[U-Boot] U-book and GPLv3? (fwd)

[Detlev Zundel <dzu@denx.de>]

Hi Mike,

> On Wednesday 24 June 2009 05:12:01 Detlev Zundel wrote:
>> > On Tuesday 23 June 2009 15:26:35 Scott Wood wrote:
>> >> On Tue, Jun 23, 2009 at 06:33:53PM +0200, Detlev Zundel wrote:
>> >> > Apart from the the above reasons, currently most people who voiced
>> >> > their opinion (not too many right now) oppose the move.  The reasoning
>> >> > seems to be that companies using U-Boot inside a commercial product
>> >> > consider it to be "a neccessary precondition to only accept blessed
>> >> > firmware upgrades" (my wording).  What motivates this argument is not
>> >> > completely clear to me.  Maybe it is fear of being liable as a product
>> >> > vendor to faulty sw upgrades.
>> >>
>> >> Regardless of what motivates it, people who sell hardware to such
>> >> customers (and who also contribute to u-boot) may not want to risk
>> >> losing that business by pushing GPLv3 on them.
>> >
>> > indeed.  expecting businesses to push other peoples' agenda isnt
>> > realistic, especially when the conversation is pretty much a net customer
>> > loss for said businesses.
>>
>> It seems so clear for you, but it isn't for me - where is this net loss
>> for them, what exactly do they loose?
>>
>> > customers arent going to appear because your business is now pushing
>> > GPLv3 instead of GPLv2, but they will certainly disappear.
>>
>> Why will they disappear?
>
> if you want to push your agenda on your customers (i'm assuming you actually 
> have some and arent just here for fun), that's your business.

Is it possible that you jump to conslusions here?  All we - on a regular
basis - do is to talk to our customers until we understand what the
customer needs.  Then we think about how this can or cannot be done with
the help of Free Software.  After all nobody is forcing anyone to use
Free Software and for some customer wishes Free Software may simply be
not a legal option, so what?

In this process it is common that customers have incomplete information
about Free Software in general and not well-articulated fears making
them jump to premature conclusions (e.g. "we need a closed source Linux
kernel driver") which would prevent us from doing development for them.
At this point it is extremely important to learn about the reasoning of
the customer and then clearing up confusion probably leading to
revisiting the question of using Free Software.

Essentially I can only remember one customer in the last years who did
not go further at the time after learning that we would not develop a
non-GPL kernel module.  Incidentally this customer is now back on our
doorstep because the market effectively forces him to use a GNU/Linux
system from a feature perspective.  This time around closed sources
kernel modules are not even on the agenda anymore.

> but when customers absolutely state their requirements are secure boot
> and the ability to lock their hardware so no one else can run things,
> then i'm not about to argue with them.  their response is simply
> "fine, we'll move on to the next guy who will satisfy our
> requirements".

It is your decision if you don't want to even understand your customers
needs.  I surely do and this is what I try to understand in this thread.

I admit that I did not think this through completely, but how much of
this "no one else can run things" is actually connected to the
bootloader?  U-Boot itself will not be handling "prime content" I
guess.  Those "secure boot" you talk about - what is it exactly and
what are the potential attack vectors of it?  Are there vectors besides
the bootloader?  If so, how does a "non-supporting" bootloader make the
situation any worse?

> they arent generally trying to lock out people who just want to toy, they're 
> targeting people who want to clone their hardware or functionality to create 
> knockoffs or they're trying to guarantee lock down so they can get certified 
> (like medical devices).

How does GPLv3 vs. GPLv2 touch the "we will get cloned" question?  Maybe
I do not see the obvious here, but sourcecode to binaries under either
license must be available, so what's the difference?

> that's my practical standpoint from my job experience -- GPLv3 will cause a u-
> boot fork and the net result is not beneficial to anyone.

You must have a very good crystal ball.  Maybe if my crystal ball was
that good I did not need to ask questions.

> my completely personal standpoint is the same -- do not use the GPLv3.

Ok, somehow this was already clear to me.

On the other hand I also do believe that for a project which is here
simply because of the benefits of the GPL, we should spend some time
thinking this through and then base the decision of the project on a
sound basis.  Handwaving arguments do not help much here, so thanks for
your input.

Cheers
  Detlev

-- 
I haven't lost my mind, I know exactly where I left it.
--
DENX Software Engineering GmbH,      MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich,  Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-40 Fax: (+49)-8142-66989-80 Email: dzu at denx.de