EU study recommends OpenBSD • Hacker News Board

Re: EU study recommends OpenBSD

#101

Post by yellowapple » Mon, Apr 27, 2015, 5:36 PM UTC

pakled_engineer wrote: post #90

gillianseed wrote: post #48

Earlier quoted context omitted.

>that people will take code - put it under a different licence and modify it Ok, although the 'take code and put it under a different license' is untrue, you can't re-license code unless you are the copyright owner, I gather that he means someone making modifications/enhancements and placing them under a license which OpenBSD can't use while remaining fully BSD licensed.

This happened when Apple adopted pf they added a few enhancements of their own but wrapped them in Apple's license so pf maintainers could not add the changes back into upstream pf.

This also happened with Linux's Atheros drivers (which were derived from OpenBSD, but modifications were published under the GPL instead of the BSD or ISC licenses; Theo argued that doing so was actually a violation of the BSD license (apparently they were stripping out the BSD license in the actual source files? I'm fuzzy on the details)). I don't remember what the outcome was.

Re: EU study recommends OpenBSD

#102

Post by yellowapple » Mon, Apr 27, 2015, 5:41 PM UTC

erhardm wrote: post #83

I like OpenBSD. I like the spirit of the developers, which don't compromise on security. I like the simplicity of the OS, very good documented and very robust. They are prepared to break a ton of software to advance the state of security/correct code. I would like to have OpenBSD on all my machines, but unfortunately their license don't have the "infectious" effect of GPL. From my limited understanding, their license…

While it's true that the GPL and the distributed nature of Linux development helped GNU/Linux proliferate, that isn't the reason why the BSDs didn't. In reality, they were encumbered by legal problems due to being derivative works of AT&T's Unix; the ensuing legal war of attrition caused a lot of folks to be unsure of whether or not they could legally use any of the BSDs without having to pony up for Unix licenses.

As a result, Linux was created (Linus Torvalds has said that if Hurd existed or if the BSD legality issues were resolved, he wouldn't have felt the need to develop the Linux kernel), and folks jumped onto that as the preferred free Unix due to it being unencumbered by the massive legal warfare taking place in BSD Land (of course, SCO would eventually bring the battle to the GNU/Linux world, but by that point, Linux was already well-entrenched).

Re: EU study recommends OpenBSD

#103

Post by reitanqild » Mon, Apr 27, 2015, 5:48 PM UTC

cwyers wrote: post #84

nitramafve wrote: post #46

Earlier quoted context omitted.

That is why some choose to license their work under AGPL.

That still only goes so far, though. If you're building a product on top of a database that's licensed with the AGPL, like Mongo, you have to distribute those changes.* If you build your Intranet site on Mongo, though, you don't need to distribute those changes in a way that gets back to upstream. * I think. And I don't know if this has withstood the sort of court scrutiny the GPL has.

As far as I know mongo think they have solved this by providing dricers under a different licence.

Again, AFAIK, this licencing (AGPL + MIT/BSD or Apache) has not been tested in court.

Re: EU study recommends OpenBSD

#104

Post by DasIch » Mon, Apr 27, 2015, 5:52 PM UTC

s_dev wrote: post #2

Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Good to see the EU at least acknowledging that its something that they should explore. They probably use it and its features more than they realise. I suspect there is a strong political motive as well behind being "technologically independent" after the NSA mass surveillance revelations. I like the sound of…

The idea of a EU BSD fork sounds terrible. What needs to happen is government funding for key open source infrastructure projects that require it like OpenSSL, OpenBSD, GnuPG, etc.

Re: EU study recommends OpenBSD

#105

Post by brudgers » Mon, Apr 27, 2015, 6:05 PM UTC

k-mcgrady wrote: post #72

brudgers wrote: post #51

Earlier quoted context omitted.

When the same governments are funding signals intelligence gathering with one hand and open source software development with the other, there is potential conflict of interest, if not actual conflict. The NSA's role in weakening open source encryption standards was the result of the internal logic by which all intelligence organs typically operate irrespective of sponsoring state. The differences between the politics…

And with OSS we can see when the create back doors or modify the code. We can see what the modifications do. And if they are doing anything wrong we can revert the changes and publicise it. Following on from your thinking, what is their angle here? On the surface it seems more difficult to exploit OSS but is there something they can do with it that users won't know about and is easier to exploit?

Subtle security leaks are not in the center of the all-bugs-are-shallow theory. Cryptographically insecure communications don't cause code to throw exceptions or systems to crash. The effects are social. Unless Eve tells Alice or Bob, neither will know she's read their communications.

Re: EU study recommends OpenBSD

#106

Post by progman » Mon, Apr 27, 2015, 6:26 PM UTC

dash2 wrote: post #58

For those that know more about OpenBSD than the EU (and I salute you for it), the EU parliament is a fairly powerless institution. Eurocrats show it little respect; one described it as "just one big fucking NGO". Update after reading it: this isn't even an official parliament document or recommendation. It's something by the parliament's research service.

> the EU parliament is a fairly powerless institution

This is certainly not true. Thanks to the EU parliament the IT freelancers in the EU don't need to suffer software patents.

The Eurocrats did everything to invent it some years ago, even with dirty tricks (like pushing it through immediately before summer vacation). We IT freelancers contacted politicians of the EU parliament, told them about our concerns, and they actually supported us.

I remember the victory celebration at heise.de (a leading IT newsticker in Germany). Usually there are about some hundred comments per hot thread but in this case it was more than eleven thousands.

Re: EU study recommends OpenBSD

#107

Post by hackuser » Mon, Apr 27, 2015, 6:27 PM UTC

> "It is recommended that users install ..." OpenBSD?

The EU isn't serious if that's what they mean. It's not really an option for end users. My impression is that even technical users who are new to *nix should start with something more accessible.

Does the OpenBSD community even want to deal with a flood of nubes?

Re: EU study recommends OpenBSD

#108

Post by the_af » Mon, Apr 27, 2015, 6:33 PM UTC

yellowapple wrote: post #93

the_af wrote: post #81

Earlier quoted context omitted.

Yes, but forget monetary/labor contributions. I think jkyle has a point: the BSD license is a "no strings attached" license, and so it can be chosen by people who presumably don't even want to promote the software, advertise the fact they are using it or campaign for more software like it. If Theo De Raadt finds this disappointing, maybe he should choose a different license?

The problem is that de Raadt and crew have a much bigger priority: that OpenBSD's code proliferate and prevent any duplication of effort in creating secure programs. They've explicitly stated in the past that they consider proprietary use of their code to be a good thing (albeit it would be better if they'd push some money back to the OpenBSD crowd) because it prevents those companies from having to create yet anothe…

That's a perfectly reasonable priority! It's just that it possibly comes along with some disappointment, caused by people who don't contribute anything back (money, code, documentation or simply promoting the software).

Re: EU study recommends OpenBSD

#109

Post by yellowapple » Mon, Apr 27, 2015, 6:35 PM UTC

dijit wrote: post #49

I love openBSD, it's implementation of certain things is slower (like networking), but it's so clean and well implemented. even if it doesnt' get to play with all the toys (like ZFS) it's what I'd love to default to for application servers/bastion server/firewalls etc; my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\

At least with packages, there are "no-X" versions of most packages available (useful if you don't have X on a machine).

Re: EU study recommends OpenBSD

#110

Post by yellowapple » Mon, Apr 27, 2015, 6:37 PM UTC

th0waway wrote: post #33

nbevans wrote: post #29

"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts." That worked great for OpenSSL didn't it? ;)

Yep, the issue was fixed (even though it took a while).

And by "a while", one means "a few days after discovery" (a few months after it was introduced, but that's actually not terrible, all things considered).