Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Friday December 11 2015, @07:21AM   Printer-friendly
from the hidden-in-plain-site dept.

From the fine folks over at net-security.org comes this interesting announcement:

ZeroDB, an end-to-end encrypted database whose release was announced earlier this year, is now open source.

Developers MacLane Wilkison and Michael Egorov changed the license from proprietary to AGPLv3 on Monday, and invited the public to use it: "Try it, build awesome things with it, break it. Then tell us about it."

ZeroDB is based on the eponymous protocol that allows end-to-end encrypted queries, which in turn allows encrypted data to be stored on untrusted servers (e.g. in a public cloud).

[...] "In ZeroDB, the client is responsible for the database logic. Data encryption, decryption and compression also happen client side. Therefore, the server never has any knowledge about the data, its structure or order," it is explained in the documentation.

"Since the server has no insight into the nature of the data, the risk of a server-side data breach is eliminated. Even if attackers successfully infiltrate the server, they won't have access to the cleartext data," the developers pointed out.

No, NCommander, we don't need to switch databases twice in a year. Wait till 2016 at least.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 5, Insightful) by NCommander on Friday December 11 2015, @07:31AM

    by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @07:31AM (#274856) Homepage Journal

    I won't touch anything with the AGPLv3; its the license people use when you want to say you're open source but make sure no one touches it. While we could meet the requirements for it, I don't want to have to keep track of what version we're using and publish the source each time we update it as required by that license.

    Also, we just switched variants of MySQL, not an entirely new platform. PostgreSQL (or at least a clustering variant of it) is still my choice for doing that.

    --
    Still always moving
    Starting Score:    1  point
    Moderation   +3  
       Insightful=3, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   5  
  • (Score: 0) by Anonymous Coward on Friday December 11 2015, @07:43AM

    by Anonymous Coward on Friday December 11 2015, @07:43AM (#274858)

    How dare you not share your valuable innovative changes with the community. What are you, some kind of anticommunist! How dare you use Communist Software with impunity. Neckbeards everywhere shall comb our dirty beards in your direction.

    • (Score: 3, Interesting) by NCommander on Friday December 11 2015, @08:06AM

      by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @08:06AM (#274864) Homepage Journal

      I have no problem publishing the source for rehash (the codebase that powers this site; licensed GPLv2), even if we're not required to by license. However, what defines net access is so vaguely defined as to be barely understandable. Here's an example. Let's assume in a hypothetical world that we switched to an AGPLv3 license. What defines net access? Now visitors don't directly talk to the database; you connect to it by a series of intermediaries, first the loadbalancer, then varnish, then Apache, then rehash, and finally the DB itself. At what point does the net access begin?

      From a legal perspective of any commercial project, that question enough would give lawyers an ulcer. However, the problem gets worse. Let's assume for the moment that net access applies to anyone using the site because its part of our stack. In that case, whenever we update our database, we have to make sure the exact source we built it from is distributed. By the FSF guidelines, to meet the terms of the standard GPL, I need to distribute the exact source of any binary with it and do so via net access, or by post (for no more than the cost of shipping). Simply pointing a link at where I got it from does not meet the terms of the GPL. That means I need to keep track of the exact version at all times, and have that exact version available on the site at all times. That's a logistical pain in the ass, and even though we could use AGPLv3 software, and meet its terms, it means every site update requires an update to our about page.

      Doesn't sound like much. Well, our entire stack probably uses about 30+ perl modules plus their dependencies, plus Apache itself, and all the libraries it linked to. Let's say about 60 components from the kernel up in total (and that's probably a very low estimate when you take in account things like SSL and such). Let's say ten of them changed licenses to AGPLv3. Now I've got to keep track of all that in addition to the database; I can't just pull new ones from CPAN, I have to make sure source tarballs are published, and linked to every time we do a basic update. I don't know about you, but I've got better things to do with my time.

      For the record, I also consider the GPLv3 to be a bad license for much the same reasons on being overly broad, poorly defined and overly complicated for what it does. The Apache 2.0 license handles the patent problem much more cleanly for one, and the GPLv3 limits what *I* can do with the software, RMS is frankly deluded if he thinks the GPLv3 doesn't limit Freedom 0 (freedom to use software however I like) of the FSF manifesto. I single-handy credit it will killed off a large amount of commercial development on FSF projects, as well as alienating most non-GPL projects who have either been stuck with GCC 4.2, or switched to clang.

      --
      Still always moving
      • (Score: 0) by Anonymous Coward on Friday December 11 2015, @08:30AM

        by Anonymous Coward on Friday December 11 2015, @08:30AM (#274875)

        most non-GPL projects who have either been stuck with GCC 4.2, or switched to clang.

        uh ? I'm coding non-gpl projects at work that I compile with gcc 4.8. How is that a problem ? Is there a provision in the GPLv3 that forbids me to do so ? \me worried

        • (Score: 4, Informative) by NCommander on Friday December 11 2015, @09:04AM

          by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @09:04AM (#274890) Homepage Journal

          I could have worded that better. You're fine as long as you're not shipping GCC itself as part of your application. Applications compiled with GCC are linked against libgcc (which is GPLv3) + system libc, Normally, this would cause the GPLv3 to apply, but there is a runtime exception for libgcc that protects you from having to license your software GPLv3. Thus any software compiled against GCC can be distributed freely under any license, proprietary or open source.

          The problem comes from redistribution of GCC by operating system developers. Under the GPLv2, you could distribute GCC as part of a BSD work, and as long as the source of GCC was made available, you're in compliance of the license; this allowed for for the BSD projects to put GCC it the gpl folder, and keep it to the side without affecting the project as a whole. The problem is that the moment you start distributing GCC in a collected work such as an operating system, its anti-patent and anti-tivozation clauses would affect the entire work since you're distributing GPLv3 source code along with BSD licensed source code. That was the breaking point for the BSDs.

          The patent clause is what broke commercial developers. The GPLv3's language is very broad:

          "you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it."

          IANAL, but my read on it is basically, if you ship GCC as part of your operating system, the patent clause affects the entire thing. Same thing for the tivozation clause. That's why the GPLv3 is toxic to corporations.

          Compare it to the Apache2 version, which instead is a patent grant related to the work: "Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted."

          Much more clear on the scope, and much easier for anyone to digest.

          --
          Still always moving
          • (Score: 1, Interesting) by Anonymous Coward on Friday December 11 2015, @10:16AM

            by Anonymous Coward on Friday December 11 2015, @10:16AM (#274906)

            ' "you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it."

            IANAL, but my read on it is basically, if you ship GCC as part of your operating system, the patent clause affects the entire thing. Same thing for the tivozation clause. That's why the GPLv3 is toxic to corporations. '

            I don't see how the patent clause affects the rest of the OS at all. Where do you see that? It is talking about the program under the license. In this example GCC. GCC is not part of the operating system in any way. It is a program, you can run on the OS. The OS does not use any part of the GCC, except maybe it was compiled with it, but that, as you said, is protected by the runtime exception. This just means that if you distribute GCC GPLV3, you can't claim that GCC GPLV3 infringes your patents. If you bake GCC GPLV3 or any part of it into your code and distribute it, then the normal GPL rules apply and your code becomes GPLV3 as well. Also you can't charge money for handing over the source or demand money from someone making changes to GPLV3 programs.

            • (Score: 2) by NCommander on Friday December 11 2015, @10:22AM

              by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @10:22AM (#274909) Homepage Journal

              Ugh, this is why I shouldn't post when I'm half dead. I posted the text of Apache2 in that spot. The actual patent text from the GPLv3 is:

              You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.

              It's the reading of the term "import" which suggests it applies when incorporated as part of a larger distribution. The fact is I'm not a lawyer, and I'll go dig out the revelant threads from the FreeBSD mailing list when I'm less zombie. I'm going to bail out of this until tomorrow after I've slept a good 8 hours.

              --
              Still always moving
              • (Score: 0) by Anonymous Coward on Friday December 11 2015, @12:00PM

                by Anonymous Coward on Friday December 11 2015, @12:00PM (#274929)

                It's the reading of the term "import" which suggests it applies when incorporated as part of a larger distribution.

                When has "import" ever been used to mean "incorporated as part of a larger distribution" in a legal context? The GPL is a legal document, not a programming one.

                Personally, I can't see how "import" in this context could be interpreted as meaning anything other than "transfer from one legal jurisdiction to another". For example: "libfoo is developed and licensed for the EU. If you wish to use libfoo in the US, you must license our patents or we will sue".

              • (Score: 4, Informative) by Anonymous Coward on Friday December 11 2015, @01:26PM

                by Anonymous Coward on Friday December 11 2015, @01:26PM (#274953)

                Evidence that you're misreading:

                GPLv3, [www.gnu.de] section 5, last paragraph

                A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.

                So the license states quite explicitly that the license does not apply to other parts of a distribution which are independent of the covered work (i.e. the GPLv3-licensed code). Of course if the license does not apply, then this is true for any clause of the license, including the patent clause.

                In short: If you distribute a GPLv3 GCC with your OS, then the rest of the OS will not automatically be covered by the GPL, except for code that makes explicit use of GCC's code.

                Now if you compile with GCC, other considerations come into play, because the compiled code explicitly contains code from the GCC runtime library. However, that library contains the following exception:

                You have permission to propagate a work of Target Code formed by combining the Runtime Library with Independent Modules, even if such propagation would otherwise violate the terms of GPLv3, provided that all Target Code was generated by Eligible Compilation Processes. You may then convey such a combination under terms of your choice, consistent with the licensing of the Independent Modules.

                See https://www.gnu.org/licenses/gcc-exception-3.1-faq.en.html [gnu.org] for details.

      • (Score: 2) by c0lo on Friday December 11 2015, @08:49AM

        by c0lo (156) Subscriber Badge on Friday December 11 2015, @08:49AM (#274887) Journal

        However, the problem gets worse. Let's assume for the moment that net access applies to anyone using the site because its part of our stack

        The moment the system architecture says "only the client connects to the DB in a meaningful way", then there is no stack - it's a two tier client server application, no matter how many dumb proxies on the way; yes, anything on they way is dumb if...

        "In ZeroDB, the client is responsible for the database logic. Data encryption, decryption and compression also happen client side. Therefore, the server never has any knowledge about the data, its structure or order," it is explained in the documentation.

        If you think of it, this is as dumb as XBase/MSAccess... sorta MSAccess database file stored in the cloud and accessed remotely, eh?

        (just in case anyone reading is too young to even know what's Xbase [wikipedia.org] about: dBase [wikipedia.org], FoxPro [wikipedia.org], Clipper [wikipedia.org])

        --
        https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
        • (Score: 2) by NCommander on Friday December 11 2015, @09:06AM

          by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Friday December 11 2015, @09:06AM (#274891) Homepage Journal

          I was just referring to the license, not its technical merits. I haven't even looked at the thing, the license alone makes it a complete non-starter. To be fair, Access is a fancy frontend to JetDB, which was meant to be used in a manner similar to SQLite is today; it just happens a lot of people used it for things that it wasn't meant for. You can open MDB files in anything that can speak Jet; there are standard ODBC modules for it.

          --
          Still always moving
      • (Score: 2) by RamiK on Friday December 11 2015, @04:19PM

        by RamiK (1813) on Friday December 11 2015, @04:19PM (#275010)

        Having to publish all your code and all the code you depend on each and every time you release is precisely what the GPLv3 sets out to do.

        Practically speaking, just dump all the Gzips you depend on into a single folder and add a button called "download all (per GPLv3)" that concatenates all the Gzips on-the-fly as one huge download file directly to the stream. If you're extra lazy, go the Mega route and have a horrible client-side javascript do the concatenation and downloading.

        --
        compiling...
        • (Score: 2, Funny) by Osamabobama on Friday December 11 2015, @05:52PM

          by Osamabobama (5842) on Friday December 11 2015, @05:52PM (#275060)

          Can't you just put the source code in a cookie, so that every visitor to the site gets it? Boom! Problem solved.

          --
          Appended to the end of comments you post. Max: 120 chars.
  • (Score: 1, Insightful) by Anonymous Coward on Friday December 11 2015, @10:02AM

    by Anonymous Coward on Friday December 11 2015, @10:02AM (#274902)

    Sure it's a little bit more work but it is valuable work. More to the point isn't it exactly down SN's alley, for the people by the people?

    Everthing is online these days and the "browser is the operating system". That's why we need AGPL, it's a great license.

    Don't dismiss it so quickly amigo!

  • (Score: 0) by Anonymous Coward on Friday December 11 2015, @10:23AM

    by Anonymous Coward on Friday December 11 2015, @10:23AM (#274910)

    Dude...

    As long as you do not modify the Software in question, AGPL does not impose on you any restrictions that
    are not in the GPL already.

    Basically:
        - if you modify the software
        - and someone else may access it via a network
    then you have to provide the source.

    Is it really that hard for you to comply to that?

  • (Score: 4, Informative) by darkfeline on Friday December 11 2015, @10:51AM

    by darkfeline (1030) on Friday December 11 2015, @10:51AM (#274919) Homepage

    I think you misunderstand the GPL, the AGPL, the FSF, and RMS.

    All you would need to do is this:

    1. Someone asks you for the source.
    2. You tell them to go look at the official ZeroDB sources. You offer to look up the exact version used if said person is willing to pay you for the time you spend doing so (perfectly valid according to the *GPL).
    3a. Said person goes to look at sources.
    3b. Said person pays you for your time.
    4. You do a quick package version check on the servers.
    5. You send the person the exact version and a link to the exact version of ZeroDB sources.

    --
    Join the SDF Public Access UNIX System today!
    • (Score: 1) by WillR on Friday December 11 2015, @05:09PM

      by WillR (2012) on Friday December 11 2015, @05:09PM (#275029)
      We're 30 years into this, and it's still not really clear whether "we didn't modify libfoo, here's a link to their source code repo" is a legally acceptable answer to a GPL request.
      • (Score: 0) by Anonymous Coward on Friday December 11 2015, @11:32PM

        by Anonymous Coward on Friday December 11 2015, @11:32PM (#275221)

        Well, the GPL is clear that you are allowed to download a copy of libfoo on their behalf and charge them for the service.

      • (Score: 2) by TheRaven on Monday December 14 2015, @11:54AM

        by TheRaven (270) on Monday December 14 2015, @11:54AM (#276069) Journal
        The answer to that is clear: It is acceptable with GPLv3, it is not acceptable with GPLv2. With GPLv2, you are required to provide the source along with the distribution or an offer good for three years to provide the source (if paid a reasonable copying fee). If you received the binary along with an offer, then you can simply forward this offer.
        --
        sudo mod me up