Re: [in the news] New Legal Guideline

[Jan Wildeboer]

IMHO it is a risky decision. By limiting the field of use that governs what 
constitutes "acceptable" behaviour of Fedora, we effectively add regulations 
based on a vague feeling of "this could be somehow something that might put 
Fedora at risk".

I expect a full and thorough analysis of which tools we currently ship could 
be excluded under this new doctrine. Think of nmap, wireshark etc. Tools 
that have a perfect use for debugging but can also be used for not-so-good 
things.

With this decision, it will become hard to justify why some tools are OK and 
others pose a legal risk.

I am not happy with this new policy.

Jan

----- Original Message -----
From: marketing-bounces(a)lists.fedoraproject.org 
<marketing-bounces(a)lists.fedoraproject.org&gt;
To: Fedora Marketing team <marketing(a)lists.fedoraproject.org&gt;
Sent: Sun Nov 14 10:30:19 2010
Subject: [in the news] New Legal Guideline

Hi,

Some news in German about new legal guideline on pro-linux.de:

Fedora gibt sich Richtlinie für Sicherheitssoftware
http://www.pro-linux.de/news/1/16390/fedora-gibt-sich-richtlinie-fuer-sic...

Regards, vinz.
-- 
marketing mailing list
marketing(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/marketing

[in the news] New Legal Guideline

[Bert Desmet]

I agree with Jan here, because there is HUGE grey zone involved in
deciding which packages are accepted.
can't we add a rule in the user agreement, that fedora can't be hold
responsible for actions a user does with packages provided by the
fedora project?

regards,
Bert

On Sun, Nov 14, 2010 at 4:51 PM, Jan Wildeboer <jwildebo(a)redhat.com&gt; wrote:
>  IMHO it is a risky decision. By limiting the field of use that
> governs what
>  constitutes "acceptable" behaviour of Fedora, we effectively add regulations
>  based on a vague feeling of "this could be somehow something that might put
>  Fedora at risk".
>
>  I expect a full and thorough analysis of which tools we currently ship could
>  be excluded under this new doctrine. Think of nmap, wireshark etc. Tools
>  that have a perfect use for debugging but can also be used for not-so-good
>  things.
>
>  With this decision, it will become hard to justify why some tools are OK and
>  others pose a legal risk.
>
>  I am not happy with this new policy.
>
>  Jan
>
>  ----- Original Message -----
>  From: marketing-bounces(a)lists.fedoraproject.org
>  <marketing-bounces(a)lists.fedoraproject.org&gt;
>  To: Fedora Marketing team <marketing(a)lists.fedoraproject.org&gt;
>  Sent: Sun Nov 14 10:30:19 2010
>  Subject: [in the news] New Legal Guideline
>
>  Hi,
>
>  Some news in German about new legal guideline on pro-linux.de:
>
>  Fedora gibt sich Richtlinie für Sicherheitssoftware
>
> http://www.pro-linux.de/news/1/16390/fedora-gibt-sich-richtlinie-fuer-sic...
>
>  Regards, vinz.
>  --
>  marketing mailing list
>  marketing(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/marketing
>  --
>  marketing mailing list
>  marketing(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/marketing 


-- 
Bert Desmet
0477/305361

[in the news] New Legal Guideline

[Vinzenz Vietzke]

Am 14.11.2010 20:57, schrieb Bert Desmet:
>  I agree with Jan here, because there is HUGE grey zone involved in
>  deciding which packages are accepted.
>  can't we add a rule in the user agreement, that fedora can't be hold
>  responsible for actions a user does with packages provided by the
>  fedora project?
>
>  regards,
>  Bert 
That sounds useful to me, too! Something like a disclaimer.
But:
Isn't that already stated in the GPL? In other words: Isn't such a legal 
guideline a violation of the GPL?
See §16: http://www.gnu.org/licenses/gpl-3.0-standalone.html

vinz.

[in the news] New Legal Guideline

[wonderer]

Hy there,

with all we can read here and all that will come I would like to say
some things. This is (or better it can become) one of the things we
discussed last year at the marketing FAD - the Point "Crisis Management"
and I will try to summarize some things.
At this point it is VERY important that the board is open and precise
with the infos that will go out. Here should be written an official PM
over our own mailinglists (THAT should be the very first that should be
done!), to all the "big" press-agencys, the redhat press site, etc.
which clearly states what was the intention behind this decision. From
the marketing perspective this would also be good to be
mentioned/discussed open over the Developer, Ambassadors and other
involved ML's. If not then there could be more and more speculations and
no real info. And THAT would be very dangerous for the image inside and
out there. Just my 23 Cents.


mit freundlichen Grüßen / best regards
Henrik Heigl - wonderer(a)fedoraproject.org

PGP/GnuPG: 8237 D432 0616 D567 DBC6  3FE3 0D52 B374 F468 A5F0


Am 14.11.2010 20:57, schrieb Bert Desmet:
>  I agree with Jan here, because there is HUGE grey zone involved in
>  deciding which packages are accepted.
>  can't we add a rule in the user agreement, that fedora can't be hold
>  responsible for actions a user does with packages provided by the
>  fedora project?
>
>  regards,
>  Bert
>
>  On Sun, Nov 14, 2010 at 4:51 PM, Jan Wildeboer <jwildebo(a)redhat.com&gt; wrote:
> > IMHO it is a risky decision. By limiting the field of use that governs what
> > constitutes "acceptable" behaviour of Fedora, we effectively add
> regulations
> > based on a vague feeling of "this could be somehow something that might put
> > Fedora at risk".
> >
> > I expect a full and thorough analysis of which tools we currently ship could
> > be excluded under this new doctrine. Think of nmap, wireshark etc. Tools
> > that have a perfect use for debugging but can also be used for not-so-good
> > things.
> >
> > With this decision, it will become hard to justify why some tools are OK and
> > others pose a legal risk.
> >
> > I am not happy with this new policy.
> >
> > Jan
> >
> > ----- Original Message -----
> > From: marketing-bounces(a)lists.fedoraproject.org
> > <marketing-bounces(a)lists.fedoraproject.org&gt;
> > To: Fedora Marketing team <marketing(a)lists.fedoraproject.org&gt;
> > Sent: Sun Nov 14 10:30:19 2010
> > Subject: [in the news] New Legal Guideline
> >
> > Hi,
> >
> > Some news in German about new legal guideline on pro-linux.de:
> >
> > Fedora gibt sich Richtlinie für Sicherheitssoftware
> >
> http://www.pro-linux.de/news/1/16390/fedora-gibt-sich-richtlinie-fuer-sic...
> >
> > Regards, vinz.
> > --
> > marketing mailing list
> > marketing(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/marketing
> > --
> > marketing mailing list
> > marketing(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/marketing
>
>

[in the news] New Legal Guideline

[Jon Stanley]

On Sun, Nov 14, 2010 at 2:57 PM, Bert Desmet <bert(a)devnox.be&gt; wrote:
>  can't we add a rule in the user agreement, that fedora can't
> be hold
>  responsible for actions a user does with packages provided by the
>  fedora project? 
We talked about this in the Board meeting, for various reasons, this
is unenofrceable in the US (in fact, the existing agreement that we
have there is of dubious value itself)

[in the news] New Legal Guideline

[Vinzenz Vietzke]

Am 14.11.2010 23:12, schrieb Jon Stanley:
>  in fact, the existing agreement that we
>  have there is of dubious value itself 
So why not make something which is free of
doubt and holds water?
IMHO the policy will get Fedora in real trouble.

vinz.
-- 
Vinzenz Vietzke
m:  vinz(a)fedoraproject.org
wk: https://fedoraproject.org/wiki/User:Vinz
mb: https://identi.ca/vinzv | https://twitter.com/vinzv

[in the news] New Legal Guideline

[Simon Wesp]

Am Sonntag, 14 November 2010 10:51:05 schrieb Jan Wildeboer:
JW> I am not happy with this new policy.
Me, too. I would say:
"I'm not happy with the decision of the captains to navigate this boat
with full speed on the direct collision course of an iceberg"
This is imho just the newest sugar top of a nearly endless layer cake...
Something is rotten in the state of Denmark!
-- 
Mit freundlichen Grüßen aus dem schönen Hainzell
Simon Wesp

http://fedoraproject.org/wiki/User:Cassmodiah

[in the news] New Legal Guideline

[Jon Stanley]

On Sun, Nov 14, 2010 at 10:51 AM, Jan Wildeboer <jwildebo(a)redhat.com&gt; wrote:

>  be excluded under this new doctrine. Think of nmap, wireshark etc.
> Tools
>  that have a perfect use for debugging but can also be used for not-so-good
>  things. 
Here's the thing here. Nmap and wireshark do not *actively* exploit
systems, nor hold themselves out as tools for doing so. Note that the
language gives the Board the discretion, not the requirement, to deny
inclusion of packages, so an analysis of all existing packages in the
repository is not only not required, it's quite impractical.

-Jon, speaking for himself

[in the news] New Legal Guideline

[Joerg Simon]

Am 14.11.2010 23:15, schrieb Jon Stanley:
>  Here's the thing here. Nmap and wireshark do not *actively*
> exploit
>  systems,  
By just ignoring them such tools will not disappear and a lot people
prefer to have them packaged according to the Fedora standards and not
just from somewhere, this is one goal that we tried to achieve with FSL
and we were not the only who had set high expections in it -

http://lwn.net/Articles/377100/

what is with dsniff, ettercap and yersinia which are clearly made to do
multiple spoofing and layer2 mitm attacks?
To do proper security test according to the most security Testing
Standards you need these tools as well

As said before - lets see with what Spot will come up after his legal
analysis.


cu Joerg
-- 
Joerg (kital) Simon
jsimon(a)fedoraproject.org
http://fedoraproject.org/wiki/JoergSimon
http://kitall.blogspot.com
Key Fingerprint:
3691 0989 2DCA 58A2 8D1F 2CAC C823 558E 5B5B 5688

[in the news] New Legal Guideline

[Joerg Simon]

Am 14.11.2010 16:51, schrieb Jan Wildeboer:
>  I expect a full and thorough analysis of which tools we currently
> ship could 
>  be excluded under this new doctrine. Think of nmap, wireshark etc. Tools 
>  that have a perfect use for debugging but can also be used for not-so-good 
>  things. 
this is exactly what may will happen
http://lists.fedoraproject.org/pipermail/advisory-board/2010-November/009...

unfortunately, this would also lead the work on the Fedora Security Lab
ad-absurdum - it was planed to have Fedora as a platform for teaching
security and doing Security Tests according to international Standards
like the OSSTMM - and not just something third party or a fork ...

http://lists.fedoraproject.org/pipermail/advisory-board/2010-November/009...

i do understand that the fear of legal chase, leads into more and more
indemnification activities - but i am concerned and unhappy about it.
I also think we should not questioning all and everything on boards
decisions - but if the whole FOSS Eco System has implication from it, a
very thourough decision making process and a much better reason should
pointed out. I really hope i can discuss this during my talk during
FUDCon Tempe in January - and the Board will reconsider the policy and
the decision - after Spot has done a more thorough analysis about the
legal situation.

cu Joerg


-- 
Joerg (kital) Simon
jsimon(a)fedoraproject.org
http://fedoraproject.org/wiki/JoergSimon
http://kitall.blogspot.com
Key Fingerprint:
3691 0989 2DCA 58A2 8D1F 2CAC C823 558E 5B5B 5688

[in the news] New Legal Guideline

[Gerard Braad]

this would also mean that tools like proxytunnel and corkscrew are bad
as they are intended to punch holes in http(s) proxies. This is
certainly not common use as they are used to circumvent proxies like
websense, etc. These tools have been part of the fedora repositories
for some time. And what about legal risks concerning the Security
spin? This can also be used in illegal ways.

My 2cents as I am also not happy with this policy.
Gerard

On 11/14/10, Jan Wildeboer <jwildebo(a)redhat.com&gt; wrote:
>  IMHO it is a risky decision. By limiting the field of use that
> governs what
>  constitutes "acceptable" behaviour of Fedora, we effectively add regulations
>  based on a vague feeling of "this could be somehow something that might put
>  Fedora at risk".
>
>  I expect a full and thorough analysis of which tools we currently ship could
>  be excluded under this new doctrine. Think of nmap, wireshark etc. Tools
>  that have a perfect use for debugging but can also be used for not-so-good
>  things.
>
>  With this decision, it will become hard to justify why some tools are OK and
>  others pose a legal risk.
>
>  I am not happy with this new policy.
>
>  Jan
>
>  ----- Original Message -----
>  From: marketing-bounces(a)lists.fedoraproject.org
>  <marketing-bounces(a)lists.fedoraproject.org&gt;
>  To: Fedora Marketing team <marketing(a)lists.fedoraproject.org&gt;
>  Sent: Sun Nov 14 10:30:19 2010
>  Subject: [in the news] New Legal Guideline
>
>  Hi,
>
>  Some news in German about new legal guideline on pro-linux.de:
>
>  Fedora gibt sich Richtlinie für Sicherheitssoftware
>
> http://www.pro-linux.de/news/1/16390/fedora-gibt-sich-richtlinie-fuer-sic...
>
>  Regards, vinz.
>  --
>  marketing mailing list
>  marketing(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/marketing
>  --
>  marketing mailing list
>  marketing(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/marketing 

-- 
Gerard Braad — 吉拉德
   Project-lead Fedora-MIPS
   http://fedoraproject.org/wiki/User:gbraad

[in the news] New Legal Guideline

[Ryan Rix]

This should be discussed on either devel@ or advisory-board@, not the 
marketing list. 

>  this would also mean that tools like proxytunnel and corkscrew are
> bad
>  as they are intended to punch holes in http(s) proxies. This is
>  certainly not common use as they are used to circumvent proxies like
>  websense, etc. These tools have been part of the fedora repositories
>  for some time. And what about legal risks concerning the Security
>  spin? This can also be used in illegal ways.
>  
>  My 2cents as I am also not happy with this policy.
>  Gerard
>  
>  On 11/14/10, Jan Wildeboer <jwildebo(a)redhat.com&gt; wrote:
>  > IMHO it is a risky decision. By limiting the field of use that governs  
what
>  > constitutes "acceptable" behaviour of Fedora, we
> effectively add  
regulations
>  > based on a vague feeling of "this could be somehow
> something that  
might put
>  > Fedora at risk".
>  >
>  > I expect a full and thorough analysis of which tools we currently ship  
could
>  > be excluded under this new doctrine. Think of nmap, wireshark
> etc.  
Tools
>  > that have a perfect use for debugging but can also be used for
> not-so- 
good
>  > things.
>  >
>  > With this decision, it will become hard to justify why some tools are  
OK and
>  > others pose a legal risk.
>  >
>  > I am not happy with this new policy.
>  >
>  > Jan
>  >
>  > ----- Original Message -----
>  > From: marketing-bounces(a)lists.fedoraproject.org
>  > <marketing-bounces(a)lists.fedoraproject.org&gt;
>  > To: Fedora Marketing team <marketing(a)lists.fedoraproject.org&gt;
>  > Sent: Sun Nov 14 10:30:19 2010
>  > Subject: [in the news] New Legal Guideline
>  >
>  > Hi,
>  >
>  > Some news in German about new legal guideline on pro-linux.de:
>  >
>  > Fedora gibt sich Richtlinie für Sicherheitssoftware
>  > http://www.pro-linux.de/news/1/16390/fedora-gibt-sich-richtlinie-fuer-
sicherheitssoftware.html
>  >
>  > Regards, vinz.
>  > --
>  > marketing mailing list
>  > marketing(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/marketing
>  > --
>  > marketing mailing list
>  > marketing(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/marketing
>  
>  
>  -- 
>  Gerard Braad — 吉拉德
>     Project-lead Fedora-MIPS
>     http://fedoraproject.org/wiki/User:gbraad
>  -- 
>  marketing mailing list
>  marketing(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/marketing

[in the news] New Legal Guideline

[Joerg Simon]

Am 15.11.2010 01:44, schrieb Ryan Rix:
>  This should be discussed on either devel@ or advisory-board@, not the
>
>  marketing list.  
first i tend to agree - but thinking about it, i see that beside the
legal and the technology aspects, this has also a huge marketing impact
- in Germany mostly very negative press with more articles as for the
release itself - Fedora is seen as no longer attractive as
Security-Test-Platform, where it was the prefered Platform for many. I
think awarness for this issue on marketing is something important, to
find out, how to deal with such unpleasant news.

cu Joerg
-- 
Joerg (kital) Simon
jsimon(a)fedoraproject.org
http://fedoraproject.org/wiki/JoergSimon
http://kitall.blogspot.com
Key Fingerprint:
3691 0989 2DCA 58A2 8D1F 2CAC C823 558E 5B5B 5688

[in the news] New Legal Guideline

[Jan Wildeboer]

On 11/15/2010 10:14 AM, Joerg Simon wrote:
>  Am 15.11.2010 01:44, schrieb Ryan Rix:
> > This should be discussed on either devel@ or advisory-board@, not the
> > marketing list.
>
>  first i tend to agree - but thinking about it, i see that beside the
>  legal and the technology aspects, this has also a huge marketing impact 
I see it from the opposite side ;-)

Now that the decision has been taken by the board, we here on this list 
need to "sell" it to the world - That's what marketing is about for most 
parts.

The fact that I personally think it is the wrong decision doesn't really 
matter and should be discussed on devel@ or advisory-board@, I agree.

Nevertheless I would like to have a healthy and open discussion here on 
the implications for Fedora Marketing. Boilerplate statement, indepth 
analysis on the how and why etc.

Jan

-- 
Jan H Wildeboer                |
EMEA Open Source Affairs       | Office: [phone]
Red Hat GmbH                   | Mobile: [phone]
Technopark II, Haus C          | Fax:    [phone]
Werner-von-Siemens-Ring 11 -15 |
85630 Grasbrunn                |
_____________________________________________________________________

Reg. Adresse: Red Hat GmbH,
Technopark II, Haus C, Werner-von-Siemens-Ring 11 -15
85630 Grasbrunn, Handelsregister: Amtsgericht Muenchen HRB 153243
Geschaeftsfuehrer: Brendan Lane, Charlie Peters, Michael Cunningham,
Charles Cachera
_____________________________________________________________________

GPG Key:     3AC3C8AB
Fingerprint: 3D1E C4E0 DD67 E16D E47A  9564 A72F 5C39 3AC3 C8AB

[in the news] New Legal Guideline

[Gerard Braad]

I have to agree with Kital as also this news will make it to China and
will have a negative impact if not dealt with accordingly. This was
addressed before by wonderer; have a statement go out. Although this
can also have a negative impact if done wrong... Especially if people
think it comes from RH's legal department instead of the board (with
help from the legal dept.). If ambassadors are not accurately
informed, this might lead to bad marketing.

Gerard.

-- 
Gerard Braad — 吉拉德
   Project-lead Fedora-MIPS
   http://fedoraproject.org/wiki/User:gbraad

[in the news] New Legal Guideline

[Neville A. Cross]

On Mon, Nov 15, 2010 at 4:35 AM, Gerard Braad <gbraad(a)fedoraproject.org&gt; wrote:
<snip> If ambassadors are not accurately
>  informed, this might lead to bad marketing.
>
>  Gerard. 
As marketing, we need to inform our front line "customer reps" about
the current situation and also the general public. This is a very
delicate issue that may  lead to mistrust from people within the
project if they are not properly informed (specially if they get it
from twisted sources from outside). In the other hand if a outsider
approach a contributor and he/she doesn't have a clue about the issue
may result in bad image of the project.

This is a very polemic issue. You can hammer a nail to build a house,
but you can use as well to tear apart the same house ... or one person
can hammer some others people head! (as you can hammer your own
thumb). It any case, it is not the hammer's fault. But there some
sense on weapon control ... tricky topic!!

I would like to have key points for addressing public questions in
this matter, in case that they may arise in a event.

-- 
Neville
https://fedoraproject.org/wiki/User:Yn1v
Linux User # 473217

- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Check: http://www.clickmanagua.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - -