardware is not malicious.
Any device could fake owner key management but still include a hidden backdoor that subverts it. So there's no escape from trusting the vendor, the difference is how many times or how long
you trust it, it's a one time affair or a relationship for life (for the life of the device, which the owner should decide, not the vendor). A vendor that is honest today may not be able or willing to be so forever.
So there's also a reason for simply using as few devices as you can. Or use them for things or with data you can live without.
 
Also note that there is no way a normal owner can be sure the hardware is doing what it claims. Buying hardware is a decision to trust the hardware is not malicious.
Any device could fake owner key management but still include a hidden backdoor that subverts it. So there's no escape from trusting the vendor, the difference is how many times or how long
you trust it, it's a one time affair or a relationship for life (for the life of the device, which the owner should decide, not the vendor). A vendor that is honest today may not be able or willing to be so forever.
So there's also a reason for simply using as few devices as you can. Or use them for things or with data you can live without.
It's almost a philosophical discussion about "what is trust".
There has been a similar discussion on compilers (to generate software). There a 3rd party could inject malicious code into the compiler, which the vendor sells to its customers. Than the customer generates an application with a possible backdoor in it.
To prevent this kind of chained attack there are methods designed to verify if the compiler does what it's supposed to be doing.
I assume a similar thing could be designed for hardware and keys.

With hardware the vendor or the chip-design software could add backdoor into your chip. So, if you have keys stored in that chip there could be some hardware backdoor.
Chips are so complex these days that checking the actual hardware is almost impossible.
 
It's almost a philosophical discussion about "what is trust".
There has been a similar discussion on compilers (to generate software). There a 3rd party could inject malicious code into the compiler, which the vendor sells to its customers. Than the customer generates an application with a possible backdoor in it.
You mean Reflections on trusting trust, by Ken Thomson, don't you ? (yes, the Turing awarded Ken Thomson of Thomson & Ritchie, the C programming language and Unix lore)
Yes, it's a little analogous. Yet hardware adds a barrier in that the machinery to build compilers are just computers but the machinery to build hardware is out of reach.
And I don't think there's an analogue to reproducible builds for hardware (FPGAs??????).
 
You mean Reflections on trusting trust, by Ken Thomson, don't you ? (yes, the Turing awarded Ken Thomson of Thomson & Ritchie, the C programming language and Unix lore)
Yes, it's a little analogous. Yet hardware adds a barrier in that the machinery to build compilers are just computers but the machinery to build hardware is out of reach.
And I don't think there's an analogue to reproducible builds for hardware (FPGAs??????).
The FPGA is configured on the same design blocks, and a compiler is involved. So, that design could be checked but it's not as easy as software only.
Also: if you find a backdoor, it might not be easy to remove. The design block validation is a costly part.
Technically it should be possible to come up with a good test. But eventually it all comes back to trust. As no one really knows what hard or software is doing.
 
That's just an edgy CC0.
No, it has real applications for actual corner cases where CC0 is straight up legally impossible. E.g. the copyright laws of France and Germany make it impossible to drop your own copyright as they recognize that copyright still comes with liabilities, but the WTFPL doesn't even try to do that.

CC0 is just a formalized public domain. WTFPL is not public domain.
 
GPLv2 is great as a means to work together with others. The extra clauses of GPLv3 do nothing to help you develop software as GPLv2 already ensures you get the sources for the changes others make and distribute. But GPLv3 does drive companies who would otherwise have submitted patches away. So from a software developer standpoint GPLv2 seems better.
This is the big plus for GPLv2. It makes companies support it more.
 
I guess with the moral GPLv3 stance you support the movement from using hardware, to owning it. While with GPLv2 you support the open-source ecosystem and facilitate collaboration. Both have their use.
 
All pyra/pandora games/apps should come with the source. Otherwise the community rejects them.
For our community, it would be nice to just bundle the source with the executable. So, if you have the application installed you're guaranteed to always have the source to.

I think it should be done for any application. If it's a commercial application you could always lock the source code with some smart contract, so it's possible to either purchase the source to become fully open (for everyone) or it happens after a certain event (like waiting 15 years).
 
RMS created GPL because he was no longer able to work on software he created when MIT sold it. GPL was originally intended to protect developers ability to hack.
But tivoisation does not prevent a hacker from hacking, just from using his hacks on the specific hardware.

I think it should be done for any application. If it's a commercial application you could always lock the source code with some smart contract, so it's possible to either purchase the source to become fully open (for everyone) or it happens after a certain event (like waiting 15 years).
That would be really nice because as it is now people have to disobey copyright in order to preserve certain works because many works cannot survive until 70 years after it's author died while under copyright encumberment. Copyright is supposedly to enrich the public domain but by preventing works from reproducing it only creates endangered works. But with the smart contract everyone could copy the work encrypted and if it can somehow be made so that the encryption ceases 70 years after the author expires then people will not have to disobey copyright in order to preserve works.

Though it would still suck, and copyright is still obvious corruption. People like Mozart produced with 0 years of copyright, but nowadays people need to have exclusive rights until 70 years after they expire in order to motivate them to create anything? Copyright laws are just evidence that lawmakers have been bought by large corporations.

Also IMO copyright as a whole is a bad idea but it's here so I just roll with the punches. If you put your work under a permissive license or public domain then someone else can just put copyright on it (after modifying it a bit) so there is no escaping copyright laws.

----------------------------

Anyway I have noticed there are other copyleft licenses. I looked at MPL and it seemed like a great license until 10.2 where it says that Mozilla can release a new MPL which everyone can then use for your MPL software. EPL has a similar problem except the recipient of the software is not allowed to update, but the distributor of modifications is. Both licenses thus give special powers to their respective organisations which is a turn-off for me. They really are just licenses made for Mozilla or Eclipse software, respectively.

At least the GNU Foundation had the foresight to make the "or later" part optional so that they can use it for their own software but other people can also use their licenses without having to cease control over to the FSF. But I guess the FSF really cared about making their license good for people who are not associated with the FSF, while the Eclipse Foundation and Mozilla probably only cared about their own use of their license.

GPLv3-only does have a clause that people can combine your GPLv3-only work with AGPLv3 but your work stays GPLv3 and only the combined work becomes AGPLv3. But you can then take the AGPLv3 code back into your GPLv3 code and make the combination GPLv3. And besides that, AGPLv3 is already released so it is not like another organisation gets power over your source code license.

I have also been wondering whether Trezor would be able to use GPLv3. Trezor supposedly does allow anyone to install firmware, but if the firmware is not signed by Trezor you get a warning each time you boot up and your cryptowallet's memory gets ereased during installation. But the cryptowallet would still work, so it just depends whether the erease during installation or the warning at startup would count as interfering.

But I think GPLv3 is the best license. I still have my doubts whether the tivoisation part is overreaching for some software, but other than that the license is pretty good.
 
Back
Top