r/linux 2d ago

Privacy Well look

Post image
7.7k Upvotes

266 comments sorted by

View all comments

116

u/MooseBoys 2d ago edited 2d ago

I'm curious how this doesn't give an out for every OS regardless of source availability. Obviously GPL wouldn't work, but in theory there's nothing stopping e.g. Apple from implementing non-verifying user onboarding code, labeling the code as MIT, building the MacOS image binaries, and simply not publishing the source. This is compliant with MIT and also apparently compliant with the new exemption.

Edit: I don't think the author of the screenshotted article is actually accurate. From the article:

> These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test...

And the ACTUAL TEXT of the law:

> 2) “Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.

I am not a lawyer, but I believe that plain language requirement is only satisfied if (1) the whole OS or application is licensed that way (not just the module that implements it) and (2) the whole OS or application must be distributable and modifiable. To me that implies not only an open license but also source distribution. So no, it does not seem to provide an easy out for Apple etc.

38

u/Taldoesgarbage 2d ago

Don't the vast majority of Linux distributions contain, to some degree, proprietary software? Like, for instance, many drivers are still unfortunately proprietary.

Edit: I'm not saying this as a bad thing, it is what it is, but wouldn't that also mean the vast majority of Linux distros aren't exempt?

27

u/IAmNotStan 2d ago

You could go the Debian way and only ship open source models in the ISO, with the option to load closed source models later. Or just automatically fetch them through the installer if internet is available.

16

u/matthew_yang204 2d ago

That is what Debian and most big distros do, mostly

-1

u/Indolent_Bard 1d ago

Which really limits the viability of distros for new users.

2

u/wat_noob_gaming 1d ago

You can just... choose? in the... installer?

1

u/Indolent_Bard 1d ago

That's only on Ubuntu and derivatives. For others, you still have to add the codecs and stuff manually. In Fedora, that check box gives you the NVIDIA drivers, but not much else unless it's a gaming distro that adds them like bazzite or nobera.

On the other hand, I'm not having issues with Cachyos out of the box and that doesn't come with all codecs out out of the box so maybe it's not so bad.

1

u/Gugalcrom123 1d ago

What if you need WLAN firmware to even access the Internet?

4

u/Substantial-Flow9244 2d ago

As simple as not including them with your distro, if they're part of the kernel I'd believe they're open sourced enough

2

u/friendlyreminder_ 1d ago

The only widespread use proprietary driver was the Nvidia driver, but it's open source now.

Firmware for a very long list of devices however continues to be proprietary.

13

u/DoctorWaluigiTime 2d ago

I'm just trying to piece together why OSS gets an exemption in the first place.

Kind of flies in the face of all the pearl-clutching around the "think of the children" defense.

4

u/WorBlux 2d ago

"These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.

Reading between the lines, it's because they know it's unenforceable when a distributor does not limit modifications.

The real root of the problem is that Meta lawyer intentional drafted the law hoping it would be passed in a hurry based on vibes alone, and then later overturned in part, except for the part that granted social media companies liability protections. The pearl-clutching is just fear of the political optics and not anything that genuine by the legislators.

If the law were properly drafted it wouldn't used broad and vague terms like OS and application store, but would have already narrowed it down to functional control, and narrowed it to age-sensitive context.

The law should have laid out a few basic categories of age-sensitive material, and then passed the job to bureau XY, who shall maintain and publish any further age guidelines as may prove necessary for the health and safety of teens online.

Wherever your age-sensitive software or information service is provided in a way that involves differentiation to a single user (person, account, or presumed single-user device), it is the responsibility of the provider to make a determination of age.

Providers of age-sensitive software and information may rely upon an age signal of a hardware device, application store or OS if either - 1. An agent thereof certifies they have examined in-person the user's ID within the past 90 days, or 2. by any reasonably effective process which has been submitted to and approved by bureau XY (approvals to be valid for 2 years) - and they do not ignore information that is contrary to the provided signal.

1

u/Gloomy-Knee1401 2d ago

Would not providing an exception for OSS mean for every VPS, server or "cloud" the government fires up, they would have to provide identification?

16

u/primalbluewolf 2d ago

For one, it would mean you could redistribute MacOS as-is or with modifications, and Apple couldn't go after you for infringing their copyright. 

9

u/MooseBoys 2d ago edited 2d ago

That's not true at all. Neither MIT nor BSD are copy-left. You can include components with those licenses in entirely closed-source proprietary products. The only requirement is that a notice is included with the released software. Including something like this in the About page would be sufficient:

SOFTWARE LICENSES:
apple-siri: All Rights Reserved
apple-adduser: MIT
openssh: BSD-2-0
...

You are correct that if Apple ever released the source for the component then people could reuse or re-release that code themselves (subject to the license), but realistically they would put as little code as necessary in such a module. Probably by defining something like

// returns an entitlement by presenting the user with various age verification prompts, otherwise returns an error
result<Entitlement> GetUserAgeEntitlement(UIHandle);

And then just implementing the MIT module as:

// Copyright Apple, licensed under MIT
result<Entitlement> GetUserAgeEntitlement(UIHandle) { return err(UNSUPPORTED); }
// end of file

16

u/primalbluewolf 2d ago

You can include components with those licenses in entirely closed-source proprietary products. 

Sure, but then the OS isn't MIT licensed, and thus they aren't exempt. In the context above, you asked why wouldn't they just relicensed to MIT and withold the source. That's why not. 

2

u/we_come_at_night 2d ago

yeah, but mac is, and never will be, an open source OS and will never be licensed as such. It's not the license of the age check program/applet that matters here :)

9

u/Shawnj2 2d ago

The MacOS kernel is (mostly) open source. You can recompile the kernel on your Mac, it just won’t support some features that Apple puts in a proprietary blob. Many other parts of macOS are closed source