Fishbowl discussion – GPL compliance Karen M. Sandler
- Fishbowl format
- 5 seats at front of the room, 4 must be occupied
- If person has something to say they come up and sit in spare chair, then one existing person must sit down.
- Topics
- Conflicts of Law
- Mixing licences
- Implied warrenty
- Corporate Procedures and application
- Get knowledge of free licences into the law school curriculum
- “Being the Open Source guy at Oracle has always been fun”
- “Our large company has spent 2000 hours with a young company trying to fix things up because their license is not GPL compliant”
- BlackDuck is a commercial company will review your company’s code looking for GPL violations. Some others too
- “Not a perfect magical tool by any sketch”
- Fossology is alternative open tool
- Whole business model around license compliance, mixed in with security
- Some of these companies are Kinda Ambulance chasers
- “Don’t let those companies tell you how to tun your business”
- “Compliance industry complex” , “Compliance racket”
- At my employer with have a tool that just greps for a “GPL” license in code, better than nothing.
- Lots of fear in this area over Open-source compliance lawsuits
- Disagreements in community if this should be a good idea
- More, Less, None?
- “As a Lawyer I think there should definitely be more lawsuits”
- “A lot of large organisations will ignore anything less than [a lawsuit] “
- “Even today I deal with organisations who reference the SCO period and fear widespread lawsuits”
- Have Lawsuits chilled adoption?
- Yes
- Chilled adoption of free software vs GPL software
- “Android has a policy of no GPL in userspace” , “they would replace the kernel if they could”
- “Busybox lawsuits were used as a club to get specs so the kernel devs could create drivers” , this is not really applicable outside the kernel
- “My goal in doing enforcement was to ensure somebody with a busybox device could compile it”
- “Lawyers hate any license that prevents them getting future work”
- “The amount of GPL violations skyrocketed with embedded devices shipping with Linux and GPL software”
- People are working on a freer (eg “Not GPL”) embeded stack to replace Android userspace: Toybox, Toolbox, No kernel replacement yet.
- Employees and Compliance
- Large company helping out with charities systems unable to put AGPL software from that company on their laptops
- “Contributing software upstream makes you look good and makes your company look good” , Encourages others and you can use their contributions
- Work you do on your volunteer days at company do not fill under software assignment policy etc, but they still can’t install random stuff on their machines.
- Website’s often are not GPL compliance, heavy restrictions, users giving up their licenses.
- “Send your lawyers a video of another person in a suit talking about that topic”
U 2 can U2F Rob N ★
- Existing devices are not terribly but better than nothing, usability sucks
- Universal Two-Factor
- Open Standard by FIDO alliance
- USB, NFC, Bluetooth
- Multiple server and host implimentations
- One device multi-sites
- Cloning protection
- Interesting Examples
- U2F Zero – u2fzero.com
- Tomu – tomu.in – Not 100% there yet
- User experience: Login, press the button twice.
- Under the hood a lot more complicated
- Challenge from site, send must sign challenge (including website url to prevent phishing site proxying)
- Multiple keypairs for each website on device
- Has a login counter on the device included in signature, so server can panic then counter gets out of sync from a cloned device
- Attestation Certificate
- Shared across model or production batch
- Browserland
- Javascript
- Chrome-based support are good
- Firefox via extension (Native “real soon now”)
- Mobile works on Android + Chrome + Google Authenticator
