Re: GPLv3

Richard Laager wrote:

> First off, I'm not a lawyer. ;) This is not legal advice, only a summary
> of my understanding of all this.

Sure.

> If you (Roaring Penguin) have accepted patches, you are not the sole
> copyright holder, unless you received a copyright assignment for every
> patch that's substantial enough to receive copyright protection (which
> is an issue I'm not qualified to talk about).

We have not accepted substantial patches.  The only patches we've
accepted have been minor bug fixes or additions for new virus scanners
that closely follow the basic pattern of our existing virus-scanning
code.  We also typically rework submitted patches for various reasons,
rather than accepting them verbatim.

> If MIMEDefang is GPLv2-only right now, then you can't change that
> without getting consent from every other copyright holders or replacing
> that code.

That's true.  If we make the change, I would expect anyone who claims
to hold copyright to part of MIMEDefang to speak up, but I'm unaware
of anyone who's in that position.

[...]

> Also, your note about service providers and distributing conflicts with
> the common interpretation of the GPL (Google for "GPL web services", for

Re: GPLv3

On 30 Jun 2007 at 14:09, David F. Skoll wrote:

> Jeff Rife wrote:
> 
> > The biggest thing to figure out (and I'm afraid only a laywer could 
> > follow the GPL3 enough to know the answer) is if using GPL3 on 
> > MIMEDefang would essentially require you to give away CanIt with no 
> > limitations on its use.
> 
> As the copyright holder on MIMEDefang, we can distribute it under whatever
> terms we like.  Roaring Penguin is the only organization *not* bound
> by the GPL when we distribute MIMEDefang, so I don't think that's
> an issue.

I had done this same thought process, and it seems logical, but I 
really don't know if GPL3 basically says that you can't keep any part 
of an implementation "private" if it contains any GPL3 code.

Essentially, it would treat RP as two separate entities where one 
distributes MIMEDefang under GPL3, and the other grabs that code, 
modifies it, and distributes another product without including full 
source.  I know that stopping things like Tivoization were at least 
partly on the mind of the GPL3 writers, but I just don't know enough 
about the way the license reads to say what would happen.

One other reason to go to GPL3 is if you have gotten any fairly large 
chunk of code from a 3rd party and included it in MIMEDefang.  GPL3 is 
supposed protect you from being sued for patent infringement for that 
code.

Re: GPLv3

On Sat, 2007-06-30 at 23:22 -0400, Jeff Rife wrote:
> One other reason to go to GPL3 is if you have gotten any fairly large 
> chunk of code from a 3rd party and included it in MIMEDefang.  GPL3 is 
> supposed protect you from being sued for patent infringement for that 
> code.

For the sake of the archives...

That would only help if that code was GPLv3 or GPLv[12]-or-later. You
can't take code and release it under a different license, of course. And
if it's not already available under the GPLv3, you can't use anything in
the GPLv3.

Richard

On Sat, 2007-06-30 at 23:22 -0400, Jeff Rife wrote:
> One other reason to go to GPL3 is if you have gotten any fairly large 
> chunk of code from a 3rd party and included it in MIMEDefang.  GPL3 is 
> supposed protect you from being sued for patent infringement for that 
> code.

For the sake of the archives...

That would only help if that code was GPLv3 or GPLv[12]-or-later. You
can't take code and release it under a different license, of course. And
if it's not already available under the GPLv3, you can't use anything in
the GPLv3.

Richard

Re: GPLv3

David F. Skoll wrote:
> Richard Laager wrote:

>> If you (Roaring Penguin) have accepted patches, you are not the sole
>> copyright holder, unless you received a copyright assignment for every
>> patch that's substantial enough to receive copyright protection (which
>> is an issue I'm not qualified to talk about).
> 
> We have not accepted substantial patches.  The only patches we've
> accepted have been minor bug fixes or additions for new virus scanners
> that closely follow the basic pattern of our existing virus-scanning
> code.  We also typically rework submitted patches for various reasons,
> rather than accepting them verbatim.
> 

I wonder how hard it would be (and how acceptable it would be) to add 
some verbiage that patches submitted to MIMEDefang for inclusion in the 
project become the property of you and/or Roaring Penguin, solely for 
the purpose of ensuring that these issues don't become a problem.  That, 
or you'll have to start tracking individual contributors for the purpose 
of ensuring that license changes are acceptable.

Re: GPLv3

Jeff Rife wrote:
> On 30 Jun 2007 at 14:09, David F. Skoll wrote:
> 
>> Jeff Rife wrote:
>>
>>> The biggest thing to figure out (and I'm afraid only a laywer could 
>>> follow the GPL3 enough to know the answer) is if using GPL3 on 
>>> MIMEDefang would essentially require you to give away CanIt with no 
>>> limitations on its use.
>> As the copyright holder on MIMEDefang, we can distribute it under whatever
>> terms we like.  Roaring Penguin is the only organization *not* bound
>> by the GPL when we distribute MIMEDefang, so I don't think that's
>> an issue.
> 
> I had done this same thought process, and it seems logical, but I 
> really don't know if GPL3 basically says that you can't keep any part 
> of an implementation "private" if it contains any GPL3 code.
> 
> Essentially, it would treat RP as two separate entities where one 
> distributes MIMEDefang under GPL3, and the other grabs that code, 
> modifies it, and distributes another product without including full 
> source.  I know that stopping things like Tivoization were at least 
> partly on the mind of the GPL3 writers, but I just don't know enough 
> about the way the license reads to say what would happen.

Tivoization is different from the case with MD.

With Tivo, their product has a huge key infrastructure piece that is 
someone else's GPL project (linux).  Tivo took someone else's GPL code 
and built another piece of their own code, and put them together to make 

Re: GPLv3

Hi,

> MIMEDefang is currently licensed under the GPL v2 (only).  I am
> considering making the next release GPL v3; I'm trying to absorb
> the GPL3 text now.

I'm very concerned about your idea to make Mimedefang GPL v3. Our company would
then have to stay with the current release. Also, FreeBSD, and probably the 
other bsds will probably stop to support mimedefang in the ports tree and
not provide any packages anymore:

>New GPLv3 licensed code in the ports tree should be approached with caution, 
>but portmgr <at>  and core <at>  will issue guidance.  Stallman indicated in his speech 
>that any violation of the terms of GPLv3 for one package would invalidate the
>license to all GPLv3 software packages for the entity violating the
>license.  It is unclear if this was the plain meaning of the license,
>or just Stallman's interpretation of it.  We should assume for the
>moment it is true and be extra careful in our compliance with any
>GPLv3 licensed software in the ports tree.  As part of core's
>investigation of GPLv3 licensed software, we'll ask this question of
>the lawyer.

Btw:

Some people are already talking about a fork of gcc and other Gnu software.

>Without raising a debate about any of this, I want to point out
>that one of most likely, in my mind almost certain, consequences
>of GPLv3, and the one that will hit us hardest, is the possible

Re: GPLv3

Martin Blapp wrote:

> I'm very concerned about your idea to make Mimedefang GPL v3. Our
> company would then have to stay with the current release.

OK.  Why is that?  What specifically in GPL3 is the problem?

>> New GPLv3 licensed code in the ports tree should be approached with
>> caution, but portmgr <at>  and core <at>  will issue guidance.  Stallman
>> indicated in his speech that any violation of the terms of GPLv3
>> for one package would invalidate the license to all GPLv3 software
>> packages for the entity violating the license.

I don't see that at all from GPL3.  I think that's Stallman's
interpretation.  Besides, Stallman cannot possibly enforce that -- it's
up to each copyright holder to enforce the license.

> Some people are already talking about a fork of gcc and other Gnu software.

I think this is rash.  I honestly don't see anything in GPL3 that's
*that* bad.

Regards,

David.

Re: GPLv3

Hi,

Filtering is only a small part of our product, the main parts
are all written by ourself (We sell ISP packages with docsis cable modem 
provisioning software).

But ...

> OK.  Why is that?  What specifically in GPL3 is the problem?

Exactly for the same reason the FreeBSD people have. If we have a licence
problem somewhere in our own ports tree, it would be horrible to have
the licence invalidated for all other GPLv3 packages. Our ports tree
contains currently about 250 OSS packages.

Another part is the Tivoization. Our customers have the whole source
tree available, but we don't want to have local changes on the customer
side without proper integration. We update the mimedefang-filter config
automatically if there are any new changes (and overwrite local customer
changes in principle.) If we aren't allowed to do this anymore, we really
have a problem. Updating will be horrible then.

> I don't see that at all from GPL3.  I think that's Stallman's
> interpretation.  Besides, Stallman cannot possibly enforce that -- it's
> up to each copyright holder to enforce the license.
>
>> Some people are already talking about a fork of gcc and other Gnu software.
>
> I think this is rash.  I honestly don't see anything in GPL3 that's

Re: GPLv3

On Sat, 30 Jun 2007, Richard Laager wrote:

> If MIMEDefang is GPLv2-only right now, then you can't change that
> without getting consent from every other copyright holders or replacing
> that code.

MimeDefang is _not_ GPLv2-only right now:

Quote from mimedefang.pl:
"# This program may be distributed under the terms of the GNU General
# Public License, Version 2, or (at your option) any later version.
"

GPLv2 did foresee this situation 
So a shift to GPLv3 is possible regardless of any patches.

Bye,

--

-- 
Steffen Kaiser

Filtering idea for stock pump&dumps

Looking at a plain text stock pump and dump spam, the idea (good or bad is 
yet to be seen) struck me that if we could get a list of all the stocks 
being traded on the bulleting boards and other minor exchanges, we could 
use that to block this type of spam.  The message in question only hit on 
the Bayes rule, which generated a number of false positives, so it only 
adds 4.5 points, just shy of blocking messages.

Is such a list of companies and their codes easily available? 

Would it be hard to put into Spamassassin/MIMEDefang/CanIt?

Downsides?

---
The Kool-Aid from Redmond is powerful stuff.  -- Gregg Eldred

William Brown
Web Development & Messaging Services
Technology Services, WNYRIC, Erie 1 BOCES
(716)821-7285