Interesting conversation, but I think it will work out OK

Posted Jan 10, 2005 21:58 UTC (Mon) by madscientist (subscriber, #16861)
Parent article: Debian and Mozilla - a study in trademarks

I've read all the messages on this on debian-legal, and it seems to me that this is a bit of a tempest in a teapot. No one is arguing that the Mozilla license is not DFSG-free: as someone pointed out DFSG #4 clearly allows mandatory renaming clauses and indeed, Debian has contained other packages with very similar licenses for years. Similarly, DFSG #8 really means that packages whose licenses are changed to be free for Debian only, but where that change doesn't trickle down to Debian users as well, are not considered free. It doesn't mean that Debian can't have *additional* rights, which don't trickle down, as long as the end user, while having less rights, still has a DFSG-free package.

I see absolutely no reason why, from a _legal_ standpoint, Debian can't distribute the Community Edition of Mozilla. The CE is DFSG-free, and the end-user gets a package which is also DFSG-free. The comments about whether Mozilla Foundation is being unreasonable, short-sighted, etc. in their trademark policy is really irrelevant: Debian has no policy requirement that upstream authors be reasonable and have the best interests of Debian or even the F/OSS community in mind... all Debian cares about is that (a) the license meets the DFSG, and (b) there is a Debian Developer willing to package it.

From my reading of the debian-legal threads it seems clear that the sticky points are process-related, rather than legal. Can Debian live with the _process_ restrictions that MF is imposing in order to distribute the Community Edition? The MF seems like it is really willing to work hard and make some critical compromises with the Debian folks, based on Debian's well-deserved reputation for quality and integrity, in order to ensure that Debian can use the CE. It also seems obvious to me that achieving this agreement is in the best interests of both Debian and the MF; I feel confident this will be worked out satisfactorily.

Interesting conversation, but I think it will work out OK

Posted Jan 10, 2005 23:45 UTC (Mon) by kimoto (subscriber, #5244) [Link] (7 responses)

Say it is 2+ years after the release of sarge, and its successor (what, "etch"?) is not out. Debian wants to backport some security fix to the trademarked program. The trademark holder says, "No, it is an embarrassment to us for such an ancient version to be released today. You must build a version based on a more modern version of our program. Sometimes it behaves completely differently now, and it may not even build on some of your obscure architectures; however, we don't care about that."

What is Debian to do? Change their security-fix philosophy (i.e., minimal changes) for the sake of the trademark holder? Release a new .deb that deletes the program completely? Release a new .deb with no content except to depend on moz-iceweasel?

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 0:19 UTC (Tue) by khim (subscriber, #9252) [Link] (2 responses)

Right now Debian released version of Mozilla with known security holes as Debian 3.0r4. If it's Ok to do now - why it's not Ok to do in the future ?

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 11:47 UTC (Tue) by rene (guest, #8057) [Link] (1 responses)

That is because it is more or less impossible to backport the fixes to
mozilla 1.0.

When it was possible it probably was done and will be done in the future.

Interesting conversation, but I think it will work out OK

Posted Jan 13, 2005 4:08 UTC (Thu) by khim (subscriber, #9252) [Link]

Have you even read what was written before ?

I asked: what's so problematic about trademark issue.

I've got answer: it can preclude Debian from backporting bugfixes - and what then to do ?

I ask: duh... this already happened - and what Debian did ?

This time it's technical difference, next time it'll be trademark - what's the difference ?

The poimnt is: if you want to always have ability to backport fixes - then this gig is already lost clause. And if you'll think about it then you'll need to piss Mozilla developers quite severely to made them forbit porting bugfixes.

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 18:12 UTC (Tue) by madscientist (subscriber, #16861) [Link] (3 responses)

Is it really necessary to define a generic policy that Debian must follow for every trademark holder who manages their marks the way Mozilla Foundation is doing? Since the legality is not a question, but only the process, there is no reason not to examine each case individually, taking into account the upstream authors. I'm also not interested in arguing about theoretically possible but wildly improbable situations: the idea that MF would make a request like this of Debian, _especially_ when dealing with a security patch, is completely unrealistic. In fact, the threads on debian-legal raised this very point and MF stated that the terminology about patching, etc. is not intended to cover security fixes. Possibly that's something Debian and MF would want to make part of some kind of agreement, if it's a worry for some.

Anyway, in answer to your question, IF something like this happened then obviously Debian would have to create an "iceweasel" release and, as you say, release a new deb that forced the upgrade.

Note, however, that this work will have to be done ANYWAY, right now, if Debian should decide the CE is not acceptable: Debian already provides a firefox package after all. Personally I'm more of a fan of the XP development model; of KISS; of "if it ain't broke, don't fix it"; etc. Don't make work for yourself now just because there's an extremely unlikely possibility you might need it in the future.

Interesting conversation, but I think it will work out OK

Posted Jan 11, 2005 20:40 UTC (Tue) by kimoto (subscriber, #5244) [Link] (2 responses)

As far as I can tell, it's not clear whether the MF intends to restrict the use of the command name "firefox" (and whether trademark law allows them to). So you could have breakage because the command name stops working.

Also, there is no firefox in a stable Debian release (for the obvious reasons ...), and it is considered no problem for packages to disappear from unstable. This has already happened: the "mozilla-firebird" package has come and gone.

Interesting conversation, but I think it will work out OK

Posted Jan 12, 2005 2:35 UTC (Wed) by madscientist (subscriber, #16861) [Link] (1 responses)

I also don't know if MF intends to/is able to restrict the name of the program on the disk. Seems doubtful to me but you never know. Even if they could restrict the filename, it's hard for me to believe they could restrict Debian from installing a "/usr/bin/firefox" symbolic link to "iceweasel".

Anyway, if the worst came true and the word "firefox" could not appear anywhere on the system, that would of course be annoying. However most applications use (or should use!) Debian's alternatives capability to invoke the browser, which would make any such transition seemless.

symlink is no different

Posted Jan 14, 2005 1:01 UTC (Fri) by giraffedata (guest, #1954) [Link]

Even if they could restrict the filename, it's hard for me to believe they could restrict Debian from installing a "/usr/bin/firefox" symbolic link to "iceweasel".

I can't imagine that trademark law or the Mozilla license would restrict the file name but not an alias for that name. It's like saying you can put "Microsoft Office" on your CD package for your Office knockoff as long as you put some other name on the disk inside.