X-Spam-Check-By: sourceware.org
From: "Dave Korn" <dave DOT korn AT artimi DOT com>
To: <cygwin AT cygwin DOT com>
References: <20070514182135 DOT GA6692 AT trixie DOT casa DOT cgf DOT cx> 	<4648B71D DOT 4000804 AT determina DOT com> 	<31DDB7BE4BF41D4888D41709C476B657068AAFBC AT NIHCESMLBX5 DOT nih DOT gov> <y2lkfrkn04 DOT fsf AT hod DOT lan DOT m-e-leypold DOT de>
Subject: RE: Mirrors in GPL violation? + Re: MD5s of setup.exe on mirrors.
Date: Tue, 15 May 2007 00:55:40 +0100
Message-ID: <074a01c79683$60910f30$2e08a8c0@CAM.ARTIMI.COM>
MIME-Version: 1.0
Content-Type: text/plain; 	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <y2lkfrkn04.fsf@hod.lan.m-e-leypold.de>
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 15 May 2007 00:24, Markus E.L. wrote:

> is concerned with questions of trust and
> endorsement 

  That's the underlying source of your error right there: a false assumption.

> (like: cygwin.com lists the mirrors as source of the
> software, then declines any responsibility for the actual content of
> those mirrors 

  Yep.  Welcome to the internet; google 'autonomous system' to find out more.

> down to "we cannot be bothered with working with the
> mirror admins even if they (would) carry the wrong software with our
> name on it"

  Mirrors get automatically tested and delisted if they aren't up-to-date.
Apparently only non-trivial discrepancies matter.

>  -- I wouldn't handle it like that, but YMMV

  Which is precisely why you're wasting time here.

> I now prefer
> not to touch this subject, having already gotten flamed my ass off
> this week (so I'm tending the blisters instead) but I think, Alex'
> considerations 

  You are conflating two entirely different issues here.  There is absolutely
no connection between "what copyrights do I have to observe if I want to
distribute something" and "some mirrors aren't up-to-date".

> Perhaps they can even
> lead to a wishlist for the next generation of setup? 

  Yes, that's a reasonable discussion, particularly if you're volunteering to
do the work yourself.  Much less so if you aren't.  However, if you do want to
help create such a scheme, patches and discussions about setup.exe should be
sent to the -apps list.

> Cryptographically
> strong signed checksums are all the rage 

  That isn't exactly a technical argument, is it?

> My concern on the other side was only: "What the hell is md5.sum (on
> the mirrors) then for, if it doesn't contain the right sums".

  As I explained: transmission checksum.  Not security, not authentication,
nothing else at all.  Your mistake and your fault if you think that it's
something it's not, just because the md5 algorithm is involved.  See AC2 for
more details on the differences between authentification and identification.
 
> If I where the cygwin team

  And if my aunt had balls, she'd be my uncle.  But she doesn't, and she
isn't, and any attempt to reason from contrafactuals is broken before it even
gets off the ground.

  Plus, TINCT.

> and felt so strongly 

  And if you were part of the "cygwin team" and /didn't/ feel so strongly?

> about nobody ever
> running setup.exe from the mirrors, I'd probably pull it from the
> master sites 

  Nobody has ever cared before you and nobody is ever likely to care again,
but you've gotten that done just to shut this everlasting thread down.

> and consequently the mirrors) and replace it by a README
> effectively telling the reader to get/run setup.exe from
> cygwin.com. This would be in concordance with the fact that setup is
> already organised as a seperate project.
> 
>   http://cygwin.com/setup/

  You imagine structure, organisation and management where there is none.  It
is neither separate, nor the same, nor a "project".

> Interesting enough, setup seems to be GPL (most of the sources carry a
> GPL header), but the mirrors don't carry the source (since the source
> is only on http://cygwin.com/setup). Do they violate the GPL then?

  The copyright owner is at liberty to not give a damn.

> Is there a well known time limit on threads?

  Yep.  Everyone knows that when something gets pointless, boring, and
unproductively repetitious, the limit has already been reached.

  That's just real life, not computers.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/