Re: Nmap/Nessus copyright

[Fyodor <fyodor () insecure org>]

On Thu, Oct 20, 2005 at 08:01:57PM +0100, Dave Korn wrote:
> Renaud Deraison wrote:
> > licensing the output is. For instance, in the case of Nmap Fyodor
> > decided that you're not allowed to process the results from a scan
> > launched by your proprietary web GUI (cf nmap-3.XX/COPYING) -- in
> > that way he cleared the ambiguity. We find that kind of restriction
> > to be very extreme (especially if you're talking about "free"
> > software) and decided to not go with it, but at the same time there
> > should be some middle ground between considering the output as public
> > domain or restricting its use drastically.
>
>   This is nonsensical too.  There is no reasonable meaning of the words
> under which a text file with lines like "Port 21: Open" and "Port 80:
> Closed" could be considered a "derivative work" based on Nmap.  It won't
> compile, it won't run, and it won't scan a remote host.  I can't even begin
> imagine how Fyodor could hope to succeed in any such claim.

I succeed by not making any such claims.  I don't consider Nmap output
files in themselves to constitute a derivative work of Nmap.  Also, if
someone puts up a proprietary web GUI at, say, scanmyports.com, which
uses Nmap and charges people who go to the site to lanuch scans, that
is OK too.  It would be nice if they contributed any Nmap
fixes/improvements back, but the license doesn't require that.  Now
things are different if they distribute Nmap as part of this system on
an appliance or whatever, because then they actually are copying Nmap
and must abide by the copyright restrictions for doing so [
http://www.insecure.org/nmap/data/COPYING ].  If they don't agree to
those terms, nothing else gives them the right to redistribute Nmap.

I hope this helps clear things up.

Cheers,
-F