One topic that has been the cause of confusion lately is my assertion that it’s wrong for Debian to do what they’re doing to XULRunner against the authors wishes. How can I both believe in the principles of free software, yet believe it’s wrong for Debian to change XULRunner in this way? Aren’t these beliefs contradictory?
No, in fact they’re not. Just because you can do something doesn’t mean you should. There are right ways to fork software like this, and there are wrong ways. Let’s quickly review the story, but changing some of the names around.
the wrong way
The Debian Project produces a series of ISO disk images that comprise the Debian Distribution. Because these ISOs are very large, mirrors are used to distribute them and spread the load out across many servers. Debian depends on this mirror network to distribute its software – not having any single predictable revenue stream means it depends entirely upon the generosity of others.
Let us imagine that Morris the mirror operator provides Debian with 30% of its bandwidth. A generous contribution indeed! One day he rsyncs his mirror and sees a new Debian release has been downloaded. Curious, he mounts the disk images and starts poking around. While he’s there he seems some obvious bugs and decides to make some simple improvements – after all, he’s allowed to by the terms of the GPL and he means well so why not? So he goes in and changes a bunch of packages, repacks the ISOs and goes on his way. Morris doesn’t bother telling the Debian project what he’s done, he’s a busy guy.
So people start downloading things that they believe to be Debian, which looks and feels and smells like Debian, but actually isn’t Debian and when they install it things crash and burn, and generally don’t work as they expect. So they log onto the net and start posting to web forums and mailing lists how crap the new Debian release is and how it didn’t work at all, and WTF are those Debian guys smoking to produce such a release? A few people will say they can’t reproduce those problems but we’re talking about computers here so nobody is surprised anyway.
So Dave the Debian developer gets a bug report he can’t reproduce, and starts investigating and eventually finds out what Morris has done. And Dave is pretty angry because he is seeing his work being trashed in public by all these angry users, through no fault of his own. So he goes to Morris and says, hey, Morris, I know you mean well but please don’t change Debian like this against our wishes. And Morris blows Dave off and points out that the GPL lets him do exactly this. So Dave posts an angry blog entry saying Morris sucks, and Morris mocks Dave saying he doesn’t understand free software, and meanwhile people are still downloading broken software and ending up thinking Debian is crap.
Now Dave does understand the GPL, but he also understands that this situation is why trademark law is invented. He wouldn’t mind if Morris had done things differently so there was no confusion over his work, and end users were able to make an informed decision about what version they wanted to use. But they can’t, the software has been silently modified during the act of distribution to the masses, and users don’t suspect anything is amiss.
the right way
Oh goodness me. What a mess. In reality, this situation couldn’t happen because we have trademark law to stop it and Debian(tm) is a trademark of Software in the Public Interest, Inc. And actually Mozilla Firefox(tm) is trademarked for exactly the same reason, and if MozCorp trademark the name XULRunner then Debian would be forced to rename the modified package to something else, DebianMozLauncher or something sufficiently different that it couldn’t cause confusion, and Debian packages that depend on XULRunner would have to depend on the actual XULRunner package and not DebianMozLauncher so no playing tricky games with dependencies thankyou very much.
Obviously though, most open source projects aren’t as large or high profile as Mozilla or Debian is and no trademarks are held on the name. In this case there’s no legal way to stop distributors modifying the software as they distribute it yet passing it off under the same name. Worse, twice now I’ve seen Debian developers use this fact as a threat, which is entirely unacceptable. But just because filing for a trademark is more effort than most open source devs are willing to go to doesn’t invalidate the underlying principle – people should know what they’re getting, and when upstream own the name they should own the software.
Don’t like it? Fork it … the right way. Create a new name, a new website, describe the differences so people know what they’re getting and have people review the products separately. Ubuntu forked Debian in the right way. Debian forked XULRunner in the wrong way.
another example
This post is a bit personal for me, because I’ve had to deal with exactly the sort of problem the XULRunner people are now experiencing, but with Wine. Debian has packaged Wine in a way different to upstream, and this can cause extremely subtle bugs. One incident that sticks in my mind is where I wasted an entire Sunday afternoon and evening working with a user to track down why a program was crashing when they selected a menu item. It turned out that when the program started it was querying a registry key that didn’t exist, and squirreling away a NULL pointer in some internal data structure. And when it tried to access that key it crashed. Why was the key missing? Because the installer invoked the regedit.exe program to merge a pre-written .reg file into the registry, which is more convenient than using the registry apis. No error checking of course because on Windows this cannot fail. And why was regedit.exe missing? Because Debian decided it looked like a “utility” and as such should be in an optional package, which the user didn’t know about and hadn’t installed.
March 8, 2006 at 8:11 pm |
I still maintain that this is the fault of individuals with poor judgement and lousy social skills rather than a systemic problem. Look at X on Debian these days for a difficult situation that appears to be working out alright.
– Chris
March 9, 2006 at 2:52 am |
It would kick so much ass if there were an AutoPackage for WINE
Seriously though, I really believe the whole distro mess is one of the things keeping Linux from mainstream acceptance. If only a simple, reliable, user friendly distro that left the packaging to the upstream existed I think it would blow everything else out of the water. Damn I love some autopackage…Mike you guys really do kick extreme ass for what you have done.
March 9, 2006 at 9:27 am |
Chris, yes, could well be. And there are examples of where distribution patching can be a good thing.
My post shouldn’t be interpreted as “distros should never patch packages”, rather, than upstreams wishes are final and authoritative. The Linux kernel team relies upon distros to patch their stuff – most projects aren’t quite that extreme but there’s nothing wrong with it when the relationship is beneficial to both sides.
The problems start when people forget that upstream has the final say, always. If that’s problematic for technical reasons, then it’s time to fork (well – publishing patchsets under a new name). You’ll probably save people duplicated effort anyway.
March 19, 2006 at 8:27 pm |
There is no fork!
October 26, 2006 at 7:26 am |
You are wrong about forks and trademarks.
It is perfectly acceptable to use the same name in FOSS and is done in most linux distributions that have repackaged or patched their versions.
The key point to really look at concerns signatures. A modified version that is forked should have some variation in what might constitute a signature that end users can check to see if it is the original or a modified version. This could include checksum, md5, statements in the documentation/code,
program output (About dialog), etc.
Having trademarks on FOSS is ethically tainted, but simply and clearly having a signature that users can quickly check for origin is a great solution. Users will then know what they have and can decide what they want.
June 11, 2008 at 10:23 pm |
[...] googling around for some info on XULRunner, I stumbled upon Mike Hearn’s blog, where he was discussing Debian’s controversial method of forking software; it is old news, but still important to [...]
October 27, 2009 at 5:22 am |
And on Debian, one example is when Infomagic by mistake released a pre-release version of Debian as Debian 1.0. To be honest, it was partly Debian’s fault for not making obvious that Debian “1.0″ was a prerelease version.