• 16 Posts
  • 3.12K Comments
Joined 3 years ago
cake
Cake day: June 15th, 2023

help-circle









  • It’s fairly safe as long as you add a strong enough form of access control. For example if you put it behind a VPN, or a SSH tunnel, or require mTLS. Even a key in a custom HTTP header or Basic HTTP auth can be good enough if the key is strong enough.

    You can further decrease the probability of drive-by bots reaching a publicly exposed service by merely scanning IPs and ports if you use a reverse proxy and hide your service FQDNs and IP.

    You can do this by using TLS certs on wildcard domains rather than explicit domains, using explicit CNAMEs for the service subdomains rather than a wildcard domain, and keeping the A/AAAA records on an obfuscated subdomain rather than the base domain. If the bots can’t figure out a FQDN they’re not getting past the reverse proxy even if they find the IP and port.

    This is obfuscation not real security but it cuts down tremendously on bot hits.


  • I just can’t find any single sentence in the license text covering SaaS.

    SaaS is covered by the following fragment (emphasized by me below) which was added since version 1.1 to the last paragraph of Article 1:

    • ‘Distribution’ or ‘Communication’: any act of selling, giving, lending, renting, distributing, communicating, transmitting, or otherwise making available, online or offline, copies of the Work or providing access to its essential functionalities at the disposal of any other natural or legal person.

    regarding the compatible licenses, they say the other one wins.

    If you combine the original work (licensed EUPL) with another work (licensed under weaker terms, but only applicable to one of the explicitly listed licenses), and there’s a conflict of obligations for the combined result, the terms of the lesser license prevail.

    If there’s no conflict or the other license is silent, the stronger terms prevail (EUPL).

    The original work always remains under the stronger terms (EUPL).

    Hope this clears it up.

    PS: I think maybe I understand the confusion. In the earlier comment I was talking about cross-licensing. That means making the software available under two licenses. That’s something that can only be done by the copyright holder.

    What you’re describing is not cross-licensing. If someone takes EUPL software and combines it with code under one of the other listed licenses, the distribution alone of the mixed result can be done under the terms of the other license (if the obligations conflict etc. etc.)





  • Which is better than nothing but I can’t help but see it as walking into another exclusive partnership. Also, none of those phones are out yet so I’ll believe it when I see it.

    Even if it pans out and there will be one Motorola phone supporting GrapheneOS out of the box in 2027, there’s the issue of how much it will cost (I think it’s supposed to be a “flagship”), what markets it will be available in, what the unlock process and conditions will be like etc.

    Last but not least I doubt Lenovo’s commitment to “seven years of proper updates”, which I will also believe when I see. Their track record for Android updates is notoriously poor. They claim 3-5 major Android updates for most of their models but the best I’ve actually seen them do is one update (13 to 14) – and that’s for phones released 2-3 years ago. If that’s the pace they wanna go we’ll be lucky to get two updates in those 7 years.


  • It allows mixing EUPL-1.2 code with other copyleft licenses, less restrictive than GPL.

    Yes and no. I guess it depends on what you call “less restrictive”, or “lesser copyleft”. The comparison table makes it a point to mention that “lesser copyleft” is not allowed, if “lesser” means it takes away some of the core freedoms awarded by the EUPL.

    To that end, the EUPL 1.2 comes with an explicit list of other copyleft licenses that are compatible for cross-licensing. This page has a good explanation on how it works:

    Note: this does NOT change the EUPL licence of the original software component (that is NOT re-licensed). In addition, for all derivative works, EUPL provisions stay appliable where not in conflict with the compatible licence. this is because Article 5 states that the compatible licence will prevail in case its provisions conflict with those of the EUPL.

    For example, the EUPL accepts, when needed, the LGPL and MPL for covering derivatives (these licenses are known to be “less or weak copyleft”). But the LGPL and MPL do not conflict with the EUPL on the coverage of remote use (SaaS) or on the obligation to publish source code. When the compatible license is silent on such points, the EUPL obligations persist.

    There’s also the issue of what you mean by “mixing”. I’ve covered cross-licensing above. If you mean interoperability (aka linking) that is explicitly allowed by the EUPL 1.2.





  • These are welcome changes but I hope they will address the elephant in the room sooner or later. They can’t go on depending on Pixels and hardware memory tagging. They need a roadmap for opening up the project to more phone models and they need it yesterday.

    They’ve drummed up some publicity with the journalist debacle so it’s a good time to use that. But people who hear about Graphene will want to have some phone choices. “Get an old Pixel” is about to age like milk.