The OBS Project is threatening Fedora Linux with legal action

Post by tuananh » Fri, Feb 14, 2025, 3:07 AM UTC

lmm wrote: post #96

tuananh wrote: post #3

who should do packaging for each distro? - upstream maintainer: too much work. each distro requires certain best practices/convention. - distro: may not meet certain standard set by upstream maintainer.

If distro maintainers are going to futz with packages, for good reasons or bad, then they need to bear the corresponding support burden themselves and ensure it does not fall on the upstream maintainers. This is not really any different from the Debian OpenSSL fiasco, or the Debian cdrecord fiasco, or the Debian xscreensaver fiasco, or...

Post by Shish2k » Fri, Feb 14, 2025, 3:13 AM UTC

plorkyeran wrote: post #116

ndiddy wrote: post #100

Earlier quoted context omitted.

I don't understand what the big deal was there. Debian has its own bug tracker for all of its packages so the distro maintainers get bothered about bugs in old packages shipped by the stable version of Debian rather than upstream developers. JWZ decided to voluntarily subscribe to the Debian bug tracker for his package and then add a nag screen and start a flame war over them shipping an old version.

Debian users frequently report bugs to upstream and not Debian.

Post by jcelerier » Fri, Feb 14, 2025, 3:20 AM UTC

comex wrote: post #115

jcelerier wrote: post #71

Earlier quoted context omitted.

> the claim from Fedora is that is that OBS is using an EOL qt. what's amazing with this is that if for instance OBS had written their own toolkit from scratch just for the app, which by a stroke of luck ended up being exactly the same code than the Qt version they're using and which solves the use case they have - maybe it would be OBSObject or OBSString instead of QObject / QString, then this entire issue would not…

I would differentiate your scenario in five ways. First, the risk is higher. When a vulnerability has a public patch, it means the nature of the vulnerability is also public. Sometimes there is even public exploit code. While attackers sometimes find their own vulnerabilities (zero-days), it makes their job a lot easier if they can just use an already-known vulnerability. Second, if the code was part of the OBS proje…

Post by wongarsu » Fri, Feb 14, 2025, 3:24 AM UTC

akerl_ wrote: post #34

remram wrote: post #30

Earlier quoted context omitted.

From the linked comment: > This is a formal request to remove all of our branding, including but not limited to, our name, our logo, any additional IP belonging to the OBS Project Honestly it sounds very reasonable, if you want to fork it's fine, but don't have people report bugs upstream if you're introducing them.

I mean, I think the right fix is just for Fedora to stop packaging their own version. But I think that's about being good people; I don't think there's a strong legal argument here for forcing Fedora to do that.

Post by edflsafoiewq » Fri, Feb 14, 2025, 3:56 AM UTC

ndiddy wrote: post #100

rincebrain wrote: post #42

This seems like a flashback to the xscreensaver fights with Debian of yore, given that the entire fight seems to distill to "OBS is shipping EOL Qt because of unfixed regressions in newer Qt, Fedora views shipping EOL Qt as unjustifiable neglect and repackaged it with newer Qt, which, as described, breaks things." [1] For those who don't have that in their context - jwz got very upset at people reporting bugs against…

I don't understand what the big deal was there. Debian has its own bug tracker for all of its packages so the distro maintainers get bothered about bugs in old packages shipped by the stable version of Debian rather than upstream developers. JWZ decided to voluntarily subscribe to the Debian bug tracker for his package and then add a nag screen and start a flame war over them shipping an old version.