Re: [Ksummit-discuss] [CORE TOPIC] GPL defense issues

[Linus Torvalds <torvalds@linux-foundation.org>]

On Sat, Aug 27, 2016 at 5:02 PM, Matthew Garrett <mjg59@coreos.com> wrote:
>
> OK. A vendor sells 500,000 network-connected devices running a version of
> Linux that has a vulnerability in the network driver that's discovered a
> year later. The hardware is custom, they refuse to release source, and
> they've discontinued the product line, so nobody else is able to fix it. Is
> it acceptable to engage in litigation in order to ensure that owners of
> these devices can receive a security update, even if by doing so we alienate
> the vendor and cause them to choose another kernel in future?

So why don't you name them and shame them very publicly and try
everything else first?

If the vendor still exists, and sells other devices, make a big stink
about it. It sounds like you've talked to them in private already, but
why do you still call them "a vendor" now when you start talking about
wanting to sue them?

Because without that, the answer is always going to be absolutely no,
simply because of the "absolute last option" thing.

And you talk about how you're helping users, but how many of them
would actually upgrade? Very few people end up upgrading firmware even
when it's automatic, much less so if it would mean that they'd switch
to OpenWRT or DD-WRT or something (since presumably the *existing*
firmware ends up having lots of non-GPL'd sources that you wouldn't
get even with a lawsuit)?

In other words, you say it is "for the users", but it still smells to
me like it's actually "for the lawsuit".

In practical terms, how would that help Linux?

I can understand being annoyed. I'm annoyed by bad companies too. But
I'm also saying that lawsuits aren't automatically the solution, and
you really have to ask yourself if it's worth it. And you have to do a
lot of other things first.

             Linus