<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: GPL Endrun: Value-Added Binaries</title>
	<atom:link href="http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/</link>
	<description>Free and Open Source Software News and Opinion</description>
	<lastBuildDate>Tue, 22 Nov 2011 12:44:40 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1.2</generator>
	<item>
		<title>By: nautical</title>
		<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/comment-page-1/#comment-362</link>
		<dc:creator>nautical</dc:creator>
		<pubDate>Tue, 16 Mar 2010 00:11:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.the-source.com/?p=564#comment-362</guid>
		<description>I&#039;d say it depends on what compilation techniques are used. If the binaries are hardened because the compiler writers employed clever tricks, there&#039;s not much one can do but try and reverse engineer those tricks.

If the compiler includes extra bytes to make sure everything is safe those bytes must originally come from some source code.

It&#039;s not hard to imagine a compiler automatically inserting eg a banner that displays itself before the compiled program jumps to its original main function for every program it compiles, even though the code for this banner is nowhere in the original source code. Since it must come from somewhere, it&#039;s probably embedded in the compiler.
Note that this is only a problem when *distributing* the banner-infested program, where you can&#039;t comply with the GPL since you&#039;d need to distribute the source code of the program *and* the source of the compiler of which there is a tiny bit embedded in the binary. Users would still be free to use this banner-adding compiler to compile binaries for use on their own computers.</description>
		<content:encoded><![CDATA[<p>I&#8217;d say it depends on what compilation techniques are used. If the binaries are hardened because the compiler writers employed clever tricks, there&#8217;s not much one can do but try and reverse engineer those tricks.</p>
<p>If the compiler includes extra bytes to make sure everything is safe those bytes must originally come from some source code.</p>
<p>It&#8217;s not hard to imagine a compiler automatically inserting eg a banner that displays itself before the compiled program jumps to its original main function for every program it compiles, even though the code for this banner is nowhere in the original source code. Since it must come from somewhere, it&#8217;s probably embedded in the compiler.<br />
Note that this is only a problem when *distributing* the banner-infested program, where you can&#8217;t comply with the GPL since you&#8217;d need to distribute the source code of the program *and* the source of the compiler of which there is a tiny bit embedded in the binary. Users would still be free to use this banner-adding compiler to compile binaries for use on their own computers.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jason</title>
		<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/comment-page-1/#comment-361</link>
		<dc:creator>Jason</dc:creator>
		<pubDate>Mon, 15 Mar 2010 22:48:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.the-source.com/?p=564#comment-361</guid>
		<description>These are all great comments - thanks so much to everyone weighing in.

I think there is a distinction between a &quot;cheating&quot; compilation scenario - this would be where the source is encrypted, obscured, digitally signed or whatever, and an &quot;value-added&quot; compilation scenario - this would be where the source is the source and the compiler produces &quot;safer&quot;, &quot;faster&quot;, &quot;better-tasting&quot; binaries.

It seems to me that in the first (cheating) scenario - there are GPL problems, but in the second there are not.</description>
		<content:encoded><![CDATA[<p>These are all great comments &#8211; thanks so much to everyone weighing in.</p>
<p>I think there is a distinction between a &#8220;cheating&#8221; compilation scenario &#8211; this would be where the source is encrypted, obscured, digitally signed or whatever, and an &#8220;value-added&#8221; compilation scenario &#8211; this would be where the source is the source and the compiler produces &#8220;safer&#8221;, &#8220;faster&#8221;, &#8220;better-tasting&#8221; binaries.</p>
<p>It seems to me that in the first (cheating) scenario &#8211; there are GPL problems, but in the second there are not.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Lex</title>
		<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/comment-page-1/#comment-359</link>
		<dc:creator>Lex</dc:creator>
		<pubDate>Mon, 15 Mar 2010 16:57:20 +0000</pubDate>
		<guid isPermaLink="false">http://www.the-source.com/?p=564#comment-359</guid>
		<description>GLP code compiled with that compiler would be a GPL library/executable. So all the code of that library/executable must be available under GPL, that includes the code generated or otherwise inserted by the compiler. If the company would try to sell such executables they would be forced to release parts/all of their compiler under GPL.

The real problem to be concerned about is inability for anyone to decompile the code to the original source. This way it becomes impossible to verify if the program was compiled from GPL source or not. So it becomes feasible to compile GPL code and lie that you are the developer of the code, while selling binaries.</description>
		<content:encoded><![CDATA[<p>GLP code compiled with that compiler would be a GPL library/executable. So all the code of that library/executable must be available under GPL, that includes the code generated or otherwise inserted by the compiler. If the company would try to sell such executables they would be forced to release parts/all of their compiler under GPL.</p>
<p>The real problem to be concerned about is inability for anyone to decompile the code to the original source. This way it becomes impossible to verify if the program was compiled from GPL source or not. So it becomes feasible to compile GPL code and lie that you are the developer of the code, while selling binaries.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michael Johnson</title>
		<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/comment-page-1/#comment-347</link>
		<dc:creator>Michael Johnson</dc:creator>
		<pubDate>Wed, 10 Mar 2010 18:32:06 +0000</pubDate>
		<guid isPermaLink="false">http://www.the-source.com/?p=564#comment-347</guid>
		<description>I don&#039;t believe it&#039;s a problem. First, source is available as per the GPL. Second, the binaries are not locked up. You can happily recompile source with another compiler and replace the Softbound binary.

The only place I think this will run afoul (and this is purely hypothetical) is if you have a platform that requires binaries compiled using Softbound&#039;s proprietary tools. I believe that will pass the GPL2 but not GPL3. Since Softbound is not making the tools available to compile the code for the platform in a manner compliant with GPL3&#039;s anti-Tivoization clauses, it would violate those clauses.</description>
		<content:encoded><![CDATA[<p>I don&#8217;t believe it&#8217;s a problem. First, source is available as per the GPL. Second, the binaries are not locked up. You can happily recompile source with another compiler and replace the Softbound binary.</p>
<p>The only place I think this will run afoul (and this is purely hypothetical) is if you have a platform that requires binaries compiled using Softbound&#8217;s proprietary tools. I believe that will pass the GPL2 but not GPL3. Since Softbound is not making the tools available to compile the code for the platform in a manner compliant with GPL3&#8242;s anti-Tivoization clauses, it would violate those clauses.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: saulgoode</title>
		<link>http://www.the-source.com/2010/03/gpl-endrun-value-added-binaries/comment-page-1/#comment-346</link>
		<dc:creator>saulgoode</dc:creator>
		<pubDate>Wed, 10 Mar 2010 11:51:15 +0000</pubDate>
		<guid isPermaLink="false">http://www.the-source.com/?p=564#comment-346</guid>
		<description>I fail to see why this is an issue. 

&lt;blockquote&gt;A company, using a proprietary and closed “value-added” compiler compiles GPL software and sells the binaries. Source code available. Binaries locked up tight.&lt;/blockquote&gt;

The binaries are not &quot;locked up tight&quot; -- if the original software was GPLed then the binaries are also under the original GPL licensing (GPLv2 §2a or GPLv3 §5c). This means that recipients of the binaries are free to use them without restriction, to demand copies of the source code, and to make and share copies of both the source &lt;strong&gt; and the binaries&lt;/strong&gt;. 

ESR seems to be suggesting that one can produce non-GPLed binaries from GPLed source code -- permission for such re-licensing is not granted by the GPL and is otherwise prohibited by copyright law, regardless of what build chain is employed.</description>
		<content:encoded><![CDATA[<p>I fail to see why this is an issue. </p>
<blockquote><p>A company, using a proprietary and closed “value-added” compiler compiles GPL software and sells the binaries. Source code available. Binaries locked up tight.</p></blockquote>
<p>The binaries are not &#8220;locked up tight&#8221; &#8212; if the original software was GPLed then the binaries are also under the original GPL licensing (GPLv2 §2a or GPLv3 §5c). This means that recipients of the binaries are free to use them without restriction, to demand copies of the source code, and to make and share copies of both the source <strong> and the binaries</strong>. </p>
<p>ESR seems to be suggesting that one can produce non-GPLed binaries from GPLed source code &#8212; permission for such re-licensing is not granted by the GPL and is otherwise prohibited by copyright law, regardless of what build chain is employed.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

