Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's not a bad question to ask; the FSF has proven in the past to be rather uninterested and unhelpful in helping developers of medical software get their stuff licensed in a way that's either compliant or as close to as[0] being compliant as possible[1]. Instead they opted to chide those wanting help for not being true believers of the cause and told them they'll never compromise. Basically the usual "FSF is only ever willing to do FOSS in it's own Ivory Tower even though its mission is to spread it beyond an Ivory Tower."

That said - RMS has iirc said in the past that for medical emergencies he's willing to make a personal exception on this stance.

[0]: Medical devices can't be GPL compliant due to the anti-Tivo clause combined with regulations of the FDA that demand that a medical device will always behave the exact same way in the exact same situation. This is also extended to the software, meaning that not being allowed to reflash the software if you're not the manufacturer is a requirement.

[1]: https://www.fsf.org/blogs/licensing/gplv3-fda



This is wrong, the GPLv3 only requires installation information for "User Products" (as defined in the license) which the manufacturer can update even if the user can't. Most medical equipment isn't User Products and can't simply be updated by the manufacturer for regulatory reasons.

That article was written before the finished GPLv3 was published, they had only published a stricter draft.


User Products would I'm pretty sure still target things like pacemakers and other daily technological appliances some people need to get around and I'm fairly sure those require the same FDA approval process.

Therefore; I'm not wrong.


"Medical devices can't be GPL compliant due to the anti-Tivo clause combined with regulations of the FDA that demand that a medical device will always behave the exact same way in the exact same situation."

What is the anti-tivo clause?


Ok so that requires a bit of history. There's this company that makes video recorders (for your TV) called TiVo; it's not an abbreviation for anything, that's just the name.

--

Anyway, TiVo wanted to get onto the GPLv2 train like a lot of companies, but they also wanted people owning their devices to be unable to partially modify their firmware even as they distributed their copies of the firmware onto TiVo boxes. They enforced this by having a digital signature check that only allowed TiVos own software to run if the software stack was entirely TiVo. It would also work if the stack was entirely FOSS because only TiVo checked it.

For the sake of clarity; Bradley Kuhn of the SFC iirc investigated the TiVo boxes at the time, the signature checks only were an issue if you partially replaced TiVos software, not if you went the whole hog on replacing it; excercising GPLv2 rights was completely possible and you could turn a TiVo box into a XBMC (these days that's Kodi) box. You just couldn't run TiVos software ever again if you did that thanks to a hardware check.

The FSF took personal offense to this practice and dubbed it "Tivoization", which is a shorthand for "attempting to restrict the ability to install or link with Free Software via hardware DRM". (Which yes, is a modification of what TiVo actually did but really that part is just par for the course with the FSF.)

As a result, the GPLv3 includes an explicit clause that if your software is distributed in a non-code form, that you also must distribute all the information required to be able to modify that distributed software, if there's parts on the device that prevent you from doing so. (Or in plain terms: on restricted hardware, you must give up the signing keys if you preload the hardware with FOSS software.)

--

This clause is usually just called the anti-Tivo(ization) clause and it's... pretty damn controversial. It's the main reason why the Kernel is still GPLv2 and not GPLv3; Linus Torvalds personally considers this clause to be a significant enough alteration of the "deal" that FOSS provides for the kernel, so he didn't upgrade (which to be clear would've also been very difficult since the kernel is 2.0-only, not or-later, so he'd require approval from all significant contributors at that point). It's also often cited as the main reason why the GPLv2 has/had strong corporate backing but software licensed under the GPLv3 has always kinda had issues with that; the v2 was seen as more "fair" in that companies were willing to work with its terms, while the v3 was seen as basically forcing them to give up important parts of their trade secrets and made them antsy of working with the FSF in general.

And as mentioned before, in some fields (medical is the one I know of, but I'm pretty sure there's a few others), regulatory compliance is impossible with v3 while very much possible with v2 because of this clause.


Thanks for the detailed explanation and ugh, it is so frustrating. I get and share the goal of being able to fully control your devices - but you have to work with what you have. And I think this fanatism and uncompromising attitude is really not helpful in getting there.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: