Live data from Hacker News

License update

whispersystems.org

41–50 of 71 posts

Re: License update

#41

Thank you Moxie! Although we personally trusted and would've moved forward with Moxie's informal permission to distribute SignalProtocol within ChatSecure on the App Store, our funder required us to get the legal details squared away or we'd lose our funding. This announcement is an amazing gift for us, and for other GPL compatible Mac/iOS apps. This announcement also more broadly benefits the copyleft community. The…

> lot of FUD from anti-Apple copyleft zealots

Outside of the name calling, what FUD would that be? Are we uncertain if apple apply an app-store license on apps they distribute? Are we uncertain if user can or can't install their own modified version of apps on their devices?

Re: License update

#42
post #20

Earlier quoted context omitted.

> Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who co…

If the code is GPL then shouldn't WhatsApp need to be open source? Or did they get a different license? The only thing listed at https://www.whatsapp.com/android/ are some changes to qcom as per the LGPL.

I think they're talking about the protocol like "keep around these keys and exchange this", but implemented with proprietary code that doesn't use any of Moxie's C implementation which is indeed GPL.

Re: License update

#43
post #28

Earlier quoted context omitted.

> Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Olm/Megolm is not Signal Protocol. It is an entirely different protocol that has made different choices, and those choices have received less study and scrutiny. It hasn't been deployed anywhere that I know of. It's fine if you want to explore those choices, but I would caution against c…

Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it: "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." ( https://github.com/LibreSignal/LibreSignal/issues/37#issueco…

"You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then on, was under a direct cloud of legal threat."

Wait what? Because what they did was illegal, to ask them to stop is to threaten legal action?

A: "Hey, you just hit me, can you stop?"

B: "Oh sorry we'll stop."

C: "Gosh, you didn't have threaten them with legal action!"

A: "What when did I do that"

C: "You know full well assault is a criminal offense and the government could prosecute with or without your consent. There's also an open ended civil claim you'd now have against them."

Re: License update

#44

Earlier quoted context omitted.

The GPL does not but it can be used as a vehicle that does.

Can you provide a concrete example? I've seen three messages from you, and I still have no idea what you're talking about. Do you have an example of what you mean by "gag", in context of copyright? Do you have an example of how GPL or other licenses allows you to do something negative while maintaining a positive image?

Not OP, but I think I get what they're trying to say.

The GPL requires others to follow its terms, because that's the only license of the code that's available to them. There is no clause of the GPL or any software license that I'm aware of that prevents you from doing whatever you want with your own code under different terms.

Therefore, you can do something negative (sell software that uses changes to GPL'd code without providing those sources to others when they ask for it), while maintaining a positive image ("look, I license my code under the GPL because I care about software freedom").

You can see this happening in practice with software that has a "community" edition available under the GPL, but a paid version that's not GPL'd. The holder of the copyright gets to profit off of other people's well meaning contributions (which almost certainly will have had their copyright assigned to the original copyright holder), but the people who contributed don't get the benefit of the copyright holder's changes to that code that are only available to paid customers.

You can argue that those contributors made their contributions knowing that would happen, but the fact that it is possible somewhat undermines the entire point of the free software movement.

Re: License update

#45
post #17
post #5

Please be aware that you may not use this code to interact with OWS servers or in an app containing "signal" in the name [0]. [0] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of cou…

> My personal situation is that the only people I talk to via Signal are nerds

Nerds, and people who were pressured to install Signal by nerds, indeed cover nearly all of my Signal contacts. But that second group is the larger one, so "nerds" is not an entirely fair characterisation of Signal's user base any more.

Re: License update

#46

Earlier quoted context omitted.

Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it: "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're free to use our source code for whatever you would like under the terms of the license, but you're not entitled to use our name or the service that we run." ( https://github.com/LibreSignal/LibreSignal/issues/37#issueco…

"You know full well that it's illegal to use systems without authorisation. In the US, it's called the Computer Fraud and Abuse Act and they'd be committing a criminal offense, with severe penalties, if they did (and government could prosecute with or without OWS consent, as AaronSw experienced). There's also an open ended civil claim you'd now have against them. So whether express or implied, the project from then o…

I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106

i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open source, taking public interest donations, contributions, etc - and then prevent users from actually exercising simple neighborly freedoms. It's not like LibreSignal were doing anything particularly different to Desktop. LibreSignal would have been thrilled to have just had it upstreamed anyway.

How many Signal users don't have GCM or Play Store? 1%? Hardly an extreme server load burden. More so, it would have attracted code contributions to further improve Signal. Equating THAT with assault as you have, is rather fkng melodramatic.

Oh, wait, people are taking liberties and entitlements? Well what the hell do you think you're doing by using the GPL in the first place? What was the spirit and intent of the authors who wrote it? Do you think THAT is being respected?

Quite simply, don't give people nasty lock-in surprises. If you intend to be a closed, tightly-controlled cathedral of non-optional dependencies on large swathes of commercial mystery meat blobs - then just say so in the first place. If you start off with non-commercial protocols like SMS, then switch to GCM, plus have federation clearly in your plan, until you're big enough you don't have to care and can rip it - then give people an out that doesn't involve losing their whole network.

Whether you like it or not, a big part of the reason Signal attained the critical mass of users necessary to take it to the next level, was the promotion and backing of the FOSS community.

The attack on open protocols, cooperation, standards and community is hence the most disappointing part. We wouldn't even be having this conversation, if we weren't here standing on the shoulders of giants of open protocols from IETF, W3C, etc. Signal's contribution was respected as one of those, until it transformed (or revealed?) itself as a closed monopoly.

Re: License update

#47
post #20
post #17

Earlier quoted context omitted.

That's too bad, while I'm happy with Signal, I understand where people using LibreSignal are coming from and it'd be a shame to be unable to talk to them (or install yet another freaking app for it). It's hard to imagine there are enough LibreSignal users to make a notable impact on the OWS infrastructure in terms of expenses. Though over time, that could change, especially if other forks joined the party, and of cou…

> Given OWS's worries about federation and shared standards standing in the way of progress, they might want to avoid third party access simply because it might stop them from changing the server interface. Totally. Client interoperability as well. For us, the problem is that when a 3rd party client breaks compatibility, that doesn't just affect the users of those 3rd party clients, but the normal Signal users who co…

> When normal Signal users try to call LibreSignal users, it just doesn't work.

Wouldn't it be possible to give better feedback to the caller in this case, such as the name of the client the callee uses?

I don't use Signal, so I may be missing something here.

Re: License update

#48
post #39

Earlier quoted context omitted.

Apple could always do what Google does, to state that in the case of copyleft licenses their term take precedence over the ToS (neutralizing restrictive terms like the redistribution ban on everything you download from the store).

Where does Google state that? This meme keeps going around that the Android store is GPL compatible. But where is the actual license text that allows this, or at least how does the situation differ from that with iOS? I checked the current Google Play Terms of Service and the iTunes Terms and Conditions. The two were alike in several respects: - They had no blanket exception or deference I could find to third party a…

Google Play ToS: https://www.google.com/mobile/android/market-tos.html

> 3.8: You agree that Google and/or third parties own all right [...]. You agree that you will not, and will not allow any third party to, (i) copy, sell, license, distribute, transfer, modify, adapt, translate, prepare derivative works from, decompile, reverse engineer, disassemble or otherwise attempt to derive source code from the Products, unless otherwise permitted

And primarily 4.2, which you already found: In the event of a conflict between the Terms and any such licenses, the open source software licenses shall prevail with respect to those components.

These in combination has the effect I described.

https://play.google.com/intl/en_us/about/play-terms.html

> You may not sell, rent, lease, redistribute, broadcast, transmit, communicate, modify, sublicense or transfer or assign any Content or your rights to Content to any third party without authorization

Copyleft license is automatic authorization.

Re: License update

#49

Tangentially related, but since we're talking about Signal and have Moxie's attention ... Does anybody know how the "privacy preserving contact discovery" works? One of my unpleasant experiences with Signal was receiving a greeting from an unknown number when I installed it. Fortunately, it was a friend with a new number I hadn't known ... but the potential privacy leak - without any apparent warning, consent or oppo…

I posted on the issue tracker and a few other places about this and was shut down. Apparently it's a support issue, not a technical one. From my (limited and potentially erroneous) understanding, Signal hashes each of your local contacts and uses that hash to query whether the number is registered with OWS. If so, you receive a notification to that effect. Essentially, you can identify Signal users without actually communicating with them. Though the same is true with PGP if you use a public keyserver.

That said, it gave some friends quite a fright. It's really unfortunate this wasn't opt-in or publicized before-hand.

Re: License update

#50
post #8

Earlier quoted context omitted.

Tough crowd! That's what we used to do, but some extremely vocal people weren't satisfied, so we've done this to integrate our intentions into the license itself.

Was this lawyered? Because the clause reads to me like Programmer Law. > Provided that you are otherwise in compliance with the GPLv3... [we] also grants you the additional permission to convey through the Apple App Store non-source executable versions of the Program as incorporated into each applicable covered work as Executable Versions only under the Mozilla Public License version 2.0 1. The phrase "only under the…

One thing that makes me happy about the Mosh approach is that they got lawyers (SFLC, specifically) to advise on exactly how to phrase it.
Post reply on HN