GPL 3 to Take Hard Line on DRM

sebFlyte writes "ZDNet is reporting that Eben Moglen, the FSF's lead lawyer and the co-authour of GPL3, has explained that DRM is 'fundamentally incompatible' with the aims of the FSF and will be given short shrift in the latest version of the free software licence, which bans the use of 'digital restrictions' in GPL3 governed software. In his words: 'I recognise that that's a highly aggressive position, but it's not an aggression which we thought up. It's a defence related to an aggression which was launched against the people whose rights are our primary concern... We don't want our software used in a way which batters the head of the user to please somebody else. Our goal is the protection of users' rights, not movies' rights.'" We discussed the new GPL on Monday.

Re:My problem with DRM...

[cronius]

If you really appreciate writing, wouldn't you want as many as possible to have access to and read your books, even if the majority didn't pay you? (In contrast to only a few/lesser reading your works, but everyone reading them also paid you.)

Re:Signed packages

[KiloByte]

I demand that Red Hat immediately hand over all their private keys!

Wrong. GPLv3 says that you need to provide all keys needed to make the software functional for its intended purpose, not the keys needed to make a bit-for-bit identical package.

Thus, if your piece of software is supposed to be able to read scrambled data, you cannot hide the decryption key -- but, you are free to sign the packages to prove they are untampered binaries produced by you. In the former case, the program wouldn't work, in the latter, it just will trigger a warning from the OS which says the user is about to install unsigned binaries. No one forces the user to heed the warning, and she can disable it if she wants. No functionality is lost.

Re:Shooting yourself in the foot?

[_xeno_]

The GPL isn't, actually, a "play nice" style license as such - the entire concept is that it "guarentees freedom," trying to balance the freedoms of both the creator and the user. The Free Software Foundation is about the "right to tinker" (Stallman's words at the GPLv3 release), and that includes the right to tinker with a program's data files.

Stallman is, essentially, an idealist. He wants to save the world - and he seems to honestly believe that allowing DRM to exist would destroy free software. So he's taken a hard-line stance against DRM in the GPLv3.

It's sort of explained in the rational behind Section 3 [fsf.org], which I'm just going to quote outright since it's so short:

DRM is fundamentally in conflict with the freedoms of users that the GPL is designed to safeguard, but our ability to oppose DRM by means of free software licenses is limited. In section 3 we provide developers with some forms of leverage that they can use against DRM. The first paragraph essentially directs courts to interpret the GPL in light of a policy of discouraging and impeding DRM and other technical restrictions on users' freedoms and illegal invasions of users' privacy. This provides copyright holders and other GPL licensors with means to take action against activities contrary to users' freedom, if governments fail to act.

The second paragraph of section 3 declares that no GPL'd program is part of an effective technological protection measure, regardless of what the program does. Ill-advised legislation in the United States and other countries has prohibited circumvention of such technological measures. If a covered work is distributed as part of a system for generating or accessing certain data, the effect of this paragraph is to prevent someone from claiming that some other GPL'd program that accesses the same data is an illegal circumvention.

This affects content creation only

[jdoeii]

The proposed restriction would affect software for the content encryption only, i.e. the server side of the DRM.

Suppose, someone made a GPL 2 compliant DRMed book reader. The reader comes with the source, so there is no possibility of security through obscurity, the source can be modified and recompiled. In order to read the DRMed content it must be decripted. That means a secret key has to be given to the user, and passed to the reader. The source for the reader is available and can be modified to save the key or the decrypted copy. Consequently, GPL2 is sufficient to make client-side DRM ineffective.

Client-side DRM software, at least in its present form, depends on the closed source software, on obscurity. GPL3 restriction would only affect content creation, the encryption part of the DRM.

Hardware-assisted DRM may be different, but I can't see it right now.

Re:I'm not so sure this is a good idea.

[_xeno_]

That said, I'm not sure this is a good idea. What they're saying is that there is absolutely, positively no good use for DRM, and there never will be, in free software.

Actually, this came up at the GPLv3 conference. The example used was Tripwire. The general concept was that you'd sign all the binaries on your system, and then set up the kernel to only run signed binaries. If something tried to change a binary, than the signature would fail, and the program wouldn't run.

It's unclear whether or not that would really be disallowed under the GPLv3, but it was at least brought up.

It's worth mentioning, because Slashdot hasn't really made it clear, that the GPLv3 is not finalized yet. People who have issues with it are strongly encouraged to post comments on it [fsf.org] and get involved with the process. The GPLv3 is currently scheduled to be finalized between November 2006 and February 2007 - the current GPLv3 is a draft, and changes can and most likely will be made to it.

Re:GPL3 players for DRMed media illegal then?

[_xeno_]

GPLv3 is not perfect and it has many warts, so bad that I would go Linus' way (pure v2) at this moment, but the DRM clause is one of its stronger upsides.

The GPLv3 isn't finalized. The Slashdot blurbs haven't really made this clear, but the current version is a draft. It's allowed to have warts. If you have issues with it, comment on them [fsf.org]! The GPLv3 is still a draft. Changes can happen. Get involved. Be heard. [fsf.org] It's an open process.

Re:Feels overbroad

[oneandoneis2]

RTFA: GPL software cannot use "digital restrictions" on copyright material

Is your hardware copyright material? No? Then you can do what you like, can't you?

Re:My problem with DRM...

[squoozer]

I am also confilicted on this matter, or at least I was. I have written my fair share of material which I want people to read and enjoy. I admit that most of the material I have written I have done so in order to draw people to my website so that I can make money off them but that doesn't really change the issue regarding copyright.

I made the decision to release my work without any form of DRM but a clear copyright notice which grants certain additional rights such as the right to print out a copy of the work. My thinking is this: I don't want to restrict and annoy the vast number of people that aren't doing anything a reasonal person wouldn't do with the work. If someone is redistributing the work without permission or passing it off as their own there are existing laws in place to punish these people and I will persue this path.

Perhaps I am living in a dream world but I hope that by treating my consumers in a mature manner they will in turn respect my work more.

What it ACTUALLY forbids:

[oneandoneis2]

Some of the comments are nonsense like applying this to file permissions. So before you flame the decision, read it. Excerpt from the GPL:

As a free software license, this License intrinsically disfavors technical attempts to restrict users' freedom to copy, modify, and share copyrighted works. Each of its provisions shall be interpreted in light of this specific declaration of the licensor's intent. Regardless of any other provision of this License, no permission is given to distribute covered works that illegally invade users' privacy, nor for modes of distribution that deny users that run covered works the full exercise of the legal rights granted by this License.

In other words: This applies only to DRM that attempts to block copying of copyright material. Not Trusted Computing, not file permissions, not anything else.

Ok?

Upset about the new GPL?

[JackDW]

Perhaps you don't like RMS's clearly political meddling here - what is he doing, trying to control what the GPL is all about, and making it oppose DRM?

Well, it's not really a change. In spirit, the GPL has always opposed DRM. DRM, like proprietary software, takes away the control and freedom of choice that an end user should enjoy, and gives it to someone else. The GPL has always stood against the effects of proprietary software, on behalf of programmers and expert users. Now, it stands against those effects on behalf of every computer user too. Companies have an ethical choice when it comes to DRM, and I do hope that the actions of the FSF will serve to highlight this.

Re:Great Firewall of China?

[bjheu]

I think it's an issue of enforceability. Freedom is relative given what area of the globe you are in. In the U.S for example we have the right to freely speak against our government, in China that is not a guaranteed right. Therefore by the letter of the law there is nothing that a software license can do about it. Also what's to keep foreign countries from ignoring a U.S. Copyright law or two?

Re:My problem with DRM...

[MBGMorden]

I quit buying iTunes songs because of their DRM. My car CD player will play a disc full of MP3's just fine. I can fit around 12 hours of music on a CD by burning MP3's to it.

Apple's DRM only lets me make a Redbook-audio format CD, thus reducing my CD capacity by almost 90%. All becaues of ARTIFICIAL limitations. I could technically burn it to redbook first, then rerip back to MP3, but that hassle simply isn't worth it.

Re:Sony fiasco related?

[mrchaotica]

I'm not sure how many banks give out loans to cover lawyer fees in order to file a lawsuit.

Banks don't do that; lawyers themselves do. Look up "pro bono" and "contingency."

Re:My problem with DRM...

[Nahor]

I know that I, personally, have spent *way* too much money on Baen books over the last two or three years. If there are others like me, and I'm sure there are, it's no wonder Baen is doing well.

Same here. I first read their free books, then I started to buy. I currently have 160+ books from them, 75 of which were bought. They are nearly my sole source of leisure reading material.

Re:Sony fiasco related?

[2b]

I don't remember seeing any example of anyone being punished for it. Are there any such examples?

The GPL is very enforcceable, but I'm not sure what you mean by "punished". Harald Welte(sp?) has won some legal victories over companies that were distributing his code in violation of the GPL - see http://www.gpl-violations.org/ [gpl-violations.org] for more info. The FSF also has a GPL compliance lab [fsf.org] which has successfully enforced the GPL although they tend to work behind the scenes so I don't know if they have any public examples of the work that they've done.

Re:It's about freedom

[JoeBuck]

While RMS tells the printer driver story in all his speeches, that's not really what kicked off his crusade.

When Symbolics, Inc. hired away almost all of his colleagues at the MIT AI Lab and had them make all their extensions to the MIT code proprietary, RMS went on an incredible hacking binge, single-handedly duplicating the work of an entire small company and making all his code free. At his peak, he demonstrated that he could out-code whole teams of world-class experts (as long as we're talking about Lisp coding). The problem is, at the time he hadn't thought of copyleft yet; the Symbolics people could use his code; he could not use their code.

He needed copyleft to be able to compete with proprietary software developers and have a chance of winning. Same deal with Linux.

Re:Greater Gnu General Public Licence

[iabervon]

I'm not so such that the particular DRM scheme that the GPL prohibits is one that kernel developers would want to support. It's prohibiting selling devices which have GPL firmware but require binaries signed with a private key that isn't included in the source, so that people can't actually install modified versions. The current draft seems to prohibit any systems which use signing and have a public key whose matching private key isn't included, but they've said that they want to fix this issue in later drafts. (So that, for example, GNU TLS could give RMS's public key as an example without giving his private key as well) Most likely, the result will be that a program which includes a public key without the corresponding private key must be modifiable to replace the public key with a different one.

The other anti-DRM measure is that it includes a denial of the magic statement in the DMCA, such that, in case anybody thought that you could stop somebody from defeating your GPLv3-licensed copy protection by suing them under the DMCA, they're wrong. Of course, a GPL-licensed copy protection scheme is going to be easy to defeat, anyway, since all versions of the license require that the user be able to modify the code to remove it, so it couldn't really work as a practical matter. Of course, some level of DRM is fine: the user of a program should be able to prevent other people from getting the data; sending encrypted documents and maintaining privacy is a fine use for GPL software. The point is that it is the person who runs the program who can choose whether or not to include each check, not some vendor or other entity.

So as a practical matter, the only situation in which DRM and the GPL could be used together was when a single system had a GPL portion and an immutable, vendor-chosen portion, and the vendor-chosen portion has the ability to inspect the GPL portion for changes. This isn't something that anyone who releases code under the GPL is likely to want to encourage, although there's a slim chance that people would choose the GPL over the BSD license out of curiousity, hoping to see the source to modified and distributed versions they can't actually run.

Re:Greater Gnu General Public Licence

[MooUK]

Linus may have to stick with v2 because he cannot change the license on anything he doesn't own, and the linux kernel is licensed under v2 ONLY. It's been said elsewhere in this thread.