Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Friday December 11 2015, @07:21AM   Printer-friendly
from the hidden-in-plain-site dept.

From the fine folks over at net-security.org comes this interesting announcement:

ZeroDB, an end-to-end encrypted database whose release was announced earlier this year, is now open source.

Developers MacLane Wilkison and Michael Egorov changed the license from proprietary to AGPLv3 on Monday, and invited the public to use it: "Try it, build awesome things with it, break it. Then tell us about it."

ZeroDB is based on the eponymous protocol that allows end-to-end encrypted queries, which in turn allows encrypted data to be stored on untrusted servers (e.g. in a public cloud).

[...] "In ZeroDB, the client is responsible for the database logic. Data encryption, decryption and compression also happen client side. Therefore, the server never has any knowledge about the data, its structure or order," it is explained in the documentation.

"Since the server has no insight into the nature of the data, the risk of a server-side data breach is eliminated. Even if attackers successfully infiltrate the server, they won't have access to the cleartext data," the developers pointed out.

No, NCommander, we don't need to switch databases twice in a year. Wait till 2016 at least.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 4, Informative) by NCommander on Friday December 11 2015, @09:04AM

    by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @09:04AM (#274890) Homepage Journal

    I could have worded that better. You're fine as long as you're not shipping GCC itself as part of your application. Applications compiled with GCC are linked against libgcc (which is GPLv3) + system libc, Normally, this would cause the GPLv3 to apply, but there is a runtime exception for libgcc that protects you from having to license your software GPLv3. Thus any software compiled against GCC can be distributed freely under any license, proprietary or open source.

    The problem comes from redistribution of GCC by operating system developers. Under the GPLv2, you could distribute GCC as part of a BSD work, and as long as the source of GCC was made available, you're in compliance of the license; this allowed for for the BSD projects to put GCC it the gpl folder, and keep it to the side without affecting the project as a whole. The problem is that the moment you start distributing GCC in a collected work such as an operating system, its anti-patent and anti-tivozation clauses would affect the entire work since you're distributing GPLv3 source code along with BSD licensed source code. That was the breaking point for the BSDs.

    The patent clause is what broke commercial developers. The GPLv3's language is very broad:

    "you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it."

    IANAL, but my read on it is basically, if you ship GCC as part of your operating system, the patent clause affects the entire thing. Same thing for the tivozation clause. That's why the GPLv3 is toxic to corporations.

    Compare it to the Apache2 version, which instead is a patent grant related to the work: "Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted."

    Much more clear on the scope, and much easier for anyone to digest.

    --
    Still always moving
    Starting Score:    1  point
    Moderation   +2  
       Informative=2, Total=2
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   4  
  • (Score: 1, Interesting) by Anonymous Coward on Friday December 11 2015, @10:16AM

    by Anonymous Coward on Friday December 11 2015, @10:16AM (#274906)

    ' "you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it."

    IANAL, but my read on it is basically, if you ship GCC as part of your operating system, the patent clause affects the entire thing. Same thing for the tivozation clause. That's why the GPLv3 is toxic to corporations. '

    I don't see how the patent clause affects the rest of the OS at all. Where do you see that? It is talking about the program under the license. In this example GCC. GCC is not part of the operating system in any way. It is a program, you can run on the OS. The OS does not use any part of the GCC, except maybe it was compiled with it, but that, as you said, is protected by the runtime exception. This just means that if you distribute GCC GPLV3, you can't claim that GCC GPLV3 infringes your patents. If you bake GCC GPLV3 or any part of it into your code and distribute it, then the normal GPL rules apply and your code becomes GPLV3 as well. Also you can't charge money for handing over the source or demand money from someone making changes to GPLV3 programs.

    • (Score: 2) by NCommander on Friday December 11 2015, @10:22AM

      by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @10:22AM (#274909) Homepage Journal

      Ugh, this is why I shouldn't post when I'm half dead. I posted the text of Apache2 in that spot. The actual patent text from the GPLv3 is:

      You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.

      It's the reading of the term "import" which suggests it applies when incorporated as part of a larger distribution. The fact is I'm not a lawyer, and I'll go dig out the revelant threads from the FreeBSD mailing list when I'm less zombie. I'm going to bail out of this until tomorrow after I've slept a good 8 hours.

      --
      Still always moving
      • (Score: 0) by Anonymous Coward on Friday December 11 2015, @12:00PM

        by Anonymous Coward on Friday December 11 2015, @12:00PM (#274929)

        It's the reading of the term "import" which suggests it applies when incorporated as part of a larger distribution.

        When has "import" ever been used to mean "incorporated as part of a larger distribution" in a legal context? The GPL is a legal document, not a programming one.

        Personally, I can't see how "import" in this context could be interpreted as meaning anything other than "transfer from one legal jurisdiction to another". For example: "libfoo is developed and licensed for the EU. If you wish to use libfoo in the US, you must license our patents or we will sue".

      • (Score: 4, Informative) by Anonymous Coward on Friday December 11 2015, @01:26PM

        by Anonymous Coward on Friday December 11 2015, @01:26PM (#274953)

        Evidence that you're misreading:

        GPLv3, [www.gnu.de] section 5, last paragraph

        A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

        So the license states quite explicitly that the license does not apply to other parts of a distribution which are independent of the covered work (i.e. the GPLv3-licensed code). Of course if the license does not apply, then this is true for any clause of the license, including the patent clause.

        In short: If you distribute a GPLv3 GCC with your OS, then the rest of the OS will not automatically be covered by the GPL, except for code that makes explicit use of GCC's code.

        Now if you compile with GCC, other considerations come into play, because the compiled code explicitly contains code from the GCC runtime library. However, that library contains the following exception:

        You have permission to propagate a work of Target Code formed by combining the Runtime Library with Independent Modules, even if such propagation would otherwise violate the terms of GPLv3, provided that all Target Code was generated by Eligible Compilation Processes. You may then convey such a combination under terms of your choice, consistent with the licensing of the Independent Modules.

        See https://www.gnu.org/licenses/gcc-exception-3.1-faq.en.html [gnu.org] for details.