RE: Sourcefire Acquired by Check Point Software

["Dave Korn" <dave.korn () artimi com>]

Renaud Deraison wrote:

> There are several loopholes on many levels :

  I know this isn't a GPL discussion list, but the inaccuracies in this
thread are liable to spread FUD if left uncommented-upon.  It's not as bad
as you think it is!

> (a) You can take any GPL software, put it as-is on an appliance, call
> your appliance the "FOOBAR 3000" and sell FOOBAR 3000 Scanners all
> over the place. You therefore hide any credit to the original program
> you took and nobody knows that your FOOBAR 3000 is using (Nessus|
> Snort|.*)
>
> (b) You take any GPL software, make substantial changes to it, and
> "rent" the appliance to your customers. You're not obligated to give
> the source code to your customer.

  Neither of these are "loopholes".  They are simply blatant violations of
the GPL.  Selling _or_ renting an appliance that contains GPL'd software
constitutes "distributing" the binary and therefore places a binding legal
obligation on the vendor to offer the sources to anyone they distribute the
binaries to, just like any other GPL'd work.  Look at all the recent cases
of (e.g.) router manufacturers who have been forced to live up to their GPL
obligations and open the sources to their appliances' firmware if you doubt
me.

> (c) You take any GPL software which produces content, and wrap a web-
> based management GUI which does not  link to it per se, but uses the
> results. Now the GPL is very fuzzy about the output of the program.
> It actually says the following :
>
> << The act of running the Program is not restricted, and the output
> from the Program is covered only if its contents constitute a work
> based on the Program (independent of having been made by running the
> Program). Whether that is true depends on what the Program does. >>
>
> So it's up to the owner of the copyright to decide what kind of
> licensing the output is. For instance, in the case of Nmap Fyodor
> decided that you're not allowed to process the results from a scan
> launched by your proprietary web GUI (cf nmap-3.XX/COPYING) -- in
> that way he cleared the ambiguity. We find that kind of restriction
> to be very extreme (especially if you're talking about "free"
> software) and decided to not go with it, but at the same time there
> should be some middle ground between considering the output as public
> domain or restricting its use drastically.

  This is nonsensical too.  There is no reasonable meaning of the words
under which a text file with lines like "Port 21: Open" and "Port 80:
Closed" could be considered a "derivative work" based on Nmap.  It won't
compile, it won't run, and it won't scan a remote host.  I can't even begin
imagine how Fyodor could hope to succeed in any such claim.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....