Gentoo Archives: gentoo-hardened

From: Andrew Savchenko <bircoph@g.o>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] RIP hardened-sources
Date: Sun, 30 Apr 2017 12:32:40
Message-Id: 20170430153204.dee4dc8fbab98dce312b5be5@gentoo.org
In Reply to: Re: [gentoo-hardened] RIP hardened-sources by SK
1 On Sun, 30 Apr 2017 13:55:16 +0200 SK wrote:
2 > And it's not about money from what I've read, should read this if you
3 > want some more information :
4 > https://hardenedlinux.github.io/announcement/2017/04/29/hardenedlinux-statement2.html
5
6 Sounds like a very lame excuse...
7
8 > Closing the public access doesn’t make PaX/Grsecurity a
9 > non-free/libre software. Those who purchase subscriptions can
10 > access the source code. We don’t see GPL violated in any way here.
11
12 The devil is in the detail. If subscribers will not be restricted
13 in all four freedoms including distribution, than this is
14 unfortunate, but legal action. But if subscribers will be limited
15 in distribution of the source code, e.g. by a threat of cancelling
16 their subscription, this will be illegal, this will be GPLv2
17 violation and PaXTeam will turn into bunch of criminals.
18
19 > After all, it’s PaX team/Spender’s creation and they can do
20 > anything they want.
21
22 No, they can't, because it is not their exclusive creation: many
23 people have contributed to PaX/GrSec over past years and they also
24 have rights for parts of these code. Moreover PaXTeam is using Linux
25 kernel code (without it the whole project is meaningless) and they
26 must respect copyright right and authorship of everyone who
27 contibuted to the Linux kernel. If GPLv2 is respected, all is OK.
28 But PaXTeams plays on the very edge of GPLv2 violation right now
29 (without the exact terms of the subscription it is not possible to
30 say if GPLv2 is violated or not).
31
32 Frankly, I'm more and more convinced that the real reason behind
33 all this charade is that GrSec/PaX is indeed a very powerful
34 security technology. So powerful that in became a serious hindrance
35 for nsa (or any other shitty agency) and PaXTeam was nailed down to
36 provide further updates only to "proper" customers and cut off wide
37 FOSS community from this powerful technology. Of course they likely
38 have some secret court orders denying them to disclosure the real
39 reason, so we all are watching this charade.
40
41 P.S. Please do not top-post.
42
43 Best regards,
44 Andrew Savchenko