On Privacy versus Freedom

The second isn't better by default - no matter what, you're trusting some organization/entity somewhere in the chain.

Furthermore, your comment just eschews what Signal has said elsewhere - if you have a social app, you need a social graph to operate. They have to piggyback somewhere or else store a bunch of data themselves, and it's clear that they take their time to make sure they're doing something as best as possible before committing to it.

It's also not developers proliferating the approach. This is what the market developed into, and if you want your product/service/whatever to be successful, you have to win with that constraint. What you're describing is idealist, but not realistic at time of writing this. Hopefully it changes, but place the blame where it's appropriate.

> You realistically can't use Signal without an Apple ID

I do, because I got it and signed up for an account on my Android phone...

Okay, I realize what you're getting at here, but it seriously irks me when people talk as if Apple was the only ecosystem, or even the most popular ecosystem, when it is neither.

I probably don't even need a Google Play Store account if I can find an unmodified APK that's signed by OWS.

It wouldn't matter. Two things are required to trigger the clause.

1. The GPLv3 object code has to be conveyed "in, or with, or specifically for use in, a User Product", and

2. This must occur "as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient".

The "User Product" in your argument is still the computer, and so unless you are buying the computer itself from the App Store at the same time as the app you are buying, the second condition is not met.

The definition of "User Product" in GPLv3 might seem a little puzzling at first. There are two kinds of things that count:

1. "any tangible personal property which is normally used for personal, family, or household purposes", or

2. "anything designed or sold for incorporation into a dwelling".

There is no definition of "dwelling" in GPLv3, so it is going to be given its ordinary meaning which according to Oxford is "a house, apartment, or other place of residence".

#1 already covers any tangible personal property used for personal, family, or household purposes, and since dwellings are places of residence it might seem that anything incorporated into a dwelling would also be covered by #1.

So what is #2 actually getting at?

The answer, I'm sure, is fixtures. A fixture is physical property that is permanently attached to real property. Crucially, if something is a fixture then it is not considered to be personal property and so does not fall under #1 of the "User Product" definition.

Unless the sales contract specifically says otherwise, fixtures go with the house, and personal property goes with the seller.

Nowadays a lot of things that include software might be fixtures. Some things that might be considered fixtures and might also have software in them:

1. Thermostats.

2. Smoke alarms.

3. Security cameras.

4. Appliances.

5. Lighting fixtures.

(I'm not saying that they are fixtures. In some houses they might be fixtures and in others they might not be, depending on how they were installed).

Without #2 in the "User Product" definition, manufactures of those things might be able to include locked down GPLv3 firmware without trigger the "anti-tivoization" clause.

I say "might be able to" because those things aren't fixtures until they get attached to the house. A thermostat sitting in a box on the shelf at Home Depot is not a fixture at that point. It only becomes a fixture when someone installs it.

This would probably cover it under #1, closing the loophole.

But what if the thermostat is not sold through stores like Home Depot? What if instead you have to buy it through the manufacturer, which sends an installer to install it, and only conveys ownership to you after it has become a fixture? This could probably be done in a way that evades #1.

#2 shuts down such shenanigans.

What I'm puzzled by is what about things that are neither personal property used "for personal, family, or household purposes" nor for incorporation into dwelling?

Would it be OK for Boeing or Airbus to Tivoize the software in their planes and still use GPLv3 code in it? Can John Deere use GPLv3 code in its combines and Tivoize it?

>One frustrating thing about Moxie's original post is that Signal derives huge amounts of value by piggybacking on an existing distributed federated network: the phone system. If phone numbers weren't an existing working identifiers that people had regardless of what OS

oh my sweet summer child.

I hop countries and switch phones every few years. This entire assumption that my identity is tied to a phone number which I will have forever is patently false. Phone numbers are an anachronism.

I sure as hell don't trust an alleged privacy focused messenger that insists on a hard identifier (even if I know how to subvert said identifier for now). When privacy truly matters, signal runs on an emulated phone and a burner number.

SGX is crypto that is already exploited and broken, it offers no real use in this context.

Oh, and I forgot, you do need to essentially blindly trust Intel.