Subject: Re: openssl license change
To: None <itojun@iijlab.net>
From: Robert Elz <kre@munnari.OZ.AU>
List: tech-security
Date: 09/24/2002 20:28:38
    Date:        Tue, 24 Sep 2002 22:06:12 +0900
    From:        itojun@iijlab.net
    Message-ID:  <20020924130612.6C40C4B22@coconut.itojun.org>

  | 	NetBSD is used by various parties,

yes, I'm quite aware of that, I thought my messages on this topic
would have made that clear.

  |     so we can't tell if it is okay for NetBSD project to ship Sun
  |     code or not.

It is OK to ship the code.   There is no copyright issue at all here.
It would be a good idea not to ship binary versions of Sun's code, for
the same reasons as the other patented algorithms aren't compiled.
But shipping the source, and allowing people to compile it themselves,
is fine.   It isn't even any kind of contributory patent infringement,
as it is Sun's own code that they've said can be distributed around.

  |     the fact that TNF
  | 	doesn't have any patent (which you have mentioned earlier) does not
  | 	help us decide, at all.

It means that TNF could compile the code and use it is it wants.

  | 	so for the TNF to serve people best, i think we should take the safest
  | 	approach - to avoid extra clause enforced by Sun.

Which clause is that?    There *isn't* one.   I think you're being misled
by openbsd paranoia.   All that's there from Sun is a stipulation that
they won't sue you for infringing upon their patented algorithm if you
agree not to sue them.

What would you be doing if Sun hadn't added that to the files?   Their
patent would still apply.

This is just like the idea patent that you mentioned in an earlier message.
Except here, the class of people who need to think before including the
code in their binaries is "people who own patents", whereas in the idea
case it is "commercial users".

  |    (or do you think it
  | 	okay to limit NetBSD users to those who are not affected by the clause?)

No, of course not, but shipping (the source for) this stuff affects no-one.
Even shipping binaries wouldn't, in the the vast majority of cases (including
patent owners) wouldn't be a problem here.   The only ones who would be
affected (and yes, this groups needs matter too) are the ones who are likely
to actually sue sun for some patent infringement (most probably only in
a related area to this, though that part I can't be as sure of).

kre